parse-stack-next 5.6.0 → 5.7.1

data/lib/parse/acl_scope.rb

@@ -4,6 +4,7 @@
 require "set"
 require_relative "model/acl"
 require_relative "clp_scope"
+require_relative "authorization"
 
 module Parse
   # Shared identity-resolution helper for query paths that simulate
@@ -22,11 +23,13 @@ module Parse
   # userObjectId, "role:Admin", ...]`), so callers can prepend a
   # `$match` stage built via {Parse::ACL.read_predicate}.
   #
-  # Atlas Search uses the same pattern through
-  # `Parse::AtlasSearch::Session`; this module reuses that resolver
-  # (token → user_id → role expansion + caching) and adds a
-  # path-agnostic kwarg-popping front door so every mongo-direct entry
-  # point can speak the same auth vocabulary.
+  # Identity and role resolution live in {Parse::Authorization}, which
+  # owns the token → user_id → role-expansion pipeline and its caches.
+  # This module adds a path-agnostic kwarg-popping front door on top, so
+  # every mongo-direct entry point speaks the same auth vocabulary.
+  # Atlas Search is a peer consumer of the same resolver, not its home:
+  # `Parse::Query#results_direct` runs no `$search` at all and must not
+  # depend on the Atlas Search namespace to decide who the caller is.
   module ACLScope
     # Raised when a query path is configured to require an explicit
     # session-token or master mode and the caller supplied neither.
@@ -50,7 +53,7 @@ module Parse
     #   @return [String, nil] the resolved user_id, or `nil` for
     #     `:master` and `:public`.
     # @!attribute session
-    #   @return [Parse::AtlasSearch::Session::Resolved, nil] the
+    #   @return [Parse::Authorization::Resolved, nil] the
     #     underlying resolved-session struct (carries role-name set),
     #     `nil` for `:master`.
     # @!attribute strict_role
@@ -64,13 +67,38 @@ module Parse
     #     `strict_role: true`, rows with NO `_rperm` field still pass
     #     (Parse-Server treats absent `_rperm` as public-default); the
     #     knob only suppresses the `"*"` subscription in the `$in` set.
-    Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, keyword_init: true) do
+    # @!attribute client
+    #   @return [Parse::Client, nil] the client whose authorization context
+    #     produced this resolution. Carried so a caller about to run the
+    #     query against a process-global resource can check that the two
+    #     agree; see {Parse::MongoDB.verify_client!}. Per-client
+    #     authorization plus a process-global MongoDB connection is safe only
+    #     when they belong to the same application.
+    Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
       def master?; mode == :master; end
       def session?; mode == :session; end
       def public?; mode == :public; end
       def strict_role?; strict_role == true; end
     end
 
+    # The client a resolution was produced by, or nil when it cannot say.
+    #
+    # Deliberately tolerant of objects that are resolution-shaped without
+    # being a {Resolution}: test doubles and any caller-supplied stand-in.
+    # A resolution that cannot name its client IS an unidentified caller,
+    # which is a case {Parse::MongoDB.verify_client!} models explicitly (it
+    # allows the single-application case and refuses the ambiguous one).
+    # Crashing on the missing method instead would convert an unknown into
+    # a NoMethodError far from its cause.
+    #
+    # @param resolution [Object, nil]
+    # @return [Parse::Client, nil]
+    def self.client_of(resolution)
+      return nil if resolution.nil?
+      return nil unless resolution.respond_to?(:client)
+      resolution.client
+    end
+
     class << self
       # When `true`, every call to {.resolve!} that did NOT receive
       # `session_token:` or `master: true` raises {ACLRequired} instead
@@ -124,7 +152,7 @@ module Parse
           # Parse::Query#scope_to_user. Mirrors the session-token path
           # but skips the /users/me round-trip; role expansion still
           # runs via Parse::Role.all_for_user.
-          return resolve_for_user(acl_user)
+          return resolve_for_user(acl_user, client: authorization_client(options))
         end
 
