parse-stack-next 5.6.0 → 5.7.0

data/lib/parse/cache/sub_cache.rb

@@ -0,0 +1,264 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "digest"
+require "set"
+
+module Parse
+  module Cache
+    # A named plane within a {Parse::Cache::Keyspace}, exposing the
+    # `get` / `set` / `invalidate` contract that `Parse::AtlasSearch`'s
+    # `session_cache=` and `role_cache=` slots accept.
+    #
+    # The response cache speaks Moneta (`[]`, `key?`, `delete`, `store`) because
+    # that is what the Faraday middleware requires. Identity and role resolution
+    # speak a different, smaller contract. Rather than flattening both onto one
+    # object, where `get` and `[]` would sit side by side and `clear` would be
+    # ambiguous about which plane it cleared, each plane is its own object over
+    # the same connection. This mirrors Parse Server's own
+    # `CacheController` / `SubCache` split.
+    class SubCache
+      # @return [Symbol] the keyspace family this plane writes.
+      attr_reader :family
+
+      # @param store [Object] the backing store (a {Parse::Cache::Redis}).
+      # @param keyspace [Parse::Cache::Keyspace] key layout owner.
+      # @param family [Symbol] `:idn` or `:role`.
+      # @param ttl [Integer, nil] default TTL in seconds.
+      # @param digest_keys [Boolean] hash the logical key before it becomes part
+      #   of a Redis key. Required for the identity plane: its logical key is a
+      #   raw session token supplied by `Parse::AtlasSearch::Session`, and a raw
+      #   token must never be written into a key, where MONITOR, SLOWLOG, and
+      #   APM key capture would all expose it. Digesting here rather than at the
+      #   call site also keeps `get`, `set`, and `invalidate` consistent by
+      #   construction: a caller that digested for one and not another would
+      #   silently delete a different key than it wrote.
+      # Generation keys live this many times longer than the longest entry
+      # they guard. Any factor above 1 is sufficient; 2 leaves margin for
+      # clock skew and for an entry written moments before a bump.
+      GENERATION_TTL_FACTOR = 2
+
+      def initialize(store:, keyspace:, family:, ttl: nil, digest_keys: nil)
+        @store = store
+        @keyspace = keyspace
+        @family = family.to_sym
+        @ttl = ttl
+        @digest_keys = digest_keys.nil? ? @family == :idn : digest_keys
+      end
+
+      # @return [Integer, nil] how long a generation key lives, or nil when
+      #   this plane has no default TTL and generations must therefore be
+      #   permanent. See {#bump_generation} for why the two are tied.
+      def generation_ttl
+        return nil if @ttl.nil?
+        (@ttl * GENERATION_TTL_FACTOR).ceil
+      end
+
+      # @param key [String] the logical key (a token digest or user id).
+      # @return [Object, nil] the stored value, or nil on a miss.
+      def get(key)
+        return nil if key.nil?
+        decode(@store[@keyspace.key(@family, logical_key(key))])
+      end
+
+      # @param key [String] the logical key.
+      # @param value [Object] a JSON-serializable value.
+      # @param ttl [Integer, nil] seconds; falls back to the plane default.
+      def set(key, value, ttl: nil)
+        return value if key.nil?
+        effective = clamp_ttl(ttl || @ttl)
+        options = effective ? { expires: effective } : {}
+        @store.store(@keyspace.key(@family, logical_key(key)), encode(value), options)
+        value
+      end
+
+      # @param key [String] the logical key.
+      def invalidate(key)
+        return if key.nil?
+        @store.delete(@keyspace.key(@family, logical_key(key)))
+      end
+
+      # Evict every entry in this plane, and nothing outside it.
+      # @return [Integer] number of keys removed, when the store can report it.
+      def clear
+        return 0 unless @store.respond_to?(:delete_matching)
+        @store.delete_matching(@keyspace.pattern(family: @family))
+      end
+
