parse-stack-next 4.5.0

data/scripts/docker/atlas-init.js

@@ -0,0 +1,284 @@
+// Atlas Local initialization script for Atlas Search integration tests
+// This script runs after the Atlas Local container is ready
+// It seeds test data and creates the Atlas Search index
+//
+// TEST-FIXTURE BANNER (ATLAS-9):
+//   The seed data below uses `_rperm: ["U1"]` to exercise the SDK's
+//   ACL injection layer (see `Parse::ACLScope` and the ACL `$match`
+//   stage Parse::AtlasSearch.search builds). "U1" is a literal Parse
+//   objectId string chosen for test convenience — it is NOT a
+//   pattern any production deployment should use.
+//
+//   In Parse Server, `_rperm` entries are either the special public
+//   token "*", a role token like "role:Admin", or a real Parse User
+//   objectId (24-char Mongo-style id). The seed rows here ship with
+//   "U1" because the SDK unit/integration tests stub a Session that
+//   reports `user_id == "U1"`, and the test assertions are easier
+//   to read when the perm string matches the test fixture's user_id.
+//
+//   Do NOT copy this fixture pattern into production seeds, schema
+//   migrations, or examples — a real `_rperm` entry must be a real
+//   Parse User objectId. Treat this file as test-only.
+
+print("=== Atlas Search Test Setup ===");
+print("Database: " + db.getName());
+
+// Clear existing data
+print("\n1. Clearing existing data...");
+db.Song.drop();
+
+// Insert test data
+print("\n2. Inserting test song data...");
+const songs = [
+  {
+    _id: "song1",
+    title: "Love Story",
+    artist: "Taylor Swift",
+    genre: "Pop",
+    plays: 5000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song2",
+    title: "Lovely Day",
+    artist: "Bill Withers",
+    genre: "Soul",
+    plays: 3000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song3",
+    title: "Bohemian Rhapsody",
+    artist: "Queen",
+    genre: "Rock",
+    plays: 10000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song4",
+    title: "Rock and Roll",
+    artist: "Led Zeppelin",
+    genre: "Rock",
+    plays: 4000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song5",
+    title: "What Is Love",
+    artist: "Haddaway",
+    genre: "Dance",
+    plays: 2500000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song6",
+    title: "I Will Always Love You",
+    artist: "Whitney Houston",
+    genre: "Pop",
+    plays: 8000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song7",
+    title: "Crazy Little Thing Called Love",
+    artist: "Queen",
+    genre: "Rock",
+    plays: 3500000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song8",
+    title: "Shape of You",
+    artist: "Ed Sheeran",
+    genre: "Pop",
+    plays: 12000000,
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  // Songs 9-11 exercise the ACL injection path of the Atlas Search
+  // integration tests. They omit _rperm (public — matched by the
+  // $exists: false branch of the ACL predicate), include a role-
+  // restricted _rperm, and include an owner-restricted _rperm.
+  // The Atlas Search ACL integration test asserts which sessions
+  // see which subset of these rows.
+  {
+    _id: "song9",
+    title: "Restricted Anthem",
+    artist: "Member Band",
+    genre: "Rock",
+    plays: 1500000,
+    _rperm: ["role:Member"],
+    _wperm: ["role:Admin"],
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song10",
+    title: "Owner Only Ballad",
+    artist: "U1 Personal",
+    genre: "Acoustic",
+    plays: 100,
+    _rperm: ["U1"],
+    _wperm: ["U1"],
+    _created_at: new Date(),
+    _updated_at: new Date()
+  },
+  {
+    _id: "song11",
+    title: "Master Key Vault Track",
+    artist: "Locked Down",
+    genre: "Vault",
+    plays: 0,
+    _rperm: [],
+    _wperm: [],
+    _created_at: new Date(),
+    _updated_at: new Date()
+  }
+];
+
+db.Song.insertMany(songs);
