parse-stack-next 5.7.6 → 5.8.1

data/lib/parse/cache/sub_cache.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require "securerandom"
 require "set"
 
 module Parse
@@ -163,6 +164,25 @@ module Parse
         value
       end
 
+      # A random marker replaced on every identity invalidation, read by
+      # `Parse::Authorization` before and after it caches a token so an
+      # invalidation from any process in between is detected. A nonce rather
+      # than a counter: a plane clear drops it, and a counter restarting at
+      # 0 could repeat a value an in-flight lookup captured.
+      # @return [String, nil] nil when never set or cleared.
+      def invalidation_nonce
+        value = @store[invalidation_nonce_key]
+        value.nil? ? nil : value.to_s
+      end
+
+      # Replace the invalidation nonce.
+      # @return [String] the new nonce.
+      def bump_invalidation_nonce
+        nonce = SecureRandom.hex(16)
+        @store.store(invalidation_nonce_key, nonce, {})
+        nonce
+      end
+
       # @return [Float] the last invalidation epoch, 0.0 when never set.
       def epoch
         @store[epoch_key].to_f
@@ -253,6 +273,12 @@ module Parse
         @keyspace.key(@family, "meta", "epoch")
       end
 
+      # Sits beside the epoch under the reserved `meta` segment; a token key
+      # is a digest, so no token can name it.
+      def invalidation_nonce_key
+        @keyspace.key(@family, "meta", "invalidation")
+      end
+
       # Generations live in the same family so a plane clear takes them with it,
       # and are namespaced under `gen:` so they cannot collide with an entry
       # whose logical key happens to be a user id.

data/lib/parse/client/authentication.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "faraday"
+require "securerandom"
 require "active_support"
 require "active_support/core_ext"
 
@@ -15,6 +16,18 @@ module Parse
       include Parse::Protocol
       # @!visibility private
       DISABLE_MASTER_KEY = "X-Disable-Parse-Master-Key".freeze
+      # SDK-internal marker for a request that reads metadata (a class
+      # schema, the role graph) while enforcing a scope. Such a request keeps
+      # the master key inside {Parse.without_master_key}, which governs row
+      # access. The header carries a random per-process token and is removed
+      # before the request is logged or sent, so a header copied from user
+      # input cannot set it. {Parse::Client#request} adds it only for the
+      # `metadata_master:` request option set to
+      # {Parse::Client::METADATA_MASTER_REQUEST}.
+      # @!visibility private
+      METADATA_MASTER = "X-Parse-Stack-Metadata-Master".freeze
+      # @!visibility private
+      METADATA_MASTER_TOKEN = SecureRandom.hex(32).freeze
       # @return [String] the application id for this Parse endpoint.
       attr_accessor :application_id
       # @return [String] the REST API Key for this Parse endpoint.
@@ -67,7 +80,12 @@ module Parse
         #   3. A session-token-authenticated request (the existing check
         #      below; session token wins over master key).
         header_disable = env[:request_headers][DISABLE_MASTER_KEY].present?
-        fiber_disable = Parse.master_key_disabled?
+        # An SDK metadata read keeps the master key inside the block. Always
+        # remove the marker so it never reaches the logger or the server.
+        metadata_value = env[:request_headers].delete(METADATA_MASTER)
+        metadata_master = metadata_value.is_a?(String) &&
+                          ActiveSupport::SecurityUtils.secure_compare(metadata_value, METADATA_MASTER_TOKEN)
+        fiber_disable = Parse.master_key_disabled? && !metadata_master
         unless @master_key.blank? || header_disable || fiber_disable
           headers[MASTER_KEY] = @master_key
         end

data/lib/parse/client/batch.rb

@@ -70,12 +70,19 @@ module Parse
     def initialize(reqs = nil, transaction: false)
       @requests = []
       @responses = []
+      @submitted = false
       @transaction = transaction
       reqs = [reqs] unless reqs.is_a?(Enumerable)
       reqs.each { |r| add(r) } if reqs.is_a?(Enumerable)
     end
 
