parse-stack-next 5.6.0 → 5.7.0

data/lib/parse/api/hooks.rb

@@ -44,7 +44,7 @@ module Parse
       def _verify_trigger(triggerName)
         camel = triggerName.to_s.camelize(:lower).to_sym
         if %i[beforeCreate afterCreate].include?(camel)
-          save     = camel == :beforeCreate ? "beforeSave" : "afterSave"
+          save = camel == :beforeCreate ? "beforeSave" : "afterSave"
           callback = camel == :beforeCreate ? "before_create" : "after_create"
           raise ArgumentError,
                 "Parse Server has no #{camel} webhook trigger. Register a " \

data/lib/parse/api/server.rb

@@ -192,10 +192,10 @@ module Parse
       # unparseable input so a wire-format surprise never raises.
       def server_version_below?(actual, floor)
         actual_parts = actual.scan(/\d+/).first(2).map(&:to_i)
-        floor_parts  = floor.scan(/\d+/).first(2).map(&:to_i)
+        floor_parts = floor.scan(/\d+/).first(2).map(&:to_i)
         return false if actual_parts.empty? || floor_parts.empty?
         actual_parts << 0 while actual_parts.length < 2
-        floor_parts  << 0 while floor_parts.length  < 2
+        floor_parts << 0 while floor_parts.length < 2
         (actual_parts <=> floor_parts) < 0
       end
     end

data/lib/parse/api/users.rb

@@ -271,6 +271,7 @@ module Parse
         body[:email] = email || body[:email]
         create_user(body, **opts)
       end
+
       private
 
       # @!visibility private
@@ -315,7 +316,7 @@ module Parse
             entry = login_rate_limits[username] || { failures: 0, locked_until: nil }
             entry[:failures] += 1
             if entry[:failures] >= LOGIN_MAX_FAILURES
-              delay = LOGIN_BASE_DELAY**(entry[:failures] - LOGIN_MAX_FAILURES + 1)
+              delay = LOGIN_BASE_DELAY ** (entry[:failures] - LOGIN_MAX_FAILURES + 1)
               delay = [delay, 300].min # cap at 5 minutes
               entry[:locked_until] = Time.now + delay
             end
@@ -337,7 +338,6 @@ module Parse
           entry[:locked_until] && (now - entry[:locked_until]) > LOGIN_RATE_LIMIT_TTL
         end
       end
-
     end # Users
   end #API
 end #Parse

data/lib/parse/atlas_search/index_manager.rb

@@ -220,7 +220,7 @@ module Parse
         def drop_index(collection_name, index_name, confirm:, allow_system_classes: false)
           result = Parse::MongoDB.drop_search_index(
             collection_name, index_name, confirm: confirm,
-            allow_system_classes: allow_system_classes,
+                                         allow_system_classes: allow_system_classes,
           )
           clear_cache(collection_name)
           result

data/lib/parse/atlas_search/session.rb

@@ -3,249 +3,71 @@
 
 require "set"
 require_relative "../clp_scope"
+require_relative "../authorization"
 
