parse-stack-next 5.7.1 → 5.7.3

data/lib/parse/client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "faraday"
+require_relative "terminal_safe"
 
 # Attempt to load the persistent connection adapter for better performance.
 # Falls back gracefully to the default adapter if not available.
@@ -505,23 +506,52 @@ module Parse
       end
 
       # @!visibility private
-      # Emit a redacted warning about a Parse::Response error to stderr.
+      # Emit a redacted warning about a Parse::Response error.
       #
       # Routes the response error string through
       # {Parse::Middleware::BodyBuilder.redact} to strip credentials (passwords,
       # tokens, sessionTokens, access_tokens, authData) before logging, and
       # truncates to {SAFE_WARN_MAX_ERROR_LENGTH} chars.
       #
+      # Writes through {Parse::Middleware::Logging.logger} when the app has
+      # configured one (`Parse.logger = ...`), so these warnings land wherever
+      # the rest of the app's Parse request/response logging goes instead of
+      # bypassing it. Falls back to plain `warn` (STDERR) when no logger is
+      # configured, matching prior behavior. Every call site immediately
+      # raises the corresponding typed {Parse::Error} right after calling
+      # this method, so a misbehaving app-supplied logger (closed handle,
+      # full disk, a remote-aggregator client that raises on socket error)
+      # must not be allowed to propagate in its place and mask the real
+      # error — falls back to `warn` if the logger itself raises.
+      #
       # @param tag [String] the bracketed prefix (e.g. "AuthenticationError").
       # @param response [Parse::Response] the response carrying the error.
       # @param name [String, nil] optional cloud-function or job name for context.
       # @return [nil]
       def _safe_warn(tag, response, name: nil)
+        # The server's error text and the request description both carry stored
+        # values through verbatim, and this lands in a log file or on a
+        # terminal. Escape control characters and newlines so a stored value
+        # can neither drive the terminal nor forge a second log record.
         err = Parse::Middleware::BodyBuilder.redact(response.error.to_s)[0, SAFE_WARN_MAX_ERROR_LENGTH]
-        if name
-          warn "[Parse:#{tag}] `#{name}` [#{response.code}] #{err} (HTTP #{response.http_status})"
+        err = Parse::TerminalSafe.sanitize_line(err)
+        msg = if name
+            "[Parse:#{tag}] `#{Parse::TerminalSafe.sanitize_line(name)}` " \
+            "[#{response.code}] #{err} (HTTP #{response.http_status})"
+          else
+            "[Parse:#{tag}] [E-#{response.code}] " \
+            "#{Parse::TerminalSafe.sanitize_line(response.request)} : #{err} " \
+            "(#{response.http_status})"
+          end
+        logger = Parse::Middleware::Logging.logger
+        if logger
+          begin
+            logger.warn(msg)
+          rescue StandardError
+            warn msg
+          end
         else
-          warn "[Parse:#{tag}] [E-#{response.code}] #{response.request} : #{err} (#{response.http_status})"
+          warn msg
         end
         nil
       end

data/lib/parse/console.rb

@@ -23,6 +23,7 @@
 # tests / fixtures.
 
 require "timeout"
+require_relative "terminal_safe"
 
 module Parse
   module Console
@@ -65,7 +66,10 @@ module Parse
       events = Array(on || DEFAULT_WATCH_EVENTS).map(&:to_sym)
       printer = block_given? ? block : ->(ev, obj) {
         title = obj.respond_to?(:id) ? obj.id : obj.inspect
-        puts "[#{Time.now.iso8601}] #{klass.parse_class}.#{ev} #{title}"
+        # The row is tenant data arriving over a live-query socket and this
+        # line goes straight to the operator's terminal, so escape it.
+        puts "[#{Time.now.iso8601}] #{klass.parse_class}.#{ev} " \
+             "#{Parse::TerminalSafe.sanitize_line(title)}"
       }
 
       delivered = 0
@@ -78,11 +82,13 @@ module Parse
           begin
             printer.call(ev, obj)
           rescue StandardError => e
-            warn "[Parse.watch] handler raised #{e.class}: #{e.message}"
+            # The message can quote the row that triggered it.
+            warn "[Parse.watch] handler raised #{e.class}: " \
+                 "#{Parse::TerminalSafe.sanitize_line(e.message)}"
           end
         end
       end
-      sub.on(:error) { |err| warn "[Parse.watch] error: #{err}" }
+      sub.on(:error) { |err| warn "[Parse.watch] error: #{Parse::TerminalSafe.sanitize_line(err)}" }
 
