parse-stack-next 5.7.5 → 5.8.0

data/lib/parse/atlas_search.rb

@@ -8,6 +8,7 @@ require_relative "atlas_search/index_manager"
 require_relative "atlas_search/search_builder"
 require_relative "atlas_search/result"
 require_relative "atlas_search/session"
+require_relative "atlas_search/protected_paths"
 
 module Parse
   # Atlas Search module for MongoDB Atlas full-text search capabilities.
@@ -363,6 +364,7 @@ module Parse
 
         index_name = options[:index] || @default_index
         fields = normalize_fields(options[:fields])
+        assert_search_fields_allowed!(fields, protected_fields, resolution)
         limit = options[:limit] || 100
         skip_val = options[:skip] || 0
 
@@ -436,6 +438,15 @@ module Parse
           collection_name, resolution.permission_strings,
         )
         assert_highlight_field_allowed!(options[:highlight_field], protected_fields, resolution)
+        # The caller built this stage, so any operator path, sort key, or
+        # highlight inside it may name a protected field. Walk it and
+        # refuse before it runs: a protected field that decides matches
+        # or ranking leaks its value even though the output strips it.
+        ProtectedPaths.assert_search_stage_allowed!(
+          search_stage, protected_fields, resolution,
+          collection_name: collection_name,
+          method_name: "Parse::AtlasSearch.search_with_stage",
+        )
 
         search_pipeline!(
           collection_name, search_stage,
@@ -512,7 +523,8 @@ module Parse
           collection_name, resolution.permission_strings,
         )
         field_str = field.to_s
-        if !resolution.master? && protected_fields.include?(field_str)
+        if ProtectedPaths.enforce?(resolution, protected_fields) &&
+           ProtectedPaths.touches?(field_str, protected_fields)
           raise Parse::CLPScope::Denied.new(
             collection_name, :find,
             "Parse::AtlasSearch.autocomplete refused: field '#{field_str}' is in " \
@@ -689,6 +701,21 @@ module Parse
           end
         end
 
+        # A non-master caller (the public fallback when no auth kwargs are
+        # passed) must not facet on, or text-match against, a protected
+        # field: bucket values and counts would reveal it directly, and a
+        # wildcard operator lets it decide which rows are counted.
+        unless resolution.master?
+          facet_protected = Parse::CLPScope.protected_fields_for(
+            collection_name, resolution.permission_strings,
+          )
+          ProtectedPaths.assert_search_stage_allowed!(
+            search_meta_stage, facet_protected, resolution,
+            collection_name: collection_name,
+            method_name: "Parse::AtlasSearch.faceted_search",
+          )
+        end
+
         # Execute facet query. $searchMeta MUST be the only / first
         # stage of its pipeline — Atlas rejects anything prepended.
         # Bypass Parse::MongoDB.aggregate (which would prepend a
@@ -797,6 +824,14 @@ module Parse
           pipeline << { "$match" => mongo_filter }
         end
 
+        # Sorting on a protected field orders rows by its value, which is
+        # the same oracle as matching on it.
+        if sort.is_a?(Hash) && !sort.empty?
+          ProtectedPaths.assert_paths_allowed!(
+            sort.keys.map(&:to_s), protected_fields, resolution,
+            collection_name: collection_name, what: "sort key",
+          )
+        end
         pipeline << { "$sort" => (sort || { "_score" => -1 }) }
         pipeline << { "$skip" => skip } if skip.to_i > 0
         pipeline << { "$limit" => limit }
@@ -980,13 +1015,12 @@ module Parse
       # does inline (we can't reuse that path because of the $search-
       # at-stage-0 invariant).
       def assert_clp_find!(collection_name, resolution)
-        return if resolution.nil? || resolution.master?
-        unless Parse::CLPScope.permits?(collection_name, :find, resolution.permission_strings)
-          raise Parse::CLPScope::Denied.new(
-            collection_name, :find,
-            "CLP refuses find on '#{collection_name}' for the current Atlas Search scope.",
-          )
-        end
+        # Same CLP branch evaluation as Parse::MongoDB.aggregate (public,
+        # user, and role grants first; then pointerFields / readUserFields).
+        # Raises Parse::CLPScope::Denied when the scope cannot find at all.
+        Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            label: "Atlas Search")
+        nil
       end
 
