parse-stack-next 5.8.0 → 5.8.2

data/lib/parse/live_query/client.rb

@@ -158,8 +158,11 @@ module Parse
                      use_master_key: NOT_PROVIDED, auto_connect: nil, auto_reconnect: nil)
         cfg = config
 
-        # Use provided values or fall back to configuration/environment
-        @url = url || cfg.url || derive_websocket_url
+        # Use provided values or fall back to configuration/environment. An
+        # explicit or configured URL is validated here; a derived one is
+        # validated by derive_websocket_url.
+        explicit_url = url || cfg.url
+        @url = explicit_url ? validate_websocket_url!(explicit_url) : derive_websocket_url
         @application_id = application_id || cfg.application_id ||
                           parse_client_value(:application_id)
         @client_key = client_key || cfg.client_key ||
@@ -374,7 +377,11 @@ module Parse
         if class_name.is_a?(Parse::Query)
           query = class_name
           class_name = query.table
-          where = query.compile_where
+          where = query.compile_rest_where
+          # The subscription runs under the query's own session (or its
+          # `become` client's); a different explicit token raises, and so
+          # does a query bound to another application than this client.
+          session_token = query.live_query_session_token(session_token, live_query_client: self)
         end
 
         # Refuse server-side-JS / data-mutating operators in the `where`
@@ -505,12 +512,70 @@ module Parse
         nil
       end
 
-      # Loopback hostnames exempt from the `ws://` refusal in
-      # {#derive_websocket_url}. These addresses can't reach the
-      # Internet, so the cleartext-credentials threat model doesn't
-      # apply — but we still emit a warning so the operator knows
-      # they're on `ws://`.
-      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1] 0.0.0.0].freeze
+      # Normalize and validate an explicit LiveQuery URL, returning the URL
+      # to connect to.
+      #
+      # - The scheme is compared case-insensitively and the URL is stripped.
+      # - `https://` is mapped to `wss://` and `http://` to `ws://`, with a
+      #   one-time deprecation warning. The connector used to open them as a
+      #   plaintext socket, so the `https` mapping is strictly safer.
+      # - Plaintext `ws://` (including a mapped `http://`) is refused on a
+      #   host that is not this machine ({Parse::Client.loopback_host?})
+      #   unless `allow_insecure` is set, in which case it warns.
+      # - Any other scheme raises `ArgumentError`.
+      #
+      # @param url [String]
+      # @param allow_insecure [Boolean]
+      # @return [String]
+      # @raise [ArgumentError]
+      def self.normalize_url(url, allow_insecure: false)
+        scheme = Parse::Client.url_scheme(url)
+        mapped = { "http" => "ws", "https" => "wss" }[scheme]
+        if mapped
+          warn_http_scheme_once(scheme, mapped)
+          scheme = mapped
+        end
+        unless %w[ws wss].include?(scheme)
+          raise ArgumentError,
+            "[Parse::LiveQuery] LiveQuery URL #{url.to_s.inspect} must use wss:// " \
+            "(or ws:// on a loopback host). Got scheme #{scheme.inspect}."
+        end
+        normalized = url.to_s.strip.sub(/\A[a-z][a-z0-9+.\-]*:/i, "#{scheme}:")
+        host = Parse::Client.url_host(normalized).to_s
+        return normalized if scheme == "wss" || Parse::Client.loopback_host?(host)
+
+        if allow_insecure
+          warn "[Parse::LiveQuery] Using insecure ws:// URL for #{host} " \
+               "(allow_insecure is enabled). Master key and session tokens " \
+               "will traverse a cleartext socket."
+          normalized
+        else
+          raise ArgumentError,
+            "[Parse::LiveQuery] Refusing insecure ws:// LiveQuery URL #{url.to_s.inspect}. " \
+            "The connect frame carries the master key and any session token in " \
+            "plaintext on this socket. Use wss:// for routable hosts, or set " \
+            "`Parse::LiveQuery.configure { |c| c.allow_insecure = true }` (or " \
+            "`live_query: { allow_insecure: true }`) for local development."
+        end
+      end
+
+      # @!visibility private
+      def self.warn_http_scheme_once(scheme, mapped)
+        @warned_http_schemes ||= {}
+        return if @warned_http_schemes[scheme]
+        @warned_http_schemes[scheme] = true
+        warn "[Parse::LiveQuery] DEPRECATION: an #{scheme}:// LiveQuery URL is " \
+             "treated as #{mapped}://. Configure the #{mapped}:// URL directly; " \
+             "a later release will refuse #{scheme}://."
+      end
+
+      # Validate an explicit or configured LiveQuery URL the same way a
+      # derived one is, and return the URL to connect to. See
+      # {Parse::LiveQuery::Client.normalize_url}.
+      # @return [String]
+      def validate_websocket_url!(url)
+        self.class.normalize_url(url, allow_insecure: config.allow_insecure)
+      end
 