         if acl_role
@@ -137,22 +165,25 @@ module Parse
           # identity. Parent-role inheritance applies (passing
           # "scope:admin" includes any role "scope:admin" inherits
           # from).
-          return resolve_for_role(acl_role, strict_role: strict_role)
+          return resolve_for_role(acl_role, strict_role: strict_role,
+                                            client: authorization_client(options))
         end
 
         if session_token
-          require_atlas_session!
-          resolved = Parse::AtlasSearch::Session.resolve(session_token)
+          context = authorization_for(options)
+          resolved = context.resolve(session_token)
           return Resolution.new(
-            mode: :session,
-            permission_strings: resolved.permission_strings,
-            user_id: resolved.user_id,
-            session: resolved,
-          )
+                   mode: :session,
+                   permission_strings: resolved.permission_strings,
+                   user_id: resolved.user_id,
+                   session: resolved,
+                   client: context.client,
+                 )
         end
 
         if master == true
-          return Resolution.new(mode: :master, permission_strings: nil, user_id: nil, session: nil)
+          return Resolution.new(mode: :master, permission_strings: nil, user_id: nil, session: nil,
+                                client: authorization_client(options))
         end
 
         if @require_session_token == true
@@ -165,13 +196,13 @@ module Parse
         end
 
         warn_no_acl_context_once!(method_name)
-        require_atlas_session!
-        anonymous = Parse::AtlasSearch::Session::Resolved.new(nil, Set.new)
+        anonymous = Parse::Authorization::Resolved.new(nil, Set.new)
         Resolution.new(
           mode: :public,
           permission_strings: anonymous.permission_strings,
           user_id: nil,
           session: anonymous,
+          client: authorization_client(options),
         )
       end
 
@@ -384,8 +415,7 @@ module Parse
         # either shape so the CLP gate fires before the String→Hash
         # upgrade — denying access to the joined class BEFORE we go
         # to the trouble of building out an upgraded sub-pipeline.
-        target =
-          if spec.is_a?(String)
+        target = if spec.is_a?(String)
             spec
           elsif spec.is_a?(Hash)
             spec["coll"] || spec[:coll]
@@ -417,8 +447,7 @@ module Parse
         # `$and`.
         acl_predicate = acl_match["$match"]
         existing = spec["restrictSearchWithMatch"] || spec[:restrictSearchWithMatch]
-        combined =
-          if existing.nil? || (existing.respond_to?(:empty?) && existing.empty?)
+        combined = if existing.nil? || (existing.respond_to?(:empty?) && existing.empty?)
             acl_predicate
           else
             { "$and" => [existing, acl_predicate] }
@@ -431,8 +460,7 @@ module Parse
       def rewrite_facet(spec, acl_match, perms)
         return spec unless spec.is_a?(Hash)
         spec.each_with_object({}) do |(branch_name, branch_pipeline), out|
-          out[branch_name] =
-            if branch_pipeline.is_a?(Array)
+          out[branch_name] = if branch_pipeline.is_a?(Array)
               # Recurse with the same perms — facet branches are
               # evaluated in the requesting session's authority, not
               # elevated.
@@ -565,7 +593,7 @@ module Parse
       # through a session token.
       # @param user [Parse::User, Parse::Pointer]
       # @return [Resolution]
-      def resolve_for_user(user)
+      def resolve_for_user(user, client: nil)
         # SECURITY: className must be `_User` (or the legacy `User`
         # alias). Without this check, any duck-typed object exposing
         # `#id` — including a `Parse::Pointer` to a foreign class
@@ -596,10 +624,13 @@ module Parse
                 "User Pointer with a non-empty objectId."
         end
 
-        role_names =
-          begin
+        role_names = begin
             require_relative "model/classes/role"
-            Parse::Role.all_for_user(user, max_depth: 10)
+            # `client:` matters here for the same reason it does on the
+            # session-token path: resolving the user against one application
+            # and then walking the role graph on another would grant that
+            # user the other application's roles by name.
+            Parse::Role.all_for_user(user, max_depth: 10, client: client)
           rescue StandardError
             Set.new
           end
@@ -608,12 +639,12 @@ module Parse
         role_names.each { |name| perms << "role:#{name}" if name && !name.empty? }
         perms.uniq!
 
