parse-stack-next 5.8.0 → 5.8.1

data/lib/parse/authorization.rb

@@ -116,6 +116,49 @@ module Parse
       end
     end
 
+    # Process-local record of session objectId to owning user id, kept apart
+    # from the identity plane so no session token can ever read a record.
+    # Entries expire after `ttl` and the map holds at most {MAX_ENTRIES},
+    # dropping the oldest first. Values are stored typed
+    # (`{"session_owner" => user_id}`) so a shared store passed in its place
+    # cannot confuse a record with an identity entry either.
+    class SessionOwnerMap
+      MAX_ENTRIES = 10_000
+
+      def initialize
+        @data = {}
+        @mutex = Mutex.new
+      end
+
+      def get(key)
+        @mutex.synchronize do
+          entry = @data[key]
+          return nil if entry.nil?
+          if entry[:expires_at] < Time.now
+            @data.delete(key)
+            return nil
+          end
+          entry[:value]
+        end
+      end
+
+      def set(key, value, ttl:)
+        @mutex.synchronize do
+          @data.delete(key)
+          @data[key] = { value: value, expires_at: Time.now + ttl }
+          @data.shift while @data.size > MAX_ENTRIES
+        end
+      end
+
+      def invalidate(key)
+        @mutex.synchronize { @data.delete(key) }
+      end
+
+      def clear
+        @mutex.synchronize { @data.clear }
+      end
+    end
+
     # The outcome of resolving a caller. `user_id` is the `_User.objectId`
     # owning the session, or `nil` for an anonymous caller. `role_names` is a
     # `Set` of bare role names (no `role:` prefix) the user inherits
@@ -189,8 +232,26 @@ module Parse
         @role_cache_ttl = DEFAULT_ROLE_TTL
         @upstream_role_reader = nil
         @compare_upstream_roles = false
+        # Bumped by every invalidation. A token resolution captures it before
+        # calling `/users/me` and does not cache its answer when it moved, so
+        # a resolve already in flight when a session is revoked cannot put
+        # the revoked token back into the plane. A generation-capable plane
+        # (the shared Redis identity plane) keeps a plane-wide counter too,
+        # so the same holds across processes. See {#lookup_user_id}.
+        @invalidation_epoch = 0
+        @epoch_mutex = Mutex.new
+        @session_owner_cache = SessionOwnerMap.new
       end
 
+      # Where {#remember_session_owner} records which user owns a session
+      # objectId. A separate store from the identity plane, so a session
+      # token can never read a record. Defaults to a process-local
+      # {SessionOwnerMap}; set a shared store (anything with `get`, `set`
+      # with `ttl:`, `invalidate`, and `clear`) to share records across
+      # processes.
+      # @return [Object]
+      attr_accessor :session_owner_cache
+
       # Apply settings, leaving anything not passed unchanged.
       # @return [self]
       def configure(identity_cache: nil, role_cache: nil,
@@ -246,6 +307,7 @@ module Parse
       # @param session_token [String]
       def invalidate(session_token)
         return if session_token.nil?
+        bump_invalidation_epoch!
         @identity_cache.invalidate(session_token.to_s)
       end
 
@@ -268,6 +330,7 @@ module Parse
       def invalidate_user(user_id)
         return if user_id.nil? || user_id.to_s.empty?
         uid = user_id.to_s
+        bump_invalidation_epoch!
         cache = @identity_cache
         if generation_capable?(cache) && cache.respond_to?(:bump_generation)
           cache.bump_generation(uid)
@@ -294,8 +357,42 @@ module Parse
 
