parse-stack-next 5.8.0 → 5.8.2

data/lib/parse/api/batch.rb

@@ -19,13 +19,81 @@ module Parse
       # @overload batch_request(operation)
       #  Submit a batch operation.
       #  @param operation [Parse::BatchOperation] the batch operation.
+      # @param opts [Hash] request options for the `POST /batch` call itself,
+      #   such as `session_token:` or `use_master_key:`. Parse Server runs
+      #   every sub-request under the credentials of this one call (it ignores
+      #   per-sub-request headers), so the batch's authority is set here. A
+      #   request that names no credentials of its own runs under these.
+      #   Narrowing options always win: `use_master_key: false` here keeps
+      #   the master key off even for a request that set
+      #   `use_master_key: true`. An option here never widens a request.
+      # @note Every request is sent through this client, as
+      #   {Parse::Client#request} sends a single request through the client
+      #   it is called on, even when the request was built for another
+      #   object's class client.
+      # @note Each {Parse::Request}'s own credentials (its `session_token:` /
+      #   `use_master_key:` options and its session-token or master-key
+      #   suppression headers) are honored.
+      #   When every request resolves to this client and one set of
+      #   credentials, the batch is one call. A transaction that would mix
+      #   credentials raises {Parse::BatchOperation::MixedAuthorityError}
+      #   before anything is sent. A non-transactional batch with mixed
+      #   credentials is sent as one call per set of credentials, through
+      #   {Parse::BatchOperation#submit}, with responses in request order.
+      #   Elements that are not {Parse::Request} instances are ignored, as
+      #   {Parse::BatchOperation#add} ignores them.
       # @return [Array<Parse::Response>] if successful, a set of responses for each operation in the batch.
       # @return [Parse::Response] if an error occurred, the error response.
-      def batch_request(batch_operations)
+      # @raise [Parse::BatchOperation::MixedAuthorityError] for a transaction
+      #   whose requests name different credentials.
+      def batch_request(batch_operations, **opts)
         unless batch_operations.is_a?(Parse::BatchOperation)
           batch_operations = Parse::BatchOperation.new batch_operations
         end
-        response = request(:post, "batch", body: batch_operations.as_json)
+        call_auth = opts.slice(:session_token, :use_master_key, :suppress_master_key)
+        groups = batch_operations.send(:authority_groups, self, call_auth, force_client: true)
+        if groups.empty?
+          return post_batch_operation(batch_operations, opts.except(:suppress_master_key))
+        end
+        if groups.size == 1 &&
+           Parse::BatchOperation.credential_fingerprint(groups.first[:client]) ==
+           Parse::BatchOperation.credential_fingerprint(self)
+          send_opts = opts.except(:session_token, :use_master_key, :suppress_master_key)
+                          .merge(groups.first[:opts])
+          return post_batch_operation(batch_operations, send_opts)
+        end
+        if batch_operations.transaction
+          raise Parse::BatchOperation::MixedAuthorityError,
+                "A transaction cannot mix requests built for different credentials or " \
+                "another client. Parse Server runs a batch under one credential, so it " \
+                "cannot honor each request's own. Save these objects in separate transactions."
+        end
+        # Mixed credentials, not a transaction: send one call per set of
+        # credentials, keeping responses in request order.
+        # Assigned, not re-added: `add` would drop tagged duplicates and leave
+        # fewer responses than requests.
+        routed = Parse::BatchOperation.new
+        routed.requests = batch_operations.requests.dup
+        routed.client = self
+        routed.batch_defaults = call_auth
+        routed.submit
+      end
+
+      private
+
+      # Send one `POST /batch` call and map its result to responses.
+      # @param batch_operations [Parse::BatchOperation]
+      # @param opts [Hash] request options for the call.
+      def post_batch_operation(batch_operations, opts)
+        opts = opts.dup
+        headers = nil
+        # Sent as the header itself, exactly as a single request carries it:
+        # the authentication middleware drops the master key when it is set,
+        # even with `use_master_key: true`.
+        if opts.delete(:suppress_master_key)
+          headers = { Parse::Middleware::Authentication::DISABLE_MASTER_KEY => "true" }
+        end
+        response = request(:post, "batch", body: batch_operations.as_json, headers: headers, opts: opts)
         return response.batch_responses if response.success? && response.batch?
         return response if response.error?
         # A successful HTTP response whose body is not an array of results

