parse-stack-next 5.7.6 → 5.8.1

data/lib/parse/model/bytes.rb

@@ -34,10 +34,12 @@ module Parse
       ATTRIBUTES
     end
 
-    # Base64 encode and set the instance contents
+    # Base64 encode and set the instance contents. Uses strict (RFC 4648)
+    # encoding: `Base64.encode64` inserts a newline every 60 characters,
+    # which Parse Server stores verbatim in the Bytes column.
     # @param str the string to encode
     def encode(str)
-      @base64 = Base64.encode64(str)
+      @base64 = Base64.strict_encode64(str.to_s)
     end
 
     # Get the content as decoded base64 bytes
@@ -45,11 +47,17 @@ module Parse
       Base64.decode64(@base64 || "")
     end
 
+    # Mass-assign the base64 content from a base64 String, a Parse Bytes
+    # hash (`{"__type" => "Bytes", "base64" => "..."}`), or another
+    # {Parse::Bytes}.
+    # @param a [String, Hash, Parse::Bytes]
     def attributes=(a)
-      if a.is_a?(String)
-        @bytes = a
+      if a.is_a?(Bytes)
+        @base64 = a.base64.dup
+      elsif a.is_a?(String)
+        @base64 = a.dup
       elsif a.is_a?(Hash)
-        @bytes = a["base64"] || @bytes
+        @base64 = a["base64"] || a[:base64] || @base64
       end
     end
 

data/lib/parse/model/classes/role.rb

@@ -62,6 +62,78 @@ module Parse
     # @return [RelationCollectionProxy<User>] a Parse relation of users belonging to this role.
     has_many :users, through: :relation
 
+    # Grants and revocations reach mongo-direct ACL resolution immediately
+    # rather than after the role-cache TTL: the users whose membership a save
+    # changes have their cached role closures dropped, and a change to the
+    # role hierarchy drops them all.
+    before_save :_capture_role_membership_changes
+    after_save :_invalidate_role_caches
+
+    # Atomic relation operations (`role.users.add!`, `role.roles.remove!`)
+    # write immediately without a save, so they invalidate the same caches.
+    # @!visibility private
+    def op_add_relation!(field, objects = [])
+      result = super
+      _invalidate_after_relation_op(field, objects) if result
+      result
+    end
+
+    # @!visibility private
+    def op_remove_relation!(field, objects = [])
+      result = super
+      _invalidate_after_relation_op(field, objects) if result
+      result
+    end
+
+    # @!visibility private
+    def _invalidate_after_relation_op(field, objects)
+      key = field.to_s
+      if %w[roles].include?(key)
+        @_role_hierarchy_changed = true
+      elsif %w[users].include?(key)
+        @_role_membership_changed_ids = Array(objects).filter_map do |u|
+          id = u.respond_to?(:id) ? u.id : (u.is_a?(Hash) ? (u["objectId"] || u[:objectId]) : u)
+          id.to_s if id.present?
+        end
+      else
+        return
+      end
+      _invalidate_role_caches
+    end
+
+    # @!visibility private
+    def _capture_role_membership_changes
+      users_proxy = instance_variable_get(:@users)
+      ids = []
+      if users_proxy.respond_to?(:additions)
+        (Array(users_proxy.additions) + Array(users_proxy.removals)).each do |u|
+          id = u.respond_to?(:id) ? u.id : u
+          ids << id.to_s if id.present?
+        end
+      end
+      roles_proxy = instance_variable_get(:@roles)
+      @_role_hierarchy_changed = roles_proxy.respond_to?(:additions) &&
+                                 (Array(roles_proxy.additions).any? || Array(roles_proxy.removals).any?)
+      @_role_membership_changed_ids = ids.uniq
+      nil
+    end
+
+    # @!visibility private
+    def _invalidate_role_caches
+      auth = client.respond_to?(:authorization) ? client.authorization : nil
+      return unless auth
+      if @_role_hierarchy_changed && auth.respond_to?(:invalidate_all_roles)
+        auth.invalidate_all_roles
+      elsif auth.respond_to?(:invalidate_user_roles)
+        Array(@_role_membership_changed_ids).each { |id| auth.invalidate_user_roles(id) }
+      end
+    rescue StandardError => e
+      warn "[Parse::Role] role cache invalidation failed: #{e.class}"
+    ensure
+      @_role_membership_changed_ids = nil
+      @_role_hierarchy_changed = nil
+    end
+
     # Names of Mongo driver errors that mean "the server is momentarily
     # unreachable", for which falling back to the Parse Server walk is right.
     #
@@ -207,6 +279,12 @@ module Parse
       #   query/constraints) — none of those have a caller scope to
       #   forward. The fast path is opt-in for performance-conscious
       #   callers that can supply explicit authorization.
+      # @note Inside {Parse.without_master_key}, the Parse Server walk (no
+      #   `master:` or `as:`) still reads `_Role` with the master key as SDK
+      #   metadata, so it returns the full role-name closure of `user`, not
+      #   only the publicly readable roles. The block guards against
+      #   accidental master-key use; it does not scope this lookup. Pass
+      #   `as:` for a scope-checked answer.
       # @example
       #   names = Parse::Role.all_for_user(user, master: true)  # admin/analytics
       #   names = Parse::Role.all_for_user(user, as: current_user)  # scope-checked
@@ -351,6 +429,20 @@ module Parse
       end
 
