parse-stack-next 5.8.0 → 5.8.1

data/lib/parse/webhooks.rb

@@ -501,6 +501,8 @@ module Parse
                 master: payload.master? || false,
                 is_new: payload.original.blank?,
               )
+              # A guard revert is not the handler assigning the ACL.
+              pre_obj.reset_webhook_handler_acl_assigned! if pre_obj.respond_to?(:reset_webhook_handler_acl_assigned!)
             end
           end
         end
@@ -529,6 +531,7 @@ module Parse
             # ran ActiveModel before_save callbacks locally. A client-spoofed
             # `_RB_` without master falls through and runs them here.
             unless trusted_ruby_initiated
+              adopt_request_user_as_acl_owner!(payload, result)
               before_save_result = result.run_before_save_callbacks
               # If a before_save callback halted the chain (returned false), reject the save.
               if before_save_result == false
@@ -779,18 +782,23 @@ module Parse
       #
       # Fields are compared against a fresh build of the payload, so only the
       # fields the handler actually changed are encoded from the Ruby object.
-      # Two limits come from what Parse Server sends: an operator on a dotted
-      # sub-key (`"meta.count"`) reaches the webhook only as its resulting
-      # sub-document, and is written back that way when the reply is not
-      # `nil`; and a field the handler rewrites is written as an absolute
-      # value.
+      # A field the handler rewrites is written as an absolute value. An
+      # operator on a dotted sub-key (`"meta.count"`) reaches the webhook only
+      # as its resulting sub-document, so on an update a changed sub-document
+      # is written back as dotted keys for just the sub-keys that differ from
+      # the stored one. A concurrent write to another sub-key survives; the
+      # changed sub-key itself is written as its resulting value. The split
+      # is one level deep (a changed sub-key is written whole at
+      # `field.sub`), and a field whose writes would carry a typed value is
+      # written whole.
       #
       # @param payload [Parse::Webhooks::Payload] the beforeSave payload.
       # @param obj [Parse::Object, nil] the handler's object (nil when none).
       # @param overrides [Hash, nil] field values a handler returned as a Hash.
       # @param include_create_defaults [Boolean] on a create, also write the
-      #   object's dirty fields the client did not send (declared defaults,
-      #   default ACL), matching what an SDK-side create sends.
+      #   object's dirty fields the client did not send (declared defaults and
+      #   the ACL the class policy resolves), matching what an SDK-side create
+      #   sends.
       # @return [Hash, nil] the reply object, or nil for "unchanged".
       def before_save_reply(payload, obj, overrides: nil, include_create_defaults: false)
         return nil unless payload && payload.object?
@@ -806,27 +814,238 @@ module Parse
           if include_create_defaults && raw_original.nil?
             client_keys = raw_object.keys.map(&:to_s)
             dirty = obj.changed.map(&:to_sym) & snapshot_fields(obj)
+            # This includes the ACL. A create with no `ACL` key is stored by
+            # Parse Server as public read and write, so a class with an ACL
+            # policy always replies with the ACL that policy resolved (owned
+            # by the requesting user where the policy names an owner; see
+            # {adopt_request_user_as_acl_owner!}) or the ACL the handler set.
+            # An ACL the client sent is kept as sent.
             wire_values(obj, dirty).each do |remote, value|
               next if client_keys.include?(remote) || changes.key?(remote)
               changes[remote] = value
             end
           end
+          # An ACL the handler assigned on a create is written even when it
+          # equals the default stamp or the client's ACL, whatever the handler
+          # returned (the object, `true`, `nil`, or a Hash, whose own `ACL`
+          # still wins below). Diffing alone misses `obj.acl = Parse::ACL.new`
+          # under a `{}` default, and a create with no `ACL` key is stored
+          # public read and write.
+          if handler_assigned_acl?(obj) && !changes.key?("ACL")
+            changes.merge!(wire_values(obj, [:acl]).slice("ACL"))
+          end
         end
         overrides = overrides.as_json if overrides.is_a?(Hash)
         return nil if changes.empty? && drops.empty? && overrides.blank?
 
         reply = client_write_data(raw_object, raw_original)
+        overrides = overrides.present? ? remote_override_keys(payload, overrides) : {}
+        # A field the handler wrote or dropped replaces the client's dotted
+        # sub-key writes for it; MongoDB refuses `meta` and `meta.x` together.