data/lib/parse/atlas_search/index_manager.rb

@@ -65,7 +65,11 @@ module Parse
             # `master: true` so the SDK's CLP layer skips this metadata
             # pipeline. The mongo-side privilege check still applies
             # (the underlying connection must hold `listSearchIndexes`).
-            results = Parse::MongoDB.aggregate(collection_name, pipeline, master: true)
+            # The metadata sentinel keeps that master mode inside a
+            # `Parse.without_master_key` block, which governs row access,
+            # without re-enabling the master key for anything else.
+            results = Parse::MongoDB.aggregate(collection_name, pipeline,
+                                               master: Parse::ACLScope::METADATA_MASTER)
             cache_mutex.synchronize { cache_indexes(collection_name, results) }
             results
           rescue => e

data/lib/parse/atlas_search.rb

@@ -559,6 +559,7 @@ module Parse
         unless resolution.master?
           acl_match = Parse::ACLScope.match_stage_for(resolution)
           pipeline << acl_match if acl_match
+          pipeline << pointer_fields_match_stage(pointer_fields, resolution) if pointer_fields
         end
 
         # Add filter if provided
@@ -660,6 +661,17 @@ module Parse
                 "accept that bucket counts include all rows, or use " \
                 "#search for ACL-scoped results without facets."
         end
+        # Inside Parse.without_master_key the only scope left is public,
+        # and $searchMeta bucket counts are not ACL-filtered there either,
+        # so they would count rows the block is meant to hide. Fail closed.
+        if Parse::ACLScope.master_key_suppressed?
+          raise FacetedSearchNotACLSafe,
+                "Parse::AtlasSearch.faceted_search cannot run inside " \
+                "Parse.without_master_key: $searchMeta bucket counts include " \
+                "rows the caller cannot read. Wrap the call in " \
+                "Parse.with_master_key to accept master-key counts, or use " \
+                "#search for ACL-scoped results without facets."
+        end
         # Wave-3b READPREF-4: see #search for rationale. Captured
         # before resolve_scope! pops the auth kwargs so the recursive
         # search() call below can re-thread it explicitly (resolve!
@@ -815,6 +827,7 @@ module Parse
         unless resolution.master?
           acl_match = Parse::ACLScope.match_stage_for(resolution)
           pipeline << acl_match if acl_match
+          pipeline << pointer_fields_match_stage(pointer_fields, resolution) if pointer_fields
         end
 
         # Caller-supplied filter, sanitized against operator injection
@@ -851,6 +864,8 @@ module Parse
         unless resolution.master?
           Parse::ACLScope.redact_results!(raw_results, resolution)
           Parse::CLPScope.redact_protected_fields!(raw_results, protected_fields) if protected_fields.any?
+          # The pointerFields `$match` above already ran before `$limit`;
+          # this re-check is defense in depth and should drop nothing.
           if pointer_fields
             raw_results = Parse::CLPScope.filter_by_pointer_fields(
               raw_results, pointer_fields, resolution.user_id,
@@ -972,13 +987,37 @@ module Parse
           return Parse::ACLScope.resolve_for_role(acl_role, client: auth_client)
         end
 
-        if master == true
+        if master == true && !Parse::ACLScope.master_key_suppressed?
           return Parse::ACLScope::Resolution.new(
                    mode: :master, permission_strings: nil, user_id: nil, session: nil,
                    client: auth_client,
                  )
         end
 
+        # Inside `Parse.without_master_key` an explicit master request runs
+        # in the public scope, as Parse::ACLScope.resolve! does: no
+        # no-ACL banner (the caller did pass a scope), and either strict
+        # flag refuses the fallback.
+        if master == true
+          if @require_session_token == true || Parse::ACLScope.require_session_token == true
+            raise ACLRequired,
+                  "Parse::AtlasSearch.#{method_name} was called with master: true " \
+                  "inside Parse.without_master_key, which drops master mode, and " \
+                  "require_session_token refuses the public fallback. Pass " \
+                  "session_token:, or run the call inside Parse.with_master_key " \
+                  "if it needs master authority."
+          end
+          anonymous = Session::Resolved.new(nil, Set.new)
+          return Parse::ACLScope::Resolution.new(
+                   mode: :public,
+                   permission_strings: anonymous.permission_strings,
+                   user_id: nil,
+                   session: anonymous,
+                   client: auth_client,
+                   master_dropped: true,
+                 )
+        end
+
         if @require_session_token == true
           raise ACLRequired,
                 "Parse::AtlasSearch.#{method_name} requires session_token: or " \
@@ -1037,6 +1076,15 @@ module Parse
                                             label: "Atlas Search")
       end
 