       # Drop every entry in both planes.
       def reset_caches!
+        bump_invalidation_epoch!
         @identity_cache.clear if @identity_cache.respond_to?(:clear)
         @role_cache.clear if @role_cache.respond_to?(:clear)
+        # A plane clear takes the plane-wide marker with it. Bump it again so
+        # it does not sit at a value a lookup that started before the reset
+        # could have captured.
+        bump_plane_epoch!
+      end
+
+      # Record which user owns a session objectId, so a later delete of that
+      # session can drop the owner's cached identities even when the delete
+      # can no longer read the session row (it is already gone, or not
+      # visible to the caller). Only the owner's user id is stored, never the
+      # token. Called when a `_Session` row with both is loaded from the
+      # server. The entry lives as long as an identity entry.
+      # @param session_id [String]
+      # @param user_id [String]
+      # @return [void]
+      def remember_session_owner(session_id, user_id)
+        return if session_id.to_s.empty? || user_id.to_s.empty?
+        @session_owner_cache.set(session_id.to_s, { "session_owner" => user_id.to_s }, ttl: @identity_cache_ttl)
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # The owner recorded by {#remember_session_owner}, or nil.
+      # @param session_id [String]
+      # @return [String, nil]
+      def session_owner(session_id)
+        return nil if session_id.to_s.empty?
+        value = @session_owner_cache.get(session_id.to_s)
+        owner = value.is_a?(Hash) ? value["session_owner"] : nil
+        owner.is_a?(String) && !owner.empty? ? owner : nil
+      rescue StandardError
+        nil
       end
 
       def inspect
@@ -314,6 +411,14 @@ module Parse
         cached = cached_user_id(session_token)
         return cached unless cached.nil?
 
+        # Captured before `/users/me`: an invalidation that lands while the
+        # lookup is in flight must win over the answer it returns. The plane
+        # marker is created first if a clear removed it, so the snapshot
+        # never holds "no marker", which a concurrent reset also produces.
+        ensure_plane_marker!
+        snapshot = invalidation_snapshot
+        prior_uid, prior_gen = prior_generation(session_token)
+
         response = begin
             # cache: false: a revoked or expired token must not re-resolve
             # from a cached /users/me response after its identity entry is
@@ -331,10 +436,136 @@ module Parse
         raise InvalidSession, "session token resolved no user objectId" if user_id.nil? || user_id.to_s.empty?
 
         user_id = user_id.to_s
-        store_user_id(session_token, user_id)
+        # A stale entry for the same user tells us its generation from
+        # before the lookup; storing under it lets a bump made across
+        # processes during the lookup still reject the entry.
+        store_unless_invalidated(session_token, user_id, snapshot,
+                                 gen: prior_uid == user_id ? prior_gen : nil)
         user_id
       end
 