+      # Monotonic per-subject generation, used to invalidate entries that cannot
+      # be named.
+      #
+      # A `_User` write tells us a user id, but identity entries are keyed by
+      # session token and there is no reverse map, so the entries belonging to
+      # that user cannot be enumerated. Bumping a generation the reader checks
+      # invalidates all of them in O(1), including tokens this process has never
+      # seen, without a master-key `_Session` query.
+      #
+      # **Generation keys expire, and their TTL must exceed the longest-lived
+      # entry they guard.** One key per user id, written on every `_User`
+      # webhook, is unbounded growth on a public signup flow: every account
+      # that ever saves leaves a permanent key behind.
+      #
+      # The TTL cannot be chosen freely, because expiry resets the counter to
+      # 0 and 0 is also the value for a user who has never been bumped. If a
+      # generation expired while an entry written at generation 0 were still
+      # alive, that entry would compare current again and come back from the
+      # dead after having been invalidated. {#generation_ttl} is therefore
+      # {GENERATION_TTL_FACTOR} times the plane's entry TTL, so every entry
+      # predating a bump has expired on its own before the counter can reset.
+      # {#set} clamps per-call TTLs to keep that invariant true.
+      #
+      # A plane with no default TTL keeps permanent generations: entries there
+      # never expire, so no counter lifetime is safe.
+      #
+      # @param subject [String] the user id.
+      # @return [Integer] the new generation.
+      def bump_generation(subject)
+        return 0 if subject.nil?
+        key = generation_key(subject)
+        ttl = generation_ttl
+        # Prefer an atomic INCR. A read-then-write loses a concurrent bump, and
+        # a lost bump means an entry that should have been invalidated stays
+        # readable, which is the permissive direction.
+        if @store.respond_to?(:increment)
+          value = @store.increment(key).to_i
+          # INCR does not set an expiry, and re-applying it on each bump is
+          # what keeps an actively-bumped user's counter alive.
+          refresh_generation_expiry(key, value, ttl)
+          value
+        else
+          current = @store[key].to_i
+          @store.store(key, current + 1, ttl ? { expires: ttl } : {})
+          current + 1
+        end
+      end
+
+      # @param subject [String] the user id.
+      # @return [Integer] current generation, 0 when never bumped.
+      def generation(subject)
+        return 0 if subject.nil?
+        @store[generation_key(subject)].to_i
+      end
+
+      # Whether a value carrying `gen` is still current for `subject`.
+      # @return [Boolean]
+      def generation_current?(subject, gen)
+        generation(subject).to_i == gen.to_i
+      end
+
+      # Record that this plane was invalidated at `at`. Unlike a generation,
+      # which answers "is this exact subject stale", the epoch answers "is an
+      # entry written before now stale", which is what is needed to reject a
+      # *foreign* cache entry whose write time can only be derived from its
+      # remaining TTL.
+      #
+      # @param at [Float] wall-clock seconds; defaults to now.
+      # @return [Float] the recorded epoch.
+      def touch_epoch(at = Time.now.to_f)
+        current = epoch
+        # Never move the epoch backwards: clock skew between workers would
+        # otherwise re-admit entries a previous invalidation had rejected.
+        value = at > current ? at : current
+        @store.store(epoch_key, value, {})
+        value
+      end
+
+      # @return [Float] the last invalidation epoch, 0.0 when never set.
+      def epoch
+        @store[epoch_key].to_f
+      end
+
+      # Whether an entry written at `written_at` predates the last invalidation
+      # and must therefore be treated as a miss.
+      #