+      # The pointerFields / readUserFields ownership constraint as a
+      # `$match` stage, placed after the ACL `$match` and before `$sort` /
+      # `$limit`. Filtering the fetched rows afterwards returned short or
+      # empty pages whenever the top-ranked hits belonged to other users,
+      # even though eligible matches ranked below them.
+      def pointer_fields_match_stage(pointer_fields, resolution)
+        { "$match" => Parse::CLPScope.pointer_fields_predicate(pointer_fields, resolution.user_id) }
+      end
+
       # ATLAS-4: refuse `highlight_field:` when the field is in the
       # resolved protectedFields set. searchHighlights returns the
       # matched token plus surrounding chars verbatim; running it on
@@ -1120,6 +1168,7 @@ module Parse
       def run_atlas_pipeline!(collection_name, pipeline, max_time_ms = nil, read_preference: nil,
                                                                             authorizing_client: nil)
         agg_opts = {}
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(pipeline)
         agg_opts[:max_time_ms] = max_time_ms if max_time_ms
         # Atlas Search does not go through Parse::MongoDB.aggregate, so this
         # is the only place its reads meet the binding guard.

data/lib/parse/authorization.rb

@@ -116,6 +116,49 @@ module Parse
       end
     end
 
+    # Process-local record of session objectId to owning user id, kept apart
+    # from the identity plane so no session token can ever read a record.
+    # Entries expire after `ttl` and the map holds at most {MAX_ENTRIES},
+    # dropping the oldest first. Values are stored typed
+    # (`{"session_owner" => user_id}`) so a shared store passed in its place
+    # cannot confuse a record with an identity entry either.
+    class SessionOwnerMap
+      MAX_ENTRIES = 10_000
+
+      def initialize
+        @data = {}
+        @mutex = Mutex.new
+      end
+
+      def get(key)
+        @mutex.synchronize do
+          entry = @data[key]
+          return nil if entry.nil?
+          if entry[:expires_at] < Time.now
+            @data.delete(key)
+            return nil
+          end
+          entry[:value]
+        end
+      end
+
+      def set(key, value, ttl:)
+        @mutex.synchronize do
+          @data.delete(key)
+          @data[key] = { value: value, expires_at: Time.now + ttl }
+          @data.shift while @data.size > MAX_ENTRIES
+        end
+      end
+
+      def invalidate(key)
+        @mutex.synchronize { @data.delete(key) }
+      end
+
+      def clear
+        @mutex.synchronize { @data.clear }
+      end
+    end
+
     # The outcome of resolving a caller. `user_id` is the `_User.objectId`
     # owning the session, or `nil` for an anonymous caller. `role_names` is a
     # `Set` of bare role names (no `role:` prefix) the user inherits
@@ -189,8 +232,26 @@ module Parse
         @role_cache_ttl = DEFAULT_ROLE_TTL
         @upstream_role_reader = nil
         @compare_upstream_roles = false
+        # Bumped by every invalidation. A token resolution captures it before
+        # calling `/users/me` and does not cache its answer when it moved, so
+        # a resolve already in flight when a session is revoked cannot put
+        # the revoked token back into the plane. A generation-capable plane
+        # (the shared Redis identity plane) keeps a plane-wide counter too,
+        # so the same holds across processes. See {#lookup_user_id}.
+        @invalidation_epoch = 0
+        @epoch_mutex = Mutex.new
+        @session_owner_cache = SessionOwnerMap.new
       end
 
+      # Where {#remember_session_owner} records which user owns a session
+      # objectId. A separate store from the identity plane, so a session
+      # token can never read a record. Defaults to a process-local
+      # {SessionOwnerMap}; set a shared store (anything with `get`, `set`
+      # with `ttl:`, `invalidate`, and `clear`) to share records across
+      # processes.
+      # @return [Object]
+      attr_accessor :session_owner_cache
+
       # Apply settings, leaving anything not passed unchanged.
       # @return [self]
       def configure(identity_cache: nil, role_cache: nil,
@@ -246,6 +307,7 @@ module Parse
       # @param session_token [String]
       def invalidate(session_token)
         return if session_token.nil?
+        bump_invalidation_epoch!
         @identity_cache.invalidate(session_token.to_s)
       end
 
