parse-stack-next 5.8.0 → 5.8.1

data/lib/parse/model/classes/session.rb

@@ -90,7 +90,9 @@ module Parse
         opts.delete(:session_token)
         response = client.fetch_session(token, **opts)
         if response.success?
-          return Parse::Session.build response.result
+          built = Parse::Session.build response.result
+          _remember_owners!([built], client)
+          return built
         end
         nil
       end
@@ -205,29 +207,218 @@ module Parse
       destroy
     end
 
-    # Deletes the session and, on success, forgets it in the client's
-    # identity plane so mongo-direct and Atlas Search reads stop resolving
-    # the token at once instead of when the cached entry expires. The token
-    # is dropped when this instance carries it; the owning user's entries
-    # are dropped as well, since a session fetched without the master key
-    # does not carry its token.
+    # Deletes the session and forgets it in the client's identity plane, so
+    # mongo-direct and Atlas Search reads stop resolving the token at once
+    # instead of when the cached entry expires. Both the token and the owning
+    # user's entries are dropped. A session that does not carry them (built
+    # from its objectId, or fetched without the master key or with `keys:`
+    # leaving them out) has them looked up first: with the master key as SDK
+    # metadata when the client has one, otherwise with the `session:` passed
+    # here. A lookup that finds no row leaves nothing to forget. Only a
+    # lookup that fails outright drops every cached identity on the client,
+    # at most once every {RESET_INTERVAL} seconds per client.
+    #
+    # The entries are dropped when the delete succeeds or reports the row
+    # is already gone (or not visible to the caller). A delete that raises
+    # still drops the known token, which is harmless, but does not touch the
+    # owner's entries.
+    #
+    # A batch delete through `Array#destroy` drops the same entries for
+    # each session in it. With an identity plane that cannot drop a
+    # single user's entries (a custom plane without `bump_generation` or
+    # `invalidate_value`), a revoked token keeps resolving until its cached
+    # entry expires.
     # @param session [String] (see Parse::Object#destroy)
     # @return [Boolean] whether the operation was successful.
     def destroy(session: nil)
-      token = @session_token
-      # Read the association ivar directly: calling `user` on a partially
-      # fetched session could trigger an autofetch just to learn the owner.
-      owner = @user
-      owner_id = owner.respond_to?(:id) ? owner.id : nil
-      success = super
-      if success
-        cl = client
-        cl.invalidate_session_identity(token) if token.is_a?(String) && cl.respond_to?(:invalidate_session_identity)
-        cl.invalidate_user_identity(owner_id) if owner_id && cl.respond_to?(:invalidate_user_identity)
+      # A session never saved is not deleted (see Parse::Object#destroy), so
+      # there is nothing to forget either.
+      return super if new?
+      token = nil
+      owner_id = nil
+      begin
+        Parse::Session.send(:_preload_identity_for_destroy!, [self], session_token: session)
+        token, owner_id = _identity_for_destroy
+      ensure
+        # The looked-up token is a live credential: keep it in locals only.
+        _clear_identity_for_destroy!
+      end
+      result = nil
+      begin
+        result = super
+      ensure
+        # `false` covers "object not found", which is either a session
+        # already revoked elsewhere or one the caller cannot see; dropping
+        # cached entries is idempotent in both cases. A raised delete still
+        # drops the token it named but leaves the owner alone. A single
+        # delete cannot tell "already gone" from "denied", so an absent row
+        # only uses the recorded owner, never the reset fallback.
+        if result.nil?
+          _forget_identity!(token.is_a?(String) ? token : nil, nil)
+        else
+          _forget_identity!(token, owner_id, reset_fallback: false)
+        end
       end
-      success
     end
 