+      # Cache a resolved identity only if no invalidation happened since
+      # `snapshot` was taken, without a window between the check and the
+      # write.
+      #
+      # Every invalidation bumps the counters BEFORE it drops entries. The
+      # write is checked before and re-checked after; a change seen by the
+      # second check evicts what was just written. So an invalidation either
+      # bumped before the re-check (the entry is evicted here) or bumped
+      # after it, which means it also drops entries after the write (the
+      # entry is removed, or its generation goes stale, by the invalidation
+      # itself). Either way the revoked identity does not stay cached. The
+      # plane-wide counter extends this to invalidations made by other
+      # processes sharing a generation-capable plane.
+      def store_unless_invalidated(session_token, user_id, snapshot, gen: nil)
+        return unless snapshot_usable?(snapshot)
+        return unless invalidation_snapshot == snapshot
+        store_user_id(session_token, user_id, gen: gen)
+        return if invalidation_snapshot == snapshot
+        @identity_cache.invalidate(session_token)
+      rescue StandardError
+        # Not caching is always safe: the next read resolves again.
+        begin
+          @identity_cache.invalidate(session_token)
+        rescue StandardError
+          nil
+        end
+      end
+
+      # The process counter plus, on a generation-capable plane, the
+      # plane-wide counter shared by every process using that plane.
+      def invalidation_snapshot
+        [current_invalidation_epoch, plane_epoch]
+      end
+
+      # A snapshot whose plane counter could not be read cannot prove that no
+      # other process invalidated during the lookup, so it never caches.
+      #
+      # An absent marker on a plane that keeps one is not usable either: a
+      # reset in another process deletes the marker before it installs a new
+      # one, so "absent" before and after the write cannot prove that no reset
+      # ran in between. The re-check after the write compares against a
+      # present marker, so reading it absent there evicts the write.
+      def snapshot_usable?(snapshot)
+        snapshot[1] != :unavailable && snapshot[1] != :absent
+      end
+
+      # Create the plane-wide marker when the plane keeps one and it is
+      # missing (a fresh plane, or one a reset has just cleared).
+      def ensure_plane_marker!
+        cache = @identity_cache
+        if cache.respond_to?(:invalidation_nonce)
+          cache.bump_invalidation_nonce if cache.invalidation_nonce.nil?
+        elsif generation_capable?(cache) && cache.respond_to?(:bump_generation)
+          gen = cache.generation(PLANE_EPOCH_SUBJECT)
+          cache.bump_generation(PLANE_EPOCH_SUBJECT) if gen.nil? || gen.to_i.zero?
+        end
+      rescue StandardError
+        nil
+      end
+
+      def bump_invalidation_epoch!
+        @epoch_mutex.synchronize { @invalidation_epoch += 1 }
+        bump_plane_epoch!
+      end
+
+      def current_invalidation_epoch
+        @epoch_mutex.synchronize { @invalidation_epoch }
+      end
+
+      # Reserved generation subject for the plane-wide invalidation counter
+      # on a custom generation-capable plane without an invalidation nonce.
+      # Parse objectIds are alphanumeric, so it cannot name a real user.
+      PLANE_EPOCH_SUBJECT = "~identity-invalidations"
+
+      # The plane-wide invalidation marker: a random nonce replaced on every
+      # invalidation when the plane offers one ({Parse::Cache::SubCache}
+      # does), else a generation counter. nil when the plane has neither,
+      # `:absent` when the plane keeps one but it is missing (fresh or just
+      # cleared), `:unavailable` when reading it failed. A nonce never repeats,
+      # so a plane clear that drops it cannot make an old value come back. A
+      # generation counter can: a custom plane whose `clear` also deletes its
+      # generations restarts the counter, so a lookup racing another
+      # process's reset is bounded by `identity_cache_ttl`. Such a plane
+      # should implement `invalidation_nonce` / `bump_invalidation_nonce`.
+      def plane_epoch
+        cache = @identity_cache
+        if cache.respond_to?(:invalidation_nonce)
+          nonce = cache.invalidation_nonce
+          return nonce.nil? ? :absent : nonce
+        end
+        return nil unless generation_capable?(cache)
+        gen = cache.generation(PLANE_EPOCH_SUBJECT)
+        gen.nil? || gen.to_i.zero? ? :absent : gen
+      rescue StandardError
+        :unavailable
+      end
+
+      def bump_plane_epoch!
+        cache = @identity_cache
+        if cache.respond_to?(:bump_invalidation_nonce)
+          cache.bump_invalidation_nonce
+        elsif generation_capable?(cache) && cache.respond_to?(:bump_generation)
+          cache.bump_generation(PLANE_EPOCH_SUBJECT)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # The user id and that user's current generation from a stale entry
+      # already stored for the token, read before `/users/me`.
+      # @return [Array(String, Object), Array(nil, nil)]
+      def prior_generation(session_token)
+        cache = @identity_cache
+        return [nil, nil] unless generation_capable?(cache)
+        raw = cache.get(session_token)
+        uid = raw.is_a?(Hash) ? (raw["user_id"] || raw[:user_id]) : nil
+        return [nil, nil] if uid.nil?
+        [uid.to_s, cache.generation(uid.to_s)]
+      rescue StandardError
+        [nil, nil]
+      end
+
       # Read the identity plane and, where the plane supports it, check that
       # the entry's generation is still current.
       #
@@ -369,10 +600,11 @@ module Parse
 
       # Write the identity entry, tagging it with the subject's current
       # generation when the plane can track one.
-      def store_user_id(session_token, user_id)
+      def store_user_id(session_token, user_id, gen: nil)
         cache = @identity_cache
         if generation_capable?(cache)
-          cache.set(session_token, { "user_id" => user_id, "gen" => cache.generation(user_id) },
+          gen = cache.generation(user_id) if gen.nil?
+          cache.set(session_token, { "user_id" => user_id, "gen" => gen },
                     ttl: @identity_cache_ttl)
         else
           cache.set(session_token, user_id, ttl: @identity_cache_ttl)

data/lib/parse/cache/sub_cache.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require "securerandom"
 require "set"
 