+      # @param written_at [Float, nil] derived write time in wall-clock seconds.
+      # @return [Boolean] true when the entry is safe to use.
+      def fresh_since_epoch?(written_at)
+        return false if written_at.nil?
+        written_at.to_f >= epoch
+      end
+
+      private
+
+      # Keep an entry from outliving the generation counter that invalidates
+      # it. A caller passing `ttl:` greater than the plane default would
+      # otherwise create exactly the resurrection window {#bump_generation}
+      # describes: the counter expires back to 0, and an entry still alive
+      # from before the bump compares current again.
+      #
+      # Shortening silently is the safe direction. The cost is an extra
+      # resolution; the cost of the alternative is a session that stays
+      # resolvable after it was invalidated.
+      def clamp_ttl(requested)
+        return requested if requested.nil?
+        ceiling = @ttl
+        return requested if ceiling.nil?
+        requested > ceiling ? ceiling : requested
+      end
+
+      # Apply the expiry INCR does not set, WITHOUT rewriting the value.
+      #
+      # An earlier version fell back to `store(key, value, expires: ttl)`
+      # when the backend had no `expire`. That is a lost update: two
+      # concurrent bumps interleave as INCR(2), INCR(3), store(3), store(2),
+      # and the counter moves BACKWARDS. Generation checks are equality
+      # comparisons, so a counter that goes back to a previously issued value
+      # re-admits every identity entry stamped with it. Those are exactly the
+      # entries a `_User` write was invalidating, which makes the failure a
+      # revoked session becoming resolvable again.
+      #
+      # Rewriting the value is therefore never acceptable here, no matter the
+      # width of the window. Where the backend cannot set a TTL without
+      # touching the value, the key simply stays non-expiring, which is the
+      # behavior this method was added to improve on: unbounded, but correct.
+      # {Parse::Cache::Redis} implements `expire` (PEXPIRE), so the Redis
+      # deployments where growth actually matters do get the TTL.
+      def refresh_generation_expiry(key, value, ttl)
+        return if ttl.nil?
+        return unless @store.respond_to?(:expire)
+        @store.expire(key, ttl)
+      rescue StandardError
+        # A counter without an expiry is the pre-existing behavior: correct,
+        # just unbounded. Never fail a webhook over it.
+        nil
+      end
+
+      # Session tokens must not appear in keys; other logical keys (a user id)
+      # are opaque already and stay readable for debugging.
+      def logical_key(key)
+        return key.to_s unless @digest_keys
+        Digest::SHA256.hexdigest(key.to_s)[0, 32]
+      end
+
+      # The backing store serializes values as JSON, and `JSON.generate(Set)`
+      # produces the string "#<Set: {...}>" rather than an array, so a Set
+      # written straight through comes back as a String and every read misses.
+      # `Parse::AtlasSearch` stores and expects a Set, so tag it and rebuild on
+      # the way out.
+      SET_TAG = "__set__"
+
+      def encode(value)
+        return { SET_TAG => value.to_a } if value.is_a?(Set)
+        value
+      end
+
+      def decode(value)
+        return Set.new(value[SET_TAG]) if value.is_a?(Hash) && value.key?(SET_TAG)
+        value
+      end
+
+      # Epoch shares the family so a plane clear resets it, and sits under a
+      # reserved segment so it cannot collide with a real entry.
+      def epoch_key
+        @keyspace.key(@family, "meta", "epoch")
+      end
+
+      # Generations live in the same family so a plane clear takes them with it,
+      # and are namespaced under `gen:` so they cannot collide with an entry
+      # whose logical key happens to be a user id.
+      def generation_key(subject)
+        @keyspace.key(@family, "gen", subject.to_s)
+      end
+    end
+  end
+end