     # Add an additional request to this batch.
+    #
+    # A request tagged to a Parse object (see {Parse::Request#tag}) is skipped
+    # when the batch already holds an identical request for that same object,
+    # so adding an object twice does not send its changes twice. Untagged
+    # requests are always kept: two identical raw requests (for example two
+    # Increment operations) are two writes and are both sent.
     # @overload add(req)
     #  @param req [Parse::Request] the request to append.
     #  @return [Array<Parse::Request>] the set of requests.
@@ -83,16 +90,19 @@ module Parse
     #  @param req [Parse::BatchOperation] add all the requests from this batch operation.
     #  @return [Array<Parse::Request>] the set of requests.
     def add(req)
-      if req.respond_to?(:change_requests)
-        requests = req.change_requests.select { |r| r.is_a?(Parse::Request) }
-        @requests += requests
-      elsif req.is_a?(Array)
-        requests = req.select { |r| r.is_a?(Parse::Request) }
-        @requests += requests
-      elsif req.is_a?(BatchOperation)
-        @requests += req.requests if req.is_a?(BatchOperation)
-      else
-        @requests.push(req) if req.is_a?(Parse::Request)
+      incoming = if req.is_a?(BatchOperation)
+          req.requests
+        elsif req.respond_to?(:change_requests)
+          req.change_requests
+        elsif req.is_a?(Array)
+          req
+        else
+          [req]
+        end
+      incoming.each do |r|
+        next unless r.is_a?(Parse::Request)
+        next if duplicate_object_request?(r)
+        @requests.push(r)
       end
       @requests
     end
@@ -127,13 +137,15 @@ module Parse
       @requests.clear
     end
 
-    # @return [Boolean] true if the request was successful.
+    # @return [Boolean] true if every response in the batch succeeded. A
+    #   batch that was submitted with no requests is successful; one that has
+    #   not been submitted is not.
     def success?
-      return false if @responses.empty?
-      @responses.compact.all?(&:success?)
+      return @submitted == true if @responses.empty?
+      @responses.all? { |r| r.respond_to?(:success?) && r.success? }
     end
 
-    # @return [Boolean] true if the request had an error.
+    # @return [Boolean] true if at least one response in the batch failed.
     def error?
       return false if @responses.empty?
       !success?
@@ -143,57 +155,202 @@ module Parse
     # Parse limits requests in each batch to 50 and it is possible that a {BatchOperation}
     # instance contains more than 50 requests. This method will slice up the array of
     # request and send them based on the `segment` amount until they have all been submitted.
+    #
+    # The returned array always has one response per request, in request
+    # order. When a chunk fails as a whole (an HTTP error, or a response that
+    # cannot be matched to its requests), every request in that chunk gets a
+    # failed response, so a failure never shifts results onto other requests.
+    #
+    # A transactional batch (`transaction: true`) is never split. All of its
+    # requests go to Parse Server in one `POST /batch` with `transaction: true`,
+    # which commits or rolls back as a unit, regardless of `segment`. Parse
+    # Server has no fixed sub-request limit; a server configured with
+    # `requestComplexity.batchRequestLimit` rejects an oversized transaction
+    # for non-master callers, and nothing is written.
+    #
+    # When a chunk raises (for example a 5xx or a dropped connection), the
+    # other chunks are still processed and the block still sees every
+    # request, with failed responses for the chunk that raised. The first
+    # exception is then re-raised.
     # @param segment [Integer] the number of requests to send in each batch. Default 50.
     # @param parallelism [Integer] the number of segments dispatched in
     #   parallel. Defaults to `Parse::BatchOperation.parallelism` (2).
+    # @yieldparam request [Parse::Request] a submitted request.
+    # @yieldparam response [Parse::Response] the response for that request.
     # @return [Array<Parse::Response>] the corresponding set of responses for
     #  each request in the batch.
     def submit(segment = 50, parallelism: self.class.parallelism, &block)
       @responses = []
-      @requests.uniq!(&:signature)
-      parallelism = 1 if parallelism.nil? || parallelism < 1
-      @responses = @requests.each_slice(segment).to_a.threaded_map(parallelism) do |slice|
-        client.batch_request(BatchOperation.new(slice))
+      @submitted = true
+      failure = nil
+      return @responses if @requests.empty?
+
+      if @transaction
+        # One request, one transaction. Exceptions propagate unchanged so the
+        # caller can roll back its local state.
+        @responses = align_responses(@requests, client.batch_request(self))
+      else
+        segment = 50 if segment.nil? || segment < 1
+        parallelism = 1 if parallelism.nil? || parallelism < 1
+        slices = @requests.each_slice(segment).to_a
+        outcomes = slices.threaded_map(parallelism) do |slice|
+          begin
+            [align_responses(slice, client.batch_request(BatchOperation.new(slice))), nil]
+          rescue StandardError => e
+            [Array.new(slice.size) { exception_response(e) }, e]
+          end
+        end
+        @responses = outcomes.flat_map(&:first)
+        failure = outcomes.map(&:last).compact.first
       end
-      @responses.flatten!
+
       @requests.zip(@responses).each(&block) if block_given?
+      raise failure if failure
       @responses
     end
 