 module Parse
   module AtlasSearch
-    # Resolves session tokens to user identities and inherited role
-    # sets for ACL-scoped Atlas Search queries.
+    # Compatibility shim over {Parse::Authorization}.
     #
-    # Atlas Search runs aggregations directly against MongoDB and
-    # therefore bypasses Parse Server's per-request ACL enforcement.
-    # To compile a `_rperm` `$match` stage (see {Parse::ACL.read_predicate})
-    # the caller needs to know two things about the requesting
-    # session:
+    # This module used to own session-token resolution, role-closure
+    # expansion, and both caches. It no longer does. Deciding who a caller is
+    # and what they may read is authorization infrastructure that Atlas
+    # Search consumes, not infrastructure Atlas Search owns, and the old
+    # arrangement meant `Parse::Query#results_direct` on a query with no
+    # `$search` in it went through `Parse::ACLScope` into this namespace to
+    # find out who was asking. See {Parse::Authorization} for the reasoning
+    # and for the real implementation.
     #
-    #   1. The `_User.objectId` that owns the session.
-    #   2. The transitive upward closure of role names that user
-    #      inherits permissions from (cf. {Parse::Role.all_for_user}).
+    # Everything here now delegates to the default client's authorization
+    # context. That is the one behavior difference worth knowing: these
+    # methods take no `client:`, so they can only ever address
+    # `Parse.client`. Code running against a secondary application should
+    # call `other_client.authorization` directly.
     #
-    # Both lookups can be expensive — token → user requires a
-    # `/users/me` round-trip, and user → roles can require multiple
-    # `_Role` queries to walk the inheritance graph. Both are cached
-    # separately so a single agent turn that runs several Atlas Search
-    # tools amortizes the cost.
-    #
-    # Two distinct caches:
-    #
-    #   * `session_cache`: maps `session_token` to `user_id`. Long
-    #     TTL (1 hour default), invalidation profile is logout. Apps
-    #     that need sub-TTL revocation must call {.invalidate}
-    #     explicitly from their logout path.
-    #
-    #   * `role_cache`: maps `user_id` to a `Set` of role names. Short
-    #     TTL (2 minutes default), invalidation profile is role-graph
-    #     mutation. Stale role data here yields incorrect ACL
-    #     decisions, so the default is conservatively short.
-    #
-    # The default cache implementation is process-local
-    # ({MemoryCache}) and guarded by a `Mutex`. Apps that need shared
-    # cross-process caching (Redis, Memcached) may install a
-    # replacement via {AtlasSearch.session_cache=} /
-    # {AtlasSearch.role_cache=}; the replacement must respond to
-    # `get(key)`, `set(key, value, ttl:)`, and `invalidate(key)`.
+    # Slated for removal in 6.0.
     module Session
-      # Raised when a `session_token` cannot be resolved — invalid
-      # token, expired session, or `/users/me` returned an error.
-      # Atlas Search callers should treat this as a 401-equivalent.
-      class InvalidSession < StandardError; end
-
-      # Default cache: in-memory hash with per-entry TTL, guarded by a
-      # `Mutex`. Suitable for single-process apps. Apps running
-      # multi-process (Puma workers, Sidekiq processes) get a per-
-      # process cache — install a shared cache through
-      # {AtlasSearch.session_cache=} for cross-process sharing.
-      class MemoryCache
-        def initialize
-          @data = {}
-          @mutex = Mutex.new
-        end
-
-        # @param key [String]
-        # @return [Object, nil] the cached value, or `nil` when the key
-        #   is missing or its TTL has elapsed. Expired entries are
-        #   evicted lazily on read.
-        def get(key)
-          @mutex.synchronize do
-            entry = @data[key]
-            return nil if entry.nil?
-            if entry[:expires_at] < Time.now
-              @data.delete(key)
-              return nil
-            end
-            entry[:value]
-          end
-        end
-
-        # @param key [String]
-        # @param value [Object]
-        # @param ttl [Numeric] seconds until the entry expires.
-        def set(key, value, ttl:)
-          @mutex.synchronize do
-            @data[key] = { value: value, expires_at: Time.now + ttl }
-          end
-        end
-
-        # @param key [String] cache key to forget.
-        def invalidate(key)
-          @mutex.synchronize { @data.delete(key) }
-        end
-
-        # Drop every entry. Used by {Session.reset_caches!} and by
-        # tests that need a clean slate.
-        def clear
-          @mutex.synchronize { @data.clear }
-        end
-      end
+      # @deprecated Use {Parse::Authorization::InvalidSession}. Kept as the
+      #   same object rather than a subclass so existing `rescue
+      #   Parse::AtlasSearch::Session::InvalidSession` clauses still catch
+      #   what the resolver actually raises.
+      InvalidSession = Parse::Authorization::InvalidSession
 
-      # Value returned by {Session.resolve}. `user_id` is the
-      # `_User.objectId` owning the session, or `nil` for an anonymous
-      # caller. `role_names` is a `Set` of role names (no `role:`
-      # prefix) the user inherits permissions from, computed via
-      # {Parse::Role.all_for_user}.
-      Resolved = Struct.new(:user_id, :role_names) do
-        # Build the canonical `_rperm`/`_wperm` permission-string set
-        # for this session. Always includes `"*"` (public). Includes
-        # `user_id` when present. Includes `"role:#{name}"` for each
-        # inherited role.
-        # @return [Array<String>]
-        def permission_strings
-          out = ["*"]
-          out << user_id if user_id && !user_id.empty?
-          role_names.each { |name| out << "role:#{name}" if name && !name.empty? }
-          out.uniq
-        end
+      # @deprecated Use {Parse::Authorization::MemoryCache}.
+      MemoryCache = Parse::Authorization::MemoryCache
 
-        # @return [Boolean] `true` for the anonymous-session case.
-        def anonymous?
-          user_id.nil? || user_id.empty?
-        end
-      end
+      # @deprecated Use {Parse::Authorization::Resolved}.
+      Resolved = Parse::Authorization::Resolved
 
       class << self
-        # Resolve a `session_token` to the requesting user and the
-        # transitive set of role names whose `role:NAME` permission
-        # strings should be checked against `_rperm`.
-        #
-        # `nil` or empty `session_token` → anonymous {Resolved} with
-        # `user_id: nil` and an empty `role_names` set. The caller
-        # decides whether to refuse the request (the
-        # `require_session_token` toggle on {Parse::AtlasSearch}) or
-        # treat as public-only.
-        #
-        # Cache layering: token-to-user_id is checked first; on hit
-        # the slower `/users/me` round-trip is skipped. User-to-roles
-        # is then checked independently (a single user shared across
-        # sessions amortizes the role lookup).
-        #
-        # @param session_token [String, nil] the `X-Parse-Session-Token`
-        #   value from the requesting session.
-        # @return [Resolved]
-        # @raise [InvalidSession] when the token cannot be resolved by
-        #   `/users/me` (404 / 209 invalid session token / 401).
+        # @deprecated Use `client.authorization.resolve(token)`, or
+        #   {Parse::Authorization.resolve} with an explicit `client:`.
+        # @return [Parse::Authorization::Resolved]
         def resolve(session_token)
-          return Resolved.new(nil, Set.new) if session_token.nil? || session_token.to_s.empty?
-
-          user_id = lookup_user_id(session_token.to_s)
-          role_names = lookup_role_names(user_id)
-          Resolved.new(user_id, role_names)
+          context.resolve(session_token)
         end
 