@@ -268,6 +330,7 @@ module Parse
       def invalidate_user(user_id)
         return if user_id.nil? || user_id.to_s.empty?
         uid = user_id.to_s
+        bump_invalidation_epoch!
         cache = @identity_cache
         if generation_capable?(cache) && cache.respond_to?(:bump_generation)
           cache.bump_generation(uid)
@@ -294,8 +357,42 @@ module Parse
 
       # Drop every entry in both planes.
       def reset_caches!
+        bump_invalidation_epoch!
         @identity_cache.clear if @identity_cache.respond_to?(:clear)
         @role_cache.clear if @role_cache.respond_to?(:clear)
+        # A plane clear takes the plane-wide marker with it. Bump it again so
+        # it does not sit at a value a lookup that started before the reset
+        # could have captured.
+        bump_plane_epoch!
+      end
+
+      # Record which user owns a session objectId, so a later delete of that
+      # session can drop the owner's cached identities even when the delete
+      # can no longer read the session row (it is already gone, or not
+      # visible to the caller). Only the owner's user id is stored, never the
+      # token. Called when a `_Session` row with both is loaded from the
+      # server. The entry lives as long as an identity entry.
+      # @param session_id [String]
+      # @param user_id [String]
+      # @return [void]
+      def remember_session_owner(session_id, user_id)
+        return if session_id.to_s.empty? || user_id.to_s.empty?
+        @session_owner_cache.set(session_id.to_s, { "session_owner" => user_id.to_s }, ttl: @identity_cache_ttl)
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # The owner recorded by {#remember_session_owner}, or nil.
+      # @param session_id [String]
+      # @return [String, nil]
+      def session_owner(session_id)
+        return nil if session_id.to_s.empty?
+        value = @session_owner_cache.get(session_id.to_s)
+        owner = value.is_a?(Hash) ? value["session_owner"] : nil
+        owner.is_a?(String) && !owner.empty? ? owner : nil
+      rescue StandardError
+        nil
       end
 
       def inspect
@@ -314,6 +411,14 @@ module Parse
         cached = cached_user_id(session_token)
         return cached unless cached.nil?
 
+        # Captured before `/users/me`: an invalidation that lands while the
+        # lookup is in flight must win over the answer it returns. The plane
+        # marker is created first if a clear removed it, so the snapshot
+        # never holds "no marker", which a concurrent reset also produces.
+        ensure_plane_marker!
+        snapshot = invalidation_snapshot
+        prior_uid, prior_gen = prior_generation(session_token)
+
         response = begin
             # cache: false: a revoked or expired token must not re-resolve
             # from a cached /users/me response after its identity entry is
@@ -331,10 +436,136 @@ module Parse
         raise InvalidSession, "session token resolved no user objectId" if user_id.nil? || user_id.to_s.empty?
 
         user_id = user_id.to_s
-        store_user_id(session_token, user_id)
+        # A stale entry for the same user tells us its generation from
+        # before the lookup; storing under it lets a bump made across
+        # processes during the lookup still reject the entry.
+        store_unless_invalidated(session_token, user_id, snapshot,
+                                 gen: prior_uid == user_id ? prior_gen : nil)
         user_id
       end
 