       # Derive WebSocket URL from Parse server URL. Refuses to
       # synthesize a `ws://` URL from an `http://` server URL on any
@@ -526,7 +591,7 @@ module Parse
         scheme = uri.scheme == "https" ? "wss" : "ws"
         host = uri.host.to_s
 
-        if scheme == "ws" && !LOOPBACK_HOSTS.include?(host)
+        if scheme == "ws" && !Parse::Client.loopback_host?(host)
           if config.allow_insecure
             warn "[Parse::LiveQuery] Deriving insecure ws:// URL for #{host} " \
                  "(allow_insecure is enabled). Master key and session tokens " \
@@ -1007,6 +1072,27 @@ module Parse
         end
       end
 
+      # Release the latch set when this admin client first connected inside
+      # {Parse.without_master_key}. Until this is called, every later
+      # connect and reconnect withholds the master key. The next connect
+      # made outside the block then sends it again, elevating every
+      # subscription on the socket (a warning names how many).
+      # @return [void]
+      def allow_master_key_connection!
+        return unless @master_key_withheld
+        @master_key_withheld = false
+        @master_key_latch_released = true
+        nil
+      end
+
+      # @return [Boolean] whether this client withholds its master key on
+      #   every connect because it first connected inside
+      #   {Parse.without_master_key}.
+      def master_key_withheld?
+        @master_key_withheld == true
+      end
+      public :allow_master_key_connection!, :master_key_withheld?
+
       # Resubscribe all pending subscriptions
       def resubscribe_all
         subs = @monitor.synchronize { @subscriptions.values.dup }
@@ -1031,8 +1117,32 @@ module Parse
         # bypasses ACL/CLP/protectedFields. Sending it unconditionally
         # (the pre-5.1.0 behavior) silently elevated session-token
         # subscriptions the caller believed were scoped.
-        if admin_connection?
+        if admin_connection? && Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled?
+          # Inside `Parse.without_master_key` the connect frame carries no
+          # master key, as REST requests in the block do not. The socket is
+          # then ACL-scoped for its whole lifetime, and the choice is latched:
+          # a later reconnect (including an explicit `connect` made outside
+          # the block) keeps withholding it, so subscriptions created on
+          # this socket are never silently elevated.
+          @master_key_withheld = true
+          @connected_as_admin = false
+          warn_master_key_withheld_once
+        elsif admin_connection? && @master_key_withheld
+          @connected_as_admin = false
+          warn_master_key_withheld_once
+        elsif admin_connection?
+          if @master_key_latch_released
+            @master_key_latch_released = false
+            pending = @monitor.synchronize { @subscriptions.size }
+            if pending.positive?
+              warn "[Parse::LiveQuery:SECURITY] reconnecting with the master key after " \
+                   "allow_master_key_connection!: #{pending} existing subscription(s), " \
+                   "including any created inside Parse.without_master_key, now bypass " \
+                   "ACL/CLP."
+            end
+          end
           message[:masterKey] = @master_key
+          @connected_as_admin = true
           warn_master_key_connection_once
         elsif @use_master_key
           # Opted into admin mode but no usable master key is present —
@@ -1045,6 +1155,16 @@ module Parse
         send_message(message)
       end
 
