parse-stack-next 5.7.0 → 5.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a554fcec1f40152e03956f033d593c1a4a98fa09ef22e033c270721c701d336
-  data.tar.gz: 10db25291fc3e2f1e61a36df7499f5b38af2e4e04f73f72f7adfaca8c55dd156
+  metadata.gz: 7cb6a2c813f0a1b2d624852680651ed289f7aac282fa24e246b28d0ed9e69383
+  data.tar.gz: a3984ae30555af28eadfdc19fa936103bb252bad332b0ddb8ead163277ae4bde
 SHA512:
-  metadata.gz: aa3333741642e2faea789f829e23c37f3b72dccba2a4c5ed85b3601d2a945a58767cc65cd55ab9eb385225cf6d61cccbe0e4fb824891c273bc735c3c792916e5
-  data.tar.gz: 572f5a1bd5683d2e9a7aad5293e279401680e268359e3d9f805875453a92ac4ca570ac9c4da9a7c85542b986b91544fcf6adffe223314af0aef7a3828071f7cf
+  metadata.gz: d19428000255676b8a5f10ee0087bf3b6d21216c499f56d895d1ee50a646985a4297b725807b2b19878a8576415c8e1551471d34fa236e9bf90170e6e13abed5
+  data.tar.gz: 5db3159d3da214300df9e21760ae871f070f6a79d961fe9e082b5160dd0bd2c07cba5d64656791b961ab2c347e9ebf5151eb607fcf0a3768587a3c382476000e

data/CHANGELOG.md

@@ -1,5 +1,85 @@
 ## parse-stack-next Changelog
 
+### 5.7.1
+
+#### Cache-invalidation webhooks no longer break every application hook for the same trigger
+
+- **FIXED**: `Parse::Cache::Invalidation` raised `NoMethodError: undefined
+  method 'guard'` on every `_User`, `_Role`, and `_Session` trigger it
+  registered, and the failure was not contained. A webhook handler block is
+  bound to the payload before it runs, so the bare `guard` / `bump_subject` /
+  `subject_id` calls in the handler bodies resolved against
+  `Parse::Webhooks::Payload`, which defines none of them. `guard`'s own
+  `rescue` never ran, because it lives inside the body that was never entered,
+  so the error escaped into the route dispatcher. The dispatcher folds a
+  trigger's handlers with `Array#map`, which abandons the collection on the
+  first raise, and these triggers install during `Parse.setup` and therefore
+  sit ahead of every application handler for the same trigger. One
+  unresolvable method name silently prevented an application's own
+  `after_save "_User"` hook from running at all, so any work downstream of it
+  stopped without a visible cause. The handlers now call the module on an
+  explicit receiver captured in a local, which is independent of whatever
+  `self` the dispatcher binds. Applications that set
+  `cache_invalidation_hooks: false` to work around this can remove it.
+- **FIXED**: The invalidation tests dispatched handlers with a plain
+  `Proc#call`, which leaves `self` bound to the module the block closed over,
+  so every one of them passed against handlers that could not run in
+  production. They now dispatch through the real handler invocation and fail
+  against the broken code.
+
+#### Whether one failing `after_*` handler stops the rest is now a setting
+
+- **NEW**: `Parse::Webhooks.abort_after_callbacks_on_error` decides whether an
+  exception raised by one `after_*` handler prevents the remaining handlers for
+  that trigger from running. It defaults to `true`, which is the existing
+  behavior, so nothing changes on upgrade. Set it to `false` to isolate
+  handlers from each other: each one runs regardless of what an earlier one
+  raised, and the failure is reported with a warning and a
+  `parse.webhooks.handler_error` notification instead of being swallowed
+  silently. This was previously not a decision at all but a side effect of
+  folding handlers with `Array#map`, which abandons the collection on the
+  first raise. Registration order is not fully under an application's control,
+  since the SDK's own cache-invalidation triggers install during `Parse.setup`
+  and therefore sit ahead of handlers registered by application files loaded
+  later, so a single raising handler could silently prevent an application's
+  own hooks from running with nothing logged to say they had been skipped.
+- **BEHAVIOR**: The setting governs only whether later handlers still run.
+  Neither mode reverts anything: an `after_*` trigger fires once the write has
+  already committed, so there is no version of this setting that can undo a
+  save. `before_*` dispatch is untouched, and only the accumulating,
+  non-rejectable triggers (`after_save`, `after_delete`, `after_logout`) can
+  hold more than one handler in the first place. A rejectable `before_*`
+  trigger must deny if any handler denies, so its raise must continue to
+  abort.
+
+#### Failed transactions restore the object they rolled back
+
+- **FIXED**: A failed `Parse::Object.transaction` left the in-memory object
+  holding its modified values. The rollback snapshotted `Parse::Object#attributes`
+  and restored it, but that method returns a schema map of field name to type
+  symbol rather than values, so nothing was ever restored. Property values
+  live in `@<field>` instance variables; those are now what the rollback
+  captures and restores, including values nested inside arrays and hashes,
+  relation operation queues, and properties whose ivar did not exist before
+  the transaction. State is captured when the object first enters the
+  transaction rather than at `batch.add`, so the documented pattern of
+  mutating an object and adding it afterwards rolls back correctly.
+- **FIXED**: A failed transaction also left the object with broken change
+  tracking. Restoring the schema map defined `@attributes`, which is the
+  instance variable `ActiveModel::Dirty` keys its behavior on: once defined it
+  builds an `AttributeMutationTracker` over that hash instead of the
+  `ForcedMutationTracker` a `Parse::Object` needs, and `clear_changes!` then
+  called `forgetting_assignment` on the `[key, value]` pairs `Hash#map`
+  yields. Both call sites rescue and warn, so every rollback quietly
+  downgraded the object rather than failing. The rollback no longer defines
+  `@attributes`.
+- **FIXED**: The mongo-direct role-graph integration test gated on
+  `ANALYTICS_DATABASE_URI`, a production variable name the test stack never
+  sets, so both of its traversal assertions skipped on every run while the
+  per-file reporter still reported the file as passing. It now reads
+  `PARSE_TEST_MONGO_URI` like every other mongo-direct integration file and
+  still honors `ANALYTICS_DATABASE_URI` as an override.
+
 ### 5.7.0
 