       def role_query_all(constraints, client: nil)
+        # Inside `Parse.without_master_key` the role graph is still read with
+        # the master key. It is metadata the SDK needs to enforce a scope, as
+        # Parse Server reads it itself; read without the key it returned only
+        # publicly readable roles, and that short closure was then cached for
+        # the user and served to every caller until it expired.
+        if Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled?
+          query = Parse::Role.query(constraints.reverse_merge(limit: :max))
+          query.client = client if client
+          # A master-key read: keep it out of the shared response cache.
+          query.cache = false
+          query.instance_variable_set(:@_metadata_master, true)
+          return query.results
+        end
+
         # No explicit client means the historical path, unchanged. This is not
         # only for compatibility: `Parse::Role.all` is what callers and tests
         # observe and stub, and routing around it when nothing asked us to
@@ -885,6 +977,9 @@ module Parse
     #   another's role names.
     # @param strict [Boolean] re-raise role-query failures rather than returning
     #   a partial parent closure.
+    # @note Inside {Parse.without_master_key} the walk still reads `_Role`
+    #   with the master key as SDK metadata, so it returns the full parent
+    #   closure, not only publicly readable roles.
     def all_parent_role_names(max_depth: 10, client: nil, strict: false)
       Parse::Role.expand_inheritance_upward(
         [self], max_depth: max_depth, client: client, strict: strict,

