parse-stack-next 5.8.0 → 5.8.2

data/lib/parse/webhooks/registration.rb

@@ -84,12 +84,34 @@ module Parse
         end
       end
 
+      # Check that a webhook endpoint is an http(s) URL (scheme compared
+      # case-insensitively, surrounding whitespace ignored) and return it
+      # stripped. Plain http:// to a host that is not this machine is
+      # allowed but warns: Parse Server sends the webhook key on every call,
+      # so it would travel in cleartext.
+      # @param endpoint [String]
+      # @return [String]
+      # @raise [ArgumentError]
+      # @!visibility private
+      def validate_hooks_endpoint!(endpoint)
+        url = endpoint.to_s.strip
+        scheme = Parse::Client.url_scheme(url)
+        host = Parse::Client.url_host(url)
+        unless %w[http https].include?(scheme) && host.present? && url.match?(%r{\Ahttps?://}i)
+          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}'"
+        end
+        if scheme == "http" && !Parse::Client.loopback_host?(host)
+          warn "[Parse::Webhooks] SECURITY WARNING: webhook endpoint #{url} uses http://. " \
+               "Parse Server sends the webhook key with every call, so it travels in " \
+               "cleartext. Use an https:// endpoint."
+        end
+        url
+      end
+
       # Registers all webhook functions registered with Parse::Stack with Parse server.
       # @param endpoint [String] a https url that points to the webhook server.
       def register_functions!(endpoint)
-        unless endpoint.present? && (endpoint.starts_with?("http://") || endpoint.starts_with?("https://"))
-          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}''"
-        end
+        endpoint = validate_hooks_endpoint!(endpoint)
         assert_webhook_url_safe!(endpoint)
         endpoint += "/" unless endpoint.ends_with?("/")
         functionsMap = {}
@@ -114,9 +136,7 @@ module Parse
       # @param endpoint [String] a https url that points to the webhook server.
       # @param include_wildcard [Boolean] Allow wildcard registrations
       def register_triggers!(endpoint, include_wildcard: false)
-        unless endpoint.present? && (endpoint.starts_with?("http://") || endpoint.starts_with?("https://"))
-          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}''"
-        end
+        endpoint = validate_hooks_endpoint!(endpoint)
         assert_webhook_url_safe!(endpoint)
         endpoint += "/" unless endpoint.ends_with?("/")
         all_triggers = Parse::API::Hooks::TRIGGER_NAMES_LOCAL

data/lib/parse/webhooks/replay_protection.rb

@@ -124,16 +124,26 @@ module Parse
         # works with any Rack request. Replay dedup applies only when
         # `request_id` or an `X-Parse-Webhook-Nonce` header is present.
         def verify!(env, body_str, request_id)
+          check(env, body_str, request_id).first
+        end
+
+        # @!visibility private
+        # Same checks as {.verify!}, also reporting whether a signature was
+        # verified. The signing secret is read once, so the answer always
+        # matches the check that ran.
+        # @return [Array(String, Boolean)] the error message (nil when the
+        #   request passes) and true when it carried a valid signature.
+        def check(env, body_str, request_id)
           secret = signing_secret
           signed_key = nil
           if secret && !secret.empty?
             ts_header = env[HEADER_TIMESTAMP].to_s
             sig_header = env[HEADER_SIGNATURE].to_s
-            return "Missing webhook signature." if ts_header.empty? || sig_header.empty?
-            return "Invalid webhook timestamp." unless ts_header =~ /\A-?\d{1,12}\z/
+            return ["Missing webhook signature.", false] if ts_header.empty? || sig_header.empty?
+            return ["Invalid webhook timestamp.", false] unless ts_header =~ /\A-?\d{1,12}\z/
             ts = ts_header.to_i
             skew = (Time.now.to_i - ts).abs
-            return "Stale webhook timestamp." if skew > signing_max_skew_seconds
+            return ["Stale webhook timestamp.", false] if skew > signing_max_skew_seconds
             # A sender that signs a per-delivery nonce (`ts.nonce.body`) gets a
             # distinct signature for every delivery, so identical bodies sent
             # in the same second are not mistaken for replays. The original
@@ -145,7 +155,7 @@ module Parse
               expected = OpenSSL::HMAC.hexdigest("SHA256", secret, material)
               ActiveSupport::SecurityUtils.secure_compare(expected, sig_header)
             end
-            return "Invalid webhook signature." unless matched
+            return ["Invalid webhook signature.", false] unless matched
             # A signed delivery is deduplicated on its signature, which covers
             # the timestamp and body and cannot be changed without the secret.
             # Keying it on the unsigned nonce would let a captured request be
@@ -157,23 +167,23 @@ module Parse
           if signed_key
             window = [replay_window_seconds, signing_max_skew_seconds * 2].max
             digest = Digest::SHA256.hexdigest(signed_key)
-            return "Webhook replay detected." if cache.seen?(digest, window)
+            return ["Webhook replay detected.", false] if cache.seen?(digest, window)
             cache.record(digest, replay_cache_size)
-            return nil
+            return [nil, true]
           end
 