       # Resolve and return pointerFields for `find` on the collection.
@@ -994,17 +1028,13 @@ module Parse
       # current scope has no user_id (acl_role-only / public agents).
       # Returns nil when master-mode or no pointerFields entry exists.
       def resolve_pointer_fields!(collection_name, resolution)
-        return nil if resolution.nil? || resolution.master?
-        pointer_fields = Parse::CLPScope.pointer_fields_for(collection_name, :find)
-        return nil if pointer_fields.nil?
-        if resolution.user_id.nil?
-          raise Parse::CLPScope::Denied.new(
-            collection_name, :find,
-            "CLP requires user identity (pointerFields=#{pointer_fields.inspect}) " \
-            "but the current Atlas Search scope has no user_id.",
-          )
-        end
-        pointer_fields
+        # nil when a public, user, or role grant already permits every row
+        # (Parse Server ignores pointer permissions then); otherwise the
+        # pointerFields plus readUserFields the rows must match. The older
+        # permits? / pointer_fields_for pair missed readUserFields entirely
+        # and over-restricted a public grant that also listed pointerFields.
+        Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            label: "Atlas Search")
       end
 
       # ATLAS-4: refuse `highlight_field:` when the field is in the
@@ -1016,8 +1046,8 @@ module Parse
         return if highlight_field.nil?
         return if resolution.nil? || resolution.master?
         return if protected_fields.nil? || protected_fields.empty?
-        path = highlight_field.to_s
-        return unless protected_fields.include?(path)
+        return unless ProtectedPaths.touches?(highlight_field, protected_fields)
+        path = highlight_field.is_a?(String) || highlight_field.is_a?(Symbol) ? highlight_field.to_s : highlight_field.inspect
         raise Parse::CLPScope::Denied.new(
           nil, :find,
           "Parse::AtlasSearch.search refused: highlight_field '#{path}' is in " \
@@ -1026,6 +1056,35 @@ module Parse
         )
       end
 
+      # Refuse a scoped text search whose paths include a protected field,
+      # or that searches every field (no `fields:`) while the scope has
+      # protected fields. Stripping a protected field from the RESULT does
+      # not stop it from deciding which documents MATCH and how they RANK,
+      # so a caller could test guesses against its value. Master scopes and
+      # scopes with nothing protected are unaffected.
+      #
+      # @raise [Parse::CLPScope::Denied]
+      def assert_search_fields_allowed!(fields, protected_fields, resolution)
+        return if resolution.nil? || resolution.master?
+        return if protected_fields.nil? || protected_fields.empty?
+        if fields.nil? || fields.empty?
+          raise Parse::CLPScope::Denied.new(
+            nil, :find,
+            "Parse::AtlasSearch.search refused: a search over every field would " \
+            "match on protectedFields for the current scope; pass fields: with " \
+            "the fields to search.",
+          )
+        end
+        list = fields.is_a?(Array) ? fields : [fields]
+        hit = list.find { |f| ProtectedPaths.touches?(f, protected_fields) }
+        return unless hit
+        raise Parse::CLPScope::Denied.new(
+          nil, :find,
+          "Parse::AtlasSearch.search refused: field '#{hit}' is in protectedFields " \
+          "for the current scope; matching on it would reveal its value.",
+        )
+      end
+
       # Drop `_highlights` entries whose `path` matches a
       # protectedFields entry. Defense-in-depth complement to
       # {.assert_highlight_field_allowed!} — that gate refuses the
@@ -1035,13 +1094,14 @@ module Parse
       def strip_protected_highlights!(documents, protected_fields)
         return if documents.nil? || documents.empty?
         return if protected_fields.nil? || protected_fields.empty?
-        protected_set = protected_fields.to_set
         documents.each do |doc|
           next unless doc.is_a?(Hash)
           highlights = doc["_highlights"]
           next unless highlights.is_a?(Array)
           doc["_highlights"] = highlights.reject do |h|
-            h.is_a?(Hash) && protected_set.include?((h["path"] || h[:path]).to_s)
+            # A highlight entry with no usable path is dropped too: it
+            # cannot be shown to address an unprotected field.
+            h.is_a?(Hash) && ProtectedPaths.touches?(h["path"] || h[:path], protected_fields)
           end
         end
       end
@@ -1172,6 +1232,18 @@ module Parse
           Parse::PipelineSecurity.refuse_protected_field_references!(
             [{ "$match" => filter }], collection_name, resolution,
           )
+          # Predicate KEYS decide matches too: `{ "ssn" => /^1/ }` is the
+          # same oracle as the `$expr` form above. Refuse any key (top
+          # level or nested under $and/$or/$nor/$not, dotted or `_p_`
+          # storage form) that touches a protected field.
+          unless resolution.master?
+            protected_fields = Parse::CLPScope.protected_fields_for(
+              collection_name, resolution.permission_strings,
+            )
+            ProtectedPaths.assert_filter_allowed!(
+              filter, protected_fields, resolution, collection_name: collection_name,
+            )
+          end
         end
 
