parse-stack-next 5.6.0 → 5.7.1

data/lib/parse/graphql/type_generator.rb

@@ -87,7 +87,7 @@ module Parse
         end
         collisions = by_gql_name.select { |_, names| names.size > 1 }
         return if collisions.empty?
-        details = collisions.map { |gql, parse| "#{gql} ← #{parse.join(', ')}" }.join('; ')
+        details = collisions.map { |gql, parse| "#{gql} ← #{parse.join(", ")}" }.join("; ")
         raise "Parse::GraphQL::TypeGenerator: graphql_name collisions: #{details}. " \
               "Parse class names that differ only by underscores collapse to the same " \
               "GraphQL type name. Rename or generate the conflicting classes separately."

data/lib/parse/graphql.rb

@@ -26,11 +26,11 @@ module Parse
       def available?
         return @gem_available if defined?(@gem_available)
         @gem_available = begin
-          require "graphql"
-          true
-        rescue LoadError
-          false
-        end
+            require "graphql"
+            true
+          rescue LoadError
+            false
+          end
       end
 
       # Force-reset the cached availability flag. Test-only.

data/lib/parse/live_query/client.rb

@@ -364,7 +364,7 @@ module Parse
       #   returned subscription and register callbacks later.
       # @return [Subscription]
       def subscribe(class_name, where: {}, fields: nil, keys: nil, watch: nil, session_token: nil,
-                    use_master_key: false, &block)
+                                use_master_key: false, &block)
         # Handle Parse::Object subclass
         if class_name.is_a?(Class) && class_name < Parse::Object
           class_name = class_name.parse_class

data/lib/parse/live_query.rb

@@ -83,7 +83,7 @@ module Parse
         prefix_parts = []
         prefix_parts << "request_id=#{request_id}" if request_id
         prefix_parts << "class=#{class_name}" if class_name
-        prefixed = prefix_parts.empty? ? text : "#{prefix_parts.join(' ')} #{text}"
+        prefixed = prefix_parts.empty? ? text : "#{prefix_parts.join(" ")} #{text}"
         super(prefixed)
       end
     end

data/lib/parse/lock.rb

@@ -93,10 +93,10 @@ module Parse
   module Lock
     KEY_PREFIX = "parse-stack:lock:v1:"
 
-    DEFAULT_TTL  = 3
+    DEFAULT_TTL = 3
     DEFAULT_WAIT = 2.0
-    MAX_TTL      = 30
-    MAX_WAIT     = 30
+    MAX_TTL = 30
+    MAX_WAIT = 30
 
     # Minimum byte-length for an explicit `secret:` kwarg. 16 bytes
     # ≈ 128 bits of separation between tenants — short enough not to
@@ -196,13 +196,13 @@ module Parse
       # @raise [Parse::Lock::UnavailableError] when `on_degraded: :raise`
       #   and the store is process-local.
       def acquire(key, ttl: DEFAULT_TTL, wait: DEFAULT_WAIT,
-                  on_degraded: :warn, secret: :auto, &block)
+                       on_degraded: :warn, secret: :auto, &block)
         raise ArgumentError, "block required" unless block_given?
         validated_key = validate_key!(key)
         validate_on_degraded!(on_degraded)
         validate_secret!(secret)
-        normalized_ttl  = clamp(Integer(ttl),  1,   MAX_TTL)
-        normalized_wait = clamp(Float(wait),   0.0, MAX_WAIT)
+        normalized_ttl = clamp(Integer(ttl), 1, MAX_TTL)
+        normalized_wait = clamp(Float(wait), 0.0, MAX_WAIT)
 
