parse-stack-next 5.7.6 → 5.8.1

data/lib/parse/stack.rb

@@ -62,6 +62,25 @@ module Parse
   # the first attempt and gone by the retry; the fiber-local state lives
   # for the lifetime of the block).
   #
+  # Mongo-direct reads follow the same rule: an explicit `master: true`
+  # passed to `Parse::MongoDB.aggregate`, a `Parse::Query` direct terminal,
+  # Atlas Search, or vector search runs in the public scope inside the
+  # block (or raises `ACLRequired` when `require_session_token` is on), and
+  # the `parse.mongodb.aggregate` notification payload carries
+  # `master_dropped: true`. `Parse::AtlasSearch.faceted_search` refuses to
+  # run inside the block. A LiveQuery admin connection opened inside the
+  # block sends no master key; one that already connected with it stays
+  # elevated, because Parse Server authorizes per connection.
+  #
+  # The SDK's own metadata reads keep the master key inside the block: the
+  # class schemas and role graph it reads to enforce a scope, index
+  # statistics, and the Atlas Search index listing. Those requests are
+  # marked individually; the block's state is never lifted while they run.
+  #
+  # This is a guard against accidental master-key use, not an isolation
+  # boundary. Code inside the block can call {Parse.with_master_key}, and
+  # `Parse::MongoDB.find` and `Parse::MongoDB.indexes` take no scope at all.
+  #
   # @yield runs the block with master-key disabled
   # @return [Object] the block's return value
   # @example
@@ -115,9 +134,12 @@ module Parse
   #
   # The `token` argument may be a String, a {Parse::User} (its
   # `session_token` is read), a {Parse::Session} (its `session_token` is
-  # read), or `nil`. Passing `nil` clears the ambient inside the block —
-  # useful for performing one anonymous call inside an otherwise
-  # session-scoped region.
+  # read), or `nil`. Passing `nil`, or a user or session that carries no
+  # token, runs the block ANONYMOUSLY: requests inside it send neither a
+  # session token nor the master key, and a client's bound token is not
+  # used either. This is useful for performing one anonymous call inside an
+  # otherwise session-scoped region. A call inside the block can still opt
+  # out with an explicit `session_token:` or `use_master_key: true`.
   #
   # Fiber-local, not thread-local: concurrent fibers (and threads, since
   # each thread starts with its own root fiber) do not share state.
@@ -156,17 +178,37 @@ module Parse
         "token is refused so the block cannot silently execute with master-key " \
         "authority — pass a valid session token, or `nil` for no ambient session."
     end
-    Fiber[SESSION_TOKEN_STATE_KEY] = resolved
+    # `nil` (no token, or a user/session without one) installs the
+    # anonymous sentinel rather than clearing the slot. A cleared slot meant
+    # "no ambient", which the request layer resolves to the master key on a
+    # master-keyed client: the opposite of the documented anonymous block.
+    Fiber[SESSION_TOKEN_STATE_KEY] = resolved.nil? ? ANONYMOUS_SESSION : resolved
     yield
   ensure
     Fiber[SESSION_TOKEN_STATE_KEY] = previous
   end
 
+  # Fiber-state sentinel installed by `Parse.with_session(nil)`. The request
+  # layer treats it as "anonymous": no session token and no master key.
+  # @!visibility private
+  ANONYMOUS_SESSION = :__parse_anonymous_session__
+
   # The ambient session token set by {.with_session} for the current
-  # fiber, or `nil` when not inside such a block.
+  # fiber, or `nil` when not inside such a block or inside an anonymous
+  # `with_session(nil)` block (see {.anonymous_session?}).
   # @return [String, nil]
   def self.current_session_token
-    Fiber[SESSION_TOKEN_STATE_KEY]
+    value = Fiber[SESSION_TOKEN_STATE_KEY]
+    value == ANONYMOUS_SESSION ? nil : value
+  end
+
+  # Whether the current fiber is inside an anonymous `Parse.with_session(nil)`
+  # block (directly, or nested without a token-bearing block inside it).
+  # Requests there carry no session token and no master key unless the call
+  # passes `session_token:` or `use_master_key: true` explicitly.
+  # @return [Boolean]
+  def self.anonymous_session?
+    Fiber[SESSION_TOKEN_STATE_KEY] == ANONYMOUS_SESSION
   end
 