-        require_atlas_session!
         Resolution.new(
           mode: :session,
           permission_strings: perms,
           user_id: user.id,
-          session: Parse::AtlasSearch::Session::Resolved.new(user.id, role_names),
+          session: Parse::Authorization::Resolved.new(user.id, role_names),
+          client: client,
         )
       end
 
@@ -646,24 +677,22 @@ module Parse
       #   {.match_stage_for} for the precise predicate shape.
       # @return [Resolution]
       # @raise [ArgumentError] when the role cannot be resolved.
-      def resolve_for_role(role, strict_role: false)
+      def resolve_for_role(role, strict_role: false, client: nil)
         require_relative "model/classes/role"
-        role_obj =
-          case role
+        role_obj = case role
           when Parse::Role then role
           when String, Symbol
             name = role.to_s.sub(/\Arole:/, "")
             raise ArgumentError, "[Parse::ACLScope] role name must be non-empty." if name.empty?
-            found = Parse::Role.first(name: name)
+            found = role_lookup_by_name(name, client: client)
             raise ArgumentError, "[Parse::ACLScope] no _Role found with name #{name.inspect}." if found.nil?
             found
           else
             raise ArgumentError, "[Parse::ACLScope] resolve_for_role expects Parse::Role or String."
           end
 
-        names =
-          begin
-            role_obj.all_parent_role_names(max_depth: 10)
+        names = begin
+            role_obj.all_parent_role_names(max_depth: 10, client: client)
           rescue StandardError
             Set.new([role_obj.name].compact)
           end
@@ -678,13 +707,13 @@ module Parse
         names.each { |n| perms << "role:#{n}" if n && !n.empty? }
         perms.uniq!
 
-        require_atlas_session!
         Resolution.new(
           mode: :session,
           permission_strings: perms,
           user_id: nil,
-          session: Parse::AtlasSearch::Session::Resolved.new(nil, names),
+          session: Parse::Authorization::Resolved.new(nil, names),
           strict_role: strict_role,
+          client: client,
         )
       end
 
@@ -717,18 +746,62 @@ module Parse
              "= true to make this misuse an error instead of a warning."
       end
 
-      # Lazily load the Atlas Search session resolver — it carries the
-      # token-cache / role-cache plumbing this module reuses. Loads
-      # `atlas_search.rb` (not just `atlas_search/session.rb`) so the
-      # parent module's session_cache / role_cache are initialized.
-      # Loading session.rb in isolation leaves Parse::AtlasSearch
-      # without its memory caches and Session.lookup_user_id crashes
-      # with NoMethodError. Keeping the require lazy means apps that
-      # never call an auth-resolving path don't pay the load cost.
-      def require_atlas_session!
-        return if defined?(Parse::AtlasSearch) && Parse::AtlasSearch.respond_to?(:session_cache) &&
-                  !Parse::AtlasSearch.session_cache.nil?
-        require_relative "atlas_search"
+      # The authorization context that should resolve this call.
+      #
+      # **Mutates `options`** by `delete`-ing `:client`, consistent with the
+      # other auth kwargs, so the remaining hash can be forwarded to the
+      # transport without leaking it.
+      #
+      # Defaults to `Parse.client` at this boundary. Below it,
+      # {Parse::Authorization.resolve} requires `client:` with no default: a
+      # token belonging to application B must never be validated against
+      # application A, which is exactly what a global resolver did.
+      #
+      # This used to lazily `require "atlas_search"` and call
+      # `Parse::AtlasSearch::Session.resolve`, so a plain mongo-direct query
+      # with no `$search` anywhere in it pulled in the Atlas Search namespace
+      # to decide who the caller was.
+      def authorization_for(options)
+        client = authorization_client(options)
+        if client.nil?
+          raise ACLRequired,
+                "Parse::ACLScope could not determine a Parse client to resolve this " \
+                "session token against. Pass client: explicitly, or configure a default " \
+                "client with Parse.setup."
+        end
+        client.authorization
+      end
+
+      # Look up a `_Role` by name against a SPECIFIC client.
+      #
+      # `Parse::Role.first` resolves its client through the class, which is
+      # the default. On the `acl_role:` path that would find a role in the
+      # default application and then use its name to grant access in another,
+      # which is the same cross-application mixing the session-token path
+      # guards against. A nil client keeps the historical behavior.
+      def role_lookup_by_name(name, client: nil)
+        return Parse::Role.first(name: name) if client.nil?
+        query = Parse::Role.query(name: name)
+        query.client = client
+        query.first
+      end
+
+      # The client for this call, or `nil` when none can be determined.
+      #
+      # **Mutates `options`** by `delete`-ing `:client`, so calling this more
+      # than once per call is safe: the first call consumes the kwarg and
+      # later ones fall back to the default.
+      #
+      # Never raises. The master and public paths run no identity resolution
+      # and historically worked in a process that had never called
+      # `Parse.setup`, so making them raise `ConnectionError` just to label
+      # the resolution would be a regression. They still want the label when
+      # one is available, because {Parse::MongoDB.verify_client!} checks it
+      # against the application the global connection is bound to.
+      def authorization_client(options)
+        options.delete(:client) || Parse.client
+      rescue Parse::Error::ConnectionError
+        nil
       end
     end
 