 #### Cache keys move into a reserved, app-scoped keyspace
@@ -205,7 +285,7 @@
   Server's self-access rules, and role-only checks cannot claim a concrete
   member's pointer or `_User` self permission. CLP cache entries are isolated
   by Parse application so identically named classes cannot leak policy across
-  clients. These helpers are advisory—the eventual Parse Server request is
+  clients. These helpers are advisory: the eventual Parse Server request is
   still authoritative.
 
 #### Test infrastructure

data/lib/parse/cache/invalidation.rb

@@ -52,26 +52,111 @@ module Parse
           registered
         end
 
+        # Run a role-trigger invalidation.
+        #
+        # Public because the registered webhook block calls it on an explicit
+        # receiver. See {handle_identity_trigger} for why that matters.
+        #
+        # @!visibility private
+        # @param cache [Parse::Cache::Redis] the keyspace-configured cache.
+        # @return [void]
+        def handle_role_trigger(cache)
+          guard do
+            # A role write does not say which users are affected: membership
+            # and hierarchy changes arrive as relation deltas on `users` and
+            # `roles`, and the cached value is a flattened transitive closure,
+            # so a parent-role change reaches the members of every child.
+            # Clearing the whole plane is both correct and cheap under a
+            # scoped SCAN. Parse Server does the same, for the same reason.
+            cache.roles.clear
+            # Stamp the epoch so a *foreign* role entry written before this
+            # moment is rejected on read. Parse Server does not clear its own
+            # role cache on a `_Role` delete, so without this the next read
+            # would take its stale entry back and our clear would shorten
+            # revocation by nothing.
+            cache.roles.touch_epoch
+          end
+        end
+
+        # Run an identity-trigger invalidation.
+        #
+        # Public, and invoked on an explicit receiver, because a webhook
+        # handler block does NOT run with `self` bound to the module that
+        # created it. {Parse::Webhooks.invoke_handler} binds the block to the
+        # payload (`payload.define_singleton_method(name, &block)`), and the
+        # historical `payload.instance_exec(payload, &block)` did the same.
+        # A block body calling a bare `guard` / `bump_subject` / `subject_id`
+        # therefore resolved against {Parse::Webhooks::Payload}, which defines
+        # none of them, and raised `NoMethodError` on every `_User`, `_Role`,
+        # and `_Session` trigger.
+        #
+        # That failure was not contained. `guard`'s `rescue` lives inside
+        # `guard`'s own body, which was never entered, so the error escaped
+        # into `call_route`'s `registry.map`. `Array#map` abandons the whole
+        # collection on the first raise, and these triggers register at
+        # `Parse.setup` and therefore sit AHEAD of any application handler for
+        # the same trigger. One unresolvable method name silently prevented
+        # every application `after_save "_User"` hook from running at all.
+        #
+        # Capturing the module in a local and calling it explicitly is what
+        # makes the handler independent of whatever `self` the dispatcher
+        # binds.
+        #
+        # @!visibility private
+        # @param cache [Parse::Cache::Redis] the keyspace-configured cache.
+        # @param type [Symbol] the trigger being handled.
+        # @param payload [Parse::Webhooks::Payload] the incoming payload.
+        # @return [void]
+        def handle_identity_trigger(cache, type, payload)
+          guard do
+            case type
+            when :after_logout
+              # The only trigger Parse Server permits on `_Session`. The
+              # object's own sessionToken is scrubbed from the payload, but
+              # the token is captured from the requesting user before
+              # scrubbing, and for a logout that user *is* the session being
+              # ended. A master-key logout carries no user, so fall back to
+              # the generation bump.
+              #
+              # Pass the RAW token, not a pre-hashed digest.
+              # `Parse::Cache::SubCache#invalidate` hashes its `key`
+              # argument internally for the `:idn` family (see
+              # `SubCache#logical_key`), the same way `#get` / `#set` do.
+              # That is what makes a `set(raw_token, ...)` /
+              # `get(raw_token)` pair round-trip. Hashing here first and
+              # handing SubCache an already-hashed value made it hash the
+              # digest a second time, landing on a key nothing had ever
+              # written to, so logout silently failed to evict the entry.
+              token = payload.respond_to?(:session_token) ? payload.session_token : nil
+              if token && !token.to_s.empty?
+                cache.identity.invalidate(token.to_s)
+              else
+                bump_subject(cache, subject_id(payload))
+              end
+            else
+              # A `_User` write gives a user id, but identity entries are
+              # keyed by session token and no reverse map exists. Bumping a
+              # per-user generation invalidates every one of that user's
+              # entries in O(1), including tokens this process has never
+              # resolved, and without Parse Server's master-key `_Session`
+              # query.
+              bump_subject(cache, subject_id(payload))
+            end
+          end
+        end
+
         private
 