 module Parse
@@ -163,6 +164,25 @@ module Parse
         value
       end
 
+      # A random marker replaced on every identity invalidation, read by
+      # `Parse::Authorization` before and after it caches a token so an
+      # invalidation from any process in between is detected. A nonce rather
+      # than a counter: a plane clear drops it, and a counter restarting at
+      # 0 could repeat a value an in-flight lookup captured.
+      # @return [String, nil] nil when never set or cleared.
+      def invalidation_nonce
+        value = @store[invalidation_nonce_key]
+        value.nil? ? nil : value.to_s
+      end
+
+      # Replace the invalidation nonce.
+      # @return [String] the new nonce.
+      def bump_invalidation_nonce
+        nonce = SecureRandom.hex(16)
+        @store.store(invalidation_nonce_key, nonce, {})
+        nonce
+      end
+
       # @return [Float] the last invalidation epoch, 0.0 when never set.
       def epoch
         @store[epoch_key].to_f
@@ -253,6 +273,12 @@ module Parse
         @keyspace.key(@family, "meta", "epoch")
       end
 
+      # Sits beside the epoch under the reserved `meta` segment; a token key
+      # is a digest, so no token can name it.
+      def invalidation_nonce_key
+        @keyspace.key(@family, "meta", "invalidation")
+      end
+
       # Generations live in the same family so a plane clear takes them with it,
       # and are namespaced under `gen:` so they cannot collide with an entry
       # whose logical key happens to be a user id.

data/lib/parse/client/authentication.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "faraday"
+require "securerandom"
 require "active_support"
 require "active_support/core_ext"
 
@@ -15,6 +16,18 @@ module Parse
       include Parse::Protocol
       # @!visibility private
       DISABLE_MASTER_KEY = "X-Disable-Parse-Master-Key".freeze
+      # SDK-internal marker for a request that reads metadata (a class
+      # schema, the role graph) while enforcing a scope. Such a request keeps
+      # the master key inside {Parse.without_master_key}, which governs row
+      # access. The header carries a random per-process token and is removed
+      # before the request is logged or sent, so a header copied from user
+      # input cannot set it. {Parse::Client#request} adds it only for the
+      # `metadata_master:` request option set to
+      # {Parse::Client::METADATA_MASTER_REQUEST}.
+      # @!visibility private
+      METADATA_MASTER = "X-Parse-Stack-Metadata-Master".freeze
+      # @!visibility private
+      METADATA_MASTER_TOKEN = SecureRandom.hex(32).freeze
       # @return [String] the application id for this Parse endpoint.
       attr_accessor :application_id
       # @return [String] the REST API Key for this Parse endpoint.
@@ -67,7 +80,12 @@ module Parse
         #   3. A session-token-authenticated request (the existing check
         #      below; session token wins over master key).
         header_disable = env[:request_headers][DISABLE_MASTER_KEY].present?
-        fiber_disable = Parse.master_key_disabled?
+        # An SDK metadata read keeps the master key inside the block. Always
+        # remove the marker so it never reaches the logger or the server.
+        metadata_value = env[:request_headers].delete(METADATA_MASTER)
+        metadata_master = metadata_value.is_a?(String) &&
+                          ActiveSupport::SecurityUtils.secure_compare(metadata_value, METADATA_MASTER_TOKEN)
+        fiber_disable = Parse.master_key_disabled? && !metadata_master
         unless @master_key.blank? || header_disable || fiber_disable
           headers[MASTER_KEY] = @master_key
         end