data/lib/parse/model/classes/session.rb

@@ -90,7 +90,9 @@ module Parse
         opts.delete(:session_token)
         response = client.fetch_session(token, **opts)
         if response.success?
-          return Parse::Session.build response.result
+          built = Parse::Session.build response.result
+          _remember_owners!([built], client)
+          return built
         end
         nil
       end
@@ -204,5 +206,306 @@ module Parse
     def revoke!
       destroy
     end
+
+    # Deletes the session and forgets it in the client's identity plane, so
+    # mongo-direct and Atlas Search reads stop resolving the token at once
+    # instead of when the cached entry expires. Both the token and the owning
+    # user's entries are dropped. A session that does not carry them (built
+    # from its objectId, or fetched without the master key or with `keys:`
+    # leaving them out) has them looked up first: with the master key as SDK
+    # metadata when the client has one, otherwise with the `session:` passed
+    # here. A lookup that finds no row leaves nothing to forget. Only a
+    # lookup that fails outright drops every cached identity on the client,
+    # at most once every {RESET_INTERVAL} seconds per client.
+    #
+    # The entries are dropped when the delete succeeds or reports the row
+    # is already gone (or not visible to the caller). A delete that raises
+    # still drops the known token, which is harmless, but does not touch the
+    # owner's entries.
+    #
+    # A batch delete through `Array#destroy` drops the same entries for
+    # each session in it. With an identity plane that cannot drop a
+    # single user's entries (a custom plane without `bump_generation` or
+    # `invalidate_value`), a revoked token keeps resolving until its cached
+    # entry expires.
+    # @param session [String] (see Parse::Object#destroy)
+    # @return [Boolean] whether the operation was successful.
+    def destroy(session: nil)
+      # A session never saved is not deleted (see Parse::Object#destroy), so
+      # there is nothing to forget either.
+      return super if new?
+      token = nil
+      owner_id = nil
+      begin
+        Parse::Session.send(:_preload_identity_for_destroy!, [self], session_token: session)
+        token, owner_id = _identity_for_destroy
+      ensure
+        # The looked-up token is a live credential: keep it in locals only.
+        _clear_identity_for_destroy!
+      end
+      result = nil
+      begin
+        result = super
+      ensure
+        # `false` covers "object not found", which is either a session
+        # already revoked elsewhere or one the caller cannot see; dropping
+        # cached entries is idempotent in both cases. A raised delete still
+        # drops the token it named but leaves the owner alone. A single
+        # delete cannot tell "already gone" from "denied", so an absent row
+        # only uses the recorded owner, never the reset fallback.
+        if result.nil?
+          _forget_identity!(token.is_a?(String) ? token : nil, nil)
+        else
+          _forget_identity!(token, owner_id, reset_fallback: false)
+        end
+      end
+    end
+
+    # Seconds between two full identity-cache resets triggered by a failed
+    # session lookup on the same client.
+    RESET_INTERVAL = 5
+
+    # Process-local record of the last lookup-triggered reset per client.
+    @identity_reset_at = {}
+    @identity_reset_mutex = Mutex.new
+
+    class << self
+      # Record, in the identity context of `cl` (the client that fetched
+      # them), which user owns each session that carries both its objectId
+      # and its owner, so a later delete can drop the owner's cached
+      # identities after the row is gone. Never raises: it runs while query
+      # results are decoded.
+      # @param sessions [Array<Parse::Object>]
+      # @param cl [Parse::Client]
+      # @!visibility private
+      def _remember_owners!(sessions, cl)
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        return unless auth.respond_to?(:remember_session_owner)
+        Array(sessions).each do |o|
+          next unless o.is_a?(Parse::Session)
+          owner_id = o.send(:_identity_owner_id)
+          id = o.id
+          auth.remember_session_owner(id, owner_id) if owner_id && id.present?
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      private
+
+      # Reset `cl`'s identity and role caches, at most once every
+      # {RESET_INTERVAL} seconds per client.
+      # @!visibility private
+      def _rate_limited_identity_reset!(cl)
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        return unless auth.respond_to?(:reset_caches!)