         # Route through Parse::LockBackend — the shared module that
         # also serves Parse::CreateLock. The KEY_PREFIX
@@ -216,15 +216,12 @@ module Parse
         # up the operator-configured secret if one exists; the
         # explicit-String branch overrides it; the explicit-nil
         # branch opts out without a warn.
-        resolved_secret =
-          case secret
-          when :auto   then Parse::LockBackend.lock_secret_for(store: store, source: "Parse::Lock")
-          when String  then secret
-          when nil     then nil
+        resolved_secret = case secret
+          when :auto then Parse::LockBackend.lock_secret_for(store: store, source: "Parse::Lock")
+          when String then secret
+          when nil then nil
           end
-        digest = resolved_secret \
-          ? OpenSSL::HMAC.hexdigest("SHA256", resolved_secret, validated_key) \
-          : Digest::SHA256.hexdigest(validated_key)
+        digest = resolved_secret ? OpenSSL::HMAC.hexdigest("SHA256", resolved_secret, validated_key) : Digest::SHA256.hexdigest(validated_key)
         store_key = "#{KEY_PREFIX}#{digest}"
 
         if Parse::LockBackend.degraded_store?(store)
@@ -238,13 +235,13 @@ module Parse
           # cross-process owner here — the Mutex IS the exclusion — so a
           # fresh UUID is purely for signature parity / local fencing.
           return Parse::LockBackend.synchronize_process_mutex(store_key) do
-            yield SecureRandom.uuid
-          end
+                   yield SecureRandom.uuid
+                 end
         end
 
-        owner       = SecureRandom.uuid
+        owner = SecureRandom.uuid
         acquired_at = nil
-        start       = Parse::LockBackend.monotonic_now
+        start = Parse::LockBackend.monotonic_now
 
         loop do
           if Parse::LockBackend.try_acquire(store, store_key, owner, normalized_ttl)

data/lib/parse/lock_backend.rb

@@ -102,7 +102,7 @@ module Parse
       #   error (Parse::CreateLockUnavailableError vs
       #   Parse::Lock::UnavailableError) without coupling here.
       def handle_degraded(mode, key, source: "Parse::LockBackend",
-                          unavailable_error: nil)
+                                     unavailable_error: nil)
         case mode
         when :raise
           err = unavailable_error || Parse::Error

data/lib/parse/lookup_rewriter.rb

@@ -236,9 +236,9 @@ module Parse
       mongo_local = "_p_#{pointer_field}"
       if foreign_has_parse_reference?(target_class)
         replace_keys(spec,
-                    "from" => from_collection,
-                    "localField" => mongo_local,
-                    "foreignField" => PARSE_REFERENCE_REMOTE)
+                     "from" => from_collection,
+                     "localField" => mongo_local,
+                     "foreignField" => PARSE_REFERENCE_REMOTE)
       else
         as_value = read_string(spec, "as")
         let_var = "rwLookupId_#{pointer_field}"
@@ -262,9 +262,9 @@ module Parse
       mongo_foreign = "_p_#{pointer_field}"
       if foreign_has_parse_reference?(local_class)
         replace_keys(spec,
-                    "from" => from_collection,
-                    "localField" => PARSE_REFERENCE_REMOTE,
-                    "foreignField" => mongo_foreign)
+                     "from" => from_collection,
+                     "localField" => PARSE_REFERENCE_REMOTE,
+                     "foreignField" => mongo_foreign)
       else
         as_value = read_string(spec, "as")
         let_var = "rwReverseId_#{pointer_field}"

data/lib/parse/model/associations/belongs_to.rb

@@ -243,6 +243,10 @@ module Parse
               instance_variable_set ivar, val
             end
 
+            # Capture after lazy hydration, before a caller can mutate an
+            # object returned by this association getter.
+            send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
+
             # Track association source for N+1 detection when returning an unfetched pointer
             # Uses a registry instead of setting instance variables on the pointer object
             if val.is_a?(Parse::Pointer) && val.pointer? && Parse.warn_on_n_plus_one

data/lib/parse/model/associations/collection_proxy.rb

@@ -359,6 +359,9 @@ module Parse
 
     # Notifies the delegate that the collection changed.
     def notify_will_change!
+      if @delegate && @delegate.respond_to?(:_capture_transaction_state!, true)
+        @delegate.send(:_capture_transaction_state!)
+      end
       collection_will_change!
       forward "#{@key}_will_change!"
     end

data/lib/parse/model/associations/has_many.rb

@@ -502,6 +502,10 @@ module Parse
               val = instance_variable_get ivar
             end
 