         def install_role_triggers!(cache)
+          # `invalidator` is a captured LOCAL, not `self`. The registered block
+          # runs with `self` rebound to the payload, so a bare method call in
+          # its body would resolve against `Parse::Webhooks::Payload`. A local
+          # closes over correctly regardless of the receiver the dispatcher
+          # binds.
+          invalidator = self
           TRIGGERS[:role].map do |(type, class_name)|
             Parse::Webhooks.route(type, class_name) do |payload|
-              guard do
-                # A role write does not say which users are affected: membership
-                # and hierarchy changes arrive as relation deltas on `users` and
-                # `roles`, and the cached value is a flattened transitive closure,
-                # so a parent-role change reaches the members of every child.
-                # Clearing the whole plane is both correct and cheap under a
-                # scoped SCAN. Parse Server does the same, for the same reason.
-                cache.roles.clear
-                # Stamp the epoch so a *foreign* role entry written before this
-                # moment is rejected on read. Parse Server does not clear its own
-                # role cache on a `_Role` delete, so without this the next read
-                # would take its stale entry back and our clear would shorten
-                # revocation by nothing.
-                cache.roles.touch_epoch
-              end
+              invalidator.handle_role_trigger(cache)
               true
             end
             [type, class_name]
@@ -79,43 +164,10 @@ module Parse
         end
 
         def install_identity_triggers!(cache)
+          invalidator = self
           TRIGGERS[:identity].map do |(type, class_name)|
             Parse::Webhooks.route(type, class_name) do |payload|
-              guard do
-                case type
-                when :after_logout
-                  # The only trigger Parse Server permits on `_Session`. The
-                  # object's own sessionToken is scrubbed from the payload, but
-                  # the token is captured from the requesting user before
-                  # scrubbing, and for a logout that user *is* the session being
-                  # ended. A master-key logout carries no user, so fall back to
-                  # the generation bump.
-                  #
-                  # Pass the RAW token, not a pre-hashed digest.
-                  # `Parse::Cache::SubCache#invalidate` hashes its `key`
-                  # argument internally for the `:idn` family (see
-                  # `SubCache#logical_key`), the same way `#get` / `#set` do —
-                  # that is what makes a `set(raw_token, ...)` /
-                  # `get(raw_token)` pair round-trip. Hashing here first and
-                  # handing SubCache an already-hashed value made it hash the
-                  # digest a second time, landing on a key nothing had ever
-                  # written to, so logout silently failed to evict the entry.
-                  token = payload.respond_to?(:session_token) ? payload.session_token : nil
-                  if token && !token.to_s.empty?
-                    cache.identity.invalidate(token.to_s)
-                  else
-                    bump_subject(cache, subject_id(payload))
-                  end
-                else
-                  # A `_User` write gives a user id, but identity entries are
-                  # keyed by session token and no reverse map exists. Bumping a
-                  # per-user generation invalidates every one of that user's
-                  # entries in O(1), including tokens this process has never
-                  # resolved, and without Parse Server's master-key `_Session`
-                  # query.
-                  bump_subject(cache, subject_id(payload))
-                end
-              end
+              invalidator.handle_identity_trigger(cache, type, payload)
               true
             end
             [type, class_name]

data/lib/parse/model/associations/belongs_to.rb

@@ -243,6 +243,10 @@ module Parse
               instance_variable_set ivar, val
             end
 
+            # Capture after lazy hydration, before a caller can mutate an
+            # object returned by this association getter.
+            send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
+
             # Track association source for N+1 detection when returning an unfetched pointer
             # Uses a registry instead of setting instance variables on the pointer object
             if val.is_a?(Parse::Pointer) && val.pointer? && Parse.warn_on_n_plus_one

data/lib/parse/model/associations/collection_proxy.rb

@@ -359,6 +359,9 @@ module Parse
 
     # Notifies the delegate that the collection changed.
     def notify_will_change!
+      if @delegate && @delegate.respond_to?(:_capture_transaction_state!, true)
+        @delegate.send(:_capture_transaction_state!)
+      end
       collection_will_change!
       forward "#{@key}_will_change!"
     end

data/lib/parse/model/associations/has_many.rb

@@ -502,6 +502,10 @@ module Parse
               val = instance_variable_get ivar
             end
 
