parse-stack-next 5.7.6 → 5.8.0

data/lib/parse/model/associations/pointer_collection_proxy.rb

@@ -32,15 +32,50 @@ module Parse
     # @overload add(parse_objects)
     #  Add an array of Parse::Objects or Parse::Pointers to this collection.
     #  @param parse_objects [Array<Parse::Object,Parse::Pointer>] the array to append.
+    # An objectId String is accepted and becomes a pointer of the declared
+    # class.
+    # @raise [ArgumentError] if an item is nil, of another Parse class, or
+    #  cannot be turned into a pointer.
     # @return [Array<Parse::Object>] the collection
     def add(*items)
-      notify_will_change! if items.count > 0
-      items.flatten.parse_objects.each do |item|
-        collection.push(item) if item.is_a?(Parse::Pointer)
-      end
+      items = typecast_items(items)
+      return @collection if items.empty?
+      notify_will_change!
+      items.each { |item| collection.push(item) }
+      @collection
+    end
+
+    alias_method :push, :add
+
+    # Add items that are not already part of the collection.
+    # @param items [Array<Parse::Object,Parse::Pointer,String>] items to uniquely add
+    # @raise [ArgumentError] (see #add)
+    # @return [Array<Parse::Object>] the collection
+    def add_unique(*items)
+      items = typecast_items(items)
+      return @collection if items.empty?
+      notify_will_change!
+      @collection = collection | items
       @collection
     end
 
+    alias_method :push_unique, :add_unique
+
+    # @see #add
+    def <<(*list)
+      add(*list)
+      self
+    end
+
+    # Replace the contents of the collection. The items are validated as in
+    # {#add}.
+    # @param items [Array<Parse::Object,Parse::Pointer,String>] the new contents.
+    # @raise [ArgumentError] (see #add)
+    # @return [self]
+    def replace(items)
+      super(typecast_items(Array(items.is_a?(Parse::CollectionProxy) ? items.to_a : items)))
+    end
+
     # Removes Parse::Objects from the collection.
     # @overload remove(parse_object)
     #  Remove a Parse::Object or Parse::Pointer to this collection.
@@ -48,40 +83,37 @@ module Parse
     # @overload remove(parse_objects)
     #  Remove an array of Parse::Objects or Parse::Pointers from this collection.
     #  @param parse_objects [Array<Parse::Object,Parse::Pointer>] the array of objects to remove.
+    # An objectId String removes the object of the declared class with that id.
     # @return [Array<Parse::Object>] the collection
     def remove(*items)
-      notify_will_change! if items.count > 0
-      items.flatten.parse_objects.each do |item|
-        collection.delete item
-      end
+      items = typecast_items(items, strict: false)
+      return @collection if items.empty?
+      notify_will_change!
+      items.each { |item| collection.delete item }
       @collection
     end
 
+    alias_method :delete, :remove
+
     # Atomically add a set of Parse::Objects to this collection.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
     # @see CollectionProxy#add!
     # @see #add_unique!
     def add!(*items)
-      super(items.flatten.parse_pointers)
+      super(*typecast_items(items))
     end
 
     # Atomically add a set of Parse::Objects to this collection for those not already
     # in the collection.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
     # @see CollectionProxy#add_unique!
     # @see #add!
     def add_unique!(*items)
-      super(items.flatten.parse_pointers)
+      super(*typecast_items(items))
     end
 
     # Atomically remove a set of Parse::Objects to this collection.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
     # @see CollectionProxy#remove!
     def remove!(*items)
-      super(items.flatten.parse_pointers)
+      super(*typecast_items(items, strict: false))
     end
 