           # Dedup only when the delivery carries a per-delivery identifier.
           # Keying on the body alone rejects legitimate identical requests.
           nonce = request_id.to_s.strip
           nonce = env[HEADER_NONCE].to_s.strip if nonce.empty?
-          return nil if nonce.empty?
+          return [nil, false] if nonce.empty?
 
           digest = Digest::SHA256.hexdigest("#{nonce}\x1f#{body_str}")
           if cache.seen?(digest, replay_window_seconds)
-            return "Webhook replay detected."
+            return ["Webhook replay detected.", false]
           end
           cache.record(digest, replay_cache_size)
-          nil
+          [nil, false]
         end
       end
 

data/lib/parse/webhooks.rb

@@ -477,7 +477,10 @@ module Parse
                        payload&.raw&.dig("headers", "X-Parse-Request-Id")
           ruby_initiated = request_id&.start_with?("_RB_") || false
           payload.instance_variable_set(:@ruby_initiated, ruby_initiated)
-          trusted_ruby_initiated = ruby_initiated && (payload.master? == true)
+          # `master?` is the authenticated claim: on unauthenticated ingress
+          # it is false, so a forged `_RB_` id plus `"master": true` cannot
+          # suppress model callbacks.
+          trusted_ruby_initiated = ruby_initiated && payload.master?
         else
           trusted_ruby_initiated = false
         end
@@ -501,6 +504,8 @@ module Parse
                 master: payload.master? || false,
                 is_new: payload.original.blank?,
               )
+              # A guard revert is not the handler assigning the ACL.
+              pre_obj.reset_webhook_handler_acl_assigned! if pre_obj.respond_to?(:reset_webhook_handler_acl_assigned!)
             end
           end
         end
@@ -529,6 +534,7 @@ module Parse
             # ran ActiveModel before_save callbacks locally. A client-spoofed
             # `_RB_` without master falls through and runs them here.
             unless trusted_ruby_initiated
+              adopt_request_user_as_acl_owner!(payload, result)
               before_save_result = result.run_before_save_callbacks
               # If a before_save callback halted the chain (returned false), reject the save.
               if before_save_result == false
@@ -670,7 +676,7 @@ module Parse
         # matched route, so read that stamped value rather than recomputing via
         # `ruby_initiated?` -- whose `||=` memoization re-derives on a stamped
         # `false` and could disagree with call_route's header lookup.
-        return if payload.ruby_initiated? && payload.master? == true
+        return if payload.ruby_initiated? && payload.master?
 