+      # One-time warning that an admin connection was opened without its
+      # master key because `Parse.without_master_key` was active.
+      def warn_master_key_withheld_once
+        return if @master_key_withheld_warning_emitted
+        @master_key_withheld_warning_emitted = true
+        warn "[Parse::LiveQuery] admin connection (use_master_key: true) opened " \
+             "inside Parse.without_master_key: the connect frame carries no master " \
+             "key, so every subscription on this connection is ACL-scoped."
+      end
+
       # One-time loud warning that this connection bypasses ACL/CLP for
       # every subscription. Master-key LiveQuery is connection-level, so
       # this is the only place the risk can be surfaced.
@@ -1063,6 +1183,17 @@ module Parse
       # silently disagree with the connection's actual authorization.
       # Both are "you think you're scoped (or elevated) but you're not."
       def warn_subscription_scope_mismatch(use_master_key, session_token)
+        if @connected_as_admin && Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled? &&
+           !@block_on_admin_warning_emitted
+          # Parse Server fixes master-key authorization per connection at
+          # connect time, so a socket that connected with the master key
+          # stays elevated even for a subscription made inside the block.
+          @block_on_admin_warning_emitted = true
+          warn "[Parse::LiveQuery:SECURITY] subscribe inside Parse.without_master_key " \
+               "on a connection that already connected with the master key: Parse " \
+               "Server authorizes per connection, so this subscription still " \
+               "bypasses ACL/CLP. Use a non-admin client for streams inside the block."
+        end
         if use_master_key && !admin_connection?
           return if @per_sub_master_key_warning_emitted
           @per_sub_master_key_warning_emitted = true

data/lib/parse/lock_backend.rb

@@ -164,9 +164,10 @@ module Parse
       # a holder whose lease expired and was re-acquired by someone else
       # can never delete the new holder's key. Falls back to a
       # best-effort GET-then-DEL for raw-Moneta stores, where the
-      # worst-case cross-holder-delete race is bounded by the short TTL
-      # (callers clamp `ttl:` to ≤ 30s) — documented residual risk for
-      # the non-Redis path.
+      # worst-case cross-holder-delete race is bounded by the lease TTL.
+      # `Parse::Lock` clamps `ttl:` to 30s and the `first_or_create!`
+      # create-lock to 300s. This is a documented residual risk for the
+      # non-Redis path.
       #
       # @param store [Object] Moneta-shaped store.
       # @param key [String] cache key.

data/lib/parse/model/associations/collection_proxy.rb

@@ -271,9 +271,10 @@ module Parse
     alias_method :delete, :remove
 
     # Atomically adds all items to the array field. The request is sent
-    # directly to the Parse backend. On success the local collection is
-    # updated to match (the items are appended) without marking the field
-    # as changed, so a later save does not overwrite the server array. On
+    # directly to the Parse backend. On success the local collection takes
+    # the array the server returned (or appends the items when the reply
+    # does not include the field) without marking the field as changed, so
+    # a later save does not overwrite the server array. On
     # an owner that has not been saved yet there is nothing to update on
     # the server, so the items are added locally as a normal change and
     # sent with the next save.
@@ -509,11 +510,11 @@ module Parse
       # Read the owner's dirty state before touching the items, so a change
       # that was already pending is still sent by the next save.
       was_dirty = delegate_field_dirty?
-      # A clean plain array adopts the array the server returned, so a local
-      # copy that was already out of date is corrected. With unsaved local
-      # edits pending, adopting it would discard them, so the operation is
-      # applied locally instead (as it is for pointer collections, or a reply
-      # without the field) and the pending edits are still sent on save.
+      # A clean array adopts the array the server returned, so a local copy
+      # that was already out of date is corrected. With unsaved local edits
+      # pending, adopting it would discard them, so the operation is applied
+      # locally instead (as it is for a reply without the field) and the
+      # pending edits are still sent on save.
       server = was_dirty ? nil : server_array_after_op
       @collection = server || yield(collection.to_a.dup, items)
       @loaded = true
@@ -528,13 +529,20 @@ module Parse
     end
 