+            # Capture before this getter materializes or returns a mutable
+            # proxy that can be changed in place.
+            send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
+
             # if the result is not a collection proxy, then create a new one.
             unless val.is_a?(Parse::PointerCollectionProxy)
               results = []

data/lib/parse/model/classes/role.rb

@@ -62,6 +62,47 @@ module Parse
     # @return [RelationCollectionProxy<User>] a Parse relation of users belonging to this role.
     has_many :users, through: :relation
 
+    # Names of Mongo driver errors that mean "the server is momentarily
+    # unreachable", for which falling back to the Parse Server walk is right.
+    #
+    # Names rather than classes, resolved on first use rather than at load
+    # time, because the driver is required lazily (`Parse::MongoDB.require_gem!`)
+    # and `Mongo::Error` does not exist when this file loads.
+    #
+    # The previous check tested `Mongo::Error::ConnectionFailure`, which does
+    # NOT exist in the locked 2.25.0 driver, so `defined?` was always false and
+    # the fallback never fired on a real error. The tests manufactured the
+    # constant themselves, which is how a guard can be green and dead at the
+    # same time. Real availability errors propagated instead of degrading.
+    #
+    # `ConnectionFailure` is kept for older drivers that do define it.
+    # Deliberately narrow otherwise: `ExecutionTimeout`, `DeniedOperator`, and
+    # `CLPScope::Denied` are attack signals or policy denials and must keep
+    # propagating rather than silently downgrading to the slow path.
+    MONGO_AVAILABILITY_ERROR_NAMES = %w[
+      ConnectionFailure
+      ConnectionUnavailable
+      ConnectionPerished
+      ConnectionCheckOutTimeout
+      SocketError
+      SocketTimeoutError
+      NoServerAvailable
+    ].freeze
+
+    # @return [Array<Class>] the subset of {MONGO_AVAILABILITY_ERROR_NAMES}
+    #   this driver actually defines.
+    def self.mongo_availability_errors
+      return [] unless defined?(::Mongo::Error)
+      @mongo_availability_errors ||= MONGO_AVAILABILITY_ERROR_NAMES.filter_map do |name|
+        ::Mongo::Error.const_get(name) if ::Mongo::Error.const_defined?(name)
+      end.freeze
+    end
+
+    # @return [Boolean] whether `error` means the server was unreachable.
+    def self.mongo_availability_error?(error)
+      mongo_availability_errors.any? { |klass| error.is_a?(klass) }
+    end
+
     # Parse Server requires every _Role row to ship with an ACL (the
     # requirement is hard-coded in SchemaController.requiredColumns and
     # cannot be disabled by config). We default to master-only (ACL = {})
@@ -150,6 +191,9 @@ module Parse
       #   scope (subject to `_Role` CLP). The scope is forwarded
       #   verbatim to {Parse::MongoDB.role_names_for_user}; CLP denial
       #   raises {Parse::CLPScope::Denied}.
+      # @param strict [Boolean] re-raise REST role-query failures instead of
+      #   returning the closure resolved before the failure. Access inspection
+      #   uses this to distinguish no membership from unavailable evidence.
       # @return [Set<String>] role names (no `role:` prefix) the user
       #   transitively inherits permissions from, including direct
       #   memberships. Empty set for anonymous or no-membership users.
@@ -166,7 +210,8 @@ module Parse
       # @example
       #   names = Parse::Role.all_for_user(user, master: true)  # admin/analytics
       #   names = Parse::Role.all_for_user(user, as: current_user)  # scope-checked
-      def all_for_user(user, max_depth: 10, master: false, as: nil)
+      def all_for_user(user, max_depth: 10, master: false, as: nil, client: nil,
+                             strict: false)
         names = Set.new
         return names if user.nil? || max_depth <= 0
 
@@ -182,7 +227,7 @@ module Parse
         # have no scope to forward.
         if master == true || !as.nil?
           fast_path_result = all_for_user_mongo_fast_path(
-            user_pointer.id, max_depth, master: master, as: as,
+            user_pointer.id, max_depth, master: master, as: as, client: client,
           )
           if fast_path_result.is_a?(Set)
             ActiveSupport::Notifications.instrument(
@@ -195,13 +240,34 @@ module Parse
           end
         end
 