data/lib/parse/cache/upstream_roles.rb

@@ -0,0 +1,230 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "set"
+
+module Parse
+  module Cache
+    # Read-only consumer of Parse Server's own role cache.
+    #
+    # Parse Server caches `<appId>:role:<userId>` as a JSON array of
+    # `"role:NAME"` strings representing the transitive closure. When the SDK
+    # already holds a user id from a trusted source (a webhook payload, most
+    # usefully), reading that entry skips the role-graph walk entirely, and the
+    # value was computed by Parse Server's own code so there is no divergence
+    # between our closure and the one the server enforces.
+    #
+    # **We never write this keyspace.** Our closure is depth-capped while Parse
+    # Server's is not, so injecting ours would hand the server a strict subset
+    # in a deep hierarchy, which it would then read back as authoritative and
+    # under-permission users in windows that are close to undiagnosable.
+    #
+    # **Trust.** This makes the Parse Server cache database part of the SDK's
+    # authorization trust base: the array feeds `permission_strings`, which is
+    # the only input to both the `_rperm` match and the CLP gate on the
+    # mongo-direct path. Anyone who can write that database can grant themselves
+    # roles. The credential should be restricted accordingly:
+    #
+    #     ACL SETUSER parse-stack-role-reader on >SECRET \
+    #       ~<appId>:role:* resetchannels -@all +get +pttl
+    #
+    # `+pttl` is required alongside `+get`: the freshness guard below cannot run
+    # without it, and PTTL is a separate ACL command from GET.
+    class UpstreamRoles
+      # Parse Server's `RedisCacheAdapter` default TTL, used to derive an
+      # entry's write time from its remaining TTL. Configurable because an
+      # operator supplies the adapter instance and may have passed another.
+      DEFAULT_UPSTREAM_TTL_MS = 30_000
+
+      # Reject an entry whose remaining TTL exceeds this. Neither Parse Server
+      # entry carries its own write time, so a very long TTL means either a
+      # misconfigured adapter or a value we cannot age, and an un-ageable
+      # authorization input is not one to trust.
+      DEFAULT_MAX_TTL_MS = 60_000
+
+      # Caps on the decoded array. Role counts scale with tenants, so these are
+      # generous: a low cap would be an outage, not a safeguard. An unbounded
+      # array becomes an unbounded `$in` sent to MongoDB.
+      MAX_ROLE_COUNT = 4096
+      MAX_ROLE_NAME_LENGTH = 256
+
+      # Role names may legitimately contain `/` and `:` (scoped conventions such
+      # as `owner/t:<id>/p:<id>` are common), so this only excludes control
+      # characters and the NUL byte. A tighter pattern would reject every role
+      # in such an app and fail closed into total loss of role access.
+      INVALID_ROLE_NAME = /[\x00-\x1f\x7f]/.freeze
+
+      attr_reader :app_id
+
+      # @param client [Object] a redis-rb-shaped client answering `get` and
+      #   `pttl`. Injected rather than constructed so tests and alternative
+      #   transports work, and so the caller owns connection lifecycle.
+      # @param app_id [String] Parse application id, used to build the key.
+      # @param roles_plane [Parse::Cache::SubCache, nil] our own role plane,
+      #   consulted for the invalidation epoch.
+      # @param upstream_ttl_ms [Integer] Parse Server's configured entry TTL.
+      # @param max_ttl_ms [Integer] reject entries with more remaining than this.
+      def initialize(client:, app_id:, roles_plane: nil,
+                     upstream_ttl_ms: DEFAULT_UPSTREAM_TTL_MS,
+                     max_ttl_ms: DEFAULT_MAX_TTL_MS)
+        @client = client
+        @app_id = app_id.to_s
+        @roles_plane = roles_plane
+        @upstream_ttl_ms = upstream_ttl_ms
+        @max_ttl_ms = max_ttl_ms
+      end
+
+      # Key Parse Server writes for a user's role closure.
+      # @return [String]
+      def key_for(user_id)
+        "#{@app_id}:role:#{user_id}"
+      end
+
+      # Read and validate the upstream closure.
+      #
+      # @param user_id [String]
+      # @return [Set<String>, nil] bare role names (no `role:` prefix), or nil
+      #   on any miss, malformed value, stale entry, or transport error. Every
+      #   failure is a miss, so the caller falls back to computing the closure
+      #   itself. This never fails open.
+      def roles_for(user_id)
+        return nil if user_id.nil? || user_id.to_s.empty?
+        key = key_for(user_id)
+
+        raw = @client.get(key)
+        return nil if raw.nil?
+
+        ttl = safe_pttl(key)
+        return nil unless usable_ttl?(ttl)
+        return nil unless fresh?(ttl)
+
+        decode(raw)
+      rescue StandardError
+        # Transport failures, malformed JSON, anything: treat as a miss. Note
+        # the deliberate absence of the exception message, which would carry the
+        # key and therefore the user id.
+        nil
+      end
+
+      # Whether the entry is newer than our last role invalidation.
+      #
+      # Parse Server does not clear its role cache on a `_Role` delete, so
+      # without this gate a delete we handled would be undone by reading their