+        (drops + changes.keys + overrides.keys).each do |remote|
+          reply.delete_if { |key, _| key.start_with?("#{remote}.") }
+        end
         drops.each { |remote| reply.delete(remote) }
         reply.merge!(changes)
-        reply.merge!(overrides.transform_keys(&:to_s)) if overrides.present?
+        reply.merge!(overrides)
+        fold_dotted_overrides!(reply, overrides.keys, raw_object: raw_object, create: raw_original.nil?)
+        reply
+      end
+
+      # A handler's Hash override keyed by Ruby names (`{acl: ...}`,
+      # `{author_name: ...}`) is mapped to the remote field names the reply
+      # uses, so it replaces the matching field instead of sitting beside it.
+      # A dotted key maps its first segment.
+      # @!visibility private
+      def remote_override_keys(payload, overrides)
+        klass = begin
+            name = payload.parse_class
+            name.present? ? Parse::Object.find_class(name) : nil
+          rescue StandardError
+            nil
+          end
+        map = klass.respond_to?(:field_map) ? klass.field_map : {}
+        overrides.each_with_object({}) do |(key, value), out|
+          key = key.to_s
+          head, rest = key.split(".", 2)
+          remote = map[head.to_sym]
+          head = remote.to_s if remote
+          out[rest ? "#{head}.#{rest}" : head] = value
+        end
+      end
+
+      # A handler's Hash override may name a sub-key (`"meta.y"`) of a field
+      # the reply writes whole (a create, or a field written whole on an
+      # update). MongoDB refuses `meta` and `meta.y` in one update, so the
+      # sub-key write is folded into the whole value. An override deeper
+      # than one level (`"meta.count.value"`) is folded into a `field.sub`
+      # write seeded from the pending object, because Parse Server rebuilds
+      # the afterSave object from a dotted key only one level deep. On a
+      # create every dotted override folds into its whole field.
+      #
+      # When the value it folds into is not a plain sub-document, a client's
+      # value is replaced by the handler's sub-key, and two of the handler's
+      # own overrides that conflict (`"meta.a" => 5` with `"meta.a.b" => 6`)
+      # raise {ResponseError}.
+      # @!visibility private
+      def fold_dotted_overrides!(reply, override_keys, raw_object: {}, create: false)
+        handler_keys = override_keys.to_set
+        override_keys.sort_by { |k| k.count(".") }.each do |key|
+          next unless key.include?(".") && reply.key?(key)
+          segments = key.split(".")
+          # The nearest ancestor path the reply writes whole, if any.
+          parent = (1...segments.length).map { |n| segments.first(n).join(".") }.reverse.find { |p| reply.key?(p) }
+          unless parent
+            next if !create && segments.length <= 2
+            parent = create ? segments.first : segments.first(2).join(".")
+            seed = parent.split(".").reduce(raw_object) { |cur, seg| cur.is_a?(Hash) ? cur[seg] : nil }
+            reply[parent] = plain_sub_document?(seed) ? seed.deep_dup : {}
+          end
+          value = reply.delete(key)
+          whole = reply[parent]
+          if plain_sub_document?(whole)
+            whole = whole.deep_dup
+          elsif handler_keys.include?(parent)
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: #{key} conflicts with #{parent} in the handler's reply"
+          else
+            whole = {}
+          end
+          *dirs, leaf = segments.drop(parent.count(".") + 1)
+          node = dirs.reduce(whole) do |cur, dir|
+            cur[dir] = {} unless plain_sub_document?(cur[dir])
+            cur[dir]
+          end
+          if value.is_a?(Hash) && value.key?("__op")
+            # A whole write stores its value as data, so an operator folded
+            # into it is applied here rather than written as a Hash.
+            result = fold_override_op(key, node[leaf], value)
+            if result.equal?(FOLD_DELETE)
+              node.delete(leaf)
+            else
+              node[leaf] = result
+            end
+          else
+            node[leaf] = value
+          end
+          reply[parent] = whole
+        end
         reply
       end
 
+      # @!visibility private
+      FOLD_DELETE = Object.new.freeze
+
+      # Apply a handler's sub-key operator to the value it replaces inside a
+      # sub-document the reply writes whole, with Parse Server's semantics
+      # for that operator. Raises {ResponseError} (an `{error}` reply, so
+      # Parse Server refuses the save) for an operator that cannot be applied
+      # to a plain value, rather than storing the operator Hash as data.
+      # @param key [String] the dotted override key, for the error message.
+      # @param current [Object] the value at that path in the whole write.
+      # @param op [Hash] the operator Hash (`{"__op" => ...}`).
