parse-stack-next 5.8.1 → 5.8.2

data/lib/parse/client/response.rb

@@ -264,19 +264,77 @@ module Parse
       self
     end
 
+    # A summary that never prints result values: login, signup, and
+    # `users/me` responses carry a live `sessionToken` (and sometimes
+    # `authData`), and any other row can carry private data, so inspect
+    # shows only the shape of the result.
     # @!visibility private
     def inspect
       if error?
-        "#<#{self.class} @code=#{code} @error='#{error}'>"
+        "#<#{self.class} @code=#{code} @error='#{safe_error_text}' @http_status=#{http_status.inspect}>"
       else
-        "#<#{self.class} @result='#{@result}'>"
+        "#<#{self.class} @http_status=#{http_status.inspect} @result=#{result_summary}>"
       end
     end
 
-    # @return [String] JSON encoded object, or an error string.
+    # @return [String] JSON encoded object, or an error string. Credential
+    #   fields (`sessionToken`, `password`, `authData`, MFA recovery codes
+    #   and secrets, keys) are replaced with a placeholder, and credential
+    #   text inside string values (`password=x`, `X-Parse-Master-Key: mk`)
+    #   is filtered too, so printing the response with `to_s` or `inspect`
+    #   does not leak a live session token. The error form has its text redacted and control characters
+    #   escaped. `#result`, `#to_json`, and `#as_json` return the raw values
+    #   by design; do not log those.
     def to_s
-      return "[E-#{@code}] #{@request} : #{@error} (#{@http_status})" if error?
-      @result.to_json
+      if error?
+        return "[E-#{@code}] #{safe_request_text} : #{safe_error_text} (#{@http_status})"
+      end
+      result = redacted_result
+      return Parse::Middleware::BodyBuilder.redact_patterns(result) if result.is_a?(String)
+      # Text patterns run on string values before encoding, never on the
+      # encoded JSON, so escaped quotes cannot defeat them or corrupt it.
+      Parse::Middleware::BodyBuilder.redact_string_values!(result).to_json
+    end
+
+    private
+
+    # Maximum error text length kept in `to_s` / `inspect`.
+    SAFE_ERROR_TEXT_LENGTH = 1_000
+
+    # The server's error text with credentials redacted, truncated, and
+    # control characters escaped, matching what the client logs.
+    def safe_error_text
+      text = Parse::Middleware::BodyBuilder.redact(@error.to_s)[0, SAFE_ERROR_TEXT_LENGTH]
+      Parse::TerminalSafe.sanitize_line(text)
+    rescue StandardError
+      "[unprintable error]"
+    end
+
+    # The request line (method and path, including any query string) with
+    # credentials redacted and control characters escaped.
+    def safe_request_text
+      Parse::TerminalSafe.sanitize_line(Parse::Middleware::BodyBuilder.redact(@request.to_s))
+    rescue StandardError
+      "[unprintable request]"
+    end
+
+    # Class and size of the result, without its values.
+    def result_summary
+      case @result
+      when Array then "Array(#{@result.size})"
+      when Hash then "Hash(#{@result.size} keys)"
+      when nil then "nil"
+      else @result.class.name
+      end
+    end
+
+    # A deep copy of the result with credential fields replaced.
+    def redacted_result
+      return @result unless @result.is_a?(Hash) || @result.is_a?(Array)
+      copy = JSON.parse(@result.to_json)
+      Parse::Middleware::BodyBuilder.scrub_sensitive!(copy)
+    rescue StandardError
+      "[unprintable result]"
     end
   end
 end

data/lib/parse/client.rb

@@ -419,6 +419,39 @@ module Parse
       "session_token=#{@session_token ? "[FILTERED]" : "nil"}>"
     end
 