+      # surviving entry. Neither entry records its write time, so it is derived
+      # from what remains of the configured TTL.
+      def fresh?(pttl_ms)
+        return true if @roles_plane.nil?
+        # A remaining TTL larger than the configured starting TTL cannot be
+        # aged with this reader's assumptions. Subtracting it would produce a
+        # negative elapsed time and a future write timestamp, which could pass
+        # the epoch gate and re-admit a pre-invalidation entry. Fail closed.
+        return false if pttl_ms > @upstream_ttl_ms
+        elapsed_ms = @upstream_ttl_ms - pttl_ms
+        written_at = Time.now.to_f - (elapsed_ms / 1000.0)
+        @roles_plane.fresh_since_epoch?(written_at)
+      end
+
+      # Whether our own database also holds Parse Server's cache entries, which
+      # means the two are the same database.
+      #
+      # The probe deliberately runs against OUR connection, looking for THEIR
+      # key pattern, rather than the reverse. An earlier version wrote a
+      # sentinel on our side and tried to read it back through the upstream
+      # client, which cannot work under the credential this class documents:
+      # that ACL permits only `<appId>:role:*`, so reading a
+      # `parse-stack:probe:*` key returns NOPERM. The rescue then swallowed it
+      # and reported the databases as isolated, so the check passed exactly when
+      # it was least able to see anything.
+      #
+      # Inverting it also removes the write. We never need to create a key to
+      # answer the question, and our own connection has the permissions to scan
+      # its own database.
+      #
+      # **This can only ever prove sharing, never isolation.** A `false`
+      # return means "no Parse-Server-shaped key was seen", which is what a
+      # genuinely separate database looks like AND what a shared database
+      # looks like before Parse Server has cached its first role closure. A
+      # freshly deployed stack is in that second state, and it is exactly
+      # when an operator is most likely to run the check. Callers must not
+      # report `false` as "isolated"; see
+      # {Parse::Cache::Redis#verify_upstream_isolation!}, which pairs this
+      # with a sentinel round-trip that CAN establish the negative.
+      #
+      # @param scanner [Object] our own store, answering `scan_exist?` or a
+      #   redis-rb-shaped `scan`.
+      # @return [Boolean] true when Parse Server's keys are visible in our
+      #   database. False means only "not detected".
+      def shares_database_with?(scanner)
+        pattern = "#{@app_id}:role:*"
+        client = scanner.respond_to?(:scan) ? scanner : nil
+        return false if client.nil?
+
+        cursor = "0"
+        # Bounded: a handful of iterations is enough to answer "are any of their
+        # keys here", and an unbounded scan on a large database would be a
+        # startup stall.
+        8.times do
+          cursor, keys = client.scan(cursor, match: pattern, count: 100)
+          # Callers that use a broad pattern are responsible for filtering out
+          # anything that is not a genuine Parse Server entry before it reaches
+          # here. `Parse::Cache::Redis` wraps its client in a scanner that
+          # keeps only keys matching the upstream `<appId>:role:<userId>`
+          # shape, so the filtering lives next to the wiring rather than being
+          # duplicated in both places.
+          return true unless keys.empty?
+          break if cursor == "0"
+        end
+        false
+      rescue StandardError
+        # Cannot tell. Report not-shared so a probe failure never blocks
+        # startup; the warning path is advisory, not a gate.
+        false
+      end
+
+      private
+
+      def safe_pttl(key)
+        return nil unless @client.respond_to?(:pttl)
+        @client.pttl(key)
+      rescue StandardError
+        nil
+      end
+
+      # -1 means no expiry, -2 means the key vanished between GET and PTTL, nil
+      # means we could not ask. An entry we cannot age is one we cannot trust.
+      def usable_ttl?(ttl)
+        return false if ttl.nil?
+        ttl = ttl.to_i
+        return false if ttl.negative?
+        return false if ttl > @max_ttl_ms
+        true
+      end
+
+      # Validate strictly and strip exactly one `role:` prefix. Our own
+      # `role_names` set holds bare names and re-adds the prefix when building
+      # permission strings, so reading prefixed values straight through would
+      # yield `role:role:X` and silently under-permission every query.
+      def decode(raw)
+        parsed = raw.is_a?(String) ? JSON.parse(raw) : raw
+        return nil unless parsed.is_a?(Array)
+        return Set.new if parsed.empty?
+        return nil if parsed.size > MAX_ROLE_COUNT
+
+        names = Set.new
+        parsed.each do |entry|
+          return nil unless entry.is_a?(String)
+          return nil if entry.length > MAX_ROLE_NAME_LENGTH
+          return nil unless entry.start_with?("role:")
+          name = entry.sub(/\Arole:/, "")
+          return nil if name.empty?
+          return nil if name == "*"
+          return nil if name.match?(INVALID_ROLE_NAME)
+          names << name
+        end
+        names
+      end
+    end
+  end
+end