     # Force fetch the set of pointer objects in this collection.
@@ -130,5 +162,65 @@ module Parse
       opts = defaults.merge(opts)
       super(opts)
     end
+
+    private
+
+    # Convert the given items to Parse objects of the collection's class.
+    # Parse objects and pointers are kept, pointer hashes are built, and an
+    # objectId String becomes a pointer of the declared class.
+    # @param items [Array] the items to convert (nested arrays are flattened).
+    # @param strict [Boolean] when true, an item that cannot be converted, or
+    #  belongs to another Parse class, raises. When false it is skipped.
+    # @raise [ArgumentError] in strict mode, for an invalid item.
+    # @return [Array<Parse::Pointer>]
+    def typecast_items(items, strict: true)
+      items.flatten.each_with_object([]) do |item, list|
+        obj = typecast_item(item)
+        if obj.nil?
+          next unless strict
+          raise ArgumentError, "Invalid item #{item.inspect} for #{collection_label}: " \
+                               "expected a Parse::Object, Parse::Pointer or objectId String."
+        end
+        unless item_class_allowed?(obj.parse_class)
+          next unless strict
+          raise ArgumentError, "Invalid item for #{collection_label}: expected a " \
+                               "#{@parse_class} object, got #{obj.parse_class}."
+        end
+        list << obj
+      end
+    end
+
+    # @return [Parse::Pointer, nil] the item as a Parse object, or nil.
+    def typecast_item(item)
+      case item
+      when Parse::Pointer
+        item
+      when Hash
+        type = item["__type"] || item[:__type]
+        return nil if type.present? && !%w[Pointer Object].include?(type.to_s)
+        # A pointer hash is wire data: with a declared class its className
+        # is ignored (with a warning), as for server data.
+        [item].parse_objects(@parse_class.presence).first
+      when String
+        return nil if item.blank? || @parse_class.blank?
+        Parse::Object.build({ Parse::Model::TYPE_FIELD => Parse::Model::TYPE_POINTER,
+                              Parse::Model::KEY_CLASS_NAME => @parse_class,
+                              Parse::Model::OBJECT_ID => item }, @parse_class)
+      end
+    end
+
+    # @return [Boolean] whether an item of `klass` may be part of this
+    #   collection. The class is checked when the declared class is a
+    #   registered model; a declaration naming no model (for example a
+    #   has_many whose `as:` was left to default) keeps accepting any class.
+    def item_class_allowed?(klass)
+      return true if @parse_class.blank? || Parse::Model.find_class(@parse_class).nil?
+      klass.present? && Parse::Model.same_parse_class?(klass, @parse_class)
+    end
+
+    def collection_label
+      owner = @delegate.respond_to?(:parse_class) ? @delegate.parse_class : @delegate.class
+      @key ? "#{owner}##{@key}" : self.class.name
+    end
   end
 end

data/lib/parse/model/associations/relation_collection_proxy.rb

@@ -51,9 +51,29 @@ module Parse
       @removals = []
     end
 
+    # The items of the relation. The first access queries the server for the
+    # related objects, then applies the additions and removals that have not
+    # been saved yet. An owner without an objectId has nothing on the server,
+    # so no query is sent for it.
+    # @return [Array<Parse::Object>]
+    def collection
+      unless @loaded
+        fetched = owner_saved? ? forward(:"#{@key}_fetch!") : nil
+        list = fetched.to_a.reject { |item| @removals.include?(item) }
+        @additions.each { |item| list.push(item) unless list.include?(item) }
+        @collection = list
+        @loaded = true
+      end
+      @collection
+    end
+
     # You can get items within the collection relation filtered by a specific set
     # of query constraints.
     def all(constraints = {}, &block)
+      # An unsaved owner has no relation on the server yet.
+      unless owner_saved?
+        return block_given? ? collection.each(&block) : collection
+      end
       q = query({ limit: :max }.merge(constraints))
       if block_given?
         # if we have a query, then use the Proc with it (more efficient)
@@ -86,32 +106,44 @@ module Parse
       query(limit: count)
     end
 
-    # Add Parse::Objects to the relation.
+    # Add Parse::Objects to the relation. The change is staged and sent with
+    # the next save of the owner. Staging does not query the relation.
+    # Adding an item that is already staged has no further effect.
     # @overload add(parse_object)
     #  Add a Parse::Object or Parse::Pointer to this relation.
     #  @param parse_object [Parse::Object,Parse::Pointer] the object to add
     # @overload add(parse_objects)
     #  Add an array of Parse::Objects or Parse::Pointers to this relation.
     #  @param parse_objects [Array<Parse::Object,Parse::Pointer>] the array to append.
+    # @raise [ArgumentError] if an item is nil, of another Parse class, or
+    #  cannot be turned into a pointer.
     # @return [Array<Parse::Object>] the collection
     def add(*items)
-      items = items.flatten.parse_objects
+      items = typecast_items(items)
       return @collection if items.empty?
 