         filter

data/lib/parse/authorization.rb

@@ -97,6 +97,19 @@ module Parse
         @mutex.synchronize { @data.delete(key) }
       end
 
+      # Drop every entry whose value equals `value`. Lets the identity plane
+      # forget every token of one user after a revocation, since it is keyed
+      # by token and holds the user id as the value.
+      # @param value [Object]
+      # @return [Integer] number of entries removed.
+      def invalidate_value(value)
+        @mutex.synchronize do
+          before = @data.size
+          @data.delete_if { |_key, entry| entry[:value] == value }
+          before - @data.size
+        end
+      end
+
       # Drop every entry.
       def clear
         @mutex.synchronize { @data.clear }
@@ -236,6 +249,35 @@ module Parse
         @identity_cache.invalidate(session_token.to_s)
       end
 
+      # Forget every cached identity entry that resolves to `user_id`. Call
+      # after an event that revokes the user's sessions: a password change,
+      # account deletion, a session destroy, or "log out everywhere". The SDK
+      # calls it itself on those paths.
+      #
+      # The identity plane is keyed by token, so there is no direct way to
+      # name a user's entries. A generation-capable plane (the keyspaced
+      # Redis identity plane) bumps the user's generation, which rejects
+      # every entry for that user, including tokens this process never
+      # resolved. The default {MemoryCache} drops the matching values. A
+      # custom plane that supports neither is left to its TTL.
+      #
+      # The role entry is dropped too: it is cheap to rebuild and a deleted
+      # user should not keep a role closure around.
+      # @param user_id [String]
+      # @return [void]
+      def invalidate_user(user_id)
+        return if user_id.nil? || user_id.to_s.empty?
+        uid = user_id.to_s
+        cache = @identity_cache
+        if generation_capable?(cache) && cache.respond_to?(:bump_generation)
+          cache.bump_generation(uid)
+        elsif cache.respond_to?(:invalidate_value)
+          cache.invalidate_value(uid)
+        end
+        @role_cache.invalidate(uid)
+        nil
+      end
+
       # Forget one user's cached role closure. Call after any `_Role.users`
       # mutation affecting them.
       # @param user_id [String]
@@ -244,6 +286,12 @@ module Parse
         @role_cache.invalidate(user_id.to_s)
       end
 