data/lib/parse/agent/cancellation_token.rb

@@ -44,14 +44,14 @@ module Parse
 
       def initialize
         @cancelled = false
-        @reason    = nil
+        @reason = nil
         # Mutex protects the read-modify-write in {#cancel!} so a
         # concurrent cancel from notifications/cancelled and client
         # disconnect cannot lose a reason or partially update state.
         # The hot poll path (#cancelled?) reads the boolean ivar
         # directly — atomic on MRI and on each major Ruby
         # implementation we ship against.
-        @mutex     = Mutex.new
+        @mutex = Mutex.new
       end
 
       # @return [Boolean] true once {#cancel!} has been called at least once.
@@ -71,7 +71,7 @@ module Parse
         @mutex.synchronize do
           return false if @cancelled
           @cancelled = true
-          @reason    = reason
+          @reason = reason
           true
         end
       end

data/lib/parse/agent/constraint_translator.rb

@@ -171,10 +171,10 @@ module Parse
           # count deltas even when operators are otherwise clean.
           assert_where_key_permitted!(key)
           result[columnize(key)] = if key == "$relatedTo"
-                                     translate_related_to_value(value, depth: 0, agent: agent)
-                                   else
-                                     translate_value(value, depth: 0, agent: agent)
-                                   end
+              translate_related_to_value(value, depth: 0, agent: agent)
+            else
+              translate_value(value, depth: 0, agent: agent)
+            end
         end
       end
 

data/lib/parse/agent/describe.rb

@@ -51,14 +51,14 @@ module Parse
             class_name.to_s
           end
         {
-          class_name:              cn,
-          accessible:              describe_class_accessibility(cn),
-          agent_fields:            class_field_allowlist(cn),
-          agent_canonical_filter:  Parse::Agent::MetadataRegistry.canonical_filter(cn),
-          per_agent_filter:        respond_to?(:filter_for) ? filter_for(cn) : nil,
-          tenant_scope:            class_tenant_scope(cn),
-          large_fields:            class_large_fields(cn),
-          agent_methods:           class_agent_method_names(cn),
+          class_name: cn,
+          accessible: describe_class_accessibility(cn),
+          agent_fields: class_field_allowlist(cn),
+          agent_canonical_filter: Parse::Agent::MetadataRegistry.canonical_filter(cn),
+          per_agent_filter: respond_to?(:filter_for) ? filter_for(cn) : nil,
+          tenant_scope: class_tenant_scope(cn),
+          large_fields: class_large_fields(cn),
+          agent_methods: class_agent_method_names(cn),
         }
       end
 