+    # Redacted JSON form. ActiveSupport's default `as_json` serializes every
+    # instance variable, so a client in a JSON log or error-tracker context
+    # (or inside an object that serializes it, such as a {Parse::Agent})
+    # would emit the master key, REST key, and bound session token.
+    # @return [Hash]
+    def as_json(*)
+      {
+        "server_url" => @server_url,
+        "app_id" => @application_id,
+        "master_key" => @master_key ? "[FILTERED]" : nil,
+        "session_token" => @session_token ? "[FILTERED]" : nil,
+      }
+    end
+
+    # @return [String] the redacted {#as_json} summary as JSON.
+    def to_json(*args)
+      as_json.to_json(*args)
+    end
+
+    # YAML (Psych) serializes instance variables too; emit the redacted
+    # summary instead.
+    def encode_with(coder)
+      as_json.each { |k, v| coder[k] = v }
+    end
+
+    # A client holds the master key, REST key, and session tokens, so it is
+    # never marshaled (Rails.cache, DRb, or a job payload would store them in
+    # the clear). Store the configuration and build a new client instead.
+    # @raise [TypeError]
+    def marshal_dump
+      raise TypeError, "Parse::Client cannot be marshaled"
+    end
+
     # A NEW non-master {Parse::Client} that mirrors THIS client's connection
     # settings (`server_url` / `application_id` / `api_key`) but carries no
     # master key and binds `session_token`, so it acts on the server as that
@@ -645,6 +678,12 @@ module Parse
     #    middleware. The default value is 3 seconds. If :expires is set to 0,
     #    caching will be disabled. You can always clear the current state of the
     #    cache using the clear_cache! method on your Parse::Client instance.
+    # @option opts [Boolean] :cache_session_requests Whether this client's
+    #    response cache stores and serves reads made with a session token.
+    #    Overrides {Parse::Middleware::Caching.cache_session_requests} in
+    #    either direction; omit it to use that class default (off). Only
+    #    `true` enables it. With it on, a revoked session keeps reading its
+    #    cached rows until the entry expires.
     # @option opts [String] :cache_namespace Optional prefix applied to every
     #    cache key. Useful when two Parse apps share one Redis instance and
     #    would otherwise collide on identical paths (e.g.
@@ -704,7 +743,9 @@ module Parse
       @allow_faraday_proxy = opts.fetch(:allow_faraday_proxy, false)
 
       # Security check for HTTP usage (except localhost/127.0.0.1 for development)
-      if @server_url&.start_with?("http://") && !@server_url.match?(%r{^http://(localhost|127\.0\.0\.1)(:|/)})
+      # The scheme and host come from URI parsing, so `HTTP://` and leading
+      # whitespace are treated as plain http, not as a secure URL.
+      if self.class.url_scheme(@server_url) == "http" && !self.class.loopback_host?(self.class.url_host(@server_url))
         if @require_https
           raise ArgumentError, "[Parse::Client] HTTPS required but server URL uses HTTP: #{@server_url}. " \
                                "Set require_https: false or use an HTTPS URL."
@@ -765,7 +806,7 @@ module Parse
       # scheme; without this guard a caller passing
       #   faraday: { ssl: { verify: false }, proxy: "http://attacker" }
       # would neuter TLS verification on an HTTPS connection.
-      validate_faraday_opts!(opts[:faraday])
+      opts[:faraday] = validate_faraday_opts!(opts[:faraday])
       opts[:faraday].merge!(:url => @server_url)
       @conn = Faraday.new(opts[:faraday]) do |conn|
         # Apply timeouts before any user-supplied middleware sees a request.
@@ -937,6 +978,10 @@ module Parse
               # old workers still read the legacy shape, so invalidation has to
               # hit both until every old worker is drained.
               delete_legacy_variants: opts.fetch(:cache_delete_legacy_variants, true),
+              # Per-client override of
+              # Parse::Middleware::Caching.cache_session_requests; omitted
+              # means the class default applies.
+              **(opts.key?(:cache_session_requests) ? { cache_session_requests: opts[:cache_session_requests] } : {}),
             }
 