data/lib/parse/client/batch.rb

@@ -266,7 +266,10 @@ class Array
   # Each object whose delete succeeds has its local state updated the same
   # way {Parse::Object#destroy} updates it. Objects whose delete fails are
   # left untouched; inspect the returned batch's responses to find them.
-  # Destroy callbacks are not run.
+  # Destroy callbacks are not run. Every {Parse::Session} and {Parse::User}
+  # whose delete succeeded, or reported "object not found" (the row is
+  # already gone, for example revoked elsewhere), is dropped from its
+  # client's identity plane, as their single-object destroy does.
   # @example
   #  # assume Post and Author are Parse models
   #  author = Author.first
@@ -281,6 +284,19 @@ class Array
       raise ArgumentError, "Array#destroy requires Parse::Object elements; " \
                            "this array holds none (#{first.class})"
     end
+    # A session deleted from a pointer or a partial fetch carries no token or
+    # owner to drop from the identity cache; look them up first, in one
+    # query per client.
+    Parse::Session.send(:_preload_identity_for_destroy!, targets) if defined?(Parse::Session)
+    _destroy_batch(targets)
+  ensure
+    # A looked-up session token is a live credential; never leave it on an
+    # object whose delete was skipped or whose batch raised.
+    targets&.each { |o| o.send(:_clear_identity_for_destroy!) if _batch_identity_hook?(o, :_clear_identity_for_destroy!) }
+  end
+
+  # @!visibility private
+  def _destroy_batch(targets)
     batch = Parse::BatchOperation.new
     objects = {}
     targets.each do |o|
@@ -292,7 +308,13 @@ class Array
     end
     batch.submit do |request, response|
       o = objects[request.tag]
-      next unless o && response.respond_to?(:success?) && response.success?
+      next unless o
+      # Sessions and users drop their identity-plane entries when the delete
+      # applied or the row is already gone ("object not found"), so a revoked
+      # token stops resolving now. They decide from the response; a denied
+      # delete leaves the cache alone.
+      o.send(:_after_batch_destroy, response) if _batch_identity_hook?(o, :_after_batch_destroy)
+      next unless response.respond_to?(:success?) && response.success?
       # Mirror Parse::Object#destroy: keep the id and mark the object
       # destroyed so it reports `destroyed?` and a later save refuses.
       o.instance_variable_set(:@_destroyed, true)
@@ -300,6 +322,17 @@ class Array
     end
     batch
   end
+  private :_destroy_batch
+
+  # Whether `o`'s class defines the internal (non-public) identity hook
+  # `name`. Checked on the class rather than with `respond_to?(name, true)`
+  # so a duck-typed element overriding `respond_to?` cannot break the batch.
+  # @!visibility private
+  def _batch_identity_hook?(o, name)
+    klass = o.class
+    klass.private_method_defined?(name) || klass.method_defined?(name)
+  end
+  private :_batch_identity_hook?
 
   # Do not alias method as :delete is already part of array.
   # alias_method :delete, :destroy

data/lib/parse/client.rb

@@ -283,6 +283,14 @@ module Parse
     DEFAULT_RETRIES = 2
     # The wait time in seconds between retries
     RETRY_DELAY = 1.5
+    # SDK-internal value for the `metadata_master:` request option. A request
+    # that passes it together with `use_master_key: true` reads metadata (a
+    # class schema, the role graph) and keeps the master key inside
+    # {Parse.without_master_key}. Only this exact object turns it on.
+    # @!visibility private
+    METADATA_MASTER_REQUEST = Object.new.tap do |o|
+      def o.inspect = "#<Parse::Client::METADATA_MASTER_REQUEST>"
+    end.freeze
 
     # An error when a general response error occurs when communicating with Parse server.
     class ResponseError < Parse::Error; end
@@ -1319,7 +1327,10 @@ module Parse
           body ||= _request.body
           headers.merge! _request.headers
         else
-          _request = Parse::Request.new(method, uri, body: body, headers: headers, opts: opts)
+          # The metadata-master sentinel stays off the stored request: a
+          # caller replaying `response.request` later must not inherit it.
+          _request = Parse::Request.new(method, uri, body: body, headers: headers,
+                                                     opts: opts.except(:metadata_master))
           # Request copies the headers it is given, so carry its request id
           # back onto the outgoing headers.
           headers.merge!(_request.headers)
@@ -1348,6 +1359,14 @@ module Parse
         #      never sent unless the caller explicitly passed `use_master_key: true`
         explicit_master = opts.key?(:use_master_key)
 