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        due = @identity_reset_mutex.synchronize do
+          last = @identity_reset_at[cl.object_id]
+          next false if last && now - last < RESET_INTERVAL
+          @identity_reset_at[cl.object_id] = now
+          true
+        end
+        auth.reset_caches! if due
+      end
+
+      # Look up the token and owner of every session about to be deleted that
+      # does not carry them, so the delete can drop their identity entries.
+      # One `_Session` query per client. A client with a master key reads it
+      # as SDK metadata (it works inside `Parse.without_master_key`); one
+      # without reads it with `session_token`, or skips the lookup when there
+      # is none. The query never uses the response cache: its rows carry live
+      # session tokens.
+      #
+      # A row the lookup did not return is marked absent: there is nothing
+      # to forget for it. Only a lookup that raised marks its sessions
+      # `:unknown`, which makes their delete reset the client's identity
+      # cache (rate limited).
+      # @param sessions [Array<Parse::Object>]
+      # @param session_token [String, nil] the delete's own session.
+      # @!visibility private
+      def _preload_identity_for_destroy!(sessions, session_token: nil)
+        pending = sessions.select { |o| o.is_a?(Parse::Session) && o.send(:_identity_lookup_needed?) }
+        return if pending.empty?
+        pending.group_by(&:client).each do |cl, group|
+          has_master = cl.respond_to?(:master_key) && cl.master_key.present?
+          token = session_token.respond_to?(:session_token) ? session_token.session_token : session_token
+          token = nil unless token.is_a?(String) && !token.strip.empty?
+          unless has_master || token
+            group.each { |o| o.instance_variable_set(:@_identity_for_destroy, :absent) }
+            next
+          end
+          ids = group.map(&:id).uniq
+          found = begin
+              query = Parse::Session.query(:objectId.in => ids, limit: ids.size)
+              query.keys(:session_token, :user)
+              query.client = cl
+              query.cache = false
+              if has_master
+                query.instance_variable_set(:@_metadata_master, true)
+              else
+                query.session_token = token
+              end
+              query.results.to_h do |row|
+                owner = row.instance_variable_get(:@user)
+                [row.id, [row.instance_variable_get(:@session_token), owner.respond_to?(:id) ? owner.id : nil]]
+              end
+            rescue StandardError => e
+              warn "[Parse::Session] could not look up the token and owner of " \
+                   "#{ids.size} session(s) before deleting them (#{e.class}); " \
+                   "dropping the whole identity cache instead."
+              nil
+            end
+          group.each do |o|
+            mark = if found.nil?
+                :unknown
+              elsif (row = found[o.id]) && (row[0].is_a?(String) || row[1])
+                row
+              else
+                :absent
+              end
+            o.instance_variable_set(:@_identity_for_destroy, mark)
+          end
+        end
+      end
+    end
+
+    # Called by `Array#destroy` for each session in the batch with its
+    # response. The entries are dropped only when the delete succeeded or
+    # reported the row gone ("object not found").
+    # @!visibility private
+    def _after_batch_destroy(response = nil)
+      identity = _identity_for_destroy
+      _clear_identity_for_destroy!
+      return unless Parse::Session.send(:_destroy_applied?, response)
+      # The batch response tells success and "object not found" apart from
+      # a denial, so an absent row whose owner was never recorded may fall
+      # back to the rate-limited reset here.
+      _forget_identity!(*identity, reset_fallback: true)
+    end
+    private :_after_batch_destroy
+
+    # Whether a batch delete response means the row is gone: success, or
+    # "object not found". A missing response (older callers) counts as
+    # applied.
+    # @!visibility private
+    def self._destroy_applied?(response)
+      return true if response.nil?
+      (response.respond_to?(:success?) && response.success?) ||
+        (response.respond_to?(:object_not_found?) && response.object_not_found?)
+    end
+    private_class_method :_destroy_applied?
+
+    # Remove the token and owner {._preload_identity_for_destroy!} looked
+    # up. The token is a live credential and must not outlive the delete
+    # (it would show in `inspect` or `instance_variables`).
+    # @!visibility private
+    def _clear_identity_for_destroy!