+print("Inserted " + db.Song.countDocuments() + " songs (8 public, 1 role-restricted, 1 owner-restricted, 1 master-only)");
+
+// Create Atlas Search index
+print("\n3. Creating Atlas Search index...");
+
+// Drop existing search indexes first
+try {
+  const existingIndexes = db.Song.getSearchIndexes();
+  existingIndexes.forEach(function(idx) {
+    print("Dropping existing index: " + idx.name);
+    db.Song.dropSearchIndex(idx.name);
+  });
+} catch (e) {
+  print("No existing search indexes to drop (or error checking): " + e.message);
+}
+
+// Wait a moment for any dropped indexes to be fully removed
+sleep(1000);
+
+// Create the search index with autocomplete support
+const indexDefinition = {
+  mappings: {
+    dynamic: true,
+    fields: {
+      title: [
+        {
+          type: "string",
+          analyzer: "lucene.standard"
+        },
+        {
+          type: "autocomplete",
+          analyzer: "lucene.standard",
+          tokenization: "edgeGram",
+          minGrams: 2,
+          maxGrams: 15,
+          foldDiacritics: true
+        }
+      ],
+      artist: {
+        type: "string",
+        analyzer: "lucene.standard"
+      },
+      genre: [
+        {
+          type: "string",
+          analyzer: "lucene.standard"
+        },
+        {
+          type: "stringFacet"
+        }
+      ],
+      plays: [
+        {
+          type: "number"
+        },
+        {
+          type: "numberFacet"
+        }
+      ]
+    }
+  }
+};
+
+try {
+  db.Song.createSearchIndex("default", indexDefinition);
+  print("Search index 'default' created successfully");
+} catch (e) {
+  print("Error creating search index: " + e.message);
+  // Try alternative method
+  try {
+    db.runCommand({
+      createSearchIndexes: "Song",
+      indexes: [{ name: "default", definition: indexDefinition }]
+    });
+    print("Search index created via runCommand");
+  } catch (e2) {
+    print("Alternative method also failed: " + e2.message);
+  }
+}
+
+// Wait for index to become queryable
+print("\n4. Waiting for index to become ready...");
+let attempts = 0;
+const maxAttempts = 30;
+let indexReady = false;
+
+while (attempts < maxAttempts && !indexReady) {
+  try {
+    const indexes = db.Song.getSearchIndexes();
+    const defaultIndex = indexes.find(idx => idx.name === "default");
+    if (defaultIndex && defaultIndex.queryable === true) {
+      indexReady = true;
+      print("Index is ready and queryable!");
+    } else {
+      print("Waiting for index... (attempt " + (attempts + 1) + "/" + maxAttempts + ")");
+      sleep(2000);
+    }
+  } catch (e) {
+    print("Error checking index status: " + e.message);
+    sleep(2000);
+  }
+  attempts++;
+}
+
+if (!indexReady) {
+  print("WARNING: Index may not be ready yet. Tests might fail initially.");
+}
+
+// Verify setup
+print("\n5. Verification:");
+print("   Songs in collection: " + db.Song.countDocuments());
+
+try {
+  const searchIndexes = db.Song.getSearchIndexes();
+  print("   Search indexes: " + searchIndexes.length);
+  searchIndexes.forEach(function(idx) {
+    print("     - " + idx.name + " (queryable: " + idx.queryable + ")");
+  });
+} catch (e) {
+  print("   Could not list search indexes: " + e.message);
+}
+
+// Test a simple search to verify it works
+print("\n6. Testing search...");
+try {
+  const testResult = db.Song.aggregate([
+    { $search: { index: "default", text: { query: "love", path: { wildcard: "*" } } } },
+    { $limit: 3 }
+  ]).toArray();
+  print("   Test search found " + testResult.length + " results for 'love'");
+  if (testResult.length > 0) {
+    print("   First result: " + testResult[0].title + " by " + testResult[0].artist);
+  }
+} catch (e) {
+  print("   Search test failed (index may still be building): " + e.message);
+}
+
+print("\n=== Atlas Search Setup Complete ===\n");