         # By the time afterSave fires the object is ALREADY persisted in Parse
         # Server, and Parse Server discards the afterSave response body entirely
@@ -733,7 +739,7 @@ module Parse
         obj = payload.parse_object
         return unless obj.is_a?(Parse::Object)
         return unless route_registered?(:after_delete, payload.parse_class)
-        return if payload.ruby_initiated? && payload.master? == true
+        return if payload.ruby_initiated? && payload.master?
         obj.run_after_delete_callbacks
         nil
       rescue => e
@@ -779,18 +785,23 @@ module Parse
       #
       # Fields are compared against a fresh build of the payload, so only the
       # fields the handler actually changed are encoded from the Ruby object.
-      # Two limits come from what Parse Server sends: an operator on a dotted
-      # sub-key (`"meta.count"`) reaches the webhook only as its resulting
-      # sub-document, and is written back that way when the reply is not
-      # `nil`; and a field the handler rewrites is written as an absolute
-      # value.
+      # A field the handler rewrites is written as an absolute value. An
+      # operator on a dotted sub-key (`"meta.count"`) reaches the webhook only
+      # as its resulting sub-document, so on an update a changed sub-document
+      # is written back as dotted keys for just the sub-keys that differ from
+      # the stored one. A concurrent write to another sub-key survives; the
+      # changed sub-key itself is written as its resulting value. The split
+      # is one level deep (a changed sub-key is written whole at
+      # `field.sub`), and a field whose writes would carry a typed value is
+      # written whole.
       #
       # @param payload [Parse::Webhooks::Payload] the beforeSave payload.
       # @param obj [Parse::Object, nil] the handler's object (nil when none).
       # @param overrides [Hash, nil] field values a handler returned as a Hash.
       # @param include_create_defaults [Boolean] on a create, also write the
-      #   object's dirty fields the client did not send (declared defaults,
-      #   default ACL), matching what an SDK-side create sends.
+      #   object's dirty fields the client did not send (declared defaults and
+      #   the ACL the class policy resolves), matching what an SDK-side create
+      #   sends.
       # @return [Hash, nil] the reply object, or nil for "unchanged".
       def before_save_reply(payload, obj, overrides: nil, include_create_defaults: false)
         return nil unless payload && payload.object?
@@ -806,27 +817,238 @@ module Parse
           if include_create_defaults && raw_original.nil?
             client_keys = raw_object.keys.map(&:to_s)
             dirty = obj.changed.map(&:to_sym) & snapshot_fields(obj)
+            # This includes the ACL. A create with no `ACL` key is stored by
+            # Parse Server as public read and write, so a class with an ACL
+            # policy always replies with the ACL that policy resolved (owned
+            # by the requesting user where the policy names an owner; see
+            # {adopt_request_user_as_acl_owner!}) or the ACL the handler set.
+            # An ACL the client sent is kept as sent.
             wire_values(obj, dirty).each do |remote, value|
               next if client_keys.include?(remote) || changes.key?(remote)
               changes[remote] = value
             end
           end
+          # An ACL the handler assigned on a create is written even when it
+          # equals the default stamp or the client's ACL, whatever the handler
+          # returned (the object, `true`, `nil`, or a Hash, whose own `ACL`
+          # still wins below). Diffing alone misses `obj.acl = Parse::ACL.new`
+          # under a `{}` default, and a create with no `ACL` key is stored
+          # public read and write.
+          if handler_assigned_acl?(obj) && !changes.key?("ACL")
+            changes.merge!(wire_values(obj, [:acl]).slice("ACL"))
+          end
         end
         overrides = overrides.as_json if overrides.is_a?(Hash)
         return nil if changes.empty? && drops.empty? && overrides.blank?
 