+            # Capture before this getter materializes or returns a mutable
+            # proxy that can be changed in place.
+            send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
+
             # if the result is not a collection proxy, then create a new one.
             unless val.is_a?(Parse::PointerCollectionProxy)
               results = []

data/lib/parse/model/core/actions.rb

@@ -94,6 +94,28 @@ module Parse
   module Core
     # Defines some of the save, update and destroy operations for Parse objects.
     module Actions
+      # Fiber-local context used to capture an object's state before its first
+      # mutation inside a transaction block. `batch.add` is intentionally too
+      # late for this: the public API documents mutating an object and adding it
+      # afterwards.
+      TRANSACTION_CONTEXT_KEY = :__parse_transaction_context__
+
+      # Distinguishes a property whose ivar did not exist from one explicitly
+      # set to nil. Rollback removes the former instead of defining it as nil.
+      UNDEFINED_PROPERTY = Object.new.freeze
+
+      # Non-property state that can change while building/submitting a batch
+      # and must be restored along with the `@<field>` property ivars.
+      ROLLBACK_STATE_IVARS = %i[
+        @changed_attributes
+        @id
+        @mutations_from_database
+        @mutations_before_last_save
+        @_acl_snapshot_before_change
+        @_acl_pristine
+        @_authorization_acl_state
+      ].freeze
+
       # @!visibility private
       def self.included(base)
         base.extend(ClassMethods)
@@ -133,10 +155,16 @@ module Parse
       #   cannot corrupt the saved copy.
       def self.snapshot_property_values(obj)
         fields = obj.class.respond_to?(:fields) ? obj.class.fields.keys : []
-        fields.each_with_object({}) do |key, snapshot|
+        relations = obj.class.respond_to?(:relations) ? obj.class.relations.keys : []
+        property_keys = (fields + relations).uniq
+        seen = {}
+        property_keys.each_with_object({}) do |key, snapshot|
           ivar = :"@#{key}"
-          next unless obj.instance_variable_defined?(ivar)
-          snapshot[ivar] = dup_for_snapshot(obj.instance_variable_get(ivar))
+          snapshot[ivar] = if obj.instance_variable_defined?(ivar)
+              dup_for_snapshot(obj.instance_variable_get(ivar), seen)
+            else
+              UNDEFINED_PROPERTY
+            end
         end
       end
 
@@ -147,25 +175,144 @@ module Parse
       # `:array` and association properties hold a {Parse::CollectionProxy},
       # and duplicating the proxy still shares the underlying `@collection`
       # array, so `widget.tags << "b"` would mutate the snapshot too. The
-      # proxy's inner array is duplicated as well.
+      # proxy's mutable backing arrays and nested values are duplicated as
+      # well. Parse objects nested inside values remain references: a pointer
+      # property should restore the same object, not manufacture a clone.
       #
       # @param value [Object] the live property value.
       # @return [Object] a copy safe to hold across the transaction.
-      def self.dup_for_snapshot(value)
-        copy = begin
-            value.dup
-          rescue TypeError
-            # Symbols, Integers, true/false/nil and other immediates are not
-            # duplicable on older rubies; they are also immutable, so sharing
-            # the reference is safe.
-            return value
+      def self.dup_for_snapshot(value, seen = {})
+        return value if value.nil? || value == true || value == false || value.is_a?(Symbol) || value.is_a?(Numeric)
+        return value if defined?(Parse::Pointer) && value.is_a?(Parse::Pointer)
+
+        object_id = value.object_id
+        return seen[object_id] if seen.key?(object_id)
+
+        case value
+        when Array
+          copy = value.dup
+          copy.clear
+          seen[object_id] = copy
+          value.each { |item| copy << dup_for_snapshot(item, seen) }
+          copy
+        when Hash
+          copy = value.dup
+          copy.clear
+          seen[object_id] = copy
+          value.each do |key, item|
+            copy[dup_for_snapshot(key, seen)] = dup_for_snapshot(item, seen)
+          end
+          copy
+        when Parse::CollectionProxy
+          copy = value.dup
+          seen[object_id] = copy
+          %i[@collection @additions @removals @changed_attributes].each do |ivar|
+            next unless value.instance_variable_defined?(ivar)
+            copy.instance_variable_set(ivar, dup_for_snapshot(value.instance_variable_get(ivar), seen))
+          end
+          %i[@mutations_from_database @mutations_before_last_save].each do |ivar|
+            next unless value.instance_variable_defined?(ivar)
+            tracker = value.instance_variable_get(ivar)
+            copy.instance_variable_set(ivar, dup_mutation_tracker(tracker, copy, seen))
           end
+          copy
+        when Parse::ACL
+          copy = Parse::ACL.new(dup_for_snapshot(value.as_json, seen), owner: value.delegate)
+          seen[object_id] = copy
+          copy
+        else
+          copy = begin
+              value.dup
+            rescue TypeError
+              # Immutable values are safe to share with the snapshot.
+              return value
+            end
+          seen[object_id] = copy
+          copy
+        end
+      end
 