       notify_will_change!
       additions_will_change!
       removals_will_change!
-      # take all the items
       items.each do |item|
-        @additions.push item
-        @collection.push item
-        #cleanup
-        @removals.delete item
+        @additions.push(item) unless @additions.include?(item)
+        @removals.delete(item)
+        @collection.push(item) if @loaded && !@collection.include?(item)
       end
       @collection
     end
 
-    # Removes Parse::Objects from the relation.
+    alias_method :push, :add
+
+    # Same as {#add}: a relation never holds an object twice.
+    def add_unique(*items)
+      add(*items)
+    end
+
+    alias_method :push_unique, :add_unique
+
+    # Removes Parse::Objects from the relation. The change is staged and sent
+    # with the next save of the owner. Staging does not query the relation.
     # @overload remove(parse_object)
     #  Remove a Parse::Object or Parse::Pointer to this relation.
     #  @param parse_object [Parse::Object,Parse::Pointer] the object to remove
@@ -120,45 +152,103 @@ module Parse
     #  @param parse_objects [Array<Parse::Object,Parse::Pointer>] the array of objects to remove.
     # @return [Array<Parse::Object>] the collection
     def remove(*items)
-      items = items.flatten.parse_objects
+      items = typecast_items(items, strict: false)
       return @collection if items.empty?
       notify_will_change!
       additions_will_change!
       removals_will_change!
+      # An unsaved owner has nothing on the server to remove.
+      saved = owner_saved?
       items.each do |item|
-        @removals.push item
-        @collection.delete item
-        # remove it from any add operations
-        @additions.delete item
+        @removals.push(item) if saved && !@removals.include?(item)
+        @additions.delete(item)
+        @collection.delete(item)
       end
       @collection
     end
 
+    alias_method :delete, :remove
+
+    # Stage the removal of every object in the relation. This loads the
+    # relation to know what to remove.
+    # @return [Array<Parse::Object>] the (now empty) collection.
+    def clear
+      remove(*collection.to_a)
+      @collection
+    end
+
+    # Stage the changes that make the relation hold exactly `items`.
+    # @return [self]
+    def replace(items)
+      items = typecast_items(Array(items.is_a?(Parse::CollectionProxy) ? items.to_a : items))
+      current = collection.to_a
+      stale = current.reject { |item| items.include?(item) }
+      remove(*stale) if stale.any?
+      fresh = items.reject { |item| current.include?(item) }
+      add(*fresh) if fresh.any?
+      self
+    end
+
     # Atomically add a set of Parse::Objects to this relation.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
+    # This is done by making the API request directly with Parse server. On
+    # success the loaded collection includes the items, and a staged
+    # removal of the same items is dropped so a later save does not undo it.
+    # On an owner that has not been saved yet the items are staged as in
+    # {#add} and sent with the next save.
+    # @return [Boolean] whether the operation succeeded.
     def add!(*items)
       return false unless @delegate.respond_to?(:op_add_relation!)
-      items = items.flatten.parse_pointers
-      @delegate.send :op_add_relation!, @key, items
+      items = typecast_items(items)
+      return true if items.empty?
+      return add(*items) && true unless owner_saved?
+      return false unless @delegate.send(:op_add_relation!, @key, items.parse_pointers)
+      items.each do |item|
+        @removals.delete(item)
+        @collection.push(item) if @loaded && !@collection.include?(item)
+      end
+      true
     end
 
-    # Atomically add a set of Parse::Objects to this relation.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
+    # @see #add!
     def add_unique!(*items)
-      return false unless @delegate.respond_to?(:op_add_relation!)
-      items = items.flatten.parse_pointers
-      @delegate.send :op_add_relation!, @key, items
+      add!(*items)
     end
 
-    # Atomically remove a set of Parse::Objects to this relation.
-    # This is done by making the API request directly with Parse server; the
-    # local object is not updated with changes.
+    # Atomically remove a set of Parse::Objects from this relation.
+    # This is done by making the API request directly with Parse server. On
+    # success the items leave the loaded collection, and a staged addition
+    # of the same items is dropped.
+    # @return [Boolean] whether the operation succeeded.
     def remove!(*items)
       return false unless @delegate.respond_to?(:op_remove_relation!)
-      items = items.flatten.parse_pointers
-      @delegate.send :op_remove_relation!, @key, items
+      items = typecast_items(items, strict: false)
+      return true if items.empty?
+      return remove(*items) && true unless owner_saved?
+      return false unless @delegate.send(:op_remove_relation!, @key, items.parse_pointers)
+      items.each do |item|
+        @additions.delete(item)
+        @collection.delete(item)
+      end
+      true
+    end
+
+    # Marks the staged additions and removals as saved. Called after the
+    # owner is saved successfully, so the operations are not sent again by a
+    # later save.
+    def changes_applied!
+      @additions = []
+      @removals = []
+      super
+    end
+
+    # Drops the staged additions and removals. The items are reloaded from
+    # the server on the next access.
+    def rollback!
+      super
+      @additions = []
+      @removals = []
+      reset!
+      @collection
     end
 