+    # Seconds between two full identity-cache resets triggered by a failed
+    # session lookup on the same client.
+    RESET_INTERVAL = 5
+
+    # Process-local record of the last lookup-triggered reset per client.
+    @identity_reset_at = {}
+    @identity_reset_mutex = Mutex.new
+
+    class << self
+      # Record, in the identity context of `cl` (the client that fetched
+      # them), which user owns each session that carries both its objectId
+      # and its owner, so a later delete can drop the owner's cached
+      # identities after the row is gone. Never raises: it runs while query
+      # results are decoded.
+      # @param sessions [Array<Parse::Object>]
+      # @param cl [Parse::Client]
+      # @!visibility private
+      def _remember_owners!(sessions, cl)
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        return unless auth.respond_to?(:remember_session_owner)
+        Array(sessions).each do |o|
+          next unless o.is_a?(Parse::Session)
+          owner_id = o.send(:_identity_owner_id)
+          id = o.id
+          auth.remember_session_owner(id, owner_id) if owner_id && id.present?
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      private
+
+      # Reset `cl`'s identity and role caches, at most once every
+      # {RESET_INTERVAL} seconds per client.
+      # @!visibility private
+      def _rate_limited_identity_reset!(cl)
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        return unless auth.respond_to?(:reset_caches!)
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        due = @identity_reset_mutex.synchronize do
+          last = @identity_reset_at[cl.object_id]
+          next false if last && now - last < RESET_INTERVAL
+          @identity_reset_at[cl.object_id] = now
+          true
+        end
+        auth.reset_caches! if due
+      end
+
+      # Look up the token and owner of every session about to be deleted that
+      # does not carry them, so the delete can drop their identity entries.
+      # One `_Session` query per client. A client with a master key reads it
+      # as SDK metadata (it works inside `Parse.without_master_key`); one
+      # without reads it with `session_token`, or skips the lookup when there
+      # is none. The query never uses the response cache: its rows carry live
+      # session tokens.
+      #
+      # A row the lookup did not return is marked absent: there is nothing
+      # to forget for it. Only a lookup that raised marks its sessions
+      # `:unknown`, which makes their delete reset the client's identity
+      # cache (rate limited).
+      # @param sessions [Array<Parse::Object>]
+      # @param session_token [String, nil] the delete's own session.
+      # @!visibility private
+      def _preload_identity_for_destroy!(sessions, session_token: nil)
+        pending = sessions.select { |o| o.is_a?(Parse::Session) && o.send(:_identity_lookup_needed?) }
+        return if pending.empty?
+        pending.group_by(&:client).each do |cl, group|
+          has_master = cl.respond_to?(:master_key) && cl.master_key.present?
+          token = session_token.respond_to?(:session_token) ? session_token.session_token : session_token
+          token = nil unless token.is_a?(String) && !token.strip.empty?
+          unless has_master || token
+            group.each { |o| o.instance_variable_set(:@_identity_for_destroy, :absent) }
+            next
+          end
+          ids = group.map(&:id).uniq
+          found = begin
+              query = Parse::Session.query(:objectId.in => ids, limit: ids.size)
+              query.keys(:session_token, :user)
+              query.client = cl
+              query.cache = false
+              if has_master
+                query.instance_variable_set(:@_metadata_master, true)
+              else
+                query.session_token = token
+              end
+              query.results.to_h do |row|
+                owner = row.instance_variable_get(:@user)
+                [row.id, [row.instance_variable_get(:@session_token), owner.respond_to?(:id) ? owner.id : nil]]
+              end
+            rescue StandardError => e
+              warn "[Parse::Session] could not look up the token and owner of " \
+                   "#{ids.size} session(s) before deleting them (#{e.class}); " \
+                   "dropping the whole identity cache instead."
+              nil
+            end
+          group.each do |o|
+            mark = if found.nil?
+                :unknown
+              elsif (row = found[o.id]) && (row[0].is_a?(String) || row[1])
+                row
+              else
+                :absent
+              end
+            o.instance_variable_set(:@_identity_for_destroy, mark)
+          end
+        end
+      end
+    end
+
+    # Called by `Array#destroy` for each session in the batch with its
+    # response. The entries are dropped only when the delete succeeded or
+    # reported the row gone ("object not found").
+    # @!visibility private
+    def _after_batch_destroy(response = nil)
+      identity = _identity_for_destroy
+      _clear_identity_for_destroy!
+      return unless Parse::Session.send(:_destroy_applied?, response)
+      # The batch response tells success and "object not found" apart from
+      # a denial, so an absent row whose owner was never recorded may fall