-        if copy.instance_variable_defined?(:@collection)
-          inner = copy.instance_variable_get(:@collection)
-          copy.instance_variable_set(:@collection, inner.dup) if inner.is_a?(Array)
+      # Duplicate ActiveModel's mutation tracker without sharing its mutable
+      # forced/finalized change hashes. Forced trackers retain their owning
+      # Parse object (or copied collection proxy) so dirty reads keep working.
+      #
+      # @param tracker [Object, nil] ActiveModel mutation tracker.
+      # @param owner [Object] object whose attributes the copy should read.
+      # @param seen [Hash] identity map used by {dup_for_snapshot}.
+      # @return [Object, nil] isolated tracker copy.
+      def self.dup_mutation_tracker(tracker, owner, seen = {})
+        return nil if tracker.nil?
+        return tracker if defined?(ActiveModel::NullMutationTracker) && tracker.is_a?(ActiveModel::NullMutationTracker)
+        return seen[tracker.object_id] if seen.key?(tracker.object_id)
+
+        copy = tracker.dup
+        seen[tracker.object_id] = copy
+        if defined?(ActiveModel::ForcedMutationTracker) && tracker.is_a?(ActiveModel::ForcedMutationTracker)
+          copy.instance_variable_set(:@attributes, owner)
+        end
+        %i[@forced_changes @finalized_changes].each do |ivar|
+          next unless tracker.instance_variable_defined?(ivar)
+          copy.instance_variable_set(ivar, dup_for_snapshot(tracker.instance_variable_get(ivar), seen))
         end
         copy
+      rescue TypeError
+        tracker
+      end
+
+      # Capture all local state needed to restore an object after a failed
+      # transaction. This is separate from `#attributes`, which is a schema.
+      #
+      # @param obj [Parse::Object] object being transacted.
+      # @return [Hash] rollback state.
+      def self.snapshot_object_state(obj)
+        seen = {}
+        instance_variables = ROLLBACK_STATE_IVARS.each_with_object({}) do |ivar, snapshot|
+          snapshot[ivar] = if obj.instance_variable_defined?(ivar)
+              value = obj.instance_variable_get(ivar)
+              if %i[@mutations_from_database @mutations_before_last_save].include?(ivar)
+                dup_mutation_tracker(value, obj, seen)
+              else
+                dup_for_snapshot(value, seen)
+              end
+            else
+              UNDEFINED_PROPERTY
+            end
+        end
+
+        {
+          object: obj,
+          property_values: snapshot_property_values(obj),
+          instance_variables: instance_variables,
+        }
+      end
+
+      # Record that an object was initialized inside the active transaction.
+      # Its first rollback snapshot is intentionally taken when it is added to
+      # the batch, after initialization, so a failed create stays usable as an
+      # initialized unsaved object.
+      #
+      # @param obj [Parse::Object] newly initialized object.
+      # @return [void]
+      def self.mark_transaction_object_created(obj)
+        context = Fiber[TRANSACTION_CONTEXT_KEY]
+        return unless context
+        context[:created_objects][obj.object_id] = true
+        context[:snapshots].delete(obj.object_id)
+      end
+
+      # Capture an object's state once, before its first transaction mutation.
+      # Objects created inside the transaction defer capture until `batch.add`.
+      #
+      # @param obj [Parse::Object] object whose state should be captured.
+      # @param context [Hash, nil] transaction context; defaults to the current fiber.
+      # @param include_created [Boolean] capture a newly created object at add time.
+      # @return [Hash, nil] the object's rollback state.
+      def self.capture_transaction_state(obj, context = Fiber[TRANSACTION_CONTEXT_KEY], include_created: false)
+        return unless context && obj
+
+        object_id = obj.object_id
+        return if context[:created_objects].key?(object_id) && !include_created
+        context[:snapshots][object_id] ||= snapshot_object_state(obj)
       end
 
       # Restore the values captured by {snapshot_property_values}.
@@ -180,6 +327,25 @@ module Parse
       def self.restore_property_values(obj, snapshot)
         return unless snapshot.is_a?(Hash)
         snapshot.each do |ivar, value|
+          if value.equal?(UNDEFINED_PROPERTY)
+            obj.remove_instance_variable(ivar) if obj.instance_variable_defined?(ivar)
+          else
+            obj.instance_variable_set(ivar, value)
+          end
+        end
+      end
+
+      # Restore one instance variable while preserving whether it originally
+      # existed. Used for dirty/ACL bookkeeping outside the property schema.
+      #
+      # @param obj [Object] target object.
+      # @param ivar [Symbol] instance variable name.
+      # @param value [Object] snapshotted value or {UNDEFINED_PROPERTY}.
+      # @return [void]
+      def self.restore_instance_variable(obj, ivar, value)
+        if value.equal?(UNDEFINED_PROPERTY)
+          obj.remove_instance_variable(ivar) if obj.instance_variable_defined?(ivar)
+        else
           obj.instance_variable_set(ivar, value)
         end
       end
@@ -193,16 +359,35 @@ module Parse
         obj = state[:object]
         return if obj.nil?
         restore_property_values(obj, state[:property_values])
-        obj.instance_variable_set(:@changed_attributes, state[:changed_attributes])
-        obj.instance_variable_set(:@id, state[:id])
-        # Restore change tracking state. Leaving `@mutations_from_database`
-        # nil is fine: `ActiveModel::Dirty` lazily rebuilds it, and with
-        # `@attributes` no longer defined on the object it correctly rebuilds
-        # a `ForcedMutationTracker`.
-        obj.instance_variable_set(:@mutations_from_database, state[:mutations_from_database])
-        obj.instance_variable_set(:@mutations_before_last_save, state[:mutations_before_last_save])
+        if state[:instance_variables]
+          state[:instance_variables].each do |ivar, value|
+            restore_instance_variable(obj, ivar, value)
+          end
+        else
+          # Compatibility with rollback states produced before the complete
+          # snapshot format was introduced.
+          obj.instance_variable_set(:@changed_attributes, state[:changed_attributes])
+          obj.instance_variable_set(:@id, state[:id])
+          obj.instance_variable_set(:@mutations_from_database, state[:mutations_from_database])
+          obj.instance_variable_set(:@mutations_before_last_save, state[:mutations_before_last_save])
+        end
+      end
+
+      # Hook used by generated property accessors and collection proxies.
+      # @api private
+      def _capture_transaction_state!
+        Parse::Core::Actions.capture_transaction_state(self)
+      end
+
+      # ActiveModel calls this immediately after `<field>_will_change!`; the
+      # hook also covers callers that explicitly mark a mutable value dirty.
+      def _read_attribute(attr_name)
+        _capture_transaction_state!
+        super
       end
 
+      private :_capture_transaction_state!, :_read_attribute
+
       # Class methods applied to Parse::Object subclasses.
       module ClassMethods
 
@@ -238,123 +423,109 @@ module Parse
         def transaction(retries: 5, &block)
           raise ArgumentError, "Block required for transaction" unless block_given?
 