     # The field's new array from the delegate's last atomic operation, when
-    # this is a plain array proxy and the server returned it.
+    # the server returned it.
     # @return [Array, nil]
     def server_array_after_op
-      return nil unless instance_of?(Parse::CollectionProxy)
       return nil unless @delegate.respond_to?(:_last_operation_value, true)
       value = @delegate.send(:_last_operation_value, @key)
-      value.is_a?(Array) ? Parse::Properties.deep_copy_value(value) : nil
+      value.is_a?(Array) ? adopt_server_items(value) : nil
+    end
+
+    # The local items for an array the server returned, or nil to apply the
+    # operation locally instead.
+    # @param value [Array] the field's array from the server's reply.
+    # @return [Array, nil]
+    def adopt_server_items(value)
+      Parse::Properties.deep_copy_value(value)
     end
 
     # Convert items to pointer format for atomic operations.

data/lib/parse/model/associations/has_many.rb

@@ -555,6 +555,17 @@ module Parse
               warn "[#{self.class}] has_many :#{key} expected className=#{klassName.inspect}, ignoring incoming className=#{val[Parse::Model::KEY_CLASS_NAME].inspect}"
             end
             if val.is_a?(Hash) && val["__type"] == "Relation"
+              current = instance_variable_get(ivar)
+              # A server descriptor carries no membership. When the current
+              # proxy holds staged additions or removals (a fetch of a record
+              # with unsaved relation changes), keep it so they are not lost.
+              if track != true && current.is_a?(Parse::RelationCollectionProxy) &&
+                 current.staged_changes?
+                # The loaded list predates this fetch. Unload it so the next
+                # read queries the server and re-applies the staged changes.
+                current.reset! if current.loaded?
+                return current
+              end
               relation_objects = val["objects"] || []
               val = Parse::RelationCollectionProxy.new relation_objects, delegate: self, key: key, parse_class: klassName
             elsif val.is_a?(Hash) && val["__op"] == "AddRelation" && val["objects"].present?

data/lib/parse/model/associations/pointer_collection_proxy.rb

@@ -190,6 +190,42 @@ module Parse
       end
     end
 
+    # The server returns the field's array as pointer hashes. Each entry
+    # becomes an object of the declared class, reusing the local object with
+    # the same id so fetched data is kept. The array is adopted only when
+    # the declared class is a registered model and every entry is a pointer
+    # to that class; anything else (another class, a bare string, a value
+    # that is not a pointer) makes the operation apply locally instead,
+    # rather than relabeling the entry as the declared class.
+    # @return [Array<Parse::Pointer>, nil]
+    def adopt_server_items(value)
+      return nil if @parse_class.blank? || Parse::Model.find_class(@parse_class).nil?
+      local_by_id = {}
+      collection.to_a.each do |item|
+        id = item.respond_to?(:id) ? item.id : nil
+        local_by_id[id] ||= item if id.present?
+      end
+      value.map do |entry|
+        class_name, object_id = server_pointer_parts(entry)
+        return nil unless object_id.is_a?(String) && object_id.present?
+        return nil unless Parse::Model.same_parse_class?(class_name, @parse_class)
+        local_by_id[object_id] || typecast_item(entry) || (return nil)
+      end
+    end
+
+    # @return [Array(String, String), nil] the className and objectId of a
+    #   pointer entry from a server reply, or nil when it is not a pointer.
+    def server_pointer_parts(entry)
+      case entry
+      when Parse::Pointer
+        [entry.parse_class, entry.id]
+      when Hash
+        type = entry["__type"] || entry[:__type]
+        return nil unless %w[Pointer Object].include?(type.to_s)
+        [entry["className"] || entry[:className], entry["objectId"] || entry[:objectId]]
+      end
+    end
+
     # @return [Parse::Pointer, nil] the item as a Parse object, or nil.
     def typecast_item(item)
       case item