+      # back to the rate-limited reset here.
+      _forget_identity!(*identity, reset_fallback: true)
+    end
+    private :_after_batch_destroy
+
+    # Whether a batch delete response means the row is gone: success, or
+    # "object not found". A missing response (older callers) counts as
+    # applied.
+    # @!visibility private
+    def self._destroy_applied?(response)
+      return true if response.nil?
+      (response.respond_to?(:success?) && response.success?) ||
+        (response.respond_to?(:object_not_found?) && response.object_not_found?)
+    end
+    private_class_method :_destroy_applied?
+
+    # Remove the token and owner {._preload_identity_for_destroy!} looked
+    # up. The token is a live credential and must not outlive the delete
+    # (it would show in `inspect` or `instance_variables`).
+    # @!visibility private
+    def _clear_identity_for_destroy!
+      remove_instance_variable(:@_identity_for_destroy) if instance_variable_defined?(:@_identity_for_destroy)
+    end
+    private :_clear_identity_for_destroy!
+
+    # Whether this session lacks the token or the owner its identity-plane
+    # entries are keyed by: a fetch without the master key (no token) or
+    # with `keys:` leaving them out.
+    # @!visibility private
+    def _identity_lookup_needed?
+      # Keyed on the objectId, not `new?`: `Array#destroy` deletes by id
+      # alone, so a session built from an id (no timestamps loaded) is still
+      # deleted and its token must still be dropped.
+      return false if @id.blank?
+      !@session_token.is_a?(String) || @session_token.empty? || _identity_owner_id.nil?
+    end
+    private :_identity_lookup_needed?
+
     # Serialization omits `sessionToken` unless `include_session_token: true`
     # is passed. A session token is a bearer credential, and `as_json` is the
     # surface that reaches logs, API responses and agent tool output.
@@ -245,7 +436,76 @@ module Parse
     # Redacts the session token from the default inspect output.
     # @return [String]
     def inspect
-      Parse::User.redact_session_token(super, @session_token)
+      looked_up = @_identity_for_destroy
+      Parse::User.redact_session_token(super, @session_token, looked_up.is_a?(Array) ? looked_up[0] : nil)
+    end
+
+    private
+
+    # The token and owner id to forget for this delete: what this instance
+    # carries, completed by {._preload_identity_for_destroy!} when it did
+    # not, or `:unknown` when that lookup failed.
+    # @!visibility private
+    def _identity_for_destroy
+      looked_up = @_identity_for_destroy
+      token = @session_token.is_a?(String) && !@session_token.empty? ? @session_token : nil
+      owner_id = _identity_owner_id
+      return [:unknown, owner_id] if looked_up == :unknown
+      if looked_up == :absent
+        # No row to read: the session is gone or not visible. Forget what
+        # this instance carries; with nothing at all, mark it absent so the
+        # delete can fall back to the recorded owner.
+        return token || owner_id ? [token, owner_id] : [:absent, nil]
+      end
+      if looked_up.is_a?(Array)
+        token ||= looked_up[0]
+        owner_id ||= looked_up[1]
+      end
+      [token, owner_id]
+    end
+
+    # The owning user's id, read from the association ivar directly:
+    # calling `user` on a partially fetched session could trigger an
+    # autofetch just to learn the owner.
+    # @!visibility private
+    def _identity_owner_id
+      owner = @user
+      owner.respond_to?(:id) ? owner.id : nil
+    end
+
+    # Drop the token and the owner's entries from this session's client's
+    # identity plane.
+    # @!visibility private
+    def _forget_identity!(token, owner_id, reset_fallback: false)
+      cl = client
+      if token == :absent
+        # The row was not readable before the delete. Use the owner recorded
+        # when this session was last loaded; without one, and only when the
+        # delete is known to have applied or found the row gone, fall back to
+        # the rate-limited reset. Never on a denied delete.
+        token = nil
+        auth = cl.respond_to?(:authorization) ? cl.authorization : nil
+        recorded = auth.respond_to?(:session_owner) ? auth.session_owner(@id) : nil
+        if recorded
+          owner_id ||= recorded
+        elsif owner_id.nil? && reset_fallback
+          Parse::Session.send(:_rate_limited_identity_reset!, cl)
+        end
+      end
+      if token == :unknown
+        # The lookup failed, so the token's entry cannot be named. Drop every
+        # cached identity on this client (the next read of each token
+        # re-resolves it, which is safe), at most once every RESET_INTERVAL
+        # seconds so repeated failures cannot flush a shared plane on every
+        # request. The owner's entries go as well when the owner is known.
+        Parse::Session.send(:_rate_limited_identity_reset!, cl)
+        token = nil
+      end
+      cl.invalidate_session_identity(token) if token.is_a?(String) && cl.respond_to?(:invalidate_session_identity)
+      cl.invalidate_user_identity(owner_id) if owner_id && cl.respond_to?(:invalidate_user_identity)
+    rescue StandardError
+      # Runs from an `ensure`: never replace the delete's own outcome.
+      nil
     end
   end
 end