+      # @return [Object] the new value, or {FOLD_DELETE} to remove the key.
+      # @!visibility private
+      def fold_override_op(key, current, op)
+        name = op["__op"]
+        case name
+        when "Delete"
+          FOLD_DELETE
+        when "Increment"
+          amount = op["amount"]
+          unless amount.is_a?(Numeric) && (current.nil? || current.is_a?(Numeric))
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: cannot apply Increment to #{key} (#{current.class})"
+          end
+          (current || 0) + amount
+        when "Add", "AddUnique", "Remove"
+          objects = op["objects"]
+          unless objects.is_a?(Array) && (current.nil? || current.is_a?(Array))
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: cannot apply #{name} to #{key} (#{current.class})"
+          end
+          base = current || []
+          case name
+          when "Add" then base + objects
+          when "AddUnique" then base + objects.reject { |o| base.include?(o) }.uniq
+          else base.reject { |o| objects.include?(o) }
+          end
+        else
+          raise Parse::Webhooks::ResponseError,
+                "before_save reply: operator #{name.inspect} on #{key} cannot be combined " \
+                "with a whole write of its parent field"
+        end
+      end
+
+      # @!visibility private
+      def handler_assigned_acl?(obj)
+        return true if obj.instance_variable_get(:@_webhook_reply_acl) == true
+        obj.respond_to?(:webhook_handler_acl_assigned?) && obj.webhook_handler_acl_assigned?
+      end
+
+      # On a client create, an owner-based ACL policy (`:owner_else_private`,
+      # the shipped default, `:owner_else_public`, `:owner_but_public_read`)
+      # resolves its owner the way an SDK create `as:` the requesting user
+      # does: when the declared owner field holds no value, the user who made
+      # the request owns the record. A request without a user (anonymous, or
+      # master key) gets the policy's fallback. Leaves the object alone when
+      # the handler or the client already set an ACL.
+      # @!visibility private
+      def adopt_request_user_as_acl_owner!(payload, obj)
+        return unless payload && payload.original.nil?
+        if handler_assigned_acl?(obj)
+          # The handler's ACL is final: keep the save-time policy resolver
+          # from replacing it, even when it equals the default stamp.
+          obj.instance_variable_set(:@_acl_pristine, false)
+          return
+        end
+        return unless obj.is_a?(Parse::Object) && obj.instance_variable_get(:@_acl_pristine)
+        return if obj.instance_variable_get(:@_acl_owner_override)
+        klass = obj.class
+        return if klass.respond_to?(:builtin_acl_default_active?) && klass.builtin_acl_default_active?
+        return unless klass.respond_to?(:acl_policy_setting) && klass.acl_policy_setting.to_s.start_with?("owner_")
+        field = klass.acl_owner_field
+        if field == :self
+          adopt_self_owned_acl!(obj, klass)
+          return
+        end
+        # A master-key request is not the user's own write.
+        return if payload.master?
+        user = payload.user
+        return unless user.is_a?(Parse::User) && user.id.present?
+        if field && obj.respond_to?(field)
+          return if obj.send(field).present?
+        end
+        obj.instance_variable_set(:@_acl_owner_override, user)
+      end
+
+      # A self-owned user (`acl_policy ..., owner: :self`) owns its own
+      # record, never the requesting user. Its objectId is assigned by Parse
+      # Server after beforeSave, and Parse Server adds the new user's own
+      # read and write to the ACL of every `_User` create. So the reply
+      # carries the policy's ACL without the owner entry (`{}`, or public
+      # read under `:owner_but_public_read`), which Parse Server completes
+      # with the user's own grant. The save-time resolver is skipped, since
+      # it would pre-generate an objectId the server does not use.
+      # @!visibility private
+      def adopt_self_owned_acl!(obj, klass)
+        acl = if klass.acl_policy_setting == :owner_but_public_read
+            Parse::ACL.everyone(true, false)
+          else
+            Parse::ACL.new
+          end
+        klass.instance_method(:acl=).bind_call(obj, acl)
+        obj.instance_variable_set(:@_acl_pristine, false)
+        obj.instance_variable_set(:@_webhook_reply_acl, true)
+      end
+
       # The client's write, rebuilt from a beforeSave payload. Parse Server
       # serializes the pending object with `toJSON()`, which reports every
       # pending top-level operator as its operator hash, so the operators
       # survive here as sent. On an update, a field whose value equals the
-      # stored one was not written by the client and is left out.