   # @!visibility private
@@ -776,10 +818,17 @@ module Parse
     #   - the name singularizes to a *different* string (i.e. looks plural),
     #   - the singular form does NOT already end in `s` (per design: classes
     #     whose name ends in `s` are not auto-aliased),
-    #   - the singular constant is defined (searching ancestors so a
-    #     top-level model is visible from a nested reference) and is a
-    #     `Parse::Object` subclass,
-    #   - the plural is not already defined on the referencing module.
+    #   - the singular constant resolves from the referencing module and
+    #     is a `Parse::Object` subclass,
+    #   - the plural is not already defined in the singular class's own
+    #     namespace.
+    #
+    # The alias is installed in the namespace that defines the singular
+    # class (`Object` for a top-level `Post`, `Blog` for `Blog::Post`), never
+    # on the module where the lookup happened. A reference to `Posts` from
+    # inside an unrelated class or module therefore resolves, but does not
+    # add a `Posts` constant to that module. A frozen namespace is left
+    # alone (no `FrozenError`).
     #
     # @param mod [Module] the module/class on which `const_missing` fired.
     # @param name [Symbol] the missing constant name.
@@ -795,15 +844,40 @@ module Parse
       return nil unless mod.const_defined?(sym, true)
       klass = mod.const_get(sym)
       return nil unless klass.is_a?(Class) && klass < Parse::Object
-      return nil if mod.const_defined?(name, false)
-      mod.const_set(name, klass)
+      home = __pluralized_alias_home(klass, sym)
+      return nil if home.nil?
+      if home.const_defined?(name, false)
+        existing = home.const_get(name, false)
+        return existing.equal?(klass) ? klass : nil
+      end
+      return nil if home.frozen?
+      home.const_set(name, klass)
       klass
-    rescue NameError, LoadError
+    rescue NameError, LoadError, FrozenError
       # const_get/const_defined? can raise on malformed names or autoload
       # failures; never let alias resolution mask the original lookup.
       nil
     end
 
+    # @!visibility private
+    # The namespace that directly defines `klass` under the name `singular`,
+    # which is where its pluralized alias belongs. nil when it cannot be
+    # determined (anonymous class, or a constant that only resolves through
+    # an ancestor).
+    # @param klass [Class]
+    # @param singular [Symbol]
+    # @return [Module, nil]
+    def __pluralized_alias_home(klass, singular)
+      name = klass.name
+      return nil if name.nil?
+      parent_name = name.rpartition("::").first
+      home = parent_name.empty? ? ::Object : ::Object.const_get(parent_name, false)
+      return nil unless home.is_a?(Module) && home.const_defined?(singular, false)
+      home.const_get(singular, false).equal?(klass) ? home : nil
+    rescue NameError
+      nil
+    end
+
     # Verify that every association target across the loaded {Parse::Object}
     # subclasses resolves to a known Parse class. Covers `belongs_to` and
     # `property … as:` pointer targets (via each class's `references`),
@@ -1048,4 +1122,7 @@ Parse._attach_slow_query_subscriber! if Parse.slow_query_threshold_ms
 # already defined. Gated at runtime on Parse.pluralized_aliases?.
 require_relative "model/core/pluralized_aliases"
 
-require_relative "stack/railtie" if defined?(::Rails)
+# Only hook into Rails when railties is loaded. A bare `Rails` module (for
+# example the one rails-html-sanitizer defines) has no `Rails::Railtie`, and
+# subclassing it would abort loading the gem.
+require_relative "stack/railtie" if defined?(::Rails::Railtie)

data/lib/parse/two_factor_auth/user_extension.rb

@@ -50,8 +50,14 @@ module Parse
         def login_with_mfa(username, password, mfa_token)
           raise MFA::RequiredError, "MFA token is required" if mfa_token.blank?
 
+          # `client.login_with_mfa` always goes out without the master key
+          # (see Parse::API::Users#login_with_mfa): with it, Parse Server
+          # would skip this verification and overwrite the enrolled secret.
           response = client.login_with_mfa(username, password, mfa_token)
-          return nil unless response.success?
+          unless response.success?
+            raise MFA::VerificationError, response.error.to_s if MFA.invalid_token_response?(response)
+            return nil
+          end
 