+        if as
+          # FAIL CLOSED. The slow path below reads `_Role` through the REST
+          # client, which in a master-keyed process answers with every role
+          # regardless of what `as:` may see. Silently falling back would turn
+          # a scoped traversal into a master-keyed one and hand the caller a
+          # closure they were never entitled to. A caller who wants the master
+          # answer has to ask for it.
+          raise Parse::MongoDB::NotEnabled,
+                "Parse::Role.all_for_user: `as:` requires the mongo-direct role graph, " \
+                "which is unavailable. Refusing to fall back to the Parse Server walk, " \
+                "which would run under the client's own credentials rather than the " \
+                "requested scope. Configure Parse::MongoDB, or pass `master: true` to " \
+                "take the unscoped answer deliberately."
+        end
+
         begin
-          direct_roles = Parse::Role.all(users: user_pointer)
-        rescue
+          direct_roles = role_query_all({ users: user_pointer }, client: client)
+        rescue StandardError
+          raise if strict
           return names
         end
 
-        result = expand_inheritance_upward(direct_roles, max_depth: max_depth)
+        result = expand_inheritance_upward(
+          direct_roles,
+          max_depth: max_depth,
+          client: client,
+          strict: strict,
+        )
         ActiveSupport::Notifications.instrument(
           "parse.role.expand",
           direction: :forward, target_id: user_pointer.id,
@@ -217,11 +283,11 @@ module Parse
       # is unavailable (mongo not configured, or a benign availability
       # error). Attack-signal errors (timeouts, denied operators,
       # CLP::Denied, ArgumentError on missing auth) are propagated.
-      def all_for_user_mongo_fast_path(user_id, max_depth, master: false, as: nil)
+      def all_for_user_mongo_fast_path(user_id, max_depth, master: false, as: nil, client: nil)
         return nil unless defined?(Parse::MongoDB)
         return nil unless Parse::MongoDB.respond_to?(:role_names_for_user)
         Parse::MongoDB.role_names_for_user(
-          user_id, max_depth: max_depth, master: master, as: as,
+          user_id, max_depth: max_depth, master: master, as: as, client: client,
         )
       rescue StandardError => e
         # Fall back to Parse-Server path on benign availability errors
@@ -229,8 +295,7 @@ module Parse
         # ExecutionTimeout, DeniedOperator, CLPScope::Denied,
         # ArgumentError, and any unrecognized Mongo::Error subclass —
         # so attack signals aren't masked by a silent slow-path retry.
-        if defined?(::Mongo::Error::ConnectionFailure) &&
-           e.is_a?(::Mongo::Error::ConnectionFailure)
+        if Parse::Role.mongo_availability_error?(e)
           # Emit a structured event so operators can observe the
           # fast-path-unavailable rate (e.g. analytics-replica
           # connection flapping). The fallback to the Parse-Server
@@ -262,7 +327,46 @@ module Parse
       # @param max_depth [Integer] maximum BFS depth.
       # @return [Set<String>] role names (no `role:` prefix) including
       #   the starting frontier and every transitive parent.
-      def expand_inheritance_upward(starting_roles, max_depth: 10)
+      # @!visibility private
+      # Run a `_Role` query against a SPECIFIC client.
+      #
+      # `Parse::Role.all(...)` resolves its client through the class, which is
+      # the default client. That was fine while identity resolution was also
+      # global, and became a split brain once it was not: a session token
+      # could be resolved against client B while the role closure for the
+      # resulting user was walked against the default application, mixing one
+      # application's identity with another's role graph.
+      #
+      # A nil client keeps the historical behavior.
+      # @!visibility private
+      # Run a `_User` query against a SPECIFIC client. Same rationale as
+      # {.role_query_all}: `Parse::User.all` resolves through the class, which
+      # is the default client, so the reverse role traversal would hydrate one
+      # application's users while the subtree came from another's database.
+      def user_query_all(constraints, client: nil)
+        return Parse::User.all(**constraints) if client.nil?
+        query = Parse::User.query(constraints)
+        query.client = client
+        query.results
+      end
+
+      def role_query_all(constraints, client: nil)
+        # No explicit client means the historical path, unchanged. This is not
+        # only for compatibility: `Parse::Role.all` is what callers and tests
+        # observe and stub, and routing around it when nothing asked us to
+        # would change behavior for every existing caller to fix a problem
+        # none of them have.
+        # Double-splat, not a positional Hash: `Parse::Role.all` takes
+        # keywords, and Ruby 3 does not convert one to the other.
+        return Parse::Role.all(**constraints) if client.nil?
+
+        query = Parse::Role.query(constraints)
+        query.client = client
+        query.results
+      end
+
+      def expand_inheritance_upward(starting_roles, max_depth: 10, client: nil,
+                                                    strict: false)
         names = Set.new
         visited_ids = Set.new
         frontier = []
@@ -281,8 +385,9 @@ module Parse
           frontier.each do |role|
             next if role.nil? || role.id.nil?
             begin
-              parents = Parse::Role.all(roles: role)
-            rescue
+              parents = role_query_all({ roles: role }, client: client)
+            rescue StandardError
+              raise if strict
               next
             end
             parents.each do |parent|
@@ -554,13 +659,13 @@ module Parse
     # @example
     #   all_users = admin_role.all_users(master: true)
     #   visible = admin_role.all_users(as: current_user)
-    def all_users(max_depth: 10, visited: Set.new, master: false, as: nil)
+    def all_users(max_depth: 10, visited: Set.new, master: false, as: nil, client: nil)
       return [] if max_depth <= 0
       return [] if id.nil? || visited.include?(id)
 