       _block_until_interrupt
       delivered

data/lib/parse/embeddings/image_fetch.rb

@@ -164,7 +164,15 @@ module Parse
 
         mime = verify!(bytes, url: canonical)
         bytes = strip_metadata(bytes, mime) if exif_strip
-        FetchedImage.new(bytes: bytes, mime_type: mime, url: canonical)
+        # Store the query-stripped URL, not `canonical` verbatim: when
+        # `url` is a presigned URL (a private-bucket file adapter),
+        # `canonical` carries a live signature, and FetchedImage#url is
+        # purely informational from here on (nothing re-fetches it).
+        # Keeping the signature out of the struct preserves the
+        # log-safety `#inspect` below was written for — third-party
+        # provider adapters and error reporters that capture locals
+        # would otherwise leak a valid bearer credential through it.
+        FetchedImage.new(bytes: bytes, mime_type: mime, url: Parse::File.strip_query(canonical))
       end
 
       # Verify raw bytes: sniff the magic, check the allowlist, and

data/lib/parse/embeddings.rb

@@ -382,6 +382,17 @@ module Parse
       # `"true"`, or a non-matching String) raises
       # {ConfirmationRequired}. Reset to `nil` to disable.
       #
+      # For a `:file` source backed by a private-bucket adapter
+      # (S3/GCS with server-side presigning), the URL forwarded under
+      # this sentinel may be the file's presigned URL rather than its
+      # bare canonical one — a time-limited bearer credential for that
+      # object, not just a pointer to it (see {Parse::File#presigned_url}
+      # and `Parse::Core::EmbedManaged.embed_image`). Reviewing the
+      # provider's egress behavior before setting this sentinel should
+      # account for that: the provider (and anyone with access to its
+      # request logs) gains temporary read access to the object for
+      # however long the signature remains valid.
+      #
       # @param value [String, nil] {TRUST_PROVIDER_URL_FETCH_SENTINEL} or nil.
       # @raise [ConfirmationRequired] on any other value.
       def trust_provider_url_fetch=(value)
@@ -395,10 +406,12 @@ module Parse
                 "String #{TRUST_PROVIDER_URL_FETCH_SENTINEL.inspect}. Plain `true` and " \
                 "other values are refused — forwarding image URLs to a third-party " \
                 "provider lets that provider issue an HTTP request from its own network " \
-                "with attacker-controllable host/path. Set the sentinel only after you " \
-                "have configured Parse::Embeddings.allowed_image_hosts AND reviewed the " \
-                "provider's documented egress behavior (DNS rebinding window, redirect " \
-                "policy)."
+                "with attacker-controllable host/path, and for a private-bucket file may " \
+                "hand it a time-limited presigned URL rather than a bare pointer. Set the " \
+                "sentinel only after you have configured " \
+                "Parse::Embeddings.allowed_image_hosts AND reviewed the provider's " \
+                "documented egress behavior (DNS rebinding window, redirect policy, " \
+                "request-log retention)."
         end
         CONFIG_MUTEX.synchronize { @trust_provider_url_fetch = value }
       end

data/lib/parse/model/core/embed_managed.rb

@@ -687,7 +687,7 @@ module Parse
         return if stored_digest == digest && target_present
 