data/scripts/docker/docker-compose.atlas.yml

@@ -0,0 +1,76 @@
+# Docker Compose configuration for Atlas Search integration tests
+# Uses the official mongodb/mongodb-atlas-local image which supports Atlas Search
+#
+# Usage:
+#   Start:  docker-compose -f scripts/docker/docker-compose.atlas.yml up -d
+#   Stop:   docker-compose -f scripts/docker/docker-compose.atlas.yml down
+#   Logs:   docker-compose -f scripts/docker/docker-compose.atlas.yml logs -f atlas-init
+#   Reset:  docker-compose -f scripts/docker/docker-compose.atlas.yml down -v && docker-compose -f scripts/docker/docker-compose.atlas.yml up -d
+#
+# Run tests:
+#   ATLAS_URI="mongodb://localhost:27020/parse_atlas_test?directConnection=true" ruby -Ilib:test test/lib/parse/atlas_search_integration_test.rb
+#
+# Stability notes (see commit history for context):
+#   The mongodb-atlas-local image runs a supervisor ("runner") that intentionally
+#   restarts mongod 1-2 times during startup to enable the replica set and wire
+#   in mongot (Atlas Search). Those startup SIGTERMs are NORMAL and visible in
+#   `docker logs` — do not interpret them as crashes. The container is "ready"
+#   when the runner's built-in healthcheck (`runner healthcheck`) reports healthy,
+#   which checks both mongod AND mongot. We rely on that built-in healthcheck
+#   rather than overriding it with a faster mongosh probe.
+
+services:
+  atlas-local:
+    # Pinned patch tag rather than the floating :8.0 — mongodb-atlas-local has
+    # known per-patch start-up flakiness (see testcontainers/testcontainers-java#10267
+    # and MongoDB community forum 321179). Bump deliberately, not by drift.
+    image: mongodb/mongodb-atlas-local:8.0.10
+    container_name: parse-stack-atlas-local
+    # `hostname` is called out by the official compose example — the embedded
+    # single-node replica set advertises this name, and a stable value makes
+    # restart-after-down work cleanly.
+    hostname: atlas-local
+    # Surface runner + mongot logs through `docker logs` so failures during the
+    # supervisor's bring-up phase are visible. Pure visibility, no behavior change.
+    environment:
+      RUNNER_LOG_FILE: /dev/stderr
+      MONGOT_LOG_FILE: /dev/stderr
+    # Loopback-only by default — Atlas Local has no auth configured.
+    ports:
+      - "${ATLAS_BIND:-127.0.0.1}:27020:27017"
+    volumes:
+      # Persist mongod data, replset config, and — critically — the mongot
+      # Lucene index directory. Without /data/mongot persistence, every restart
+      # forces a full search re-index, which lengthens "ready" time and is a
+      # real source of test flakiness. Matches the official compose example.
+      - atlas-data:/data/db
+      - atlas-configdb:/data/configdb
+      - atlas-mongot:/data/mongot
+    # Recover from genuine crashes automatically. Test runs `docker compose down`
+    # explicitly, so this does not interfere with teardown.
+    restart: unless-stopped
+    # NOTE: We deliberately do NOT override `healthcheck:` here. The image ships
+    # a built-in `runner healthcheck` (interval 30s, timeout 60s, start_period
+    # 60s, retries 3) that verifies BOTH mongod and mongot are ready. The
+    # previous mongosh ping at 5s interval was both noisier (spawns a mongosh
+    # process every 5s) and incorrect (it returned healthy as soon as mongod
+    # accepted connections, before mongot was wired in, so atlas-init could
+    # race the search-index subsystem).
+
+  atlas-init:
+    image: mongodb/mongodb-atlas-local:8.0.10
+    container_name: parse-stack-atlas-init
+    depends_on:
+      atlas-local:
+        # Uses the image's built-in healthcheck (see above), so this now waits
+        # for mongot readiness too — not just mongod accepting connections.
+        condition: service_healthy
+    volumes:
+      - ./atlas-init.js:/atlas-init.js:ro
+    entrypoint: ["mongosh", "--quiet", "mongodb://atlas-local:27017/parse_atlas_test", "/atlas-init.js"]
+    restart: "no"
+
+volumes:
+  atlas-data:
+  atlas-configdb:
+  atlas-mongot:

data/scripts/docker/docker-compose.test.yml

@@ -0,0 +1,106 @@
+version: '3.8'
+
+services:
+  mongo:
+    image: mongo:8
+    container_name: parse-stack-test-mongo
+    # Bind to loopback so the test database isn't reachable from the LAN
+    # when a developer runs `docker-compose up`. Override with
+    # `MONGO_BIND=0.0.0.0` if you really want it exposed.
+    ports:
+      - "${MONGO_BIND:-127.0.0.1}:27019:27017"
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USER:-admin}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD:-password}
+      MONGO_INITDB_DATABASE: admin
+    volumes:
+      - mongo-data:/data/db
+      - ./mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
+
+  parse:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.parse
+    container_name: parse-stack-test-server
+    # Bind to loopback by default — Parse Server with the test master key
+    # has no business being reachable on a developer's LAN.
+    ports:
+      - "${PARSE_BIND:-127.0.0.1}:2337:1337"
+    # `host.docker.internal` is needed so Parse Server can POST to the
+    # in-process WEBrick that backs webhook integration tests. Docker
+    # Desktop on Mac/Windows resolves this natively; on Linux we map it
+    # to host-gateway. Without this, end-to-end webhook tests are skipped.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      mongo:
+        condition: service_started
+    volumes:
+      - ../../test/cloud:/parse-server/cloud
+      - ../../config:/parse-server/config
+      - ../start-parse.sh:/start-parse.sh:ro
+    environment:
+      # Application id / master key / database URI are provided to the
+      # container so `start-parse.sh` doesn't have to invent fallbacks.
+      # `start-parse.sh` will abort if any of these is unset, so any
+      # name drift here surfaces immediately rather than booting Parse
+      # Server with whatever placeholder default the SDK README documents.
+      PARSE_SERVER_APPLICATION_ID: ${PARSE_APP_ID:-myAppId}
+      PARSE_SERVER_MASTER_KEY:     ${PARSE_MASTER_KEY:-myMasterKey}
+      PARSE_SERVER_REST_API_KEY:   ${PARSE_API_KEY:-test-rest-key}
+      PARSE_SERVER_DATABASE_URI:   mongodb://${MONGO_ROOT_USER:-admin}:${MONGO_ROOT_PASSWORD:-password}@mongo:27017/parse?authSource=admin
+      # Accept client-supplied objectId on create. Required by the
+      # `parse_reference precompute: true` DSL. The SDK only forwards
+      # client objectIds under master-key authority; for non-master
+      # enforcement across other SDKs, see the Cloud Code hook documented
+      # in lib/parse/model/core/parse_reference.rb.
+      PARSE_SERVER_ALLOW_CUSTOM_OBJECT_ID: "true"
+      # Tests connect from the docker bridge gateway (typically
+      # 172.16.0.0/12 or 192.168.x.x), not loopback. Widen the master-key
+      # allowlist accordingly. DO NOT mirror this into a deployed
+      # environment — production should keep the allowlist tight to the
+      # subnets that actually host the Ruby app.
+      PARSE_SERVER_MASTER_KEY_IPS: "127.0.0.1/32,::1/128,172.16.0.0/12,192.168.0.0/16,10.0.0.0/8"
+    # Remove health check for now since it's causing startup delays
+    # healthcheck:
+    #   test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:1337/parse/health"]
+    #   interval: 10s
+    #   timeout: 5s
+    #   retries: 5
+    #   start_period: 30s
+
+  parse-dashboard:
+    image: parseplatform/parse-dashboard:9
+    container_name: parse-stack-test-dashboard
+    # Loopback-only by default. This compose is for `rake test:integration`
+    # and local debugging; do not expose to the network.
+    ports:
+      - "${DASHBOARD_BIND:-127.0.0.1}:4040:4040"
+    environment:
+      # `allowInsecureHTTP` and `useEncryptedPasswords: false` are kept
+      # because this stack runs over plain HTTP on loopback. Do NOT copy
+      # these settings to a deployed environment.
+      PARSE_DASHBOARD_ALLOW_INSECURE_HTTP: "1"
+      PARSE_SERVER_MASTER_KEY: ${PARSE_MASTER_KEY:-myMasterKey}
+      PARSE_SERVER_APPLICATION_ID: ${PARSE_APP_ID:-myAppId}
+      PARSE_SERVER_URL: http://localhost:2337/parse
+      PARSE_DASHBOARD_CONFIG: |
+        {
+          "apps": [{
+            "serverURL": "http://localhost:2337/parse",
+            "appId": "${PARSE_APP_ID:-myAppId}",
+            "masterKey": "${PARSE_MASTER_KEY:-myMasterKey}",
+            "appName": "ParseStackTest"
+          }],
+          "users": [{
+            "user": "${DASHBOARD_USER:-admin}",
+            "pass": "${DASHBOARD_PASS:-admin}"
+          }],
+          "useEncryptedPasswords": false,
+          "allowInsecureHTTP": true
+        }
+    depends_on:
+      - parse
+
+volumes:
+  mongo-data:

data/scripts/docker/mongo-init.js

@@ -0,0 +1,21 @@
+// MongoDB initialization script
+// This script runs when the MongoDB container is first created
+// It grants the admin user access to the parse database for direct queries
+
+// The admin user needs readWriteAnyDatabase role to access all databases
+db = db.getSiblingDB('admin');
+
+// Grant admin user roles needed for all database access
+db.grantRolesToUser('admin', [
+  { role: 'readWriteAnyDatabase', db: 'admin' },
+  { role: 'dbAdminAnyDatabase', db: 'admin' }
+]);
+
+// Initialize the parse database
+db = db.getSiblingDB('parse');
+
+// Create a placeholder collection to ensure the database exists
+db.createCollection('_init');
+db.getCollection('_init').drop();
+
+print('MongoDB initialization completed - admin user granted full database access');