     # Save the changes to the relation
@@ -173,5 +263,21 @@ module Parse
       list.each { |d| add(d) }
       @collection
     end
+
+    private
+
+    attr_writer :additions, :removals
+
+    # @return [Boolean] whether the owner has an objectId to query by.
+    def owner_saved?
+      !(@delegate.respond_to?(:id) && @delegate.id.blank?)
+    end
+
+    # ActiveModel reads the current value when a change starts. Read the
+    # items directly: going through {#collection} would query the whole
+    # relation just to stage an add or remove.
+    def _read_attribute(attr)
+      attr.to_s == "collection" ? @collection : super
+    end
   end
 end

data/lib/parse/model/bytes.rb

@@ -34,10 +34,12 @@ module Parse
       ATTRIBUTES
     end
 
-    # Base64 encode and set the instance contents
+    # Base64 encode and set the instance contents. Uses strict (RFC 4648)
+    # encoding: `Base64.encode64` inserts a newline every 60 characters,
+    # which Parse Server stores verbatim in the Bytes column.
     # @param str the string to encode
     def encode(str)
-      @base64 = Base64.encode64(str)
+      @base64 = Base64.strict_encode64(str.to_s)
     end
 
     # Get the content as decoded base64 bytes
@@ -45,11 +47,17 @@ module Parse
       Base64.decode64(@base64 || "")
     end
 
+    # Mass-assign the base64 content from a base64 String, a Parse Bytes
+    # hash (`{"__type" => "Bytes", "base64" => "..."}`), or another
+    # {Parse::Bytes}.
+    # @param a [String, Hash, Parse::Bytes]
     def attributes=(a)
-      if a.is_a?(String)
-        @bytes = a
+      if a.is_a?(Bytes)
+        @base64 = a.base64.dup
+      elsif a.is_a?(String)
+        @base64 = a.dup
       elsif a.is_a?(Hash)
-        @bytes = a["base64"] || @bytes
+        @base64 = a["base64"] || a[:base64] || @base64
       end
     end
 

data/lib/parse/model/classes/role.rb

@@ -62,6 +62,78 @@ module Parse
     # @return [RelationCollectionProxy<User>] a Parse relation of users belonging to this role.
     has_many :users, through: :relation
 
+    # Grants and revocations reach mongo-direct ACL resolution immediately
+    # rather than after the role-cache TTL: the users whose membership a save
+    # changes have their cached role closures dropped, and a change to the
+    # role hierarchy drops them all.
+    before_save :_capture_role_membership_changes
+    after_save :_invalidate_role_caches
+
+    # Atomic relation operations (`role.users.add!`, `role.roles.remove!`)
+    # write immediately without a save, so they invalidate the same caches.
+    # @!visibility private
+    def op_add_relation!(field, objects = [])
+      result = super
+      _invalidate_after_relation_op(field, objects) if result
+      result
+    end
+
+    # @!visibility private
+    def op_remove_relation!(field, objects = [])
+      result = super
+      _invalidate_after_relation_op(field, objects) if result
+      result
+    end
+
+    # @!visibility private
+    def _invalidate_after_relation_op(field, objects)
+      key = field.to_s
+      if %w[roles].include?(key)
+        @_role_hierarchy_changed = true
+      elsif %w[users].include?(key)
+        @_role_membership_changed_ids = Array(objects).filter_map do |u|
+          id = u.respond_to?(:id) ? u.id : (u.is_a?(Hash) ? (u["objectId"] || u[:objectId]) : u)
+          id.to_s if id.present?
+        end
+      else
+        return
+      end
+      _invalidate_role_caches
+    end
+
+    # @!visibility private
+    def _capture_role_membership_changes
+      users_proxy = instance_variable_get(:@users)
+      ids = []
+      if users_proxy.respond_to?(:additions)
+        (Array(users_proxy.additions) + Array(users_proxy.removals)).each do |u|
+          id = u.respond_to?(:id) ? u.id : u
+          ids << id.to_s if id.present?
+        end
+      end
+      roles_proxy = instance_variable_get(:@roles)
+      @_role_hierarchy_changed = roles_proxy.respond_to?(:additions) &&
+                                 (Array(roles_proxy.additions).any? || Array(roles_proxy.removals).any?)
+      @_role_membership_changed_ids = ids.uniq
+      nil
+    end
+
+    # @!visibility private
+    def _invalidate_role_caches
+      auth = client.respond_to?(:authorization) ? client.authorization : nil
+      return unless auth
+      if @_role_hierarchy_changed && auth.respond_to?(:invalidate_all_roles)
+        auth.invalidate_all_roles
+      elsif auth.respond_to?(:invalidate_user_roles)
+        Array(@_role_membership_changed_ids).each { |id| auth.invalidate_user_roles(id) }
+      end
+    rescue StandardError => e
+      warn "[Parse::Role] role cache invalidation failed: #{e.class}"
+    ensure
+      @_role_membership_changed_ids = nil
+      @_role_hierarchy_changed = nil
+    end
+
     # Names of Mongo driver errors that mean "the server is momentarily
     # unreachable", for which falling back to the Parse Server walk is right.
     #