-          batch = Parse::BatchOperation.new(nil, transaction: true)
-
-          # Store original state of objects for rollback
+          previous_context = Fiber[TRANSACTION_CONTEXT_KEY]
+          transaction_context = { snapshots: {}, created_objects: {} }
+          Fiber[TRANSACTION_CONTEXT_KEY] = transaction_context
           original_states = {}
           tracked_objects = []
 
-          # Wrap the batch to capture objects being added
-          batch_wrapper = Object.new
-          batch_wrapper.define_singleton_method(:is_a?) do |klass|
-            klass == Parse::BatchOperation || super(klass)
-          end
-          batch_wrapper.define_singleton_method(:kind_of?) do |klass|
-            klass == Parse::BatchOperation || super(klass)
-          end
-          batch_wrapper.define_singleton_method(:instance_of?) do |klass|
-            klass == Parse::BatchOperation
-          end
-          batch_wrapper.define_singleton_method(:add) do |obj|
-            # Store original state when object is first added to transaction.
-            # Use obj.object_id (Ruby identity) as the key because Parse::Object#hash
-            # and #eql? treat all unsaved objects (nil id) as equal, which would cause
-            # only the first unsaved object to be tracked.
-            if obj.respond_to?(:attributes) && obj.respond_to?(:id) && !original_states.key?(obj.object_id)
-              original_states[obj.object_id] = {
-                object: obj,
-                property_values: Parse::Core::Actions.snapshot_property_values(obj),
-                changed_attributes: obj.instance_variable_get(:@changed_attributes)&.dup || {},
-                id: obj.id,
-                mutations_from_database: obj.instance_variable_get(:@mutations_from_database),
-                mutations_before_last_save: obj.instance_variable_get(:@mutations_before_last_save),
-              }
-              tracked_objects << obj
+          begin
+            batch = Parse::BatchOperation.new(nil, transaction: true)
+
+            # Wrap the batch to associate the pre-mutation snapshot with each
+            # object that actually participates in the transaction.
+            batch_wrapper = Object.new
+            batch_wrapper.define_singleton_method(:is_a?) do |klass|
+              klass == Parse::BatchOperation || super(klass)
+            end
+            batch_wrapper.define_singleton_method(:kind_of?) do |klass|
+              klass == Parse::BatchOperation || super(klass)
+            end
+            batch_wrapper.define_singleton_method(:instance_of?) do |klass|
+              klass == Parse::BatchOperation
+            end
+            batch_wrapper.define_singleton_method(:add) do |obj|
+              # Ruby identity is required because all unsaved Parse objects
+              # compare equal while their ids are nil.
+              if obj.respond_to?(:attributes) && obj.respond_to?(:id) && !original_states.key?(obj.object_id)
+                original_states[obj.object_id] = Parse::Core::Actions.capture_transaction_state(
+                  obj,
+                  transaction_context,
+                  include_created: true,
+                )
+                tracked_objects << obj
+              end
+              batch.add(obj)
             end
-            batch.add(obj)
-          end
 
-          # Forward other methods to the real batch
-          batch_wrapper.define_singleton_method(:method_missing) do |method, *args, &block|
-            batch.send(method, *args, &block)
-          end
+            # Forward other methods to the real batch.
+            batch_wrapper.define_singleton_method(:method_missing) do |method, *args, &method_block|
+              batch.send(method, *args, &method_block)
+            end
+            batch_wrapper.define_singleton_method(:respond_to_missing?) do |method, include_private = false|
+              batch.respond_to?(method, include_private)
+            end
 
-          result = yield(batch_wrapper)
+            result = yield(batch_wrapper)
 
-          # If block returns objects, add them to batch
-          if result.respond_to?(:change_requests)
-            batch_wrapper.add(result)
-          elsif result.is_a?(Array)
-            result.each { |obj| batch_wrapper.add(obj) if obj.respond_to?(:change_requests) }
-          end
+            # If block returns objects, add them to batch.
+            if result.respond_to?(:change_requests)
+              batch_wrapper.add(result)
+            elsif result.is_a?(Array)
+              result.each { |obj| batch_wrapper.add(obj) if obj.respond_to?(:change_requests) }
+            end
 