+      # Cache a resolved identity only if no invalidation happened since
+      # `snapshot` was taken, without a window between the check and the
+      # write.
+      #
+      # Every invalidation bumps the counters BEFORE it drops entries. The
+      # write is checked before and re-checked after; a change seen by the
+      # second check evicts what was just written. So an invalidation either
+      # bumped before the re-check (the entry is evicted here) or bumped
+      # after it, which means it also drops entries after the write (the
+      # entry is removed, or its generation goes stale, by the invalidation
+      # itself). Either way the revoked identity does not stay cached. The
+      # plane-wide counter extends this to invalidations made by other
+      # processes sharing a generation-capable plane.
+      def store_unless_invalidated(session_token, user_id, snapshot, gen: nil)
+        return unless snapshot_usable?(snapshot)
+        return unless invalidation_snapshot == snapshot
+        store_user_id(session_token, user_id, gen: gen)
+        return if invalidation_snapshot == snapshot
+        @identity_cache.invalidate(session_token)
+      rescue StandardError
+        # Not caching is always safe: the next read resolves again.
+        begin
+          @identity_cache.invalidate(session_token)
+        rescue StandardError
+          nil
+        end
+      end
+
+      # The process counter plus, on a generation-capable plane, the
+      # plane-wide counter shared by every process using that plane.
+      def invalidation_snapshot
+        [current_invalidation_epoch, plane_epoch]
+      end
+
+      # A snapshot whose plane counter could not be read cannot prove that no
+      # other process invalidated during the lookup, so it never caches.
+      #
+      # An absent marker on a plane that keeps one is not usable either: a
+      # reset in another process deletes the marker before it installs a new
+      # one, so "absent" before and after the write cannot prove that no reset
+      # ran in between. The re-check after the write compares against a
+      # present marker, so reading it absent there evicts the write.
+      def snapshot_usable?(snapshot)
+        snapshot[1] != :unavailable && snapshot[1] != :absent
+      end
+
+      # Create the plane-wide marker when the plane keeps one and it is
+      # missing (a fresh plane, or one a reset has just cleared).
+      def ensure_plane_marker!
+        cache = @identity_cache
+        if cache.respond_to?(:invalidation_nonce)
+          cache.bump_invalidation_nonce if cache.invalidation_nonce.nil?
+        elsif generation_capable?(cache) && cache.respond_to?(:bump_generation)
+          gen = cache.generation(PLANE_EPOCH_SUBJECT)
+          cache.bump_generation(PLANE_EPOCH_SUBJECT) if gen.nil? || gen.to_i.zero?
+        end
+      rescue StandardError
+        nil
+      end
+
+      def bump_invalidation_epoch!
+        @epoch_mutex.synchronize { @invalidation_epoch += 1 }
+        bump_plane_epoch!
+      end
+
+      def current_invalidation_epoch
+        @epoch_mutex.synchronize { @invalidation_epoch }
+      end
+
+      # Reserved generation subject for the plane-wide invalidation counter
+      # on a custom generation-capable plane without an invalidation nonce.
+      # Parse objectIds are alphanumeric, so it cannot name a real user.
+      PLANE_EPOCH_SUBJECT = "~identity-invalidations"
+
+      # The plane-wide invalidation marker: a random nonce replaced on every
+      # invalidation when the plane offers one ({Parse::Cache::SubCache}
+      # does), else a generation counter. nil when the plane has neither,
+      # `:absent` when the plane keeps one but it is missing (fresh or just
+      # cleared), `:unavailable` when reading it failed. A nonce never repeats,
+      # so a plane clear that drops it cannot make an old value come back. A
+      # generation counter can: a custom plane whose `clear` also deletes its
+      # generations restarts the counter, so a lookup racing another
+      # process's reset is bounded by `identity_cache_ttl`. Such a plane
+      # should implement `invalidation_nonce` / `bump_invalidation_nonce`.
+      def plane_epoch
+        cache = @identity_cache
+        if cache.respond_to?(:invalidation_nonce)
+          nonce = cache.invalidation_nonce
+          return nonce.nil? ? :absent : nonce
+        end
+        return nil unless generation_capable?(cache)
+        gen = cache.generation(PLANE_EPOCH_SUBJECT)
+        gen.nil? || gen.to_i.zero? ? :absent : gen
+      rescue StandardError
+        :unavailable
+      end
+
+      def bump_plane_epoch!
+        cache = @identity_cache
+        if cache.respond_to?(:bump_invalidation_nonce)
+          cache.bump_invalidation_nonce
+        elsif generation_capable?(cache) && cache.respond_to?(:bump_generation)
+          cache.bump_generation(PLANE_EPOCH_SUBJECT)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # The user id and that user's current generation from a stale entry
+      # already stored for the token, read before `/users/me`.
+      # @return [Array(String, Object), Array(nil, nil)]
+      def prior_generation(session_token)
+        cache = @identity_cache
+        return [nil, nil] unless generation_capable?(cache)
+        raw = cache.get(session_token)
+        uid = raw.is_a?(Hash) ? (raw["user_id"] || raw[:user_id]) : nil
+        return [nil, nil] if uid.nil?
+        [uid.to_s, cache.generation(uid.to_s)]
+      rescue StandardError
+        [nil, nil]
+      end
+
       # Read the identity plane and, where the plane supports it, check that
       # the entry's generation is still current.
       #
@@ -369,10 +600,11 @@ module Parse
 