data/lib/parse/model/classes/session.rb

@@ -204,5 +204,48 @@ module Parse
     def revoke!
       destroy
     end
+
+    # Deletes the session and, on success, forgets it in the client's
+    # identity plane so mongo-direct and Atlas Search reads stop resolving
+    # the token at once instead of when the cached entry expires. The token
+    # is dropped when this instance carries it; the owning user's entries
+    # are dropped as well, since a session fetched without the master key
+    # does not carry its token.
+    # @param session [String] (see Parse::Object#destroy)
+    # @return [Boolean] whether the operation was successful.
+    def destroy(session: nil)
+      token = @session_token
+      # Read the association ivar directly: calling `user` on a partially
+      # fetched session could trigger an autofetch just to learn the owner.
+      owner = @user
+      owner_id = owner.respond_to?(:id) ? owner.id : nil
+      success = super
+      if success
+        cl = client
+        cl.invalidate_session_identity(token) if token.is_a?(String) && cl.respond_to?(:invalidate_session_identity)
+        cl.invalidate_user_identity(owner_id) if owner_id && cl.respond_to?(:invalidate_user_identity)
+      end
+      success
+    end
+
+    # Serialization omits `sessionToken` unless `include_session_token: true`
+    # is passed. A session token is a bearer credential, and `as_json` is the
+    # surface that reaches logs, API responses and agent tool output.
+    # @param opts [Hash] see Parse::Object#as_json.
+    # @option opts [Boolean] :include_session_token include the token.
+    # @return [Hash]
+    def as_json(opts = nil)
+      opts = (opts || {}).dup
+      include_token = opts.delete(:include_session_token) == true
+      json = super(opts)
+      return json if include_token || !json.is_a?(Hash)
+      json.except("session_token", "sessionToken", :session_token, :sessionToken)
+    end
+
+    # Redacts the session token from the default inspect output.
+    # @return [String]
+    def inspect
+      Parse::User.redact_session_token(super, @session_token)
+    end
   end
 end

data/lib/parse/model/classes/user.rb

@@ -202,6 +202,17 @@ module Parse
   class User < Parse::Object
     parse_class Parse::Model::CLASS_USER
 
+    # ActiveModel naming relative to the `Parse` namespace, so Rails forms,
+    # params, routes, and i18n see `Parse::User` as `user`
+    # (`params[:user]`, `users_path`) rather than `parse_user`. `name` stays
+    # "Parse::User". A subclass outside the `Parse` namespace keeps the
+    # default naming.
+    # @return [ActiveModel::Name]
+    def self.model_name
+      return super if name.nil? || !name.start_with?("Parse::")
+      @_relative_model_name ||= ActiveModel::Name.new(self, Parse)
+    end
+
     # When true (default), saving a new {Parse::User} that has a `password`
     # value routes through Parse Server's signup endpoint (`POST /parse/users`)
     # with the `X-Parse-Revocable-Session` header set, so the signup response
@@ -908,6 +919,57 @@ module Parse
       self.session_token.present?
     end
 