         provider = Parse::Embeddings.provider(directive.provider_name)
-        vectors = call_provider(provider, directive, input)
+        vectors = call_provider(provider, directive, input, record)
         unless vectors.is_a?(Array) && vectors.length == 1 && vectors.first.is_a?(Array)
           raise Parse::Embeddings::InvalidResponseError,
                 "Parse::Core::EmbedManaged (#{record.class}##{directive.into}): provider " \
@@ -774,16 +774,27 @@ module Parse
       # provider a {Parse::Embeddings::ImageFetch::FetchedImage}; `:url`
       # mode forwards the raw URL String (the provider validates and
       # fetches it itself).
-      def self.call_provider(provider, directive, input)
+      #
+      # `input` is the bare canonical URL used for the digest (see
+      # {.build_source_input}). It stays stable across saves, so an
+      # unsigned re-read of the same file location does not force a
+      # re-embed.
+      # The actual fetch/forward target prefers the file's presigned
+      # URL ({Parse::File#presigned_url}) when one is currently valid,
+      # since a private-bucket adapter's bare `file.url` is stripped of
+      # its signature and will not resolve for the provider or for the
+      # SDK's own `:bytes`-mode download.
+      def self.call_provider(provider, directive, input, record)
         if directive.image?
+          fetch_url = presigned_fetch_url(record, directive, input)
           source = if directive.bytes_mode?
               Parse::Embeddings::ImageFetch.fetch!(
-                input,
+                fetch_url,
                 allow_insecure: directive.allow_insecure ? true : false,
                 exif_strip: directive.exif_strip != false,
               )
             else
-              input
+              fetch_url
             end
           provider.embed_image([source],
                                input_type: directive.input_type,
@@ -793,6 +804,32 @@ module Parse
         end
       end
 
+      # @!visibility private
+      # Resolve the URL to actually fetch/forward for an image
+      # directive: the source file's currently-valid presigned URL if
+      # it has one, otherwise the bare canonical `fallback` (the same
+      # string used for the digest). Never used for text directives, so
+      # `directive.sources.first` is always a `:file` property here.
+      #
+      # Checks validity with a zero safety buffer rather than
+      # {Parse::File#presigned_url_valid?}'s default 60-second one. That
+      # default exists so a browser has time to render before a
+      # presigned URL goes stale; here it would instead spend the last
+      # 60 seconds of a perfectly usable presigned URL falling back to
+      # `fallback`, which on a private-bucket adapter is not fetchable
+      # at all. A fetch that starts immediately after this check has no
+      # meaningful use for that margin, and a 403 from a URL that
+      # expired mid-request is strictly better than a guaranteed 403
+      # from a URL known unfetchable in advance.
+      def self.presigned_fetch_url(record, directive, fallback)
+        file = record.public_send(directive.sources.first)
+        if file.respond_to?(:presigned_url_valid?) && file.presigned_url_valid?(buffer: 0)
+          file.presigned_url
+        else
+          fallback
+        end
+      end
+
       # @!visibility private
       # Concatenate source-field string values. `nil` and blank entries
       # are skipped; remaining values are joined with a double newline.

data/lib/parse/model/core/querying.rb

@@ -253,7 +253,6 @@ module Parse
           # same created_at date (down to the microsecond). This prevents getting the same
           # record in the next query request.
           exclusion_set = results.select { |r| r.created_at == next_cursor.created_at }.map(&:id)
-          results = nil
           cursor = next_cursor
         end
       end
@@ -356,7 +355,6 @@ module Parse
       #   Object.latest(:user.eq => user, limit: 5) # => 5 most recent for user
       #  @return [Parse::Object] the most recently created object matching constraints.
       def latest(constraints = {})
-        fetch_count = 1
         if constraints.is_a?(Numeric)
           fetch_count = constraints.to_i
           constraints = {}
@@ -385,7 +383,6 @@ module Parse
       #   Object.last_updated(:user.eq => user, limit: 3) # => 3 most recently updated for user
       #  @return [Parse::Object] the most recently updated object matching constraints.
       def last_updated(constraints = {})
-        fetch_count = 1
         if constraints.is_a?(Numeric)
           fetch_count = constraints.to_i
           constraints = {}
@@ -600,7 +597,6 @@ module Parse
         parse_ids.compact!
         # determines if the result back to the call site is an array or a single result
         as_array = parse_ids.count > 1
-        results = []
 
         # Default to write-only cache mode - find always gets fresh data
         # but updates cache for future cached reads. Controlled by feature flag.