+      remove_instance_variable(:@_identity_for_destroy) if instance_variable_defined?(:@_identity_for_destroy)
+    end
+    private :_clear_identity_for_destroy!
+
+    # Whether this session lacks the token or the owner its identity-plane
+    # entries are keyed by: a fetch without the master key (no token) or
+    # with `keys:` leaving them out.
+    # @!visibility private
+    def _identity_lookup_needed?
+      # Keyed on the objectId, not `new?`: `Array#destroy` deletes by id
+      # alone, so a session built from an id (no timestamps loaded) is still
+      # deleted and its token must still be dropped.
+      return false if @id.blank?
+      !@session_token.is_a?(String) || @session_token.empty? || _identity_owner_id.nil?
+    end
+    private :_identity_lookup_needed?
+
+    # Serialization omits `sessionToken` unless `include_session_token: true`
+    # is passed. A session token is a bearer credential, and `as_json` is the
+    # surface that reaches logs, API responses and agent tool output.
+    # @param opts [Hash] see Parse::Object#as_json.
+    # @option opts [Boolean] :include_session_token include the token.
+    # @return [Hash]
+    def as_json(opts = nil)
+      opts = (opts || {}).dup
+      include_token = opts.delete(:include_session_token) == true
+      json = super(opts)
+      return json if include_token || !json.is_a?(Hash)
+      json.except("session_token", "sessionToken", :session_token, :sessionToken)
+    end
+
+    # Redacts the session token from the default inspect output.
+    # @return [String]
+    def inspect
+      looked_up = @_identity_for_destroy
+      Parse::User.redact_session_token(super, @session_token, looked_up.is_a?(Array) ? looked_up[0] : nil)
+    end
+
+    private
+
+    # The token and owner id to forget for this delete: what this instance
+    # carries, completed by {._preload_identity_for_destroy!} when it did
+    # not, or `:unknown` when that lookup failed.
+    # @!visibility private
+    def _identity_for_destroy
+      looked_up = @_identity_for_destroy
+      token = @session_token.is_a?(String) && !@session_token.empty? ? @session_token : nil
+      owner_id = _identity_owner_id
+      return [:unknown, owner_id] if looked_up == :unknown
+      if looked_up == :absent
+        # No row to read: the session is gone or not visible. Forget what
+        # this instance carries; with nothing at all, mark it absent so the
+        # delete can fall back to the recorded owner.
+        return token || owner_id ? [token, owner_id] : [:absent, nil]
+      end
+      if looked_up.is_a?(Array)
+        token ||= looked_up[0]
+        owner_id ||= looked_up[1]
+      end
+      [token, owner_id]
+    end
+
+    # The owning user's id, read from the association ivar directly:
+    # calling `user` on a partially fetched session could trigger an
+    # autofetch just to learn the owner.
+    # @!visibility private
+    def _identity_owner_id
+      owner = @user
+      owner.respond_to?(:id) ? owner.id : nil
+    end
+
+    # Drop the token and the owner's entries from this session's client's
+    # identity plane.
+    # @!visibility private
+    def _forget_identity!(token, owner_id, reset_fallback: false)
+      cl = client
+      if token == :absent
+        # The row was not readable before the delete. Use the owner recorded
+        # when this session was last loaded; without one, and only when the
+        # delete is known to have applied or found the row gone, fall back to
+        # the rate-limited reset. Never on a denied delete.
+        token = nil
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        recorded = auth.respond_to?(:session_owner) ? auth.session_owner(@id) : nil
+        if recorded
+          owner_id ||= recorded
+        elsif owner_id.nil? && reset_fallback
+          Parse::Session.send(:_rate_limited_identity_reset!, cl)
+        end
+      end
+      if token == :unknown
+        # The lookup failed, so the token's entry cannot be named. Drop every
+        # cached identity on this client (the next read of each token
+        # re-resolves it, which is safe), at most once every RESET_INTERVAL
+        # seconds so repeated failures cannot flush a shared plane on every
+        # request. The owner's entries go as well when the owner is known.
+        Parse::Session.send(:_rate_limited_identity_reset!, cl)
+        token = nil
+      end
+      cl.invalidate_session_identity(token) if token.is_a?(String) && cl.respond_to?(:invalidate_session_identity)
+      cl.invalidate_user_identity(owner_id) if owner_id && cl.respond_to?(:invalidate_user_identity)
+    rescue StandardError
+      # Runs from an `ensure`: never replace the delete's own outcome.
+      nil
+    end
   end
 end