+        # SDK metadata reads (class schemas, the role graph) keep the master
+        # key inside `Parse.without_master_key`. Only the internal sentinel
+        # turns this on; a `true` or any other value from a caller does not.
+        # The marker goes on a per-attempt copy of the headers handed to the
+        # connection (below), never on `headers` or the stored request, so a
+        # retry, `response.request`, or an error reporter never carries it.
+        metadata_master = opts[:metadata_master].equal?(METADATA_MASTER_REQUEST) && opts[:use_master_key] == true
+
         if opts[:use_master_key] == false
           headers[Parse::Middleware::Authentication::DISABLE_MASTER_KEY] = "true"
         elsif Parse.client_mode && opts[:use_master_key] != true
@@ -1417,7 +1436,12 @@ module Parse
         params = (method == :get ? query : body) || {}
         # if the path does not start with the '/1/' prefix, then add it to be nice.
         # actually send the request and return the body
-        response_env = @conn.send(method, uri, params, headers)
+        send_headers = headers
+        if metadata_master
+          send_headers = headers.merge(Parse::Middleware::Authentication::METADATA_MASTER =>
+                                         Parse::Middleware::Authentication::METADATA_MASTER_TOKEN)
+        end
+        response_env = @conn.send(method, uri, params, send_headers)
         response = response_env.body
         response.request = _request
 

data/lib/parse/clp_scope.rb

@@ -86,7 +86,14 @@ module Parse
     # at request rate.
     NEGATIVE_TTL = 5
 
+    # How long a schema fetch that failed inside `Parse.without_master_key`
+    # is remembered. Kept apart from the shared cache and consulted only
+    # inside the block, so it never denies another caller's reads; it only
+    # stops a down server from being refetched on every read in the block.
+    SUPPRESSED_NEGATIVE_TTL = 2
+
     @cache = {}
+    @suppressed_failures = {}
     @cache_mutex = Mutex.new
     @cache_ttl = POSITIVE_TTL
 
@@ -490,7 +497,10 @@ module Parse
       end
 
       def reset_cache!
-        @cache_mutex.synchronize { @cache.clear }
+        @cache_mutex.synchronize do
+          @cache.clear
+          @suppressed_failures.clear
+        end
         # Also drop the unresolvable-class warned-once registry so
         # tests that assert on `warn` emission for a class don't get
         # silenced by an earlier test's call.
@@ -599,6 +609,12 @@ module Parse
         cached = @cache_mutex.synchronize { @cache[key] }
         return cached if cached && !stale?(cached)
 
+        suppressed = Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled?
+        if suppressed
+          failed_at = @cache_mutex.synchronize { @suppressed_failures[key] }
+          return unresolvable_entry if failed_at && monotonic_now - failed_at < SUPPRESSED_NEGATIVE_TTL
+        end
+
         entry = if resolved_client.nil?
             # No client configured (Parse.setup never called, etc.) —
             # treat as unresolvable so we fail closed instead of
@@ -620,7 +636,17 @@ module Parse
             end
           end
 
-        @cache_mutex.synchronize { @cache[key] = entry }
+        # A failure inside `Parse.without_master_key` is not put in the
+        # shared cache. The request keeps the master key there, but a custom
+        # schema source may not, and a negative entry is shared by every
+        # caller of this class for {NEGATIVE_TTL}: one block must not deny
+        # every other request's scoped reads. It is remembered briefly in a
+        # separate table read only inside the block.
+        if entry.kind == :unresolvable && suppressed
+          @cache_mutex.synchronize { @suppressed_failures[key] = monotonic_now }
+        else
+          @cache_mutex.synchronize { @cache[key] = entry }
+        end
         entry
       end
 
@@ -637,6 +663,13 @@ module Parse
       # and the client-bound session token. A client that holds no master key
       # still cannot read schemas, which stays fail-closed.
       #
+      # The schema is metadata, so the request also carries the SDK's
+      # metadata marker: it keeps the master key inside
+      # `Parse.without_master_key`, which strips it from every other request
+      # in the block. Without it the fetch was refused there and the
+      # `:unresolvable` entry denied every scoped read of the class, for all
+      # callers, until it expired.
+      #
       # Objects that only implement `#schema` (test doubles, custom schema
       # sources installed via {.schema_client}), and clients whose `#schema`
       # was overridden on the instance, keep the old call.
@@ -649,7 +682,8 @@ module Parse
         if resolved_client.is_a?(Parse::Client) && stock_schema
           safe = Parse::API::PathSegment.identifier!(class_key, kind: "class name")
           resolved_client.request(:get, "schemas/#{safe}",
-                                  opts: { cache: false, use_master_key: true })
+                                  opts: { cache: false, use_master_key: true,
+                                          metadata_master: Parse::Client::METADATA_MASTER_REQUEST })
         else
           resolved_client.schema(class_key)
         end