data/lib/parse/model/classes/user.rb

@@ -712,7 +712,7 @@ module Parse
 
       if response.success?
         result = response.result || {}
-        @updated_at = result["updatedAt"] || @updated_at
+        @updated_at = _server_date(result["updatedAt"]) || @updated_at
         # Parse Server may rotate the session token on a credential
         # change; apply it narrowly if present without going through the
         # full property writer chain.
@@ -826,8 +826,8 @@ module Parse
         # save-as-signup path had already addressed.
         result = response.result
         @id = result[Parse::Model::OBJECT_ID] || @id
-        @created_at = result["createdAt"] || @created_at
-        @updated_at = result["updatedAt"] || result["createdAt"] || @updated_at
+        @created_at = _server_date(result["createdAt"]) || @created_at
+        @updated_at = _server_date(result["updatedAt"] || result["createdAt"]) || @updated_at
         set_attributes!(result.slice(*SIGNUP_RESPONSE_APPLY_KEYS))
         # Drop the plaintext password from memory now that the server
         # has it hashed and we no longer need it. Matches the Parse JS
@@ -956,19 +956,40 @@ module Parse
       result
     end
 
-    # Deletes the user. On success every cached identity entry for the user
-    # is dropped from this client's identity plane, since Parse Server
-    # removes the user's sessions with the account.
+    # Deletes the user. Every cached identity entry for the user is dropped
+    # from this client's identity plane, since Parse Server removes the
+    # user's sessions with the account. The entries are dropped when the
+    # delete returns, successful or not (a failure is usually "object not
+    # found": the account is already gone or not visible to the caller, and
+    # dropping cached entries is idempotent). A delete that raises leaves
+    # them alone.
     # @param session [String] (see Parse::Object#destroy)
     # @return [Boolean] whether the operation was successful.
     def destroy(session: nil)
       user_id = id
-      success = super
-      if success && client.respond_to?(:invalidate_user_identity)
-        client.invalidate_user_identity(user_id)
+      result = super
+      begin
+        client.invalidate_user_identity(user_id) if user_id.present? && client.respond_to?(:invalidate_user_identity)
+      rescue StandardError
+        # Never replace the delete's own outcome.
+        nil
       end
-      success
+      result
+    end
+
+    # Called by `Array#destroy` for each user in the batch with its
+    # response. Drops the user's identity entries, as {#destroy} does, when
+    # the delete succeeded or the row is already gone; a denied delete
+    # leaves them alone.
+    # @!visibility private
+    def _after_batch_destroy(response = nil)
+      applied = response.nil? ||
+                (response.respond_to?(:success?) && response.success?) ||
+                (response.respond_to?(:object_not_found?) && response.object_not_found?)
+      return unless applied
+      client.invalidate_user_identity(id) if id.present? && client.respond_to?(:invalidate_user_identity)
     end
+    private :_after_batch_destroy
 