         reply = client_write_data(raw_object, raw_original)
+        overrides = overrides.present? ? remote_override_keys(payload, overrides) : {}
+        # A field the handler wrote or dropped replaces the client's dotted
+        # sub-key writes for it; MongoDB refuses `meta` and `meta.x` together.
+        (drops + changes.keys + overrides.keys).each do |remote|
+          reply.delete_if { |key, _| key.start_with?("#{remote}.") }
+        end
         drops.each { |remote| reply.delete(remote) }
         reply.merge!(changes)
-        reply.merge!(overrides.transform_keys(&:to_s)) if overrides.present?
+        reply.merge!(overrides)
+        fold_dotted_overrides!(reply, overrides.keys, raw_object: raw_object, create: raw_original.nil?)
+        reply
+      end
+
+      # A handler's Hash override keyed by Ruby names (`{acl: ...}`,
+      # `{author_name: ...}`) is mapped to the remote field names the reply
+      # uses, so it replaces the matching field instead of sitting beside it.
+      # A dotted key maps its first segment.
+      # @!visibility private
+      def remote_override_keys(payload, overrides)
+        klass = begin
+            name = payload.parse_class
+            name.present? ? Parse::Object.find_class(name) : nil
+          rescue StandardError
+            nil
+          end
+        map = klass.respond_to?(:field_map) ? klass.field_map : {}
+        overrides.each_with_object({}) do |(key, value), out|
+          key = key.to_s
+          head, rest = key.split(".", 2)
+          remote = map[head.to_sym]
+          head = remote.to_s if remote
+          out[rest ? "#{head}.#{rest}" : head] = value
+        end
+      end
+
+      # A handler's Hash override may name a sub-key (`"meta.y"`) of a field
+      # the reply writes whole (a create, or a field written whole on an
+      # update). MongoDB refuses `meta` and `meta.y` in one update, so the
+      # sub-key write is folded into the whole value. An override deeper
+      # than one level (`"meta.count.value"`) is folded into a `field.sub`
+      # write seeded from the pending object, because Parse Server rebuilds
+      # the afterSave object from a dotted key only one level deep. On a
+      # create every dotted override folds into its whole field.
+      #
+      # When the value it folds into is not a plain sub-document, a client's
+      # value is replaced by the handler's sub-key, and two of the handler's
+      # own overrides that conflict (`"meta.a" => 5` with `"meta.a.b" => 6`)
+      # raise {ResponseError}.
+      # @!visibility private
+      def fold_dotted_overrides!(reply, override_keys, raw_object: {}, create: false)
+        handler_keys = override_keys.to_set
+        override_keys.sort_by { |k| k.count(".") }.each do |key|
+          next unless key.include?(".") && reply.key?(key)
+          segments = key.split(".")
+          # The nearest ancestor path the reply writes whole, if any.
+          parent = (1...segments.length).map { |n| segments.first(n).join(".") }.reverse.find { |p| reply.key?(p) }
+          unless parent
+            next if !create && segments.length <= 2
+            parent = create ? segments.first : segments.first(2).join(".")
+            seed = parent.split(".").reduce(raw_object) { |cur, seg| cur.is_a?(Hash) ? cur[seg] : nil }
+            reply[parent] = plain_sub_document?(seed) ? seed.deep_dup : {}
+          end
+          value = reply.delete(key)
+          whole = reply[parent]
+          if plain_sub_document?(whole)
+            whole = whole.deep_dup
+          elsif handler_keys.include?(parent)
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: #{key} conflicts with #{parent} in the handler's reply"
+          else
+            whole = {}
+          end
+          *dirs, leaf = segments.drop(parent.count(".") + 1)
+          node = dirs.reduce(whole) do |cur, dir|
+            cur[dir] = {} unless plain_sub_document?(cur[dir])
+            cur[dir]
+          end
+          if value.is_a?(Hash) && value.key?("__op")
+            # A whole write stores its value as data, so an operator folded
+            # into it is applied here rather than written as a Hash.
+            result = fold_override_op(key, node[leaf], value)
+            if result.equal?(FOLD_DELETE)
+              node.delete(leaf)
+            else
+              node[leaf] = result
+            end
+          else
+            node[leaf] = value
+          end
+          reply[parent] = whole
+        end
         reply
       end
 