data/lib/parse/model/object.rb

@@ -1867,7 +1867,6 @@ module Parse
       # we should do a reverse lookup on who is registered for a different class type
       # than their name with parse_class
       klass = Parse::Model.find_class className
-      o = nil
       if klass.present?
         # when creating objects from Parse JSON data, don't use dirty tracking since
         # we are considering these objects as "pristine"

data/lib/parse/query/constraints.rb

@@ -1561,7 +1561,6 @@ module Parse
 
         # if it's a hash, then it should be {:key=>"objectId", :query=>[]}
         remote_field_name = @operation.operand
-        query = nil
         if @value.is_a?(Hash)
           res = @value.symbolize_keys
           remote_field_name = res[:key] || remote_field_name
@@ -1613,7 +1612,6 @@ module Parse
 
         # if it's a hash, then it should be {:key=>"objectId", :query=>[]}
         remote_field_name = @operation.operand
-        query = nil
         if @value.is_a?(Hash)
           res = @value.symbolize_keys
           remote_field_name = res[:key] || remote_field_name
@@ -2263,7 +2261,6 @@ module Parse
       # @return [Hash] the compiled constraint.
       def build
         remote_field_name = @operation.operand
-        query = nil
 
         if @value.is_a?(Hash)
           res = @value.symbolize_keys
@@ -2314,7 +2311,6 @@ module Parse
       # @return [Hash] the compiled constraint.
       def build
         remote_field_name = @operation.operand
-        query = nil
 
         if @value.is_a?(Hash)
           res = @value.symbolize_keys
@@ -2516,6 +2512,19 @@ module Parse
     #  User.where(:name.between => ["Alice", "John"])
     #  # Generates: "name": { "$gte": "Alice", "$lte": "John" }
     #
+    #  # A Ruby Range works the same way as a 2-element array. An inclusive
+    #  # range (`..`) maps its end to $lte, while an exclusive range (`...`)
+    #  # maps its end to $lt.
+    #  User.where(:age.between => 18..65)
+    #  # Generates: "age": { "$gte": 18, "$lte": 65 }
+    #
+    #  Record.where(:date.between => 5.days.ago...2.days.ago)
+    #  # Generates: "date": { "$gte": <5 days ago>, "$lt": <2 days ago> }
+    #
+    #  # Beginless/endless ranges only constrain the side that is present.
+    #  User.where(:age.between => 18..)
+    #  # Generates: "age": { "$gte": 18 }
+    #
     class BetweenConstraint < Constraint
       # @!method between
       # A registered method on a symbol to create the constraint.
@@ -2526,9 +2535,11 @@ module Parse
 
       # @return [Hash] the compiled constraint.
       def build
+        return build_range(@value) if @value.is_a?(Range)
+
         value = formatted_value
         unless value.is_a?(Array) && value.length == 2
-          raise ArgumentError, "#{self.class}: Value must be an array with exactly 2 elements [min_value, max_value]"
+          raise ArgumentError, "#{self.class}: Value must be an array with exactly 2 elements [min_value, max_value], or a Range"
         end
 
         min_value, max_value = value
@@ -2542,6 +2553,51 @@ module Parse
           Parse::Constraint::LessThanOrEqualConstraint.key => formatted_max,
         } }
       end
+
+      # @!visibility private
+      # Extract raw (unformatted) `[min_value, max_value, exclude_max]`
+      # bounds from a `between`-style value: a Range (`exclude_max`
+      # reflects `exclude_end?`) or a 2-element Array (always inclusive
+      # on both ends, matching {#build}'s array branch). Shared with
+      # {Parse::Query#where_not_between}, which needs the same bounds
+      # to build the negated (`$or` of the two flipped comparisons)
+      # form — a shape {BetweenConstraint} itself cannot safely emit
+      # from a single constraint's `#build` (see `where_not_between`'s
+      # docs for why).
+      # @param value [Range, Array] a `between`-style value.
+      # @return [Array(Object, Object, Boolean)]
+      # @raise [ArgumentError] if `value` isn't a Range or 2-element Array.
+      def self.extract_bounds(value)
+        if value.is_a?(Range)
+          [value.begin, value.end, value.exclude_end?]
+        elsif value.is_a?(Array) && value.length == 2
+          [value[0], value[1], false]
+        else
+          raise ArgumentError, "#{name}: Value must be an array with exactly 2 elements [min_value, max_value], or a Range"
+        end
+      end
+
+      private
+
+      # @return [Hash] the compiled constraint for a Ruby Range value.
+      def build_range(range)
+        bounds = {}
+
+        unless range.begin.nil?
+          bounds[Parse::Constraint::GreaterThanOrEqualConstraint.key] = Parse::Constraint.formatted_value(range.begin)
+        end
+
+        unless range.end.nil?
+          upper_key = range.exclude_end? ? Parse::Constraint::LessThanConstraint.key : Parse::Constraint::LessThanOrEqualConstraint.key
+          bounds[upper_key] = Parse::Constraint.formatted_value(range.end)
+        end
+
+        if bounds.empty?
+          raise ArgumentError, "#{self.class}: Range must have a begin, an end, or both (ex. 5.., ..25, 5..25)"
+        end
+
+        { @operation.operand => bounds }
+      end
     end
 