     # Invalid the current session token for this logged in user.
     # @return [Boolean] True/false if successful
@@ -1729,8 +1750,8 @@ module Parse
         unless res.error?
           result = res.result
           @id = result[Parse::Model::OBJECT_ID] || @id
-          @created_at = result["createdAt"] || @created_at
-          @updated_at = result["updatedAt"] || result["createdAt"] || @updated_at
+          @created_at = _server_date(result["createdAt"]) || @created_at
+          @updated_at = _server_date(result["updatedAt"] || result["createdAt"]) || @updated_at
           # Plaintext password is no longer needed locally; the server
           # has it hashed. Direct ivar assignment avoids re-dirtying the
           # field.

data/lib/parse/model/core/actions.rb

@@ -554,7 +554,13 @@ module Parse
 
                   # Apply any additional attributes returned by beforeSave hooks.
                   obj.set_attributes!(result) if obj.respond_to?(:set_attributes!)
-                  obj.send(:clear_changes!) if obj.respond_to?(:clear_changes!, true)
+                  # The transaction carried the record's relation ops too, so
+                  # settle them as a save does rather than discarding them.
+                  if obj.respond_to?(:changes_applied!, true)
+                    obj.send(:changes_applied!)
+                  elsif obj.respond_to?(:clear_changes!, true)
+                    obj.send(:clear_changes!)
+                  end
                 end
 
                 return responses
@@ -1108,6 +1114,8 @@ module Parse
       # @param op_hash [Hash] The operation hash. It may also be of type {Parse::RelationAction}.
       # @return [Boolean] whether the operation was successful.
       def operate_field!(field, op_hash)
+        # A reply from an earlier operation must never be read as this one's.
+        @_last_operation_result = nil
         field = field.to_sym
         field = self.field_map[field] || field
         if op_hash.is_a?(Parse::RelationAction)
@@ -1132,9 +1140,12 @@ module Parse
 
       # @!visibility private
       # The value Parse Server returned for `field` from the last
-      # {#operate_field!}, or nil when the reply did not include it.
+      # {#operate_field!}, or nil when the reply did not include it. The
+      # reply is read once: it is forgotten here so a later read cannot
+      # pick up a stale value.
       def _last_operation_value(field)
         result = @_last_operation_result
+        @_last_operation_result = nil
         return nil unless result.is_a?(Hash)
         wire = (self.field_map[field.to_sym] || field).to_s
         result[wire]
@@ -1198,7 +1209,9 @@ module Parse
       def op_add_relation!(field, objects = [])
         objects = [objects] unless objects.is_a?(Array)
         return false if objects.empty?
-        relation_action = Parse::RelationAction.new(field, polarity: true, objects: objects)
+        # The operation is keyed by the remote column, as a save sends it.
+        remote_field = self.field_map[field.to_sym] || field
+        relation_action = Parse::RelationAction.new(remote_field, polarity: true, objects: objects)
         operate_field! field, relation_action
       end
 
@@ -1210,7 +1223,9 @@ module Parse
       def op_remove_relation!(field, objects = [])
         objects = [objects] unless objects.is_a?(Array)
         return false if objects.empty?
-        relation_action = Parse::RelationAction.new(field, polarity: false, objects: objects)
+        # The operation is keyed by the remote column, as a save sends it.
+        remote_field = self.field_map[field.to_sym] || field
+        relation_action = Parse::RelationAction.new(remote_field, polarity: false, objects: objects)
         operate_field! field, relation_action
       end
 