       # The fast path is opt-in (same rationale as {.all_for_user}).
       if master == true || !as.nil?
-        fast_path = all_users_mongo_fast_path(max_depth, master: master, as: as)
+        fast_path = all_users_mongo_fast_path(max_depth, master: master, as: as, client: client)
         if fast_path.is_a?(Array)
           ActiveSupport::Notifications.instrument(
             "parse.role.expand",
@@ -571,13 +676,32 @@ module Parse
         end
       end
 
-      visited << id
+      if as
+        # Same fail-closed rule as {.all_for_user}: the relation reads below
+        # run under the client's own credentials, so a master-keyed process
+        # would answer a scoped request with every user in the subtree.
+        raise Parse::MongoDB::NotEnabled,
+              "Parse::Role#all_users: `as:` requires the mongo-direct role graph, " \
+              "which is unavailable. Refusing to fall back to the Parse Server walk, " \
+              "which would run under the client's own credentials rather than the " \
+              "requested scope. Configure Parse::MongoDB, or pass `master: true` to " \
+              "take the unscoped answer deliberately."
+      end
 
-      direct_users = users.all
+      visited << id
 
-      child_roles = roles.all
+      # The posture travels with the recursion. Dropping `client:` here meant
+      # a traversal that started on client B finished on the default, and
+      # dropping `master:` meant an explicit master call could silently
+      # downgrade under client mode or an ambient session token partway down
+      # the tree.
+      direct_users = relation_all(users, client: client)
+      child_roles = relation_all(roles, client: client)
       child_users = child_roles.flat_map do |child_role|
-        child_role.all_users(max_depth: max_depth - 1, visited: visited)
+        child_role.all_users(
+          max_depth: max_depth - 1, visited: visited,
+          master: master, as: as, client: client,
+        )
       end
 
       result = (direct_users + child_users).uniq { |u| u.id }
@@ -601,28 +725,27 @@ module Parse
     # (sub-pipeline `_rperm` match in the role-subtree join, see
     # MONGO-4) AND on the hydration query (full _User row-level ACL
     # filtering before the rows hit the wire).
-    def all_users_mongo_fast_path(max_depth, master: false, as: nil)
+    def all_users_mongo_fast_path(max_depth, master: false, as: nil, client: nil)
       return nil unless defined?(Parse::MongoDB)
       return nil unless Parse::MongoDB.respond_to?(:users_in_role_subtree)
       ids = Parse::MongoDB.users_in_role_subtree(
-        id, max_depth: max_depth, master: master, as: as,
+        id, max_depth: max_depth, master: master, as: as, client: client,
       )
       return nil if ids.nil?
       return [] if ids.empty?
 
