parse-stack-next 5.0.0 → 5.1.0

data/lib/parse/model/core/parse_reference.rb

@@ -224,7 +224,23 @@ module Parse
           if respond_to?(:protect_fields) && respond_to?(:class_permissions)
             existing = class_permissions.protected_fields_for("*") rescue []
             merged = (existing + [field_name.to_s]).uniq
-            protect_fields("*", merged)
+            # Suppress Parse::User's "raw protect_fields called" advisory
+            # for this internal auto-install. The advisory exists to nudge
+            # app code toward the new master_only_fields/self_visible_fields
+            # DSL; the parse_reference auto-install is a different concern
+            # and should not trip it at gem boot.
+            prior = nil
+            if is_a?(Class) && self <= Parse::User
+              prior = instance_variable_get(:@_user_field_dsl_active)
+              instance_variable_set(:@_user_field_dsl_active, true)
+            end
+            begin
+              protect_fields("*", merged)
+            ensure
+              if is_a?(Class) && self <= Parse::User
+                instance_variable_set(:@_user_field_dsl_active, prior)
+              end
+            end
           end
 
           # Auto-install write-side protection: once the after_create

data/lib/parse/model/core/querying.rb

@@ -435,10 +435,28 @@ module Parse
       # @param fields [Array<String>] specific fields to watch for changes (nil = all fields)
       # @param session_token [String] session token for ACL-aware subscriptions
       # @param client [Parse::LiveQuery::Client] custom LiveQuery client (optional)
+      # @param use_master_key [Boolean] per-subscription master-key opt-in.
+      #   See {Parse::Query#subscribe} for the full description.
+      # @yield [subscription] runs the block with the freshly-constructed
+      #   {Parse::LiveQuery::Subscription} BEFORE the subscribe frame is
+      #   sent so caller-registered callbacks are wired before any server
+      #   events can arrive. Optional — callers may still capture the
+      #   returned subscription and register callbacks later.
+      # @example block form (ergonomic, no race window)
+      #   Post.subscribe(where: { published: true }) do |sub|
+      #     sub.on(:create) { |obj| puts "new: #{obj.id}" }
+      #     sub.on(:update) { |obj, prev| puts "updated: #{obj.id}" }
+      #   end
+      # @example capture-then-wire form (equivalent, but has a tiny
+      #   window between subscribe-frame send and the first .on call
+      #   where a server event would be dropped if it arrived first)
+      #   sub = Post.subscribe(where: { published: true })
+      #   sub.on(:create) { |obj| … }
       # @return [Parse::LiveQuery::Subscription] the subscription object
       # @see Parse::LiveQuery::Subscription
       # @see Parse::Query#subscribe
-      def subscribe(where: {}, fields: nil, session_token: nil, client: nil)
+      def subscribe(where: {}, fields: nil, session_token: nil, client: nil,
+                    use_master_key: false, &block)
         # Fall through to the ambient set by `Parse.with_session` / `Parse.login`
         # so a caller wrapping a region with `with_session(user) { Klass.subscribe ... }`
         # gets an ACL-aware subscription without re-threading the token.
@@ -446,7 +464,13 @@ module Parse
           ambient = Parse.current_session_token
           session_token = ambient if ambient.is_a?(String) && !ambient.empty?
         end
-        query(where).subscribe(fields: fields, session_token: session_token, client: client)
+        query(where).subscribe(
+          fields: fields,
+          session_token: session_token,
+          client: client,
+          use_master_key: use_master_key,
+          &block
+        )
       end
 
       # Find objects for a given objectId in this collection. The result is a list