-          # Submit with retry logic for transaction conflicts
-          attempts = 0
-          begin
-            attempts += 1
-            responses = batch.submit
-
-            # Check for success
-            if responses.all?(&:success?)
-              # Update tracked objects with data from successful responses
-              # Match responses to objects using the request tag (Ruby object_id)
-              # Build hash lookup once for O(n) instead of O(n²) linear search
-              objects_by_id = tracked_objects.each_with_object({}) { |o, h| h[o.object_id] = o }
-              requests = batch.requests
-              requests.zip(responses).each do |request, response|
-                next unless request && response && response.success?
-                result = response.result
-                next unless result.is_a?(Hash)
-
-                # Find the object matching this request's tag
-                obj = objects_by_id[request.tag]
-                next unless obj
-
-                # Update object with response data (objectId, createdAt, updatedAt)
-                if result["objectId"]
-                  obj.instance_variable_set(:@id, result["objectId"])
-                end
-                if result["createdAt"]
-                  obj.instance_variable_set(:@created_at, Parse::Date.parse(result["createdAt"]))
-                end
-                if result["updatedAt"]
-                  obj.instance_variable_set(:@updated_at, Parse::Date.parse(result["updatedAt"]))
-                elsif result["createdAt"]
-                  obj.instance_variable_set(:@updated_at, Parse::Date.parse(result["createdAt"]))
+            # Submit with retry logic for transaction conflicts.
+            attempts = 0
+            begin
+              attempts += 1
+              responses = batch.submit
+
+              if responses.all?(&:success?)
+                # Match responses to objects using the request tag (Ruby object_id).
+                objects_by_id = tracked_objects.each_with_object({}) { |o, h| h[o.object_id] = o }
+                batch.requests.zip(responses).each do |request, response|
+                  next unless request && response && response.success?
+                  result = response.result
+                  next unless result.is_a?(Hash)
+
+                  obj = objects_by_id[request.tag]
+                  next unless obj
+
+                  obj.instance_variable_set(:@id, result["objectId"]) if result["objectId"]
+                  if result["createdAt"]
+                    obj.instance_variable_set(:@created_at, Parse::Date.parse(result["createdAt"]))
+                  end
+                  if result["updatedAt"]
+                    obj.instance_variable_set(:@updated_at, Parse::Date.parse(result["updatedAt"]))
+                  elsif result["createdAt"]
+                    obj.instance_variable_set(:@updated_at, Parse::Date.parse(result["createdAt"]))
+                  end
+
+                  # Apply any additional attributes returned by beforeSave hooks.
+                  obj.set_attributes!(result) if obj.respond_to?(:set_attributes!)
+                  obj.send(:clear_changes!) if obj.respond_to?(:clear_changes!, true)
                 end
 
-                # Apply any additional attributes returned by beforeSave hooks
-                obj.set_attributes!(result) if obj.respond_to?(:set_attributes!)
-
-                # Clear change tracking since save was successful
-                obj.send(:clear_changes!) if obj.respond_to?(:clear_changes!, true)
-              end
-
-              return responses
-            else
-              # Find first error
-              error_response = responses.find { |r| !r.success? }
-
-              # Rollback local object states
-              original_states.each_value do |state|
-                Parse::Core::Actions.rollback_object_state(state)
+                return responses
               end
 
+              error_response = responses.find { |response| !response.success? }
               raise Parse::Error, "Transaction failed: #{error_response.error}"
+            rescue Parse::Error => e
+              if e.message.include?("251") && attempts < retries
+                sleep(0.1 * attempts)
+                retry
+              end
+              raise
             end
-          rescue Parse::Error => e
-            # Retry on transaction conflict (error code 251)
-            if e.message.include?("251") && attempts < retries
-              sleep(0.1 * attempts) # Exponential backoff
-              retry
-            end
-
-            # Rollback local object states on final failure
+          rescue StandardError
             original_states.each_value do |state|
               Parse::Core::Actions.rollback_object_state(state)
             end
-
-            raise e
+            raise
+          ensure
+            Fiber[TRANSACTION_CONTEXT_KEY] = previous_context
           end
         end
 

data/lib/parse/model/core/fetching.rb

@@ -512,6 +512,10 @@ module Parse
           @_fetched_keys ||= []
           @_fetched_keys << key unless @_fetched_keys.include?(key)
         end
+
+        # A transaction must capture the value before the setter marks or
+        # replaces it. `batch.add` happens after mutation in the public API.
+        send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
       end
     end
   end

data/lib/parse/model/core/properties.rb

@@ -573,6 +573,10 @@ module Parse
             value = instance_variable_get ivar
           end
 
+          # Capture after any implicit fetch, but before a default value or
+          # mutable collection is materialized by this getter.
+          send(:_capture_transaction_state!) if respond_to?(:_capture_transaction_state!, true)
+
           # if value is nil (even after fetching), then lets see if the developer
           # set a default value for this attribute.
           if value.nil? && respond_to?("#{key}_default")

data/lib/parse/model/object.rb

@@ -1337,6 +1337,8 @@ module Parse
     #     for trusted hydration from server JSON; it bypasses the filter.
     # @return [Parse::Object] a the corresponding Parse::Object or subclass.
     def initialize(opts = {})
+      Parse::Core::Actions.mark_transaction_object_created(self)
+
       # Trusted hydration is signalled by the `@_trusted_init` instance
       # variable rather than by a `trusted:` keyword argument. Using a
       # keyword would break subclasses that override `initialize(*args)`
@@ -2042,6 +2044,8 @@ module Parse
     # caller intent to override.
     # @api private
     def acl_will_change!
+      _capture_transaction_state!
+
       # Only capture snapshot on the first change (before any modifications)
       unless defined?(@_acl_snapshot_before_change) && @_acl_snapshot_before_change
         # Deep copy the ACL by creating a new one from its JSON representation