+      # Forget every cached role closure. Call after a `_Role.roles` hierarchy
+      # change, which can affect any user holding a role in that hierarchy.
+      def invalidate_all_roles
+        @role_cache.clear if @role_cache.respond_to?(:clear)
+      end
+
       # Drop every entry in both planes.
       def reset_caches!
         @identity_cache.clear if @identity_cache.respond_to?(:clear)
@@ -267,7 +315,12 @@ module Parse
         return cached unless cached.nil?
 
         response = begin
-            @client.current_user(session_token)
+            # cache: false: a revoked or expired token must not re-resolve
+            # from a cached /users/me response after its identity entry is
+            # evicted or invalidated. The identity plane above is the only
+            # cache on this path, so its TTL and invalidation hooks bound
+            # revocation.
+            @client.current_user(session_token, cache: false)
           rescue => e
             raise InvalidSession, "session token lookup failed: #{e.class}: #{e.message}"
           end

data/lib/parse/client/batch.rb

@@ -70,12 +70,19 @@ module Parse
     def initialize(reqs = nil, transaction: false)
       @requests = []
       @responses = []
+      @submitted = false
       @transaction = transaction
       reqs = [reqs] unless reqs.is_a?(Enumerable)
       reqs.each { |r| add(r) } if reqs.is_a?(Enumerable)
     end
 
     # Add an additional request to this batch.
+    #
+    # A request tagged to a Parse object (see {Parse::Request#tag}) is skipped
+    # when the batch already holds an identical request for that same object,
+    # so adding an object twice does not send its changes twice. Untagged
+    # requests are always kept: two identical raw requests (for example two
+    # Increment operations) are two writes and are both sent.
     # @overload add(req)
     #  @param req [Parse::Request] the request to append.
     #  @return [Array<Parse::Request>] the set of requests.
@@ -83,16 +90,19 @@ module Parse
     #  @param req [Parse::BatchOperation] add all the requests from this batch operation.
     #  @return [Array<Parse::Request>] the set of requests.
     def add(req)
-      if req.respond_to?(:change_requests)
-        requests = req.change_requests.select { |r| r.is_a?(Parse::Request) }
-        @requests += requests
-      elsif req.is_a?(Array)
-        requests = req.select { |r| r.is_a?(Parse::Request) }
-        @requests += requests
-      elsif req.is_a?(BatchOperation)
-        @requests += req.requests if req.is_a?(BatchOperation)
-      else
-        @requests.push(req) if req.is_a?(Parse::Request)
+      incoming = if req.is_a?(BatchOperation)
+          req.requests
+        elsif req.respond_to?(:change_requests)
+          req.change_requests
+        elsif req.is_a?(Array)
+          req
+        else
+          [req]
+        end
+      incoming.each do |r|
+        next unless r.is_a?(Parse::Request)
+        next if duplicate_object_request?(r)
+        @requests.push(r)
       end
       @requests
     end
@@ -127,13 +137,15 @@ module Parse
       @requests.clear
     end
 
-    # @return [Boolean] true if the request was successful.
+    # @return [Boolean] true if every response in the batch succeeded. A
+    #   batch that was submitted with no requests is successful; one that has
+    #   not been submitted is not.
     def success?
-      return false if @responses.empty?
-      @responses.compact.all?(&:success?)
+      return @submitted == true if @responses.empty?
+      @responses.all? { |r| r.respond_to?(:success?) && r.success? }
     end
 