             # Inform about opt-in cache behavior
@@ -986,19 +1031,27 @@ module Parse
     #   controlled MITM unless explicitly allowlisted
     #
     # @api private
+    # @return [Hash] the options as a Hash, so a `Faraday::ConnectionOptions`
+    #   (or anything else responding to `to_hash`) is checked and used in the
+    #   same form; any other value raises.
     def validate_faraday_opts!(faraday_opts)
-      return unless faraday_opts.is_a?(Hash)
-
-      ssl = faraday_opts[:ssl] || faraday_opts["ssl"]
-      if ssl.is_a?(Hash)
-        verify = ssl.key?(:verify) ? ssl[:verify] : ssl["verify"]
-        if verify == false && @server_url.to_s.start_with?("https://")
+      faraday_opts = {} if faraday_opts.nil?
+      unless faraday_opts.is_a?(Hash)
+        unless faraday_opts.respond_to?(:to_hash)
           raise ArgumentError,
-            "[Parse::Client] Refusing to disable TLS certificate verification " \
-            "(opts[:faraday][:ssl][:verify] = false) on an HTTPS server URL. " \
-            "Fix the server certificate or downgrade the URL to http:// " \
-            "(with require_https: false) for explicit local testing."
+                "[Parse::Client] opts[:faraday] must be a Hash or Faraday::ConnectionOptions " \
+                "(got #{faraday_opts.class})."
         end
+        faraday_opts = faraday_opts.to_hash
+      end
+
+      ssl = faraday_opts[:ssl] || faraday_opts["ssl"]
+      if self.class.url_scheme(@server_url) == "https" && (setting = tls_verification_disabled(ssl))
+        raise ArgumentError,
+          "[Parse::Client] Refusing to disable TLS certificate verification " \
+          "(opts[:faraday][:ssl] #{setting}) on an HTTPS server URL. " \
+          "Fix the server certificate or downgrade the URL to http:// " \
+          "(with require_https: false) for explicit local testing."
       end
 
       proxy = faraday_opts[:proxy] || faraday_opts["proxy"]
@@ -1018,15 +1071,82 @@ module Parse
       # `proxy: nil` is the Faraday-documented way to disable
       # env-proxy autodiscovery.
       faraday_opts[:proxy] = nil unless @allow_faraday_proxy
+      faraday_opts
     end
 
     private :validate_faraday_opts!
 
-    # Hosts considered "loopback" for the cleartext-ws:// guard in
-    # {#configure_live_query}. Mirrors
-    # {Parse::LiveQuery::Client::LOOPBACK_HOSTS} so the explicit-URL
-    # path and the derived-URL path agree on what counts as local.
-    LIVE_QUERY_LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1] 0.0.0.0].freeze
+    # Which TLS setting in a Faraday `ssl:` option (a Hash or a
+    # `Faraday::SSLOptions`) turns certificate or hostname verification off,
+    # or nil when none does: `verify: false`, `verify_mode: VERIFY_NONE`, or
+    # `verify_hostname: false`.
+    # @api private
+    def tls_verification_disabled(ssl)
+      read = lambda do |key|
+        if ssl.is_a?(Hash)
+          ssl.key?(key) ? ssl[key] : ssl[key.to_s]
+        elsif ssl.respond_to?(key)
+          ssl.public_send(key)
+        end
+      end
+      return nil if ssl.nil?
+      return "verify: false" if read.call(:verify) == false
+      if defined?(OpenSSL::SSL::VERIFY_NONE) && read.call(:verify_mode) == OpenSSL::SSL::VERIFY_NONE
+        return "verify_mode: VERIFY_NONE"
+      end
+      return "verify_hostname: false" if read.call(:verify_hostname) == false
+      nil
+    end
+    private :tls_verification_disabled
+
+    # Whether a URL host is this machine: `localhost`, any `127.0.0.0/8`
+    # address, `::1`, or `0.0.0.0` (a connect to the unspecified address
+    # reaches the local host on Linux and macOS). Used by the http:// server
+    # warning and the LiveQuery cleartext guards so they agree.
+    # @param host [String, nil]
+    # @return [Boolean]
+    # @api private
+    #
+    # Addresses are parsed with IPAddr, so a malformed one such as
+    # `127.999.1.1` (which a resolver would look up by name) is not loopback.
+    # `localhost.` with a trailing dot is not either: some resolvers skip
+    # `/etc/hosts` for the fully qualified form. `0.0.0.0` stays local for
+    # client URLs only (it is a bind address everywhere else).
+    def self.loopback_host?(host)
+      h = host.to_s.strip.downcase.delete_prefix("[").delete_suffix("]")
+      return false if h.empty?
+      return true if h == "localhost" || h == "0.0.0.0"
+      return false unless h.match?(/\A[0-9a-f:.]+\z/)
+      require "ipaddr"
+      IPAddr.new(h).loopback?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
+
+    # The lowercased scheme of a URL String, or nil when it does not parse.
+    # Leading and trailing whitespace is ignored. Scheme checks go through
+    # this instead of a case-sensitive prefix match, which let `HTTP://` and
+    # `WS://` past the plaintext guards.
+    # @param url [String, nil]
+    # @return [String, nil]
+    # @api private
+    def self.url_scheme(url)
+      return nil if url.nil?
+      URI.parse(url.to_s.strip).scheme&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # The lowercased host of a URL String, or nil when it does not parse.
+    # @param url [String, nil]
+    # @return [String, nil]
+    # @api private
+    def self.url_host(url)
+      return nil if url.nil?
+      URI.parse(url.to_s.strip).host&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
 