data/lib/parse/stack/version.rb

@@ -6,6 +6,6 @@ module Parse
   # The Parse Server SDK for Ruby
   module Stack
     # The current version.
-    VERSION = "5.7.0"
+    VERSION = "5.7.1"
   end
 end

data/lib/parse/webhooks.rb

@@ -132,6 +132,46 @@ module Parse
 
     class << self
 
+      # Whether an exception raised by one `after_*` handler prevents the
+      # remaining handlers for that same trigger from running.
+      #
+      # Only the accumulating, non-rejectable `after_*` triggers can have more
+      # than one handler (see {Parse::Webhooks::Registration#route}), so this
+      # governs `after_save`, `after_delete`, and `after_logout` and nothing
+      # else. `before_*` dispatch is untouched: a raise there is how a handler
+      # denies an operation, and it must continue to abort.
+      #
+      # Defaults to `true`, which is the historical behavior. Handlers are
+      # folded with `Array#map`, and `map` abandons the collection on the first
+      # raise, so a handler that raises silently prevents every handler
+      # registered after it from running. That ordering is not something an
+      # application fully controls: the SDK's own cache-invalidation triggers
+      # install during `Parse.setup` and therefore sit ahead of handlers
+      # registered by application files loaded later.
+      #
+      # Set to `false` to isolate handlers from each other, so that each one
+      # runs regardless of what an earlier one raised. The error is reported
+      # (a warning plus a `parse.webhooks.handler_error` notification) and
+      # dispatch continues.
+      #
+      # Either way, nothing is reverted. An `after_*` trigger fires once the
+      # write has already committed, so there is no version of this setting
+      # that can undo the save; the only question it answers is whether the
+      # remaining handlers still get to run.
+      #
+      # @example Keep one failing handler from starving the others
+      #   Parse::Webhooks.abort_after_callbacks_on_error = false
+      #
+      # @return [Boolean]
+      attr_writer :abort_after_callbacks_on_error
+
+      # (see #abort_after_callbacks_on_error=)
+      # @return [Boolean]
+      def abort_after_callbacks_on_error
+        return @abort_after_callbacks_on_error unless @abort_after_callbacks_on_error.nil?
+        true
+      end
+
       # Allows support for web frameworks that support auto-reloading of source.
       # @!visibility private
       def reload!(args = {})
@@ -245,6 +285,60 @@ module Parse
       # block that declares a parameter (`do |payload| ... end`) or a splat
       # receives the payload.
       #
+      # Run every handler registered for one accumulating `after_*` trigger.
+      #
+      # `.last` is preserved as the composed result because Parse Server
+      # ignores the response body for these triggers and {#call_route}
+      # normalizes it anyway, so which handler's value survives is not
+      # observable.
+      #
+      # When {abort_after_callbacks_on_error} is false, a handler that raises
+      # is reported and skipped rather than taking the rest of the trigger down
+      # with it. Nothing is reverted in either mode: the write these triggers
+      # fire on has already committed.
+      #
+      # @param payload [Parse::Webhooks::Payload] the request payload.
+      # @param registry [Array<Proc>] the handlers, in registration order.
+      # @param type [Symbol] the trigger being dispatched.
+      # @return [Object] the last handler result.
+      def dispatch_composed(payload, registry, type)
+        return registry.map { |hook| invoke_handler(payload, hook) }.last if
+          abort_after_callbacks_on_error
+
+        last = nil
+        registry.each do |hook|
+          begin
+            last = invoke_handler(payload, hook)
+          rescue StandardError => e
+            report_handler_error(type, e)
+          end
+        end
+        last
+      end
+
+      # Report a handler failure that was isolated rather than propagated.
+      #
+      # The message is included because an application's own handler raised it
+      # and the application needs it to debug; this is not the SDK's internal
+      # `guard`, which deliberately omits messages that can carry a cache key.
+      #
+      # @param type [Symbol] the trigger being dispatched.
+      # @param error [StandardError] the raised error.
+      # @return [void]
+      def report_handler_error(type, error)
+        warn "[Parse::Webhooks] #{type} handler raised #{error.class}: #{error.message}; " \
+             "continuing with the remaining handlers " \
+             "(Parse::Webhooks.abort_after_callbacks_on_error is false)"
+        return unless defined?(ActiveSupport::Notifications)
+        begin
+          ActiveSupport::Notifications.instrument(
+            "parse.webhooks.handler_error", trigger: type, error: error.class.name,
+          )
+        rescue StandardError
+          nil
+        end
+      end
+
       # @param payload [Parse::Webhooks::Payload] the request payload (becomes `self`).
       # @param block [Proc] the registered handler block.
       # @return [Object] the handler's result value.
@@ -378,7 +472,10 @@ module Parse
         end
 
         if registry.is_a?(Array)
-          result = registry.map { |hook| invoke_handler(payload, hook) }.last
+          # An Array registry only ever exists for the accumulating,
+          # non-rejectable `after_*` triggers, so isolating handlers here
+          # cannot affect `before_*` rejection semantics.
+          result = dispatch_composed(payload, registry, type)
         else
           result = invoke_handler(payload, registry)
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.7.0
+  version: 5.7.1
 platform: ruby
 authors:
 - Adrian Curtin