           # Self-fetch trust: an MFA login returns the authenticating
           # user's own row, so authData here is legitimately theirs.
@@ -447,8 +453,14 @@ module Parse
       #   user = Parse::User.first
       #   user.login_with_mfa!("password123", "123456")
       def login_with_mfa!(password, mfa_token = nil)
+        raise MFA::RequiredError, "MFA token is required for this account" if mfa_token.blank?
         response = client.login_with_mfa(username.to_s, password.to_s, mfa_token)
-        apply_attributes!(response.result)
+        unless response.success?
+          raise MFA::VerificationError, response.error.to_s if MFA.invalid_token_response?(response)
+          return false
+        end
+        # Self-fetch trust: the login response is this user's own row.
+        self.class.with_authdata_trust { apply_attributes!(response.result) }
         session_token.present?
       rescue Parse::Client::ResponseError => e
         if e.message.include?("Missing additional authData")

data/lib/parse/two_factor_auth.rb

@@ -62,6 +62,17 @@ module Parse
       end
     end
 
+    # Whether a failed login response is Parse Server rejecting the MFA code
+    # (as opposed to wrong credentials). Parse Server's MFA adapter throws a
+    # bare string, which reaches the client as code 141 with the adapter's
+    # message, e.g. "Invalid MFA token".
+    # @!visibility private
+    # @param response [Parse::Response]
+    # @return [Boolean]
+    def self.invalid_token_response?(response)
+      response.respond_to?(:error) && response.error.to_s.start_with?("Invalid MFA token", "Please enter the token")
+    end
+
     # Error raised when MFA is required but not provided
     class RequiredError < Parse::Error
       def initialize(message = "MFA token is required for this account")

data/lib/parse/vector_search/hybrid.rb

@@ -399,9 +399,10 @@ module Parse
         # Build the native `$rankFusion` pipeline (without ACL/CLP
         # stages). Public-ish via {.native_pipeline} for snapshot tests;
         # the live path appends ACL enforcement in {#run_native}.
-        def build_rank_fusion_stage(lex, vec, oversample, k_constant:, weights:)
-          vsel = vector_search_stage(vec, oversample)
-          lsel = lexical_search_stage(lex, oversample)
+        def build_rank_fusion_stage(lex, vec, oversample, k_constant:, weights:,
+                                    owner_vector_filter: nil, owner_match: nil)
+          vsel = vector_search_stage(vec, oversample, owner_filter: owner_vector_filter)
+          lsel = lexical_search_stage(lex, oversample, owner_match: owner_match)
           stage = {
             "input" => {
               "pipelines" => { "vector" => vsel, "lexical" => lsel },
@@ -437,19 +438,44 @@ module Parse
           # AFTER the ACL `$match`, so trimming to `k` there would
           # reintroduce the underfill the window exists to prevent. The
           # trim to `k` happens client-side once enforcement is done.
+          pointer_fields = resolve_pointer_fields!(collection_name, resolution)
           native_pipeline_for(lex, vec, candidate_window, resolution,
                               k_constant: fusion[:k_constant] || DEFAULT_K_CONSTANT,
-                              weights: fusion[:weights], limit: candidate_window)
-        end
-
-        def native_pipeline_for(lex, vec, oversample, resolution, k_constant:, weights:, limit:)
-          pipeline = [build_rank_fusion_stage(lex, vec, oversample, k_constant: k_constant, weights: weights)]
+                              weights: fusion[:weights], limit: candidate_window,
+                              pointer_fields: pointer_fields,
+                              owner_vector_filter: owner_vector_filter(collection_name, vec, pointer_fields, resolution))
+        end
+
+        def native_pipeline_for(lex, vec, oversample, resolution, k_constant:, weights:, limit:,
+                                pointer_fields: nil, owner_vector_filter: nil)
+          scoped = !(resolution.nil? || resolution.master?)
+          # Ownership inside each `$rankFusion` input as well as after it:
+          # every input is capped at `oversample`, so a final `$match`
+          # alone only sees the fused top rows and can underfill when
+          # other users' rows dominate both branches. The lexical input
+          # filters before its `$limit`; the vector input uses the
+          # `$vectorSearch.filter` prefilter when the owner path is
+          # filter-indexed and served (see Parse::VectorSearch).
+          owner_match = if scoped && pointer_fields
+              Parse::CLPScope.pointer_fields_predicate(pointer_fields, resolution.user_id)
+            end
+          pipeline = [build_rank_fusion_stage(lex, vec, oversample, k_constant: k_constant, weights: weights,
+                                                                    owner_vector_filter: (owner_vector_filter if scoped),
+                                                                    owner_match: owner_match)]
           # The fused RRF score is surfaced via `{ $meta: "score" }`
           # (a numeric), not "scoreDetails" (a breakdown document).
           pipeline << { "$addFields" => { "_hybrid_score" => { "$meta" => "score" } } }
           unless resolution.nil? || resolution.master?
             acl_match = Parse::ACLScope.match_stage_for(resolution)
             pipeline << acl_match if acl_match
+            # pointerFields / readUserFields ownership before `$limit`, so
+            # rows ranked above the caller's own rows cannot crowd them
+            # out of the page.
+            if pointer_fields
+              pipeline << {
+                "$match" => Parse::CLPScope.pointer_fields_predicate(pointer_fields, resolution.user_id),
+              }
+            end
           end
           pipeline << { "$sort" => { "_hybrid_score" => -1 } }
           pipeline << { "$limit" => limit }
@@ -463,13 +489,39 @@ module Parse
           protected_fields = Parse::CLPScope.protected_fields_for(
             collection_name, resolution.permission_strings,
           )
+          # Unconditional: `Parse::AtlasSearch` may already be partially
+          # defined by a submodule (session, protected_paths) without the
+          # main file loaded. `require_relative` is idempotent.
+          require_relative "../atlas_search"
+          Parse::AtlasSearch.send(:assert_search_fields_allowed!,
+                                  Array(lex[:fields]).map(&:to_s), protected_fields, resolution)
           Parse::VectorSearch.validate_query_vector!(vec[:query_vector])
           Parse::PipelineSecurity.validate_filter!(vec[:vector_filter]) if vec[:vector_filter]
           Parse::PipelineSecurity.validate_filter!(vec[:filter]) if vec[:filter]
           Parse::PipelineSecurity.validate_filter!(lex[:filter]) if lex[:filter]
+          # The client path gets these refusals from AtlasSearch.search and
+          # VectorSearch.search. The native path builds its own pipeline,
+          # so apply the same protected-field refusals here: the vector
+          # field, every filter's predicate keys, and `$expr` references.
+          Parse::VectorSearch.send(:assert_protected_fields_untouched!,
+                                   collection_name, vec[:field].to_s, vec[:filter],
+                                   vec[:vector_filter], protected_fields, resolution)
+          if lex[:filter] && !lex[:filter].empty? && !resolution.master?
+            Parse::PipelineSecurity.refuse_protected_field_references!(
+              [{ "$match" => lex[:filter] }], collection_name, resolution,
+            )
+            Parse::AtlasSearch::ProtectedPaths.assert_filter_allowed!(
+              lex[:filter], protected_fields, resolution,
+              collection_name: collection_name,
+              method_name: "Parse::VectorSearch::Hybrid.search",
+            )
+          end
 