data/lib/parse/model/core/fetching.rb

@@ -55,6 +55,9 @@ module Parse
       # @param preserve_changes [Boolean] if true, re-apply local dirty values to fetched fields.
       #   By default (false), fetched fields accept server values and local changes are discarded.
       #   Unfetched fields always preserve their dirty state regardless of this setting.
+      #   A relation's staged additions and removals are kept in both modes (they are
+      #   operations, not field values) and the relation stays marked changed, so the
+      #   next save sends them. Use {Parse::Object#reload!} or `clear_changes!` to drop them.
       # @param opts [Hash] a set of options to pass to the client request.
       # @option opts [Boolean, Symbol] :cache (:write_only) caching mode:
       #   - :write_only (default) - skip cache read, but update cache with fresh data
@@ -220,11 +223,13 @@ module Parse
           respond_to?(:record_authorization_hydration!)
 
         begin
-          clear_changes!
+          # Not clear_changes!: that also drops a relation's staged
+          # additions and removals, which a fetch must keep.
+          clear_dirty_tracking!
         rescue => e
           # Log the error for debugging purposes
           warn "[Parse::Fetch] Warning: clear_changes! failed: #{e.class}: #{e.message}"
-          # If clear_changes! fails, manually reset change tracking
+          # If clearing fails, manually reset change tracking
           @changed_attributes = {} if instance_variable_defined?(:@changed_attributes)
           @mutations_from_database = nil if instance_variable_defined?(:@mutations_from_database)
           @mutations_before_last_save = nil if instance_variable_defined?(:@mutations_before_last_save)
@@ -266,9 +271,31 @@ module Parse
           end
         end
 
+        # A relation whose proxy still holds staged additions or removals
+        # must stay dirty, or the next save sends nothing. The loop above
+        # cannot guarantee it: when the response carries the relation's
+        # descriptor, re-applying the same proxy is not a change.
+        remark_staged_relations_dirty!
+
         self
       end
 
+      # @!visibility private
+      # Marks dirty every relation whose proxy holds staged additions or
+      # removals. Used after a fetch has cleared the record's dirty tracking.
+      def remark_staged_relations_dirty!
+        return unless respond_to?(:relations)
+        relations.each_key do |key|
+          ivar = :"@#{key}"
+          next unless instance_variable_defined?(ivar)
+          proxy = instance_variable_get(ivar)
+          next unless proxy.respond_to?(:staged_changes?) && proxy.staged_changes?
+          next if changed.include?(key.to_s)
+          will_change_method = "#{key}_will_change!"
+          send(will_change_method) if respond_to?(will_change_method)
+        end
+      end
+
       # Fetches the object with explicit caching enabled.
       # This is a convenience method that calls fetch! with cache: true.
       # Use this when you want to leverage cached responses for better performance.

data/lib/parse/model/core/field_guards.rb

@@ -197,20 +197,28 @@ module Parse
 
         if respond_to?(:relations) && relations[field_sym]
           proxy = public_send(field_sym)
-          # Reset the pending add/remove ledger that backs
-          # relation_change_operations. The proxy itself has no public reset
-          # API for these (its rollback!/restore_attributes path expects
-          # setters that don't exist for additions/removals), so we clear
-          # them directly and then drop the proxy's dirty markers.
-          proxy.instance_variable_set(:@additions, []) if proxy.instance_variable_defined?(:@additions)
-          proxy.instance_variable_set(:@removals, []) if proxy.instance_variable_defined?(:@removals)
+          # Drop the pending add/remove ledger that backs
+          # relation_change_operations, and the proxy's dirty markers. The
+          # relation proxy's clear_changes! also reloads its list on next
+          # access, since the loaded list included the discarded items. A
+          # handler that reads the relation after the revert therefore
+          # triggers one query for the stored members (on a saved owner).
           proxy.clear_changes! if proxy.respond_to?(:clear_changes!)
           clear_attribute_changes([field_str])
           return
         end
 