+      # @!visibility private
+      FOLD_DELETE = Object.new.freeze
+
+      # Apply a handler's sub-key operator to the value it replaces inside a
+      # sub-document the reply writes whole, with Parse Server's semantics
+      # for that operator. Raises {ResponseError} (an `{error}` reply, so
+      # Parse Server refuses the save) for an operator that cannot be applied
+      # to a plain value, rather than storing the operator Hash as data.
+      # @param key [String] the dotted override key, for the error message.
+      # @param current [Object] the value at that path in the whole write.
+      # @param op [Hash] the operator Hash (`{"__op" => ...}`).
+      # @return [Object] the new value, or {FOLD_DELETE} to remove the key.
+      # @!visibility private
+      def fold_override_op(key, current, op)
+        name = op["__op"]
+        case name
+        when "Delete"
+          FOLD_DELETE
+        when "Increment"
+          amount = op["amount"]
+          unless amount.is_a?(Numeric) && (current.nil? || current.is_a?(Numeric))
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: cannot apply Increment to #{key} (#{current.class})"
+          end
+          (current || 0) + amount
+        when "Add", "AddUnique", "Remove"
+          objects = op["objects"]
+          unless objects.is_a?(Array) && (current.nil? || current.is_a?(Array))
+            raise Parse::Webhooks::ResponseError,
+                  "before_save reply: cannot apply #{name} to #{key} (#{current.class})"
+          end
+          base = current || []
+          case name
+          when "Add" then base + objects
+          when "AddUnique" then base + objects.reject { |o| base.include?(o) }.uniq
+          else base.reject { |o| objects.include?(o) }
+          end
+        else
+          raise Parse::Webhooks::ResponseError,
+                "before_save reply: operator #{name.inspect} on #{key} cannot be combined " \
+                "with a whole write of its parent field"
+        end
+      end
+
+      # @!visibility private
+      def handler_assigned_acl?(obj)
+        return true if obj.instance_variable_get(:@_webhook_reply_acl) == true
+        obj.respond_to?(:webhook_handler_acl_assigned?) && obj.webhook_handler_acl_assigned?
+      end
+
+      # On a client create, an owner-based ACL policy (`:owner_else_private`,
+      # the shipped default, `:owner_else_public`, `:owner_but_public_read`)
+      # resolves its owner the way an SDK create `as:` the requesting user
+      # does: when the declared owner field holds no value, the user who made
+      # the request owns the record. A request without a user (anonymous, or
+      # master key) gets the policy's fallback. Leaves the object alone when
+      # the handler or the client already set an ACL.
+      # @!visibility private
+      def adopt_request_user_as_acl_owner!(payload, obj)
+        return unless payload && payload.original.nil?
+        if handler_assigned_acl?(obj)
+          # The handler's ACL is final: keep the save-time policy resolver
+          # from replacing it, even when it equals the default stamp.
+          obj.instance_variable_set(:@_acl_pristine, false)
+          return
+        end
+        return unless obj.is_a?(Parse::Object) && obj.instance_variable_get(:@_acl_pristine)
+        return if obj.instance_variable_get(:@_acl_owner_override)
+        klass = obj.class
+        return if klass.respond_to?(:builtin_acl_default_active?) && klass.builtin_acl_default_active?
+        return unless klass.respond_to?(:acl_policy_setting) && klass.acl_policy_setting.to_s.start_with?("owner_")
+        field = klass.acl_owner_field
+        if field == :self
+          adopt_self_owned_acl!(obj, klass)
+          return
+        end
+        # A master-key request is not the user's own write.
+        return if payload.master?
+        user = payload.user
+        return unless user.is_a?(Parse::User) && user.id.present?
+        if field && obj.respond_to?(field)
+          return if obj.send(field).present?
+        end
+        obj.instance_variable_set(:@_acl_owner_override, user)
+      end
+
+      # A self-owned user (`acl_policy ..., owner: :self`) owns its own
+      # record, never the requesting user. Its objectId is assigned by Parse
+      # Server after beforeSave, and Parse Server adds the new user's own
+      # read and write to the ACL of every `_User` create. So the reply
+      # carries the policy's ACL without the owner entry (`{}`, or public
+      # read under `:owner_but_public_read`), which Parse Server completes
+      # with the user's own grant. The save-time resolver is skipped, since
+      # it would pre-generate an objectId the server does not use.
+      # @!visibility private
+      def adopt_self_owned_acl!(obj, klass)
+        acl = if klass.acl_policy_setting == :owner_but_public_read
+            Parse::ACL.everyone(true, false)
+          else
+            Parse::ACL.new
+          end
+        klass.instance_method(:acl=).bind_call(obj, acl)
+        obj.instance_variable_set(:@_acl_pristine, false)
+        obj.instance_variable_set(:@_webhook_reply_acl, true)
+      end
+
       # The client's write, rebuilt from a beforeSave payload. Parse Server
       # serializes the pending object with `toJSON()`, which reports every
       # pending top-level operator as its operator hash, so the operators
       # survive here as sent. On an update, a field whose value equals the
-      # stored one was not written by the client and is left out.
+      # stored one was not written by the client and is left out, and a
+      # changed sub-document is split into dotted sub-key writes (see
+      # {sub_document_write}).
       #
       # @param raw_object [Hash] the unscrubbed `object` hash.
       # @param raw_original [Hash, nil] the unscrubbed `original` hash.
@@ -841,12 +1063,96 @@ module Parse
             # Parse Server drops objectId from an update write itself.
             next if key == Parse::Model::OBJECT_ID
             next if raw_original.key?(key) && raw_original[key] == value
+            dotted = sub_document_write(key, value, raw_original[key])
+            if dotted
+              data.merge!(dotted)
+              next
+            end
           end
           data[key] = value
         end
         data
       end
 