     alias_method :save, :submit
+
+    private
+
+    # Whether `req` repeats a request already in the batch for the same
+    # tagged object.
+    def duplicate_object_request?(req)
+      tag = req.tag
+      return false if tag.nil? || tag == 0
+      sig = req.signature
+      @requests.any? { |r| r.tag == tag && r.signature == sig }
+    end
+
+    # Pair a chunk's requests with the result of its batch call, one
+    # response per request.
+    # @param slice [Array<Parse::Request>] the requests that were sent.
+    # @param result [Array<Parse::Response>, Parse::Response] the result of
+    #   {Parse::API::Batch#batch_request}.
+    # @return [Array<Parse::Response>]
+    def align_responses(slice, result)
+      if result.is_a?(Array)
+        slice.each_with_index.map do |_req, i|
+          entry = result[i]
+          next entry if entry.is_a?(Parse::Response)
+          Parse::Response.error_response(
+            Parse::Response::ERROR_INTERNAL,
+            "Batch response had #{result.size} results for #{slice.size} requests",
+          )
+        end
+      elsif result.is_a?(Parse::Response) && result.error?
+        slice.map do
+          Parse::Response.error_response(result.code, result.error, http_status: result.http_status)
+        end
+      else
+        slice.map do
+          Parse::Response.error_response(Parse::Response::ERROR_INTERNAL, "Malformed batch response")
+        end
+      end
+    end
+
+    # A failed response standing in for a request whose chunk raised.
+    def exception_response(error)
+      code = Parse::Response::ERROR_INTERNAL
+      inner = error.respond_to?(:response) ? error.response : nil
+      code = inner.code if inner.respond_to?(:code) && inner.code.is_a?(Integer)
+      Parse::Response.error_response(code, "#{error.class}: #{error.message}")
+    end
   end
 end
 
 class Array
 
   # Submit a batch request for deleting a set of Parse::Objects.
+  #
+  # Each object whose delete succeeds has its local state updated the same
+  # way {Parse::Object#destroy} updates it. Objects whose delete fails are
+  # left untouched; inspect the returned batch's responses to find them.
+  # Destroy callbacks are not run. Every {Parse::Session} and {Parse::User}
+  # whose delete succeeded, or reported "object not found" (the row is
+  # already gone, for example revoked elsewhere), is dropped from its
+  # client's identity plane, as their single-object destroy does.
   # @example
   #  # assume Post and Author are Parse models
   #  author = Author.first
   #  posts = Post.all author: author
   #  posts.destroy # batch destroy request
   # @return [Parse::BatchOperation] the batch operation performed.
+  # @raise ArgumentError if the array is not empty and holds no Parse objects.
   # @see Parse::BatchOperation
   def destroy
+    targets = select { |o| o.respond_to?(:destroy_request) }
+    if targets.empty? && !empty?
+      raise ArgumentError, "Array#destroy requires Parse::Object elements; " \
+                           "this array holds none (#{first.class})"
+    end
+    # A session deleted from a pointer or a partial fetch carries no token or
+    # owner to drop from the identity cache; look them up first, in one
+    # query per client.
+    Parse::Session.send(:_preload_identity_for_destroy!, targets) if defined?(Parse::Session)
+    _destroy_batch(targets)
+  ensure
+    # A looked-up session token is a live credential; never leave it on an
+    # object whose delete was skipped or whose batch raised.
+    targets&.each { |o| o.send(:_clear_identity_for_destroy!) if _batch_identity_hook?(o, :_clear_identity_for_destroy!) }
+  end
+
+  # @!visibility private
+  def _destroy_batch(targets)
     batch = Parse::BatchOperation.new
-    each do |o|
-      next unless o.respond_to?(:destroy_request)
+    objects = {}
+    targets.each do |o|
+      next if objects.key?(o.object_id)
       r = o.destroy_request
-      batch.add(r) unless r.nil?
+      next if r.nil?
+      objects[o.object_id] = o
+      batch.add(r)
+    end
+    batch.submit do |request, response|
+      o = objects[request.tag]
+      next unless o
+      # Sessions and users drop their identity-plane entries when the delete
+      # applied or the row is already gone ("object not found"), so a revoked
+      # token stops resolving now. They decide from the response; a denied
+      # delete leaves the cache alone.
+      o.send(:_after_batch_destroy, response) if _batch_identity_hook?(o, :_after_batch_destroy)
+      next unless response.respond_to?(:success?) && response.success?
+      # Mirror Parse::Object#destroy: keep the id and mark the object
+      # destroyed so it reports `destroyed?` and a later save refuses.
+      o.instance_variable_set(:@_destroyed, true)
+      o.changes_applied! if o.respond_to?(:changes_applied!)
     end
-    batch.submit
     batch
   end
+  private :_destroy_batch
+
+  # Whether `o`'s class defines the internal (non-public) identity hook
+  # `name`. Checked on the class rather than with `respond_to?(name, true)`
+  # so a duck-typed element overriding `respond_to?` cannot break the batch.
+  # @!visibility private
+  def _batch_identity_hook?(o, name)
+    klass = o.class
+    klass.private_method_defined?(name) || klass.method_defined?(name)
+  end
+  private :_batch_identity_hook?
 