     # Configure LiveQuery with the given options
     # @param opts [Hash] configuration options
@@ -1049,7 +1169,7 @@ module Parse
       # `live_query: { url: "ws://prod-host" }` or
       # `live_query_url: "ws://prod-host"` bypassed it — the master key
       # and any session token would ride the connect frame in cleartext.
-      validate_live_query_url!(resolved_url, allow_insecure: live_query_opts[:allow_insecure])
+      resolved_url = validate_live_query_url!(resolved_url, allow_insecure: live_query_opts[:allow_insecure])
 
       # Warn (don't raise) on `live_query: { ... }` keys that are not
       # `Parse::LiveQuery::Configuration` setters. The block form would
@@ -1079,20 +1199,14 @@ module Parse
       end
     end
 
+    # Validate an explicit LiveQuery URL at configure time with the same
+    # rules {Parse::LiveQuery::Client} applies, and return the URL to use
+    # (`http://` and `https://` are mapped to `ws://` and `wss://`).
+    # @return [String, nil]
     # @api private
     def validate_live_query_url!(url, allow_insecure:)
-      return unless url.is_a?(String) && url.start_with?("ws://")
-
-      host = URI.parse(url).host.to_s rescue ""
-      return if LIVE_QUERY_LOOPBACK_HOSTS.include?(host)
-      return if allow_insecure
-
-      raise ArgumentError,
-        "[Parse::Client] Refusing explicit insecure LiveQuery URL #{url.inspect}. " \
-        "The connect frame carries the master key and any session token in " \
-        "plaintext on this socket. Use wss:// for routable hosts, or pass " \
-        "`live_query: { allow_insecure: true }` to opt into cleartext for " \
-        "local development on a non-loopback address."
+      return url unless url.is_a?(String)
+      Parse::LiveQuery::Client.normalize_url(url, allow_insecure: allow_insecure)
     end
 
     # @api private
@@ -1383,7 +1497,9 @@ module Parse
         # `with_session(token_b)` resolved user B, and the identity cache
         # then mapped token A (or a garbage token) to user B for its TTL.
         if raw_token.nil?
-          header_token = headers[Parse::Protocol::SESSION_TOKEN]
+          # Same lookup a batch uses for each request's own credentials
+          # (Parse::Request#explicit_authority).
+          header_token = Parse::Request.header_value(headers, Parse::Protocol::SESSION_TOKEN)
           raw_token = header_token if header_token.is_a?(String)
         end
         # SEC-02:an EXPLICITLY-supplied session_token that is a blank /

data/lib/parse/live_query/client.rb

@@ -158,8 +158,11 @@ module Parse
                      use_master_key: NOT_PROVIDED, auto_connect: nil, auto_reconnect: nil)
         cfg = config
 
-        # Use provided values or fall back to configuration/environment
-        @url = url || cfg.url || derive_websocket_url
+        # Use provided values or fall back to configuration/environment. An
+        # explicit or configured URL is validated here; a derived one is
+        # validated by derive_websocket_url.
+        explicit_url = url || cfg.url
+        @url = explicit_url ? validate_websocket_url!(explicit_url) : derive_websocket_url
         @application_id = application_id || cfg.application_id ||
                           parse_client_value(:application_id)
         @client_key = client_key || cfg.client_key ||
@@ -509,12 +512,70 @@ module Parse
         nil
       end
 