+    # Replace each non-empty token in `text` with `[FILTERED]`. Used by the
+    # `inspect` overrides on {Parse::User} and {Parse::Session} so a session
+    # token does not land in logs, exception messages or console history.
+    # @!visibility private
+    # @param text [String] the inspect output.
+    # @param tokens [Array<String, nil>] tokens to redact.
+    # @return [String]
+    def self.redact_session_token(text, *tokens)
+      out = text.to_s
+      tokens.each do |t|
+        next unless t.is_a?(String) && !t.strip.empty?
+        out = out.gsub(t, "[FILTERED]")
+      end
+      out
+    end
+
+    # Default inspect output with the session token redacted.
+    # @return [String]
+    def inspect
+      self.class.redact_session_token(super, @session_token, @_session_token)
+    end
+
+    # Saves pending changes. When the save changes the password, Parse Server
+    # revokes the user's other sessions, so this client's identity plane
+    # drops every cached entry for the user to make the revocation visible
+    # to mongo-direct reads at once.
+    # @!visibility private
+    def update!(raw: false, force: false)
+      password_changing = changed.include?("password")
+      result = super
+      ok = raw ? (result.respond_to?(:success?) && result.success?) : result == true
+      if ok && password_changing && client.respond_to?(:invalidate_user_identity)
+        client.invalidate_user_identity(id)
+      end
+      result
+    end
+
+    # Deletes the user. On success every cached identity entry for the user
+    # is dropped from this client's identity plane, since Parse Server
+    # removes the user's sessions with the account.
+    # @param session [String] (see Parse::Object#destroy)
+    # @return [Boolean] whether the operation was successful.
+    def destroy(session: nil)
+      user_id = id
+      success = super
+      if success && client.respond_to?(:invalidate_user_identity)
+        client.invalidate_user_identity(user_id)
+      end
+      success
+    end
+
     # Invalid the current session token for this logged in user.
     # @return [Boolean] True/false if successful
     def logout
@@ -1016,7 +1078,10 @@ module Parse
     # the request.
     #
     # @param body [Hash] The hash containing the Parse::User fields. The field `username` and `password` are required.
-    # @option opts [Boolean] :master_key Whether the master key should be used for this request.
+    # @option opts [Boolean] :use_master_key send the master key with the
+    #   signup. Off by default: a master-key signup returns no session token
+    #   and bypasses the `_User` create CLP. Pass `true` only for admin
+    #   provisioning that needs that bypass.
     # @raise [ArgumentError] If `body` contains `authData`/`auth_data`/`objectId` — use {.autologin_service} for federated flows.
     # @raise [Parse::Error::UsernameMissingError] If username is missing.
     # @raise [Parse::Error::PasswordMissingError] If password is missing.
@@ -1145,6 +1210,8 @@ module Parse
     # @param username [String] the user's username
     # @param password [String] the user's password
     # @return [User] a logged in user for the provided username. Returns nil otherwise.
+    # @raise [Parse::MFA::RequiredError] when the account has MFA enabled; use
+    #   {.login_with_mfa} with the user's code.
     # @see .login!
     def self.login(username, password)
       response = client.login(username.to_s, password.to_s)
@@ -1350,6 +1417,13 @@ module Parse
         end
         n
       end
+      # Every session but (optionally) the current one is gone server-side.
+      # Drop the user's identity entries on this client and on the default
+      # client (the logout above went through `Parse.client`). A kept
+      # current token simply re-resolves on its next use.
+      [client, Parse.client].uniq.each do |cl|
+        cl.invalidate_user_identity(id) if cl.respond_to?(:invalidate_user_identity)
+      end
       @session_token = nil unless keep_current
       @session = nil unless keep_current
       count
@@ -1648,8 +1722,9 @@ module Parse
         # Cloud Code `beforeSave(_User)` see `request.user = caller`,
         # which an integrator can mistake for "the new user". The signup
         # endpoint authenticates by the signup itself, not by a prior
-        # session — pass `nil` explicitly. Master key continues to flow
-        # via the normal authentication middleware when configured.
+        # session, so pass `nil` explicitly. The master key is not sent
+        # either (see Parse::API::Users#create_user): Parse Server mints no
+        # session token for a master-key signup.
         res = client.create_user(body, session_token: nil)
         unless res.error?
           result = res.result