data/lib/parse/client/authentication.rb

@@ -67,7 +67,7 @@ module Parse
         #   3. A session-token-authenticated request (the existing check
         #      below; session token wins over master key).
         header_disable = env[:request_headers][DISABLE_MASTER_KEY].present?
-        fiber_disable  = Parse.master_key_disabled?
+        fiber_disable = Parse.master_key_disabled?
         unless @master_key.blank? || header_disable || fiber_disable
           headers[MASTER_KEY] = @master_key
         end

data/lib/parse/client/body_builder.rb

@@ -388,8 +388,7 @@ module Parse
         params = Faraday::Utils.parse_query(query_string.to_s) || {}
         body = { "_method" => "GET" }
         params.each do |key, value|
-          body[key] =
-            begin
+          body[key] = begin
               JSON.parse(value)
             rescue JSON::ParserError, TypeError
               value

data/lib/parse/client/caching.rb

@@ -91,6 +91,23 @@ module Parse
         ns = ns.chomp(":")
         @namespace = ns.empty? ? nil : ns
 
+        # The keyspace owns physical key layout and the patterns that clear it,
+        # so key generation and eviction cannot drift apart. Previously this
+        # middleware composed keys from its own `@namespace` while
+        # `Parse::Cache::Redis` held a separate one, and `clear_cache!` used
+        # only the latter: a client namespaced here but not there would clear
+        # every SDK key on the database instead of its own.
+        #
+        # When no keyspace is supplied the middleware keeps writing legacy
+        # un-prefixed keys, so an upgrade that does not opt in behaves exactly
+        # as before.
+        @keyspace = @opts[:keyspace]
+        # During the transition, also delete the pre-keyspace form of a key on
+        # invalidation. Without this, a rolling deploy has new workers writing
+        # keyspaced keys while old workers still read legacy ones, so a write
+        # served by a new worker never invalidates what an old worker serves.
+        @delete_legacy_variants = @opts.fetch(:delete_legacy_variants, true)
+
         unless [:key?, :[], :delete, :store].all? { |method| @store.respond_to?(method) }
           raise ArgumentError, "Caching store object must a Moneta key/value store."
         end
@@ -135,11 +152,20 @@ module Parse
         method = env.method
         @cache_key = url.to_s
 
+        # Auth discriminator. A master-key request bypasses ACL, CLP and
+        # protectedFields, so the same URL returns a strictly fuller body than a
+        # session request, and two sessions can differ from each other through
+        # protectedFields entity rules and row ACLs. These must never share a
+        # cache entry or the cache would hand privileged fields to an
+        # unprivileged caller.
+        @cache_auth = :anon
         if @request_headers.key?(SESSION_TOKEN)
           @session_token = @request_headers[SESSION_TOKEN]
           hashed_token = Digest::SHA256.hexdigest(@session_token.to_s)[0, 32]
+          @cache_auth = hashed_token
           @cache_key = "#{hashed_token}:#{@cache_key}" # prefix with hashed token
         elsif @request_headers.key?(MASTER_KEY)
+          @cache_auth = :master
           @cache_key = "mk:#{@cache_key}" # prefix for master key requests
         end
 
@@ -160,6 +186,13 @@ module Parse
         # tenant/app cleanly without touching another app's entries.
         @cache_key = "#{@namespace}:#{@cache_key}" if @namespace
 