@@ -136,7 +136,7 @@ module Parse
         # mirroring assert_class_accessible!'s signature.
         if class_name
           cn = class_name.is_a?(Class) && class_name.respond_to?(:parse_class) ?
-                 class_name.parse_class : class_name.to_s
+            class_name.parse_class : class_name.to_s
           begin
             Parse::Agent::Tools.assert_class_accessible!(cn, agent: self, op: op)
           rescue Parse::Agent::AccessDenied => e
@@ -152,7 +152,7 @@ module Parse
         # tool is call_method (the method-filter only narrows that tool).
         if tool_sym == :call_method && method_name && class_name
           cn = class_name.is_a?(Class) && class_name.respond_to?(:parse_class) ?
-                 class_name.parse_class : class_name.to_s
+            class_name.parse_class : class_name.to_s
           if respond_to?(:method_filtered?) &&
              method_filtered?(method_name.to_sym, class_name: cn)
             return { allowed: false, reason: :method_filtered,
@@ -169,23 +169,23 @@ module Parse
       # paths share the same data source.
       def describe_hash
         {
-          agent_id:       agent_id,
-          agent_depth:    agent_depth,
-          permissions:    @permissions,
-          auth:           auth_descriptor,
-          tenant_id:      tenant_id,
-          classes:        filter_descriptor(@class_filter_only, @class_filter_except),
-          tools:          tools_descriptor,
-          methods:        filter_descriptor(@method_filter_only, @method_filter_except, transform: ->(s) { s.to_s }),
-          filters:        per_agent_filters_summary,
+          agent_id: agent_id,
+          agent_depth: agent_depth,
+          permissions: @permissions,
+          auth: auth_descriptor,
+          tenant_id: tenant_id,
+          classes: filter_descriptor(@class_filter_only, @class_filter_except),
+          tools: tools_descriptor,
+          methods: filter_descriptor(@method_filter_only, @method_filter_except, transform: ->(s) { s.to_s }),
+          filters: per_agent_filters_summary,
           hidden_classes: Parse::Agent::MetadataRegistry.hidden_class_names,
-          per_class:      per_class_descriptor,
-          strict_modes:   {
-            tool_filter:  strict_tool_filter?,
+          per_class: per_class_descriptor,
+          strict_modes: {
+            tool_filter: strict_tool_filter?,
             class_filter: strict_class_filter?,
           },
           correlation_id: @correlation_id,
-          prompt:         { version: Parse::Agent::PROMPT_VERSION },
+          prompt: { version: Parse::Agent::PROMPT_VERSION },
         }
       end
 
@@ -230,8 +230,8 @@ module Parse
 
       def tools_descriptor
         {
-          only:      @tool_filter_only && @tool_filter_only.to_a.sort,
-          except:    @tool_filter_except && @tool_filter_except.to_a.sort,
+          only: @tool_filter_only && @tool_filter_only.to_a.sort,
+          except: @tool_filter_except && @tool_filter_except.to_a.sort,
           effective: allowed_tools.sort,
         }
       end
@@ -250,7 +250,7 @@ module Parse
       # class.
       def per_class_descriptor
         names = Set.new
-        names.merge(@class_filter_only.to_a)   if @class_filter_only
+        names.merge(@class_filter_only.to_a) if @class_filter_only
         names.merge(@class_filter_except.to_a) if @class_filter_except
         if @filters
           names.merge(@filters.keys.reject { |k| k == :default }.map(&:to_s))
@@ -280,7 +280,7 @@ module Parse
       def describe_class_accessibility(class_name)
         if Parse::Agent::MetadataRegistry.hidden?(class_name)
           except = Parse::Agent::MetadataRegistry.respond_to?(:hidden_exception_for) ?
-                     Parse::Agent::MetadataRegistry.hidden_exception_for(class_name) : nil
+            Parse::Agent::MetadataRegistry.hidden_exception_for(class_name) : nil
           if except == :master_key && auth_context[:using_master_key] == true
             # Hidden from session-bound / acl_user / acl_role agents but
             # reachable by this master-key agent.
@@ -308,7 +308,7 @@ module Parse
       def class_tenant_scope(class_name)
         return nil if tenant_id.nil?
         rule = Parse::Agent::MetadataRegistry.respond_to?(:tenant_scope_rule) ?
-                 Parse::Agent::MetadataRegistry.tenant_scope_rule(class_name) : nil
+          Parse::Agent::MetadataRegistry.tenant_scope_rule(class_name) : nil
         return nil unless rule
         { field: rule[:field], value: tenant_id }
       end
@@ -361,8 +361,8 @@ module Parse
         lines = []
         auth = data[:auth]
         auth_line = auth[:mode] == :session_token ?
-                      "#{auth[:mode]} (fingerprint=#{auth[:fingerprint]})" :
-                      auth[:mode].to_s
+          "#{auth[:mode]} (fingerprint=#{auth[:fingerprint]})" :
+          auth[:mode].to_s
         lines << "Parse::Agent #{data[:agent_id]} (depth=#{data[:agent_depth]}, correlation=#{data[:correlation_id] || "—"})"
         lines << "  auth:        #{auth_line}"
         lines << "  permissions: #{data[:permissions]}"
@@ -370,20 +370,20 @@ module Parse
 