+      # Keys never split into dotted sub-key writes: their values are
+      # replaced as a whole by Parse Server.
+      # @!visibility private
+      BEFORE_SAVE_REPLY_WHOLE_KEYS = %w[ACL authData].freeze
+
+      # Dotted sub-key writes for a sub-document the client changed.
+      #
+      # Parse Server applies a client's `"meta.count"` operator to its pending
+      # object and sends the webhook only the resulting `meta`, which matches
+      # a whole-object write of the same value. Writing just the sub-keys that
+      # differ from the stored sub-document gives the same result as either
+      # client write, without overwriting sub-keys another request changed in
+      # the meantime. The split is one level deep: a changed sub-key is
+      # written whole at `field.sub`, nested objects included, because Parse
+      # Server rebuilds the afterSave object from a non-operator dotted key
+      # only one level deep (`"meta.count.value"` would set `meta.count` to
+      # the leaf). A sub-key missing from the new value is written as a
+      # `Delete` operator.
+      #
+      # Parse Server stores a dotted value as sent, without the type transform
+      # a whole write gets, so a Date would land as a plain sub-document
+      # instead of a BSON date. When any write would carry a typed value
+      # (`{"__type": ...}`), the field is written whole instead.
+      #
+      # @param key [String] the top-level field name.
+      # @param value [Object] the field's value in the pending object.
+      # @param stored [Object] the field's stored value.
+      # @return [Hash, nil] the dotted writes, or nil to write the field whole.
+      # @!visibility private
+      def sub_document_write(key, value, stored)
+        return nil if key.start_with?("_") || BEFORE_SAVE_REPLY_WHOLE_KEYS.include?(key)
+        return nil unless splittable_level?(value, stored)
+        writes = {}
+        diff_sub_document(key, value, stored, writes)
+        return nil if writes.empty? || writes.values.any? { |v| typed_value?(v) }
+        writes
+      end
+
+      # Collect the one-level dotted writes that turn `stored` into `value`
+      # under `path`.
+      # @!visibility private
+      def diff_sub_document(path, value, stored, writes)
+        (value.keys | stored.keys).each do |sub|
+          new_present = value.key?(sub)
+          old_present = stored.key?(sub)
+          next if new_present && old_present && value[sub] == stored[sub]
+          sub_path = "#{path}.#{sub}"
+          writes[sub_path] = new_present ? value[sub] : { "__op" => "Delete" }
+        end
+      end
+
+      # Whether a pair of values can be diffed key by key: both plain JSON
+      # objects, with sub-keys that are usable as path segments.
+      # @!visibility private
+      def splittable_level?(value, stored)
+        return false unless plain_sub_document?(value) && plain_sub_document?(stored)
+        keys = value.keys | stored.keys
+        return false if keys.empty?
+        keys.none? { |k| k.to_s.empty? || k.to_s.include?(".") || k.to_s.start_with?("$") }
+      end
+
+      # Whether a JSON value is, or contains, a Parse typed value
+      # (`{"__type": ...}`: Date, Bytes, Pointer, File, GeoPoint, ...).
+      # @!visibility private
+      def typed_value?(value)
+        case value
+        when Hash then value.key?("__type") || value.values.any? { |v| typed_value?(v) }
+        when Array then value.any? { |v| typed_value?(v) }
+        else false
+        end
+      end
+
+      # A JSON object field value: a Hash that is not a Parse operator or a
+      # typed value (Pointer, Date, File, GeoPoint, ...).
+      # @!visibility private
+      def plain_sub_document?(value)
+        value.is_a?(Hash) && !value.key?("__op") && !value.key?("__type")
+      end
+
       # Diff the handler's object against a fresh build of the same payload.
       #
       # Only fields that are dirty on either object can differ: a field the
@@ -1118,7 +1424,12 @@ module Parse
         request = Rack::Request.new env
         response = Rack::Response.new
 