data/lib/parse/model/classes/user.rb

@@ -202,6 +202,17 @@ module Parse
   class User < Parse::Object
     parse_class Parse::Model::CLASS_USER
 
+    # ActiveModel naming relative to the `Parse` namespace, so Rails forms,
+    # params, routes, and i18n see `Parse::User` as `user`
+    # (`params[:user]`, `users_path`) rather than `parse_user`. `name` stays
+    # "Parse::User". A subclass outside the `Parse` namespace keeps the
+    # default naming.
+    # @return [ActiveModel::Name]
+    def self.model_name
+      return super if name.nil? || !name.start_with?("Parse::")
+      @_relative_model_name ||= ActiveModel::Name.new(self, Parse)
+    end
+
     # When true (default), saving a new {Parse::User} that has a `password`
     # value routes through Parse Server's signup endpoint (`POST /parse/users`)
     # with the `X-Parse-Revocable-Session` header set, so the signup response
@@ -701,7 +712,7 @@ module Parse
 
       if response.success?
         result = response.result || {}
-        @updated_at = result["updatedAt"] || @updated_at
+        @updated_at = _server_date(result["updatedAt"]) || @updated_at
         # Parse Server may rotate the session token on a credential
         # change; apply it narrowly if present without going through the
         # full property writer chain.
@@ -815,8 +826,8 @@ module Parse
         # save-as-signup path had already addressed.
         result = response.result
         @id = result[Parse::Model::OBJECT_ID] || @id
-        @created_at = result["createdAt"] || @created_at
-        @updated_at = result["updatedAt"] || result["createdAt"] || @updated_at
+        @created_at = _server_date(result["createdAt"]) || @created_at
+        @updated_at = _server_date(result["updatedAt"] || result["createdAt"]) || @updated_at
         set_attributes!(result.slice(*SIGNUP_RESPONSE_APPLY_KEYS))
         # Drop the plaintext password from memory now that the server
         # has it hashed and we no longer need it. Matches the Parse JS
@@ -908,6 +919,78 @@ module Parse
       self.session_token.present?
     end
 