     # @!visibility private

data/lib/parse/query.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require_relative "client"
+require_relative "terminal_safe"
 require_relative "pipeline_security"
 require_relative "query/operation"
 require_relative "query/constraints"
@@ -1113,6 +1114,77 @@ module Parse
       copy_query
     end
 
+    # Add a "field is NOT between" condition — the logical negation of
+    # `.where(field.between => value)`: `field < min OR field > max` for a
+    # fully-bounded Range/Array, or a single one-sided comparison when the
+    # Range is beginless/endless (mirroring how {Parse::Constraint::BetweenConstraint}
+    # itself only constrains the side that is present).
+    #
+    # Not available as a `field.not_between => value` symbol constraint,
+    # unlike `.between`: a between-style range is inherently an OR of two
+    # comparisons, and a single {Parse::Constraint}'s `#build` can only
+    # safely contribute an AND'd clause to a query. A constraint that
+    # unilaterally emitted a top-level `$or` would collide with (and
+    # silently clobber, or be clobbered by) any other `$or` this query
+    # already produces via {#or_where} / `|` / another `where_not_between`
+    # call, since only one `$or` group merges correctly per query. This
+    # method instead composes the negation the same way {Parse::Query.and}
+    # does — concatenating compiled constraint arrays — which correctly
+    # nests the OR inside the query's existing AND'd conditions instead of
+    # replacing them the way {#or_where} would.
+    #
+    # @example
+    #   Person.query.where_not_between(:age, 5..25)
+    #   # age < 5 OR age > 25
+    #
+    #   Record.query.where(:archived => false).where_not_between(:date, 5.days.ago...2.days.ago)
+    #   # archived == false AND (date < 5.days.ago OR date >= 2.days.ago)
+    #
+    # @param field [Symbol, String] the field to constrain.
+    # @param value [Range, Array] a `between`-style value: a Range (including
+    #   beginless/endless/exclusive-end forms) or a 2-element `[min, max]` Array.
+    # @return [self]
+    # @raise [ArgumentError] if `value` isn't a Range or 2-element Array, or
+    #   is a fully-open (`nil..nil`) Range.
+    def where_not_between(field, value)
+      field = field.to_sym
+      min_value, max_value, exclude_max = Parse::Constraint::BetweenConstraint.extract_bounds(value)
+
+      if min_value.nil? && max_value.nil?
+        raise ArgumentError, "Query#where_not_between: Range must have a begin, an end, or both (ex. 5.., ..25, 5..25)."
+      end
+
+      # A fully-bounded range needs its own `$or` group (`field < min OR
+      # field > max`). Only ONE `$or` group survives the plain-Hash merge
+      # every constraint's compiled output goes through (`constraint_reduce`
+      # deep-merges compiled hashes; a second top-level `$or` key silently
+      # overwrites the first rather than combining with it — the same
+      # constraint that makes `field.not_between => value` unsafe as a
+      # symbol constraint, see above). Fail loudly here instead of quietly
+      # dropping half the query if this query already has one, from
+      # `#or_where`, `|`, or an earlier `where_not_between` call.
+      if min_value && max_value && @where.any? { |c| c.is_a?(Parse::Constraint::CompoundQueryConstraint) }
+        raise ArgumentError,
+              "Query#where_not_between: this query already has an `$or` group (from `or_where`, `|`, " \
+              "or a prior `where_not_between` call). Only one `$or` group can be safely merged per " \
+              "query. Compose the two queries with Parse::Query.and(...) instead."
+      end
+
+      negated = if min_value.nil?
+          Parse::Query.new(@table).where(field.public_send(exclude_max ? :gte : :gt) => max_value)
+        elsif max_value.nil?
+          Parse::Query.new(@table).where(field.lt => min_value)
+        else
+          lower = Parse::Query.new(@table).where(field.lt => min_value)
+          upper = Parse::Query.new(@table).where(field.public_send(exclude_max ? :gte : :gt) => max_value)
+          Parse::Query.or(lower, upper)
+        end
+
+      @where = @where + negated.where
+      @results = nil
+      self
+    end
+
     # Queries can be made using distinct, allowing you find unique values for a specified field.
     # For this to be performant, please remember to index your database.
     # @example
@@ -1409,7 +1481,6 @@ module Parse
         return first_direct(limit_or_constraints)
       end
 