-        # Forget a `session_token` entry from the session-token cache.
-        # Apps that revoke sessions out-of-band (logout, password
-        # reset, admin revoke) should call this from the same path so
-        # subsequent Atlas Search requests don't act on the stale
-        # `user_id` mapping. The `role_names` cache is keyed on
-        # `user_id` and is not affected — call {.invalidate_user_roles}
-        # to clear that separately.
-        # @param session_token [String]
+        # @deprecated Use `client.authorization.invalidate(token)`. Note that
+        #   `Parse::Cache::Invalidation` now does this automatically from the
+        #   `_Session` `after_logout` trigger, so an application no longer has
+        #   to remember to call it from its own logout path.
         def invalidate(session_token)
-          return if session_token.nil?
-          Parse::AtlasSearch.session_cache.invalidate(session_token.to_s)
+          context.invalidate(session_token)
         end
 
-        # Forget cached role membership for a `user_id`. Call after any
-        # `_Role.users` mutation that affects this user (role grant /
-        # revoke, role-graph reshape).
-        # @param user_id [String]
+        # @deprecated Use `client.authorization.invalidate_user_roles(id)`.
         def invalidate_user_roles(user_id)
-          return if user_id.nil?
-          Parse::AtlasSearch.role_cache.invalidate(user_id.to_s)
+          context.invalidate_user_roles(user_id)
         end
 
-        # Drop every cached entry across both caches. Useful in tests
-        # and in startup hooks for processes that fork after warming
-        # the cache.
+        # @deprecated Use `client.authorization.reset_caches!`.
         def reset_caches!
-          Parse::AtlasSearch.session_cache.clear if Parse::AtlasSearch.session_cache.respond_to?(:clear)
-          Parse::AtlasSearch.role_cache.clear if Parse::AtlasSearch.role_cache.respond_to?(:clear)
+          context.reset_caches!
         end
 
         private
 
-        # @!visibility private
-        # Resolve session_token → user_id via cache, falling through
-        # to `/users/me`. Raises {InvalidSession} on lookup failure;
-        # the caller is responsible for refusing the request.
-        def lookup_user_id(session_token)
-          cache = Parse::AtlasSearch.session_cache
-          cached = cache.get(session_token)
-          return cached if cached
-
-          response = begin
-              Parse.client.current_user(session_token)
-            rescue => e
-              raise InvalidSession, "session token lookup failed: #{e.class}: #{e.message}"
-            end
-          raise InvalidSession, "session token invalid or expired" if response.nil? || response.error?
-
-          result = response.result
-          user_id = result.is_a?(Hash) ? (result["objectId"] || result[:objectId]) : nil
-          raise InvalidSession, "session token resolved no user objectId" if user_id.nil? || user_id.to_s.empty?
-
-          user_id = user_id.to_s
-          cache.set(session_token, user_id, ttl: Parse::AtlasSearch.session_cache_ttl)
-          user_id
-        end
-
-        # @!visibility private
-        # Resolve user_id → Set<role_name> via cache, falling through
-        # to {Parse::Role.all_for_user}. Failures degrade silently to
-        # an empty set rather than raising — a Parse Server hiccup
-        # during the role walk must not turn every search call into a
-        # 500, and the worst case is a query that misses some
-        # role-restricted documents.
-        #
-        # ATLAS-7: explicitly re-raise the exceptions that signal
-        # attacks or policy denials BEFORE the generic rescue. Without
-        # this, a denied-operator probe (DeniedOperator), a timeout
-        # exhaustion (ExecutionTimeout), or a CLP denial during role
-        # graph traversal would silently downgrade to an empty role
-        # set — the caller would then run with public-only perms,
-        # missing role-restricted rows but also masking the attack
-        # signal from the operator. These exception classes are SDK
-        # contracts the caller must surface upward.
-        def lookup_role_names(user_id)
-          return Set.new if user_id.nil? || user_id.empty?
-
-          cache = Parse::AtlasSearch.role_cache
-          cached = cache.get(user_id)
-          return cached if cached.is_a?(Set)
-
-          pointer = Parse::Pointer.new(Parse::Model::CLASS_USER, user_id)
-          names = begin
-              Parse::Role.all_for_user(pointer, max_depth: 10)
-            rescue Parse::MongoDB::DeniedOperator,
-                   Parse::MongoDB::ExecutionTimeout,
-                   Parse::CLPScope::Denied
-              # Re-raise: these are attack signals or explicit policy
-              # denials and must NOT be swallowed into a fail-open
-              # public-only ACL state.
-              raise
-            rescue
-              Set.new
-            end
-          cache.set(user_id, names, ttl: Parse::AtlasSearch.role_cache_ttl)
-          names
+        def context
+          Parse.client.authorization
         end
       end
     end