+          owner_filter = owner_vector_filter(collection_name, vec, pointer_fields, resolution)
           pipeline = native_pipeline_for(lex, vec, oversample, resolution,
-                                         k_constant: k_constant, weights: weights, limit: oversample)
+                                         k_constant: k_constant, weights: weights, limit: oversample,
+                                         pointer_fields: pointer_fields,
+                                         owner_vector_filter: owner_filter)
           rows = run_pipeline!(collection_name, pipeline,
                                authorizing_client: Parse::ACLScope.client_of(resolution))
 
@@ -493,6 +545,8 @@ module Parse
             rows.select! { |doc| native_row_visible?(doc, perms_set) }
             Parse::ACLScope.redact_results!(rows, resolution)
             Parse::CLPScope.redact_protected_fields!(rows, protected_fields) if protected_fields.any?
+            # Defense in depth: the pointerFields `$match` already ran
+            # before `$limit`, so this should drop nothing.
             if pointer_fields
               rows = Parse::CLPScope.filter_by_pointer_fields(rows, pointer_fields, resolution.user_id)
             end
@@ -512,7 +566,13 @@ module Parse
           rows
         rescue Parse::CLPScope::Denied
           raise
-        rescue StandardError
+        rescue StandardError => e
+          # A refused owner prefilter means Atlas serves an index version
+          # without that filter path; stop pushing it down so the client
+          # fallback below (and later searches) run without it.
+          if owner_filter && Parse::VectorSearch.owner_prefilter_rejected?(e, owner_filter)
+            Parse::VectorSearch.owner_prefilter_unavailable!(collection_name, vector_index_name(vec))
+          end
           # Native execution failed (e.g. a cluster that probed as
           # supported but rejects this exact shape, or a transient error).
           # Fall back to the client-side path rather than failing the
@@ -520,7 +580,23 @@ module Parse
           nil
         end
 