-      # Loopback hostnames exempt from the `ws://` refusal in
-      # {#derive_websocket_url}. These addresses can't reach the
-      # Internet, so the cleartext-credentials threat model doesn't
-      # apply — but we still emit a warning so the operator knows
-      # they're on `ws://`.
-      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1] 0.0.0.0].freeze
+      # Normalize and validate an explicit LiveQuery URL, returning the URL
+      # to connect to.
+      #
+      # - The scheme is compared case-insensitively and the URL is stripped.
+      # - `https://` is mapped to `wss://` and `http://` to `ws://`, with a
+      #   one-time deprecation warning. The connector used to open them as a
+      #   plaintext socket, so the `https` mapping is strictly safer.
+      # - Plaintext `ws://` (including a mapped `http://`) is refused on a
+      #   host that is not this machine ({Parse::Client.loopback_host?})
+      #   unless `allow_insecure` is set, in which case it warns.
+      # - Any other scheme raises `ArgumentError`.
+      #
+      # @param url [String]
+      # @param allow_insecure [Boolean]
+      # @return [String]
+      # @raise [ArgumentError]
+      def self.normalize_url(url, allow_insecure: false)
+        scheme = Parse::Client.url_scheme(url)
+        mapped = { "http" => "ws", "https" => "wss" }[scheme]
+        if mapped
+          warn_http_scheme_once(scheme, mapped)
+          scheme = mapped
+        end
+        unless %w[ws wss].include?(scheme)
+          raise ArgumentError,
+            "[Parse::LiveQuery] LiveQuery URL #{url.to_s.inspect} must use wss:// " \
+            "(or ws:// on a loopback host). Got scheme #{scheme.inspect}."
+        end
+        normalized = url.to_s.strip.sub(/\A[a-z][a-z0-9+.\-]*:/i, "#{scheme}:")
+        host = Parse::Client.url_host(normalized).to_s
+        return normalized if scheme == "wss" || Parse::Client.loopback_host?(host)
+
+        if allow_insecure
+          warn "[Parse::LiveQuery] Using insecure ws:// URL for #{host} " \
+               "(allow_insecure is enabled). Master key and session tokens " \
+               "will traverse a cleartext socket."
+          normalized
+        else
+          raise ArgumentError,
+            "[Parse::LiveQuery] Refusing insecure ws:// LiveQuery URL #{url.to_s.inspect}. " \
+            "The connect frame carries the master key and any session token in " \
+            "plaintext on this socket. Use wss:// for routable hosts, or set " \
+            "`Parse::LiveQuery.configure { |c| c.allow_insecure = true }` (or " \
+            "`live_query: { allow_insecure: true }`) for local development."
+        end
+      end
+
+      # @!visibility private
+      def self.warn_http_scheme_once(scheme, mapped)
+        @warned_http_schemes ||= {}
+        return if @warned_http_schemes[scheme]
+        @warned_http_schemes[scheme] = true
+        warn "[Parse::LiveQuery] DEPRECATION: an #{scheme}:// LiveQuery URL is " \
+             "treated as #{mapped}://. Configure the #{mapped}:// URL directly; " \
+             "a later release will refuse #{scheme}://."
+      end
+
+      # Validate an explicit or configured LiveQuery URL the same way a
+      # derived one is, and return the URL to connect to. See
+      # {Parse::LiveQuery::Client.normalize_url}.
+      # @return [String]
+      def validate_websocket_url!(url)
+        self.class.normalize_url(url, allow_insecure: config.allow_insecure)
+      end
 
       # Derive WebSocket URL from Parse server URL. Refuses to
       # synthesize a `ws://` URL from an `http://` server URL on any
@@ -530,7 +591,7 @@ module Parse
         scheme = uri.scheme == "https" ? "wss" : "ws"
         host = uri.host.to_s
 