       if master == true
         # Master path: master-keyed default client returns every row.
-        Parse::User.all(:objectId.in => ids.to_a)
+        Parse::Role.send(:user_query_all, { :objectId.in => ids.to_a }, client: client)
       else
         # Scoped path: route through Parse::MongoDB.aggregate so _User
         # ACL is enforced by the SDK on the hydration query. The
         # aggregate already strips protectedFields and filters by
         # _rperm/CLP under the resolved scope.
-        hydrate_users_under_scope(ids.to_a, as)
+        hydrate_users_under_scope(ids.to_a, as, client: client)
       end
     rescue StandardError => e
-      if defined?(::Mongo::Error::ConnectionFailure) &&
-         e.is_a?(::Mongo::Error::ConnectionFailure)
+      if Parse::Role.mongo_availability_error?(e)
         # Emit a structured event so operators can monitor fast-path
         # availability separate from the role-graph notification.
         ActiveSupport::Notifications.instrument(
@@ -636,6 +759,19 @@ module Parse
       end
     end
 
+    # @!visibility private
+    # Read a relation against a SPECIFIC client. `relation.all` resolves
+    # through the class, which is the default client, so a traversal that
+    # started on a secondary client would finish on the default one.
+    def relation_all(relation, client: nil)
+      return relation.all if client.nil?
+      query = relation.query
+      query.client = client
+      query.results
+    rescue StandardError
+      relation.all
+    end
+
     # @!visibility private
     # Hydrate a list of `_User.objectId`s into {Parse::User} instances
     # via `Parse::MongoDB.aggregate` under the supplied scope. This is
@@ -644,14 +780,14 @@ module Parse
     # instead of the master-keyed `Parse::User.all`.
     #
     # Returns an Array of {Parse::User} instances (possibly empty).
-    def hydrate_users_under_scope(ids, as_scope)
+    def hydrate_users_under_scope(ids, as_scope, client: nil)
       return [] if ids.nil? || ids.empty?
       pipeline = [
         { "$match" => { "_id" => { "$in" => ids.map(&:to_s) } } },
       ]
       raw = Parse::MongoDB.aggregate(
         Parse::Model::CLASS_USER, pipeline,
-        allow_internal_fields: true, acl_user: as_scope,
+        allow_internal_fields: true, acl_user: as_scope, client: client,
       )
       raw.map do |doc|
         parse_doc = Parse::MongoDB.convert_document_to_parse(
@@ -660,8 +796,61 @@ module Parse
         Parse::User.new(parse_doc) if parse_doc
       end.compact
     end
+
     private :hydrate_users_under_scope
 
+    # Inspect one effective object permission for a hypothetical authenticated
+    # member of this role. User-specific, pointer-specific, and `_User` self
+    # rules remain unknown because a role does not identify a concrete member.
+    #
+    # @param object [Parse::Object] the Parse object to check.
+    # @param operation [Symbol] `:read`, `:write`, or `:delete`.
+    # @return [Parse::Access::Decision]
+    def access_decision(object, operation, client: nil, authenticated: nil,
+                                           max_role_depth: 10)
+      require_relative "../../access" unless defined?(Parse::Access)
+      Parse::Access.check(
+        principal: self,
+        object: object,
+        operation: operation,
+        client: client,
+        authenticated: authenticated,
+        max_role_depth: max_role_depth,
+      )
+    end
+
+    # Inspect read, write, and delete while sharing one parent-role lookup.
+    # @return [Hash<Symbol, Parse::Access::Decision>]
+    def access_decisions(object, client: nil, authenticated: nil, max_role_depth: 10)
+      require_relative "../../access" unless defined?(Parse::Access)
+      Parse::Access.check_all(
+        principal: self,
+        object: object,
+        client: client,
+        authenticated: authenticated,
+        max_role_depth: max_role_depth,
+      )
+    end
+
+    # Return whether the role-derived policy definitively grants read access.
+    # Unknown states fail closed.
+    # @return [Boolean]
+    def can_read?(object, **options)
+      access_decision(object, :read, **options).allowed?
+    end
+
+    # Return whether the role-derived policy definitively grants update access.
+    # @return [Boolean]
+    def can_write?(object, **options)
+      access_decision(object, :write, **options).allowed?
+    end
+
+    # Return whether the role-derived policy definitively grants delete access.
+    # @return [Boolean]
+    def can_delete?(object, **options)
+      access_decision(object, :delete, **options).allowed?
+    end
+
     # Get the set of role names whose presence in a `_rperm` array
     # grants access to this role's members. That's the role itself
     # plus every role `P` that lists this role in its `roles` relation,
@@ -688,8 +877,18 @@ module Parse
     #   `self.name` and every transitive parent.
     # @example
     #   permission_strings = admin.all_parent_role_names.map { |n| "role:#{n}" }
-    def all_parent_role_names(max_depth: 10)
-      Parse::Role.expand_inheritance_upward([self], max_depth: max_depth)
+    # @param client [Parse::Client, nil] resolve the `_Role` traversal
+    #   against this client. Nil uses the default, which is the historical
+    #   behavior. Supplying it matters wherever the caller's identity was
+    #   resolved against a specific client: walking the role graph on the
+    #   default application would then mix one application's identity with
+    #   another's role names.
+    # @param strict [Boolean] re-raise role-query failures rather than returning
+    #   a partial parent closure.
+    def all_parent_role_names(max_depth: 10, client: nil, strict: false)
+      Parse::Role.expand_inheritance_upward(
+        [self], max_depth: max_depth, client: client, strict: strict,
+      )
     end
 