   # Do not alias method as :delete is already part of array.
   # alias_method :delete, :destroy
 
-  # Submit a batch request for deleting a set of Parse::Objects.
+  # Submit a batch request for saving a set of Parse::Objects.
   # Batch requests are supported implicitly and intelligently through an
   # extension of array. When an array of Parse::Object subclasses is saved,
   # Parse-Stack will batch all possible save operations for the objects in the
   # array that have changed. It will also batch save 50 at a time until all items
   # in the array are saved. Note: Parse does not allow batch saving Parse::User objects.
+  #
+  # Each object is updated only from its own responses. An object whose
+  # requests all succeed gets its id and timestamps and has its changes
+  # cleared. When an object has several requests (an attribute update plus
+  # relation updates) and only some succeed, the fields written by the
+  # successful requests are cleared and the rest stay dirty, so a later save
+  # resends only what failed. An object listed more than once is saved once.
+  # Elements that are not Parse objects are skipped.
   # @note The objects of the array to be saved do not all have to be of the same collection.
   # @param merge [Boolean] whether to merge the updated changes to the series of
   #  objects back to the original ones submitted. If you don't need the original objects
@@ -206,12 +363,18 @@ class Array
   #  posts.each { |post| post.author = author }
   #  posts.save # batch save
   # @return [Parse::BatchOperation] the batch operation performed.
+  # @raise ArgumentError if the array is not empty and holds no Parse objects.
   # @see Parse::BatchOperation
   def save(merge: true, force: false)
+    targets = select { |o| o.is_a?(Parse::Object) }
+    if targets.empty? && !empty?
+      raise ArgumentError, "Array#save requires Parse::Object elements; " \
+                           "this array holds none (#{first.class})"
+    end
     batch = Parse::BatchOperation.new
     objects = {}
-    each do |o|
-      next unless o.is_a?(Parse::Object)
+    targets.each do |o|
+      next if objects.key?(o.object_id)
       objects[o.object_id] = o
       batch.add o.change_requests(force)
     end
@@ -219,16 +382,82 @@ class Array
       batch.submit
       return batch
     end
-    #rebind updates
-    batch.submit do |request, response|
-      next unless request.tag.present? && response.present? && response.success?
-      o = objects[request.tag]
-      next unless o.is_a?(Parse::Object)
-      result = response.result
-      o.id = result["objectId"] if o.id.blank?
-      o.set_attributes!(result)
-      o.clear_changes!
+    outcomes = Hash.new { |h, k| h[k] = [] }
+    begin
+      batch.submit do |request, response|
+        outcomes[request.tag] << [request, response] if objects.key?(request.tag)
+      end
+    ensure
+      # Apply what landed even when a chunk raised, so a successful create is
+      # never left looking new (which would create it again on the next save).
+      outcomes.each do |tag, pairs|
+        Parse::BatchOperation.apply_save_outcome(objects[tag], pairs)
+      end
     end
     batch
   end #save!
 end
+
+module Parse
+  class BatchOperation
+    # @!visibility private
+    # Apply the batch responses for one object's requests to that object.
+    # @param obj [Parse::Object] the object that was saved.
+    # @param pairs [Array<Array(Parse::Request, Parse::Response)>] its
+    #   requests and their responses.
+    def self.apply_save_outcome(obj, pairs)
+      return unless obj.is_a?(Parse::Object)
+      ok, failed = pairs.partition { |_req, res| res.respond_to?(:success?) && res.success? }
+
+      ok.each do |_req, res|
+        result = res.result
+        next unless result.is_a?(Hash)
+        if obj.id.blank? && result[Parse::Model::OBJECT_ID].present?
+          obj.instance_variable_set(:@id, result[Parse::Model::OBJECT_ID])
+        end
+        created = result["createdAt"]
+        updated = result["updatedAt"] || created
+        obj.instance_variable_set(:@created_at, Parse::Date.parse(created)) if created
+        obj.instance_variable_set(:@updated_at, Parse::Date.parse(updated)) if updated
+        # beforeSave triggers can change saved fields; apply what came back.
+        obj.set_attributes!(result)
+      end
+      return if ok.empty?
+
+      if failed.empty?
+        obj.changes_applied!
+        # Settle array proxies explicitly as well: their dirty state lives on
+        # the proxy, and a proxy left dirty resends the whole array on the
+        # next save.
+        settle_collections(obj, obj.class.fields(:array).keys)
+      else
+        clear_written_fields(obj, ok.map(&:first), failed.map(&:first))
+      end
+    end
+
+    # @!visibility private
+    # Clear dirty tracking only for the fields written by successful
+    # requests that no failed request also touched.
+    def self.clear_written_fields(obj, ok_requests, failed_requests)
+      remote = ->(reqs) { reqs.flat_map { |r| r.body.is_a?(Hash) ? r.body.keys.map(&:to_s) : [] } }
+      written = remote.call(ok_requests) - remote.call(failed_requests)
+      return if written.empty?
+      field_map = obj.class.respond_to?(:field_map) ? obj.class.field_map : {}
+      local = written.map do |key|
+        (field_map.find { |_local, rem| rem.to_s == key }&.first || key).to_s
+      end
+      settle_collections(obj, local)
+      obj.clear_attribute_changes(local) if obj.respond_to?(:clear_attribute_changes)
+    end
+
+    # @!visibility private
+    # Mark the collection proxies behind the named fields as saved.
+    def self.settle_collections(obj, names)
+      names.each do |name|
+        next unless obj.respond_to?(name)
+        value = obj.send(name)
+        value.changes_applied! if value.is_a?(Parse::CollectionProxy) && value.respond_to?(:changes_applied!)
+      end
+    end
+  end
+end