data/lib/parse/model/associations/relation_collection_proxy.rb

@@ -24,18 +24,19 @@ module Parse
   # get matching items within the relation collection.
   #
   # When creating a Relation proxy, all the delegate methods defined in the superclasses
-  # need to be implemented, in addition to a few others with the key parameter:
-  # _relation_query and _commit_relation_updates . :'key'_relation_query should return a
+  # need to be implemented, in addition to :'key'_relation_query, which should return a
   # Parse::Query object that is properly tied to the foreign table class related to this object column.
   # Example, if an Artist has many Song objects, then the query to be returned by this method
   # should be a Parse::Query for the class 'Song'.
   # Because relation changes are separate from object changes, you can call save on a
-  # relation collection to save the current add and remove operations. Because the delegate needs
-  # to be informed of the changes being committed, it will be notified
-  # through :'key'_commit_relation_updates message. The delegate is also in charge of
-  # clearing out the change information for the collection if saved successfully.
+  # relation collection to send only its staged add and remove operations, through the
+  # owner's atomic relation operations.
   # @see PointerCollectionProxy
   class RelationCollectionProxy < PointerCollectionProxy
+    # @!visibility private
+    # Default for {#save}'s `session:`: keep the owner's session as it is.
+    SESSION_UNSET = Object.new.freeze
+
     define_attribute_methods :additions, :removals
     # @!attribute [r] removals
     #  The objects that have been newly removed to this collection
@@ -200,7 +201,7 @@ module Parse
       return false unless @delegate.respond_to?(:op_add_relation!)
       items = typecast_items(items)
       return true if items.empty?
-      return add(*items) && true unless owner_saved?
+      return add(*items) && true unless owner_persisted?
       return false unless @delegate.send(:op_add_relation!, @key, items.parse_pointers)
       items.each do |item|
         @removals.delete(item)
@@ -223,7 +224,7 @@ module Parse
       return false unless @delegate.respond_to?(:op_remove_relation!)
       items = typecast_items(items, strict: false)
       return true if items.empty?
-      return remove(*items) && true unless owner_saved?
+      return remove(*items) && true unless owner_persisted?
       return false unless @delegate.send(:op_remove_relation!, @key, items.parse_pointers)
       items.each do |item|
         @additions.delete(item)
@@ -251,11 +252,66 @@ module Parse
       @collection
     end
 
-    # Save the changes to the relation
-    def save
-      unless @removals.empty? && @additions.empty?
-        forward :"#{@key}_commit_relation_updates"
+    # @return [Boolean] true when additions or removals are staged and not
+    #   yet sent.
+    def staged_changes?
+      @additions.any? || @removals.any?
+    end
+
+    # Drops the staged additions and removals and clears the dirty tracking,
+    # without sending anything. When operations were staged, the items are
+    # reloaded from the server on the next access, since the loaded list
+    # included them.
+    def clear_changes!
+      staged = staged_changes?
+      @additions = []
+      @removals = []
+      super
+      reset! if staged
+      @collection
+    end
+
+    # Sends the staged additions and removals of this relation without saving
+    # the rest of the owner. The owner must already be saved: an unsaved owner
+    # sends its relation additions when it is created.
+    #
+    # Removals and additions go out as two requests, removals first (each
+    # through the owner's atomic relation operation, so {Parse::Role} cache
+    # invalidation still runs). The two are not atomic: if the removals
+    # succeed and the additions fail, the removals stay applied, they are no
+    # longer staged, and the additions stay staged for a retry. An owner
+    # save sends relation changes the same way.
+    #
+    # The requests use the owner's session token from its last
+    # `save(session:)`, or the client's default credentials. Pass `session:`
+    # to send them as a specific user (a session token String or a
+    # {Parse::User}), or `session: nil` to send them with no session token.
+    # @param session [String, Parse::User, nil] the session to send the
+    #  operations with, when given.
+    # @return [Boolean] whether the staged operations were applied. False
+    #  when the owner is not saved yet or a request failed; operations that
+    #  did not succeed stay staged.
+    def save(session: SESSION_UNSET)
+      return true if @additions.empty? && @removals.empty?
+      return false unless owner_persisted?
+      return false unless @delegate.respond_to?(:op_add_relation!) && @delegate.respond_to?(:op_remove_relation!)
+      applied = with_owner_session(session) do
+        if @removals.any?
+          next false unless @delegate.send(:op_remove_relation!, @key, @removals.parse_pointers)
+          @removals = []
+        end
+        if @additions.any?
+          next false unless @delegate.send(:op_add_relation!, @key, @additions.parse_pointers)
+          @additions = []
+        end
+        true
+      end
+      return false unless applied
+      clear_changes_information
+      if @delegate.respond_to?(:clear_attribute_changes, true)
+        @delegate.send(:clear_attribute_changes, [@key.to_s])
       end
+      true
     end
 