     # Get all child roles recursively. Cycle-safe; see {#all_users}.

data/lib/parse/model/classes/user.rb

@@ -450,7 +450,7 @@ module Parse
 
       # @!visibility private
       def _rebuild_user_protected_fields!
-        @master_only_fields  ||= []
+        @master_only_fields ||= []
         @self_visible_fields ||= []
         pointer = @self_pointer_field || :self
         all_hidden = (@master_only_fields + @self_visible_fields).uniq
@@ -1437,6 +1437,65 @@ module Parse
       end
     end
 
+    # Inspect one effective object permission for this user. The richer
+    # decision distinguishes a definite denial from missing local evidence.
+    # This is a policy preflight; Parse Server remains authoritative.
+    #
+    # @param object [Parse::Object] the Parse object to check.
+    # @param operation [Symbol] `:read`, `:write`, or `:delete`.
+    # @param client [Parse::Client, nil] application whose CLP/roles to inspect.
+    # @param authenticated [Boolean, nil] explicit authentication assertion.
+    #   When omitted, an attached session token is required for user/role-
+    #   specific grants; public grants can still be answered without one.
+    # @param max_role_depth [Integer] inherited-role traversal limit.
+    # @return [Parse::Access::Decision]
+    def access_decision(object, operation, client: nil, authenticated: nil,
+                                           max_role_depth: 10)
+      require_relative "../../access" unless defined?(Parse::Access)
+      Parse::Access.check(
+        principal: self,
+        object: object,
+        operation: operation,
+        client: client,
+        authenticated: authenticated,
+        max_role_depth: max_role_depth,
+      )
+    end
+
+    # Inspect read, write, and delete while sharing one role-graph lookup.
+    # @return [Hash<Symbol, Parse::Access::Decision>]
+    def access_decisions(object, client: nil, authenticated: nil, max_role_depth: 10)
+      require_relative "../../access" unless defined?(Parse::Access)
+      Parse::Access.check_all(
+        principal: self,
+        object: object,
+        client: client,
+        authenticated: authenticated,
+        max_role_depth: max_role_depth,
+      )
+    end
+
+    # Return whether local evidence definitively grants read access. Unknown
+    # states (partial objects, unresolved CLP/roles, or an id-only user) fail
+    # closed.
+    # @return [Boolean]
+    def can_read?(object, **options)
+      access_decision(object, :read, **options).allowed?
+    end
+
+    # Return whether local evidence definitively grants update access.
+    # @return [Boolean]
+    def can_write?(object, **options)
+      access_decision(object, :write, **options).allowed?
+    end
+
+    # Return whether local evidence definitively grants delete access. Delete
+    # uses the ACL write grant plus the class's delete CLP.
+    # @return [Boolean]
+    def can_delete?(object, **options)
+      access_decision(object, :delete, **options).allowed?
+    end
+
     # Return the transitive upward closure of role names this user
     # inherits permissions from.
     #