data/lib/parse/client/body_builder.rb

@@ -346,15 +346,36 @@ module Parse
             puts "[[Response]] --------------------------------------\n"
           end
 
+          parsed = true
           begin
             r = Parse::Response.new(response_env.body)
           rescue => e
+            parsed = false
             r = Parse::Response.new
             r.code = response_env.status
             r.error = "Invalid response for #{env[:method]} #{env[:url]}: #{e}"
           end
+          status = response_env[:status].to_i
           r.http_status = response_env[:status]
           r.headers = response_env[:response_headers]
+          if parsed && status.between?(200, 299)
+            # Parse Server never reports an error with a 2xx status, so a
+            # `code` or `error` key in a 2xx body is object data (for example
+            # a column set by a beforeSave trigger), not an error envelope.
+            r.code = nil
+            r.error = nil
+          elsif status > 0 && !status.between?(200, 299) && r.error.blank?
+            # A non-2xx response is a failure even without a Parse `error`
+            # field. It may come from something in front of Parse Server (an
+            # API gateway or load balancer returning 502/504 with
+            # `{"message": ...}`), or from Parse Server itself (a failed
+            # transaction returns `{"code": 1, "message": ...}`). Record the
+            # HTTP status as the code when there is none, so the request is
+            # never mistaken for a success.
+            detail = r.result.is_a?(Hash) ? r.result["message"] : nil
+            r.code ||= status
+            r.error = detail.present? ? detail.to_s : "HTTP #{status} response without a Parse error body"
+          end
           r.code ||= response_env[:status] if r.error.present?
           response_env[:body] = r
         end