         if data[:classes][:only] || data[:classes][:except]
           lines << "  classes:"
-          lines << "    only:    #{data[:classes][:only].inspect}"   if data[:classes][:only]
+          lines << "    only:    #{data[:classes][:only].inspect}" if data[:classes][:only]
           lines << "    except:  #{data[:classes][:except].inspect}" if data[:classes][:except]
         else
           lines << "  classes:     (no filter — every visible class reachable)"
         end
 
         lines << "  tools:"
-        lines << "    only:      #{data[:tools][:only].inspect}"      if data[:tools][:only]
-        lines << "    except:    #{data[:tools][:except].inspect}"    if data[:tools][:except]
+        lines << "    only:      #{data[:tools][:only].inspect}" if data[:tools][:only]
+        lines << "    except:    #{data[:tools][:except].inspect}" if data[:tools][:except]
         lines << "    effective: #{data[:tools][:effective].inspect}"
 
         if data[:methods][:only] || data[:methods][:except]
           lines << "  methods:"
-          lines << "    only:    #{data[:methods][:only].inspect}"   if data[:methods][:only]
+          lines << "    only:    #{data[:methods][:only].inspect}" if data[:methods][:only]
           lines << "    except:  #{data[:methods][:except].inspect}" if data[:methods][:except]
         end
 

data/lib/parse/agent/errors.rb

@@ -68,10 +68,10 @@ module Parse
       def initialize(class_name = nil, message = nil,
                      kind: nil, denied_field: nil, allowed_fields: nil,
                      suggested_rewrite: nil)
-        @class_name        = class_name.to_s
-        @kind              = kind
-        @denied_field      = denied_field
-        @allowed_fields    = allowed_fields&.map(&:to_s)
+        @class_name = class_name.to_s
+        @kind = kind
+        @denied_field = denied_field
+        @allowed_fields = allowed_fields&.map(&:to_s)
         @suggested_rewrite = suggested_rewrite
         super(message || "Class '#{@class_name}' is not accessible to this agent")
       end
@@ -81,9 +81,9 @@ module Parse
       # unused nil fields.
       def to_details
         {
-          kind:              kind,
-          denied_field:      denied_field,
-          allowed_fields:    allowed_fields,
+          kind: kind,
+          denied_field: denied_field,
+          allowed_fields: allowed_fields,
           suggested_rewrite: suggested_rewrite,
         }.compact
       end
@@ -116,8 +116,8 @@ module Parse
       def initialize(message = nil, depth: nil)
         @depth = depth
         super(message || "Parse::Agent recursion depth exhausted (depth=#{depth.inspect}). " \
-                          "A sub-agent attempted to construct another sub-agent past the " \
-                          "configured recursion_depth: cap.")
+        "A sub-agent attempted to construct another sub-agent past the " \
+        "configured recursion_depth: cap.")
       end
     end