+        # Whether this request proved it came from Parse Server: the webhook
+        # key matched, or (below) a configured signature verified. Without
+        # either, the body's `master` flag is only a claim.
+        authenticated = false
         if self.key.present?
+          authenticated = true
           provided_key = request.env[HTTP_PARSE_WEBHOOK].to_s
           unless ActiveSupport::SecurityUtils.secure_compare(self.key, provided_key)
             puts "[Parse::Webhooks] Invalid Parse-Webhook Key received"
@@ -1163,7 +1474,7 @@ module Parse
         # require a fresh HMAC over the body. Done before JSON parsing so
         # a malformed payload can't bypass dedup, and before any handler
         # runs so side effects aren't repeated.
-        replay_error = ReplayProtection.verify!(
+        replay_error, signature_verified = ReplayProtection.check(
           request.env,
           body_str,
           request.env["HTTP_X_PARSE_REQUEST_ID"]
@@ -1172,6 +1483,10 @@ module Parse
           response.write error(replay_error)
           return response.finish
         end
+        # Uses the result of the check that just ran, not a second read of
+        # the signing secret, so a secret changed mid-request cannot mark an
+        # unverified request as authenticated.
+        authenticated ||= signature_verified
 
         # Parse Server registers each trigger at
         # `<endpoint>/<triggerName>/<className>`. For beforeFind/afterFind the
@@ -1184,6 +1499,7 @@ module Parse
         webhook_class = Parse::Webhooks.trigger_class_from_path(request.path)
         begin
           payload = Parse::Webhooks::Payload.new(body_str, webhook_class)
+          payload.authenticated = authenticated
         rescue => e
           warn "Invalid webhook payload format: #{Parse::TerminalSafe.sanitize_line(e.to_s)}"
           response.write error("Invalid payload format. Should be valid JSON.")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.8.0
+  version: 5.8.2
 platform: ruby
 authors:
 - Adrian Curtin