-    # @return [Boolean] true if the request had an error.
+    # @return [Boolean] true if at least one response in the batch failed.
     def error?
       return false if @responses.empty?
       !success?
@@ -143,57 +155,169 @@ module Parse
     # Parse limits requests in each batch to 50 and it is possible that a {BatchOperation}
     # instance contains more than 50 requests. This method will slice up the array of
     # request and send them based on the `segment` amount until they have all been submitted.
+    #
+    # The returned array always has one response per request, in request
+    # order. When a chunk fails as a whole (an HTTP error, or a response that
+    # cannot be matched to its requests), every request in that chunk gets a
+    # failed response, so a failure never shifts results onto other requests.
+    #
+    # A transactional batch (`transaction: true`) is never split. All of its
+    # requests go to Parse Server in one `POST /batch` with `transaction: true`,
+    # which commits or rolls back as a unit, regardless of `segment`. Parse
+    # Server has no fixed sub-request limit; a server configured with
+    # `requestComplexity.batchRequestLimit` rejects an oversized transaction
+    # for non-master callers, and nothing is written.
+    #
+    # When a chunk raises (for example a 5xx or a dropped connection), the
+    # other chunks are still processed and the block still sees every
+    # request, with failed responses for the chunk that raised. The first
+    # exception is then re-raised.
     # @param segment [Integer] the number of requests to send in each batch. Default 50.
     # @param parallelism [Integer] the number of segments dispatched in
     #   parallel. Defaults to `Parse::BatchOperation.parallelism` (2).
+    # @yieldparam request [Parse::Request] a submitted request.
+    # @yieldparam response [Parse::Response] the response for that request.
     # @return [Array<Parse::Response>] the corresponding set of responses for
     #  each request in the batch.
     def submit(segment = 50, parallelism: self.class.parallelism, &block)
       @responses = []
-      @requests.uniq!(&:signature)
-      parallelism = 1 if parallelism.nil? || parallelism < 1
-      @responses = @requests.each_slice(segment).to_a.threaded_map(parallelism) do |slice|
-        client.batch_request(BatchOperation.new(slice))
+      @submitted = true
+      failure = nil
+      return @responses if @requests.empty?
+
+      if @transaction
+        # One request, one transaction. Exceptions propagate unchanged so the
+        # caller can roll back its local state.
+        @responses = align_responses(@requests, client.batch_request(self))
+      else
+        segment = 50 if segment.nil? || segment < 1
+        parallelism = 1 if parallelism.nil? || parallelism < 1
+        slices = @requests.each_slice(segment).to_a
+        outcomes = slices.threaded_map(parallelism) do |slice|
+          begin
+            [align_responses(slice, client.batch_request(BatchOperation.new(slice))), nil]
+          rescue StandardError => e
+            [Array.new(slice.size) { exception_response(e) }, e]
+          end
+        end
+        @responses = outcomes.flat_map(&:first)
+        failure = outcomes.map(&:last).compact.first
       end
-      @responses.flatten!
+
       @requests.zip(@responses).each(&block) if block_given?
+      raise failure if failure
       @responses
     end
 
     alias_method :save, :submit
+
+    private
+
+    # Whether `req` repeats a request already in the batch for the same
+    # tagged object.
+    def duplicate_object_request?(req)
+      tag = req.tag
+      return false if tag.nil? || tag == 0
+      sig = req.signature
+      @requests.any? { |r| r.tag == tag && r.signature == sig }
+    end
+
+    # Pair a chunk's requests with the result of its batch call, one
+    # response per request.
+    # @param slice [Array<Parse::Request>] the requests that were sent.
+    # @param result [Array<Parse::Response>, Parse::Response] the result of
+    #   {Parse::API::Batch#batch_request}.
+    # @return [Array<Parse::Response>]
+    def align_responses(slice, result)
+      if result.is_a?(Array)
+        slice.each_with_index.map do |_req, i|
+          entry = result[i]
+          next entry if entry.is_a?(Parse::Response)
+          Parse::Response.error_response(
+            Parse::Response::ERROR_INTERNAL,
+            "Batch response had #{result.size} results for #{slice.size} requests",
+          )
+        end
+      elsif result.is_a?(Parse::Response) && result.error?
+        slice.map do
+          Parse::Response.error_response(result.code, result.error, http_status: result.http_status)
+        end
+      else
+        slice.map do
+          Parse::Response.error_response(Parse::Response::ERROR_INTERNAL, "Malformed batch response")
+        end
+      end
+    end
+
+    # A failed response standing in for a request whose chunk raised.
+    def exception_response(error)
+      code = Parse::Response::ERROR_INTERNAL
+      inner = error.respond_to?(:response) ? error.response : nil
+      code = inner.code if inner.respond_to?(:code) && inner.code.is_a?(Integer)
+      Parse::Response.error_response(code, "#{error.class}: #{error.message}")
+    end
   end
 end
 