-        if scheme == "ws" && !LOOPBACK_HOSTS.include?(host)
+        if scheme == "ws" && !Parse::Client.loopback_host?(host)
           if config.allow_insecure
             warn "[Parse::LiveQuery] Deriving insecure ws:// URL for #{host} " \
                  "(allow_insecure is enabled). Master key and session tokens " \

data/lib/parse/model/classes/session.rb

@@ -251,12 +251,15 @@ module Parse
         # already revoked elsewhere or one the caller cannot see; dropping
         # cached entries is idempotent in both cases. A raised delete still
         # drops the token it named but leaves the owner alone. A single
-        # delete cannot tell "already gone" from "denied", so an absent row
-        # only uses the recorded owner, never the reset fallback.
+        # delete that returns false cannot tell "already gone" from
+        # "denied", so it never resets and forgets nothing for a row the
+        # caller could not read; one that returns true removed the row, so
+        # the recorded owner (or the rate-limited reset) applies.
         if result.nil?
           _forget_identity!(token.is_a?(String) ? token : nil, nil)
         else
-          _forget_identity!(token, owner_id, reset_fallback: false)
+          deleted = result == true
+          _forget_identity!(token, owner_id, reset_fallback: deleted, deleted: deleted)
         end
       end
     end
@@ -312,16 +315,23 @@ module Parse
 
       # Look up the token and owner of every session about to be deleted that
       # does not carry them, so the delete can drop their identity entries.
-      # One `_Session` query per client. A client with a master key reads it
-      # as SDK metadata (it works inside `Parse.without_master_key`); one
-      # without reads it with `session_token`, or skips the lookup when there
-      # is none. The query never uses the response cache: its rows carry live
-      # session tokens.
+      # One `_Session` query per client. When the delete runs as a user
+      # (`session_token`), the lookup runs as that user too, so it only
+      # reads sessions that user can see. Otherwise a client with a master
+      # key reads it as SDK metadata (it works inside
+      # `Parse.without_master_key`), and one without skips the lookup. The
+      # query never uses the response cache: its rows carry live session
+      # tokens.
       #
       # A row the lookup did not return is marked absent: there is nothing
-      # to forget for it. Only a lookup that raised marks its sessions
-      # `:unknown`, which makes their delete reset the client's identity
-      # cache (rate limited).
+      # to forget for it. A row a session-scoped lookup could not see is
+      # marked `:invisible`: a denied or not-found delete of it forgets
+      # nothing and never resets, so a user deleting session ids they cannot
+      # read cannot evict other users' cached identities. A delete of it
+      # that succeeds removed a session the caller was allowed to delete, so
+      # its recorded owner (or the rate-limited reset) is used. Only
+      # a lookup that raised marks its sessions `:unknown`, which makes
+      # their delete reset the client's identity cache (rate limited).
       # @param sessions [Array<Parse::Object>]
       # @param session_token [String, nil] the delete's own session.
       # @!visibility private
@@ -337,15 +347,16 @@ module Parse
             next
           end
           ids = group.map(&:id).uniq
+          scoped = !token.nil?
           found = begin
               query = Parse::Session.query(:objectId.in => ids, limit: ids.size)
               query.keys(:session_token, :user)
               query.client = cl
               query.cache = false
-              if has_master
-                query.instance_variable_set(:@_metadata_master, true)
-              else
+              if scoped
                 query.session_token = token
+              else
+                query.instance_variable_set(:@_metadata_master, true)
               end
               query.results.to_h do |row|
                 owner = row.instance_variable_get(:@user)
@@ -362,6 +373,8 @@ module Parse
                 :unknown
               elsif (row = found[o.id]) && (row[0].is_a?(String) || row[1])
                 row
+              elsif scoped
+                :invisible
               else
                 :absent
               end
@@ -379,10 +392,14 @@ module Parse
       identity = _identity_for_destroy
       _clear_identity_for_destroy!
       return unless Parse::Session.send(:_destroy_applied?, response)
+      deleted = response.nil? || (response.respond_to?(:success?) && response.success?)
+      # A row the caller could not read counts only when the delete itself
+      # succeeded: "object not found" there may mean "not yours".
+      return if identity[0] == :invisible && !deleted
       # The batch response tells success and "object not found" apart from
       # a denial, so an absent row whose owner was never recorded may fall
       # back to the rate-limited reset here.
-      _forget_identity!(*identity, reset_fallback: true)
+      _forget_identity!(*identity, reset_fallback: true, deleted: deleted)
     end
     private :_after_batch_destroy
 