-      fetch_count = 1
       if limit_or_constraints.is_a?(Hash)
         conditions(limit_or_constraints)
         # Check if limit was set in constraints, otherwise use 1
@@ -1490,15 +1561,19 @@ module Parse
     # @return [Parse::Object] the object with the given ID.
     # @raise [Parse::Error] if the object is not found.
     def get(object_id)
-      parse_class = Object.const_get(@table) if Object.const_defined?(@table)
-      parse_class ||= Parse::Object
-
       response = client.fetch_object(@table, object_id)
       if response.error?
         raise Parse::Error.new(response.code, response.error)
       end
 
-      Parse::Object.build(response.result, parse_class)
+      # Pass the table name through as-is rather than pre-resolving it to
+      # a Class: `Object.build` does its own `Parse::Model.find_class`
+      # lookup against the String, which correctly honors `parse_class`
+      # aliasing. Resolving to a Class first and handing that back to
+      # `build` broke aliased lookups, since `find_class` would then
+      # stringify the Ruby constant name (e.g. "Musician") instead of
+      # matching the declared alias (e.g. "Artist").
+      Parse::Object.build(response.result, @table)
     end
 
     # max_results is used to iterate through as many API requests as possible using
@@ -1708,7 +1783,7 @@ module Parse
     def fetch!(compiled_query)
       response = client.find_objects(@table, compiled_query.as_json, headers: _headers, **_opts)
       if response.error?
-        puts "[ParseQuery] #{response.error}"
+        puts "[ParseQuery] #{Parse::TerminalSafe.sanitize_line(response.error)}"
       end
       response
     end
@@ -3522,12 +3597,12 @@ module Parse
         # non-master explain that worked on 8.x now returns a permission
         # error. Surface that as actionable guidance instead of a bare 403.
         if response.respond_to?(:permission_denied?) && response.permission_denied?
-          puts "[ParseQuery:Explain] #{response.error} — Parse Server 9.0+ defaults " \
+          puts "[ParseQuery:Explain] #{Parse::TerminalSafe.sanitize_line(response.error)} — Parse Server 9.0+ defaults " \
                "`allowPublicExplain` to false; query explain now requires the master key " \
                "(use_master_key: true) or `allowPublicExplain: true` in the server's " \
                "databaseOptions."
         else
-          puts "[ParseQuery:Explain] #{response.error}"
+          puts "[ParseQuery:Explain] #{Parse::TerminalSafe.sanitize_line(response.error)}"
         end
         return {}
       end

data/lib/parse/stack/version.rb

@@ -6,6 +6,6 @@ module Parse
   # The Parse Server SDK for Ruby
   module Stack
     # The current version.
-    VERSION = "5.7.1"
+    VERSION = "5.7.3"
   end
 end

data/lib/parse/stack.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require_relative "stack/version"
+require_relative "terminal_safe"
 require_relative "client"
 require_relative "query"
 require_relative "model/object"