 class Array
 
   # Submit a batch request for deleting a set of Parse::Objects.
+  #
+  # Each object whose delete succeeds has its local state updated the same
+  # way {Parse::Object#destroy} updates it. Objects whose delete fails are
+  # left untouched; inspect the returned batch's responses to find them.
+  # Destroy callbacks are not run.
   # @example
   #  # assume Post and Author are Parse models
   #  author = Author.first
   #  posts = Post.all author: author
   #  posts.destroy # batch destroy request
   # @return [Parse::BatchOperation] the batch operation performed.
+  # @raise ArgumentError if the array is not empty and holds no Parse objects.
   # @see Parse::BatchOperation
   def destroy
+    targets = select { |o| o.respond_to?(:destroy_request) }
+    if targets.empty? && !empty?
+      raise ArgumentError, "Array#destroy requires Parse::Object elements; " \
+                           "this array holds none (#{first.class})"
+    end
     batch = Parse::BatchOperation.new
-    each do |o|
-      next unless o.respond_to?(:destroy_request)
+    objects = {}
+    targets.each do |o|
+      next if objects.key?(o.object_id)
       r = o.destroy_request
-      batch.add(r) unless r.nil?
+      next if r.nil?
+      objects[o.object_id] = o
+      batch.add(r)
+    end
+    batch.submit do |request, response|
+      o = objects[request.tag]
+      next unless o && response.respond_to?(:success?) && response.success?
+      # Mirror Parse::Object#destroy: keep the id and mark the object
+      # destroyed so it reports `destroyed?` and a later save refuses.
+      o.instance_variable_set(:@_destroyed, true)
+      o.changes_applied! if o.respond_to?(:changes_applied!)
     end
-    batch.submit
     batch
   end
 