+      # stored one was not written by the client and is left out, and a
+      # changed sub-document is split into dotted sub-key writes (see
+      # {sub_document_write}).
       #
       # @param raw_object [Hash] the unscrubbed `object` hash.
       # @param raw_original [Hash, nil] the unscrubbed `original` hash.
@@ -841,12 +1060,96 @@ module Parse
             # Parse Server drops objectId from an update write itself.
             next if key == Parse::Model::OBJECT_ID
             next if raw_original.key?(key) && raw_original[key] == value
+            dotted = sub_document_write(key, value, raw_original[key])
+            if dotted
+              data.merge!(dotted)
+              next
+            end
           end
           data[key] = value
         end
         data
       end
 
+      # Keys never split into dotted sub-key writes: their values are
+      # replaced as a whole by Parse Server.
+      # @!visibility private
+      BEFORE_SAVE_REPLY_WHOLE_KEYS = %w[ACL authData].freeze
+
+      # Dotted sub-key writes for a sub-document the client changed.
+      #
+      # Parse Server applies a client's `"meta.count"` operator to its pending
+      # object and sends the webhook only the resulting `meta`, which matches
+      # a whole-object write of the same value. Writing just the sub-keys that
+      # differ from the stored sub-document gives the same result as either
+      # client write, without overwriting sub-keys another request changed in
+      # the meantime. The split is one level deep: a changed sub-key is
+      # written whole at `field.sub`, nested objects included, because Parse
+      # Server rebuilds the afterSave object from a non-operator dotted key
+      # only one level deep (`"meta.count.value"` would set `meta.count` to
+      # the leaf). A sub-key missing from the new value is written as a
+      # `Delete` operator.
+      #
+      # Parse Server stores a dotted value as sent, without the type transform
+      # a whole write gets, so a Date would land as a plain sub-document
+      # instead of a BSON date. When any write would carry a typed value
+      # (`{"__type": ...}`), the field is written whole instead.
+      #
+      # @param key [String] the top-level field name.
+      # @param value [Object] the field's value in the pending object.
+      # @param stored [Object] the field's stored value.
+      # @return [Hash, nil] the dotted writes, or nil to write the field whole.
+      # @!visibility private
+      def sub_document_write(key, value, stored)
+        return nil if key.start_with?("_") || BEFORE_SAVE_REPLY_WHOLE_KEYS.include?(key)
+        return nil unless splittable_level?(value, stored)
+        writes = {}
+        diff_sub_document(key, value, stored, writes)
+        return nil if writes.empty? || writes.values.any? { |v| typed_value?(v) }
+        writes
+      end
+
+      # Collect the one-level dotted writes that turn `stored` into `value`
+      # under `path`.
+      # @!visibility private
+      def diff_sub_document(path, value, stored, writes)
+        (value.keys | stored.keys).each do |sub|
+          new_present = value.key?(sub)
+          old_present = stored.key?(sub)
+          next if new_present && old_present && value[sub] == stored[sub]
+          sub_path = "#{path}.#{sub}"
+          writes[sub_path] = new_present ? value[sub] : { "__op" => "Delete" }
+        end
+      end
+
+      # Whether a pair of values can be diffed key by key: both plain JSON
+      # objects, with sub-keys that are usable as path segments.
+      # @!visibility private
+      def splittable_level?(value, stored)
+        return false unless plain_sub_document?(value) && plain_sub_document?(stored)
+        keys = value.keys | stored.keys
+        return false if keys.empty?
+        keys.none? { |k| k.to_s.empty? || k.to_s.include?(".") || k.to_s.start_with?("$") }
+      end
+
+      # Whether a JSON value is, or contains, a Parse typed value
+      # (`{"__type": ...}`: Date, Bytes, Pointer, File, GeoPoint, ...).
+      # @!visibility private
+      def typed_value?(value)
+        case value
+        when Hash then value.key?("__type") || value.values.any? { |v| typed_value?(v) }
+        when Array then value.any? { |v| typed_value?(v) }
+        else false
+        end
+      end
+
+      # A JSON object field value: a Hash that is not a Parse operator or a
+      # typed value (Pointer, Date, File, GeoPoint, ...).
+      # @!visibility private
+      def plain_sub_document?(value)
+        value.is_a?(Hash) && !value.key?("__op") && !value.key?("__type")
+      end
+
       # Diff the handler's object against a fresh build of the same payload.
       #
       # Only fields that are dirty on either object can differ: a field the

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.8.0
+  version: 5.8.1
 platform: ruby
 authors:
 - Adrian Curtin