+    # Replace each non-empty token in `text` with `[FILTERED]`. Used by the
+    # `inspect` overrides on {Parse::User} and {Parse::Session} so a session
+    # token does not land in logs, exception messages or console history.
+    # @!visibility private
+    # @param text [String] the inspect output.
+    # @param tokens [Array<String, nil>] tokens to redact.
+    # @return [String]
+    def self.redact_session_token(text, *tokens)
+      out = text.to_s
+      tokens.each do |t|
+        next unless t.is_a?(String) && !t.strip.empty?
+        out = out.gsub(t, "[FILTERED]")
+      end
+      out
+    end
+
+    # Default inspect output with the session token redacted.
+    # @return [String]
+    def inspect
+      self.class.redact_session_token(super, @session_token, @_session_token)
+    end
+
+    # Saves pending changes. When the save changes the password, Parse Server
+    # revokes the user's other sessions, so this client's identity plane
+    # drops every cached entry for the user to make the revocation visible
+    # to mongo-direct reads at once.
+    # @!visibility private
+    def update!(raw: false, force: false)
+      password_changing = changed.include?("password")
+      result = super
+      ok = raw ? (result.respond_to?(:success?) && result.success?) : result == true
+      if ok && password_changing && client.respond_to?(:invalidate_user_identity)
+        client.invalidate_user_identity(id)
+      end
+      result
+    end
+
+    # Deletes the user. Every cached identity entry for the user is dropped
+    # from this client's identity plane, since Parse Server removes the
+    # user's sessions with the account. The entries are dropped when the
+    # delete returns, successful or not (a failure is usually "object not
+    # found": the account is already gone or not visible to the caller, and
+    # dropping cached entries is idempotent). A delete that raises leaves
+    # them alone.
+    # @param session [String] (see Parse::Object#destroy)
+    # @return [Boolean] whether the operation was successful.
+    def destroy(session: nil)
+      user_id = id
+      result = super
+      begin
+        client.invalidate_user_identity(user_id) if user_id.present? && client.respond_to?(:invalidate_user_identity)
+      rescue StandardError
+        # Never replace the delete's own outcome.
+        nil
+      end
+      result
+    end
+
+    # Called by `Array#destroy` for each user in the batch with its
+    # response. Drops the user's identity entries, as {#destroy} does, when
+    # the delete succeeded or the row is already gone; a denied delete
+    # leaves them alone.
+    # @!visibility private
+    def _after_batch_destroy(response = nil)
+      applied = response.nil? ||
+                (response.respond_to?(:success?) && response.success?) ||
+                (response.respond_to?(:object_not_found?) && response.object_not_found?)
+      return unless applied
+      client.invalidate_user_identity(id) if id.present? && client.respond_to?(:invalidate_user_identity)
+    end
+    private :_after_batch_destroy
+
     # Invalid the current session token for this logged in user.
     # @return [Boolean] True/false if successful
     def logout
@@ -1016,7 +1099,10 @@ module Parse
     # the request.
     #
     # @param body [Hash] The hash containing the Parse::User fields. The field `username` and `password` are required.
-    # @option opts [Boolean] :master_key Whether the master key should be used for this request.
+    # @option opts [Boolean] :use_master_key send the master key with the
+    #   signup. Off by default: a master-key signup returns no session token
+    #   and bypasses the `_User` create CLP. Pass `true` only for admin
+    #   provisioning that needs that bypass.
     # @raise [ArgumentError] If `body` contains `authData`/`auth_data`/`objectId` — use {.autologin_service} for federated flows.
     # @raise [Parse::Error::UsernameMissingError] If username is missing.
     # @raise [Parse::Error::PasswordMissingError] If password is missing.
@@ -1145,6 +1231,8 @@ module Parse
     # @param username [String] the user's username
     # @param password [String] the user's password
     # @return [User] a logged in user for the provided username. Returns nil otherwise.
+    # @raise [Parse::MFA::RequiredError] when the account has MFA enabled; use
+    #   {.login_with_mfa} with the user's code.
     # @see .login!
     def self.login(username, password)
       response = client.login(username.to_s, password.to_s)
@@ -1350,6 +1438,13 @@ module Parse
         end
         n
       end
+      # Every session but (optionally) the current one is gone server-side.
+      # Drop the user's identity entries on this client and on the default
+      # client (the logout above went through `Parse.client`). A kept
+      # current token simply re-resolves on its next use.
+      [client, Parse.client].uniq.each do |cl|
+        cl.invalidate_user_identity(id) if cl.respond_to?(:invalidate_user_identity)
+      end
       @session_token = nil unless keep_current
       @session = nil unless keep_current
       count
@@ -1648,14 +1743,15 @@ module Parse
         # Cloud Code `beforeSave(_User)` see `request.user = caller`,
         # which an integrator can mistake for "the new user". The signup
         # endpoint authenticates by the signup itself, not by a prior
-        # session — pass `nil` explicitly. Master key continues to flow
-        # via the normal authentication middleware when configured.
+        # session, so pass `nil` explicitly. The master key is not sent
+        # either (see Parse::API::Users#create_user): Parse Server mints no
+        # session token for a master-key signup.
         res = client.create_user(body, session_token: nil)
         unless res.error?
           result = res.result
           @id = result[Parse::Model::OBJECT_ID] || @id
-          @created_at = result["createdAt"] || @created_at
-          @updated_at = result["updatedAt"] || result["createdAt"] || @updated_at
+          @created_at = _server_date(result["createdAt"]) || @created_at
+          @updated_at = _server_date(result["updatedAt"] || result["createdAt"]) || @updated_at
           # Plaintext password is no longer needed locally; the server
           # has it hashed. Direct ivar assignment avoids re-dirtying the
           # field.