+        # Keep the legacy key for dual-delete on invalidation, then switch the
+        # live key to the keyspace form when one is configured.
+        @legacy_cache_key = @cache_key
+        if @keyspace
+          @cache_key = @keyspace.cache_key(url, auth: @cache_auth, tenant: @cache_tenant)
+        end
+
         url_path = url.path
 
         begin
@@ -184,7 +217,7 @@ module Parse
             # check if the store was from a legacy parse-stack cache value which
             # is stored as Faraday::Env. T\he new system stores less content in a simple hash
             # for improved interoperability and access time.
-            body             = nil
+            body = nil
             response_headers = nil
             if cache_data.is_a?(Faraday::Env)
               body = cache_data.respond_to?(:body) ? cache_data.body : nil
@@ -229,10 +262,17 @@ module Parse
             #non GET requets should clear the cache for that same resource path.
             #ex. a POST to /1/classes/Artist/<objectId> should delete the cache for a GET
             # request for the same '/1/classes/Artist/<objectId>' where objectId are equivalent
-            delete_cache_variants(url)
+            delete_cache_variants(url, resource: true)
             instrument_cache(:delete, method: method, url_path: url_path)
           end
-        rescue ::TypeError, Errno::EINVAL, Redis::CannotConnectError, Redis::TimeoutError, ConnectionPool::TimeoutError => e
+          # `Redis::CommandError` covers the failures a scoped eviction can now
+          # produce that a plain GET/SET never did: a NOPERM from a restricted
+          # ACL, an UNLINK the server does not implement, and a CROSSSLOT refusal
+          # under Redis Cluster. Without it those escape the middleware and turn a
+          # cache problem into a failed application request, which inverts the
+          # whole point of the cache being optional.
+        rescue ::TypeError, Errno::EINVAL, Redis::CannotConnectError, Redis::TimeoutError,
+               Redis::CommandError, ConnectionPool::TimeoutError => e
           # if the cache store fails to connect, catch the exception but proceed
           # with the regular request, but turn off caching for this request. It is possible
           # that the cache connection resumes at a later point, so this is temporary.
@@ -312,7 +352,46 @@ module Parse
       # cleanup of stale pre-namespace entries) and non-GET writes (cache
       # invalidation for the resource).
       # @!visibility private
-      def delete_cache_variants(url)
+      # @param resource [Boolean] when true, evict every auth variant of this
+      #   resource, not just the caller's own entry. Only a write should do
+      #   that. On a GET miss this method is called defensively to clear stale
+      #   siblings, and evicting resource-wide there would destroy other
+      #   sessions' perfectly valid entries on every single cache miss.
+      def delete_cache_variants(url, resource: false)
+        delete_keyspace_variants(url) if resource && @keyspace
+        delete_legacy_variants(url) if legacy_variants?
+        @store.delete @cache_key # final key
+      end
+
+      # Whether to also evict the pre-keyspace key shape. Always true before a
+      # keyspace is configured, since that shape is the only one in use.
+      # @!visibility private
+      def legacy_variants?
+        @keyspace.nil? || @delete_legacy_variants
+      end
+
+      # Evict every auth variant of this resource, not just the caller's own.
+      #
+      # The old two-variant delete could name the anonymous and master-key
+      # siblings but had no way to enumerate *other sessions'* entries, so a
+      # write by one user left every other user holding a stale copy until TTL.
+      # A scan-capable store can express that as one pattern; anything else
+      # falls back to the variants we can name.
+      # @!visibility private
+      def delete_keyspace_variants(url)
+        pattern = @keyspace.resource_pattern(url, tenant: @cache_tenant)
+        if @store.respond_to?(:delete_matching)
+          @store.delete_matching(pattern)
+        else
+          @store.delete @keyspace.cache_key(url, auth: :anon, tenant: @cache_tenant)
+          @store.delete @keyspace.cache_key(url, auth: :master, tenant: @cache_tenant)
+        end
+      end
+
+      # Evict the pre-keyspace key shape so a rolling deploy does not leave old
+      # workers serving entries that a new worker's write should have killed.
+      # @!visibility private
+      def delete_legacy_variants(url)
         if @namespace
           # Namespaced: only delete our app's variants so a write through
           # client A doesn't blow away client B's cache when both share Redis.
@@ -322,7 +401,7 @@ module Parse
           @store.delete url.to_s # regular
           @store.delete "mk:#{url.to_s}" # master key cache-key
         end
-        @store.delete @cache_key # final key
+        @store.delete @legacy_cache_key if @legacy_cache_key
       end
     end #Caching
   end #Middleware