         if is_new
-          public_send("#{field_str}=", nil)
+          if field_sym == :acl && !self.class.builtin_acl_default_active?
+            # The class's ACL policy still decides a new record's ACL: put
+            # back the init-time default stamp and let the save-time
+            # resolver run, instead of a nil ACL that a reply would send
+            # as `{}` (master-key only).
+            public_send(:acl=, self.class.default_acls.as_json)
+            @_acl_pristine = true
+          else
+            public_send("#{field_str}=", nil)
+          end
         else
           restore_attributes([field_str])
         end

data/lib/parse/model/object.rb

@@ -1614,8 +1614,54 @@ module Parse
       clear_changes!
     end
 
-    # clears all dirty tracking information
+    # clears all dirty tracking information. Array and relation proxies are
+    # cleared too, so a relation's staged additions and removals are dropped
+    # rather than sent by a later save.
     def clear_changes!
+      clear_proxy_changes!
+      clear_dirty_tracking!
+    end
+
+    # @!visibility private
+    # Instance variable names of the array and relation proxies a class can
+    # hold. Cached per class because {#clear_changes!} runs for every record
+    # built with an id (every query row). The cache is rebuilt when a field
+    # or relation is declared after it was computed.
+    # @return [Array<Symbol>]
+    def self.proxy_change_ivars
+      all_fields = fields
+      all_relations = relations
+      signature = [all_fields.size, all_relations.size]
+      return @_proxy_change_ivars if @_proxy_change_ivars_signature == signature
+      ivars = (all_fields.select { |_, type| type == :array }.keys + all_relations.keys)
+        .uniq.map { |key| :"@#{key}" }.freeze
+      # Assign the list before its signature so a concurrent reader that
+      # sees the new signature also sees the new list.
+      @_proxy_change_ivars = ivars
+      @_proxy_change_ivars_signature = signature
+      ivars
+    end
+
+    # @!visibility private
+    # Clears the dirty state of every array and relation proxy this record
+    # holds, dropping a relation's staged additions and removals.
+    def clear_proxy_changes!
+      ivars = self.class.proxy_change_ivars
+      return if ivars.empty?
+      ivars.each do |ivar|
+        next unless instance_variable_defined?(ivar)
+        proxy = instance_variable_get(ivar)
+        proxy.clear_changes! if proxy.respond_to?(:clear_changes!)
+      end
+    end
+    private :clear_proxy_changes!
+
+    # @!visibility private
+    # Clears the record's own dirty tracking but leaves array and relation
+    # proxies alone. A fetch uses this: it replaces field values from the
+    # server, but a relation's staged additions and removals are not field
+    # values and must survive it (the fetch re-marks the field dirty).
+    def clear_dirty_tracking!
       clear_changes_information
       # Clear the ACL snapshot used for proper acl_was tracking
       @_acl_snapshot_before_change = nil
@@ -1926,6 +1972,11 @@ module Parse
       # so a later edit captures a fresh baseline.
       @acl = Parse::ACL.typecast(snapshot.as_json, self) if snapshot && !@acl.nil?
       @_acl_snapshot_before_change = nil
+      # A relation's staged additions and removals live on its proxy, not in
+      # the attribute ActiveModel restores (after a fetch the restored value
+      # is the proxy with the operations still staged). Drop them so a later
+      # save does not send what was rolled back.
+      clear_proxy_changes!
     end
 
     # Keys that mass assignment never applies to an object: the objectId

data/lib/parse/model/push.rb

@@ -352,7 +352,17 @@ module Parse
         if @channels.is_a?(Array) && @channels.empty? == false
           q.where :channels.in => @channels
         end
-        msg[:where] = q.compile_where unless q.where.empty?
+        unless q.where.empty?
+          compiled = q.compile_rest_where
+          # Constraints that compile to nothing would target every
+          # installation; refuse instead of widening the audience.
+          if compiled.empty?
+            raise ArgumentError,
+                  "The push targeting query has constraints but compiles to no `where`, " \
+                  "which would reach every installation. Check the targeting constraints."
+          end
+          msg[:where] = compiled
+        end
       elsif @channels.is_a?(Array) && @channels.empty? == false
         msg[:channels] = @channels
       end