   # Do not alias method as :delete is already part of array.
   # alias_method :delete, :destroy
 
-  # Submit a batch request for deleting a set of Parse::Objects.
+  # Submit a batch request for saving a set of Parse::Objects.
   # Batch requests are supported implicitly and intelligently through an
   # extension of array. When an array of Parse::Object subclasses is saved,
   # Parse-Stack will batch all possible save operations for the objects in the
   # array that have changed. It will also batch save 50 at a time until all items
   # in the array are saved. Note: Parse does not allow batch saving Parse::User objects.
+  #
+  # Each object is updated only from its own responses. An object whose
+  # requests all succeed gets its id and timestamps and has its changes
+  # cleared. When an object has several requests (an attribute update plus
+  # relation updates) and only some succeed, the fields written by the
+  # successful requests are cleared and the rest stay dirty, so a later save
+  # resends only what failed. An object listed more than once is saved once.
+  # Elements that are not Parse objects are skipped.
   # @note The objects of the array to be saved do not all have to be of the same collection.
   # @param merge [Boolean] whether to merge the updated changes to the series of
   #  objects back to the original ones submitted. If you don't need the original objects
@@ -206,12 +330,18 @@ class Array
   #  posts.each { |post| post.author = author }
   #  posts.save # batch save
   # @return [Parse::BatchOperation] the batch operation performed.
+  # @raise ArgumentError if the array is not empty and holds no Parse objects.
   # @see Parse::BatchOperation
   def save(merge: true, force: false)
+    targets = select { |o| o.is_a?(Parse::Object) }
+    if targets.empty? && !empty?
+      raise ArgumentError, "Array#save requires Parse::Object elements; " \
+                           "this array holds none (#{first.class})"
+    end
     batch = Parse::BatchOperation.new
     objects = {}
-    each do |o|
-      next unless o.is_a?(Parse::Object)
+    targets.each do |o|
+      next if objects.key?(o.object_id)
       objects[o.object_id] = o
       batch.add o.change_requests(force)
     end
@@ -219,16 +349,82 @@ class Array
       batch.submit
       return batch
     end
-    #rebind updates
-    batch.submit do |request, response|
-      next unless request.tag.present? && response.present? && response.success?
-      o = objects[request.tag]
-      next unless o.is_a?(Parse::Object)
-      result = response.result
-      o.id = result["objectId"] if o.id.blank?
-      o.set_attributes!(result)
-      o.clear_changes!
+    outcomes = Hash.new { |h, k| h[k] = [] }
+    begin
+      batch.submit do |request, response|
+        outcomes[request.tag] << [request, response] if objects.key?(request.tag)
+      end
+    ensure
+      # Apply what landed even when a chunk raised, so a successful create is
+      # never left looking new (which would create it again on the next save).
+      outcomes.each do |tag, pairs|
+        Parse::BatchOperation.apply_save_outcome(objects[tag], pairs)
+      end
     end
     batch
   end #save!
 end
+
+module Parse
+  class BatchOperation
+    # @!visibility private
+    # Apply the batch responses for one object's requests to that object.
+    # @param obj [Parse::Object] the object that was saved.
+    # @param pairs [Array<Array(Parse::Request, Parse::Response)>] its
+    #   requests and their responses.
+    def self.apply_save_outcome(obj, pairs)
+      return unless obj.is_a?(Parse::Object)
+      ok, failed = pairs.partition { |_req, res| res.respond_to?(:success?) && res.success? }
+
+      ok.each do |_req, res|
+        result = res.result
+        next unless result.is_a?(Hash)
+        if obj.id.blank? && result[Parse::Model::OBJECT_ID].present?
+          obj.instance_variable_set(:@id, result[Parse::Model::OBJECT_ID])
+        end
+        created = result["createdAt"]
+        updated = result["updatedAt"] || created
+        obj.instance_variable_set(:@created_at, Parse::Date.parse(created)) if created
+        obj.instance_variable_set(:@updated_at, Parse::Date.parse(updated)) if updated
+        # beforeSave triggers can change saved fields; apply what came back.
+        obj.set_attributes!(result)
+      end
+      return if ok.empty?
+
+      if failed.empty?
+        obj.changes_applied!
+        # Settle array proxies explicitly as well: their dirty state lives on
+        # the proxy, and a proxy left dirty resends the whole array on the
+        # next save.
+        settle_collections(obj, obj.class.fields(:array).keys)
+      else
+        clear_written_fields(obj, ok.map(&:first), failed.map(&:first))
+      end
+    end
+
+    # @!visibility private
+    # Clear dirty tracking only for the fields written by successful
+    # requests that no failed request also touched.
+    def self.clear_written_fields(obj, ok_requests, failed_requests)
+      remote = ->(reqs) { reqs.flat_map { |r| r.body.is_a?(Hash) ? r.body.keys.map(&:to_s) : [] } }
+      written = remote.call(ok_requests) - remote.call(failed_requests)
+      return if written.empty?
+      field_map = obj.class.respond_to?(:field_map) ? obj.class.field_map : {}
+      local = written.map do |key|
+        (field_map.find { |_local, rem| rem.to_s == key }&.first || key).to_s
+      end
+      settle_collections(obj, local)
+      obj.clear_attribute_changes(local) if obj.respond_to?(:clear_attribute_changes)
+    end
+
+    # @!visibility private
+    # Mark the collection proxies behind the named fields as saved.
+    def self.settle_collections(obj, names)
+      names.each do |name|
+        next unless obj.respond_to?(name)
+        value = obj.send(name)
+        value.changes_applied! if value.is_a?(Parse::CollectionProxy) && value.respond_to?(:changes_applied!)
+      end
+    end
+  end
+end