-        def vector_search_stage(vec, oversample)
+        # The owner prefilter for the native vector input, or nil when it
+        # cannot be pushed down (master, no pointerFields, or the owner
+        # path not filter-indexed in the index Atlas is serving).
+        def owner_vector_filter(collection_name, vec, pointer_fields, resolution)
+          return nil if resolution.nil? || resolution.master? || pointer_fields.nil?
+          Parse::VectorSearch.send(:owner_vector_prefilter, collection_name, vector_index_name(vec),
+                                   pointer_fields, resolution)
+        end
+
+        # The vector index the native input searches: the branch's
+        # `index:` or {Parse::VectorSearch.default_index}, the same
+        # fallback {Parse::VectorSearch.search} uses on the client path.
+        def vector_index_name(vec)
+          vec[:index] || Parse::VectorSearch.default_index
+        end
+
+        def vector_search_stage(vec, oversample, owner_filter: nil)
           # Parity with Parse::VectorSearch: Atlas requires
           # `numCandidates >= limit` and caps it at 10_000. The default
           # (`oversample * MULTIPLIER`) can blow past 10_000 for a large
@@ -531,19 +607,23 @@ module Parse
           num_candidates = (vec[:num_candidates] || oversample * Parse::VectorSearch::DEFAULT_NUM_CANDIDATES_MULTIPLIER).to_i
           num_candidates = [[num_candidates, oversample].max, 10_000].min
           stage = {
-            "index" => vec[:index].to_s,
+            "index" => vector_index_name(vec).to_s,
             "path" => vec[:field].to_s,
             "queryVector" => vec[:query_vector],
             "numCandidates" => num_candidates,
             "limit" => oversample,
           }
-          stage["filter"] = vec[:vector_filter] if vec[:vector_filter] && !vec[:vector_filter].empty?
+          caller_filter = vec[:vector_filter] if vec[:vector_filter] && !vec[:vector_filter].empty?
+          prefilter = [caller_filter, owner_filter].compact
+          unless prefilter.empty?
+            stage["filter"] = prefilter.size == 1 ? prefilter.first : { "$and" => prefilter }
+          end
           inner = [{ "$vectorSearch" => stage }]
           inner << { "$match" => vec[:filter] } if vec[:filter]
           inner
         end
 
-        def lexical_search_stage(lex, oversample)
+        def lexical_search_stage(lex, oversample, owner_match: nil)
           require_relative "../atlas_search" if defined?(Parse::AtlasSearch::SearchBuilder).nil?
           builder = Parse::AtlasSearch::SearchBuilder.new(index_name: lex[:index])
           fields = lex[:fields]
@@ -552,7 +632,9 @@ module Parse
           else
             Array(fields).each { |f| builder.text(query: lex[:query], path: f.to_s, fuzzy: lex[:fuzzy]) }
           end
-          inner = [builder.build, { "$limit" => oversample }]
+          inner = [builder.build]
+          inner << { "$match" => owner_match } if owner_match
+          inner << { "$limit" => oversample }
           inner << { "$match" => lex[:filter] } if lex[:filter]
           inner
         end
@@ -672,27 +754,22 @@ module Parse
         end
 
         def assert_clp_find!(collection_name, resolution)
-          return if resolution.nil? || resolution.master?
-          unless Parse::CLPScope.permits?(collection_name, :find, resolution.permission_strings)
-            raise Parse::CLPScope::Denied.new(
-              collection_name, :find,
-              "CLP refuses find on '#{collection_name}' for the current hybrid-search scope.",
-            )
-          end
+          # Same CLP branch evaluation as Parse::MongoDB.aggregate (public,
+          # user, and role grants first; then pointerFields / readUserFields).
+          # Raises Parse::CLPScope::Denied when the scope cannot find at all.
+          Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                              label: "hybrid-search")
+          nil
         end
 
         def resolve_pointer_fields!(collection_name, resolution)
-          return nil if resolution.nil? || resolution.master?
-          pointer_fields = Parse::CLPScope.pointer_fields_for(collection_name, :find)
-          return nil if pointer_fields.nil?
-          if resolution.user_id.nil?
-            raise Parse::CLPScope::Denied.new(
-              collection_name, :find,
-              "CLP requires user identity (pointerFields=#{pointer_fields.inspect}) " \
-              "but the current hybrid-search scope has no user_id.",
-            )
-          end
-          pointer_fields
+          # nil when a public, user, or role grant already permits every row
+          # (Parse Server ignores pointer permissions then); otherwise the
+          # pointerFields plus readUserFields the rows must match. The older
+          # permits? / pointer_fields_for pair missed readUserFields entirely
+          # and over-restricted a public grant that also listed pointerFields.
+          Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                              label: "hybrid-search")
         end
 
         def validate_weights!(weights)