       # Write the identity entry, tagging it with the subject's current
       # generation when the plane can track one.
-      def store_user_id(session_token, user_id)
+      def store_user_id(session_token, user_id, gen: nil)
         cache = @identity_cache
         if generation_capable?(cache)
-          cache.set(session_token, { "user_id" => user_id, "gen" => cache.generation(user_id) },
+          gen = cache.generation(user_id) if gen.nil?
+          cache.set(session_token, { "user_id" => user_id, "gen" => gen },
                     ttl: @identity_cache_ttl)
         else
           cache.set(session_token, user_id, ttl: @identity_cache_ttl)

data/lib/parse/cache/sub_cache.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require "securerandom"
 require "set"
 
 module Parse
@@ -163,6 +164,25 @@ module Parse
         value
       end
 
+      # A random marker replaced on every identity invalidation, read by
+      # `Parse::Authorization` before and after it caches a token so an
+      # invalidation from any process in between is detected. A nonce rather
+      # than a counter: a plane clear drops it, and a counter restarting at
+      # 0 could repeat a value an in-flight lookup captured.
+      # @return [String, nil] nil when never set or cleared.
+      def invalidation_nonce
+        value = @store[invalidation_nonce_key]
+        value.nil? ? nil : value.to_s
+      end
+
+      # Replace the invalidation nonce.
+      # @return [String] the new nonce.
+      def bump_invalidation_nonce
+        nonce = SecureRandom.hex(16)
+        @store.store(invalidation_nonce_key, nonce, {})
+        nonce
+      end
+
       # @return [Float] the last invalidation epoch, 0.0 when never set.
       def epoch
         @store[epoch_key].to_f
@@ -253,6 +273,12 @@ module Parse
         @keyspace.key(@family, "meta", "epoch")
       end
 
+      # Sits beside the epoch under the reserved `meta` segment; a token key
+      # is a digest, so no token can name it.
+      def invalidation_nonce_key
+        @keyspace.key(@family, "meta", "invalidation")
+      end
+
       # Generations live in the same family so a plane clear takes them with it,
       # and are namespaced under `gen:` so they cannot collide with an entry
       # whose logical key happens to be a user id.

data/lib/parse/client/authentication.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "faraday"
+require "securerandom"
 require "active_support"
 require "active_support/core_ext"
 
@@ -15,6 +16,18 @@ module Parse
       include Parse::Protocol
       # @!visibility private
       DISABLE_MASTER_KEY = "X-Disable-Parse-Master-Key".freeze
+      # SDK-internal marker for a request that reads metadata (a class
+      # schema, the role graph) while enforcing a scope. Such a request keeps
+      # the master key inside {Parse.without_master_key}, which governs row
+      # access. The header carries a random per-process token and is removed
+      # before the request is logged or sent, so a header copied from user
+      # input cannot set it. {Parse::Client#request} adds it only for the
+      # `metadata_master:` request option set to
+      # {Parse::Client::METADATA_MASTER_REQUEST}.
+      # @!visibility private
+      METADATA_MASTER = "X-Parse-Stack-Metadata-Master".freeze
+      # @!visibility private
+      METADATA_MASTER_TOKEN = SecureRandom.hex(32).freeze
       # @return [String] the application id for this Parse endpoint.
       attr_accessor :application_id
       # @return [String] the REST API Key for this Parse endpoint.
@@ -67,7 +80,12 @@ module Parse
         #   3. A session-token-authenticated request (the existing check
         #      below; session token wins over master key).
         header_disable = env[:request_headers][DISABLE_MASTER_KEY].present?
-        fiber_disable = Parse.master_key_disabled?
+        # An SDK metadata read keeps the master key inside the block. Always
+        # remove the marker so it never reaches the logger or the server.
+        metadata_value = env[:request_headers].delete(METADATA_MASTER)
+        metadata_master = metadata_value.is_a?(String) &&
+                          ActiveSupport::SecurityUtils.secure_compare(metadata_value, METADATA_MASTER_TOKEN)
+        fiber_disable = Parse.master_key_disabled? && !metadata_master
         unless @master_key.blank? || header_disable || fiber_disable
           headers[MASTER_KEY] = @master_key
         end