@@ -451,6 +468,10 @@ module Parse
       token = @session_token.is_a?(String) && !@session_token.empty? ? @session_token : nil
       owner_id = _identity_owner_id
       return [:unknown, owner_id] if looked_up == :unknown
+      # A session-scoped lookup could not see the row: forget what this
+      # instance carries; with nothing at all, mark it invisible so only a
+      # delete that succeeds may use the recorded owner or the reset.
+      return (token || owner_id ? [token, owner_id] : [:invisible, nil]) if looked_up == :invisible
       if looked_up == :absent
         # No row to read: the session is gone or not visible. Forget what
         # this instance carries; with nothing at all, mark it absent so the
@@ -476,8 +497,15 @@ module Parse
     # Drop the token and the owner's entries from this session's client's
     # identity plane.
     # @!visibility private
-    def _forget_identity!(token, owner_id, reset_fallback: false)
+    def _forget_identity!(token, owner_id, reset_fallback: false, deleted: false)
       cl = client
+      if token == :invisible
+        # The caller could not read the row. Only a delete that succeeded
+        # touches other identities: the recorded owner, else the
+        # rate-limited reset. A denied or not-found delete forgets nothing.
+        return unless deleted
+        token = :absent
+      end
       if token == :absent
         # The row was not readable before the delete. Use the owner recorded
         # when this session was last loaded; without one, and only when the

data/lib/parse/model/core/actions.rb

@@ -432,11 +432,20 @@ module Parse
         #   default; enable it only for writes that are safe to repeat (it
         #   works around Parse Server running a transaction's requests
         #   concurrently, which MongoDB intermittently rejects).
+        # @param session [String, #session_token, nil] run the transaction as
+        #   this user (ACL and CLP enforced). Without it, the transaction runs
+        #   with the credentials of its objects' class client, as a single
+        #   save does.
         # @yield [Parse::BatchOperation] the batch operation to add requests to
         # @return [Array<Parse::Response>] the responses from the transaction
         # @raise [Parse::Error] if the transaction fails
-        def transaction(retries: 5, retry_server_errors: false, &block)
+        # @raise [Parse::BatchOperation::MixedAuthorityError] if the objects
+        #   are bound to clients with different credentials. Parse Server runs
+        #   a transaction under one credential, so it is refused before
+        #   anything is sent.
+        def transaction(retries: 5, retry_server_errors: false, session: nil, &block)
           raise ArgumentError, "Block required for transaction" unless block_given?
+          session_token = Parse::BatchOperation.session_token_for!(session)
 
           previous_context = Fiber[TRANSACTION_CONTEXT_KEY]
           transaction_context = { snapshots: {}, created_objects: {} }
@@ -490,6 +499,10 @@ module Parse
               result.each { |obj| batch_wrapper.add(obj) if obj.respond_to?(:change_requests) }
             end
 
+            if session_token
+              batch.requests.each { |r| r.opts[:session_token] = session_token if r.opts.is_a?(Hash) }
+            end
+
             # Submit with retry logic for transaction conflicts.
             # Parse Server reports a write conflict inside a transaction as
             # error code 251, after rolling it back. Retry on that structured
@@ -1266,6 +1279,9 @@ module Parse
         uri = self.uri_path
         r = Request.new(:delete, uri)
         r.tag = object_id
+        # A batch sends this through the class's client (and its bound
+        # session), as a single destroy does.
+        r.client = client
         r
       end
 
@@ -1276,6 +1292,8 @@ module Parse
 
       # Creates an array of all possible operations that need to be performed
       # on this object. This includes all property and relational operation changes.
+      # Each request carries this class's client, so a batch sends it with the
+      # same credentials as a single {#save}.
       #
       # This is the path batch saves ({Array#save}) and
       # {Parse::Object.transaction} use, so it applies the same save-time
@@ -1309,6 +1327,7 @@ module Parse
             body[Parse::Model::OBJECT_ID] = @id if @id.present?
             r = Request.new(:post, uri, body: body)
             r.tag = object_id
+            r.client = client
             requests << r
           end
           return requests
@@ -1318,6 +1337,7 @@ module Parse
         if attribute_changes? || force
           r = Request.new(:put, uri, body: attribute_updates)
           r.tag = object_id
+          r.client = client
           requests << r
         end
 
@@ -1328,6 +1348,7 @@ module Parse
             next if ops.empty?
             r = Request.new(:put, uri, body: ops)
             r.tag = object_id
+            r.client = client
             requests << r
           end
         end