     # @see #add
@@ -273,6 +329,35 @@ module Parse
       !(@delegate.respond_to?(:id) && @delegate.id.blank?)
     end
 
+    # @return [Boolean] whether the owner exists on the server, so a write to
+    #  its relation can be sent. Follows {Parse::Object#persisted?}: an
+    #  id-only handle to a stored record counts, but an objectId assigned
+    #  client-side during a create (`parse_reference precompute:`) does not
+    #  until the create returns, and neither does a destroyed owner.
+    def owner_persisted?
+      return false unless owner_saved?
+      !@delegate.respond_to?(:persisted?) || @delegate.persisted?
+    end
+
+    # Run the block with the owner's session token set to `session`, then
+    # restore the owner's previous token. {SESSION_UNSET} runs it unchanged.
+    def with_owner_session(session)
+      return yield if session.equal?(SESSION_UNSET)
+      token = @delegate.send(:_validate_session_token!, session, :save)
+      had = @delegate.instance_variable_defined?(:@_session_token)
+      previous = @delegate.instance_variable_get(:@_session_token)
+      @delegate.instance_variable_set(:@_session_token, token)
+      begin
+        yield
+      ensure
+        if had
+          @delegate.instance_variable_set(:@_session_token, previous)
+        else
+          @delegate.remove_instance_variable(:@_session_token)
+        end
+      end
+    end
+
     # ActiveModel reads the current value when a change starts. Read the
     # items directly: going through {#collection} would query the whole
     # relation just to stage an add or remove.

data/lib/parse/model/classes/role.rb

@@ -279,6 +279,12 @@ module Parse
       #   query/constraints) — none of those have a caller scope to
       #   forward. The fast path is opt-in for performance-conscious
       #   callers that can supply explicit authorization.
+      # @note Inside {Parse.without_master_key}, the Parse Server walk (no
+      #   `master:` or `as:`) still reads `_Role` with the master key as SDK
+      #   metadata, so it returns the full role-name closure of `user`, not
+      #   only the publicly readable roles. The block guards against
+      #   accidental master-key use; it does not scope this lookup. Pass
+      #   `as:` for a scope-checked answer.
       # @example
       #   names = Parse::Role.all_for_user(user, master: true)  # admin/analytics
       #   names = Parse::Role.all_for_user(user, as: current_user)  # scope-checked
@@ -423,6 +429,20 @@ module Parse
       end
 
       def role_query_all(constraints, client: nil)
+        # Inside `Parse.without_master_key` the role graph is still read with
+        # the master key. It is metadata the SDK needs to enforce a scope, as
+        # Parse Server reads it itself; read without the key it returned only
+        # publicly readable roles, and that short closure was then cached for
+        # the user and served to every caller until it expired.
+        if Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled?
+          query = Parse::Role.query(constraints.reverse_merge(limit: :max))
+          query.client = client if client
+          # A master-key read: keep it out of the shared response cache.
+          query.cache = false
+          query.instance_variable_set(:@_metadata_master, true)
+          return query.results
+        end
+
         # No explicit client means the historical path, unchanged. This is not
         # only for compatibility: `Parse::Role.all` is what callers and tests
         # observe and stub, and routing around it when nothing asked us to
@@ -957,6 +977,9 @@ module Parse
     #   another's role names.
     # @param strict [Boolean] re-raise role-query failures rather than returning
     #   a partial parent closure.
+    # @note Inside {Parse.without_master_key} the walk still reads `_Role`
+    #   with the master key as SDK metadata, so it returns the full parent
+    #   closure, not only publicly readable roles.
     def all_parent_role_names(max_depth: 10, client: nil, strict: false)
       Parse::Role.expand_inheritance_upward(
         [self], max_depth: max_depth, client: client, strict: strict,