parse-stack-next 5.8.2 → 5.8.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d49d6371c1e6873ea48401f789d9087e23870530ae405bf2629ea9db67360995
-  data.tar.gz: 9589dfb1ec150a78d527c6ad0097a3ee4263701b104baf7b54afb73e73ec3bdf
+  metadata.gz: 278d766a244ba60e85ce4e67d8866df2ce6e6ab78dc76e1f72aedf0b4285d149
+  data.tar.gz: 4883c76b576d2a0b726ded45adb1c7a3d569a5d5366f1740da7d44a359d26d53
 SHA512:
-  metadata.gz: 22998b27d0f277d174759d29c5087675628eee3a9a24ed460c82c87deda6a28252ed1d1ad78daee9a2438b2a7b1c4f8995197450d9eb5922b5689e58bda52bdb
-  data.tar.gz: 5ef7ef2f07269ca95bbd985c806250ca7d93d02c7c6bccd83a9d72a0c9a57b990bac63e977ddfbd1c601481562fb12d5c0272639ec415787cef0cc76fc4dd3c0
+  metadata.gz: b2a40e323b870080c02613b30b821b87029bb49ddbba9e31581481ac4d13624aae8f456d8bf1fb55f18642fb40d6f73f5e007902b572254f54190df482d6ea80
+  data.tar.gz: 2f8e0d0a6d47dafb547e6edb4663ebc2534e24da79760ed81a9ca612cfab8a466f6e9590987401715b0f7edffc61012c4c006f11767ed2a0c33b8cc8e83ecc69

data/CHANGELOG.md

@@ -1,5 +1,328 @@
 ## parse-stack-next Changelog
 
+### 5.8.4
+
+A security patch across the agent, MCP, Atlas Search, mongo-direct, transport,
+cache, webhook, LiveQuery, GraphQL, MFA, and cursor surfaces, with raised
+dependency floors and a release-workflow fix. Outcomes that change are listed
+under Behavior Notes.
+
+#### Agent tools
+
+- **FIXED**: `semantic_search` now applies the agent's `classes:` allowlist,
+  the CLP `find` check for scoped agents, and the per-agent `filters:` for the
+  searched class, as every other read tool does. Before, it checked only the
+  global hidden flag and the tenant scope, so an agent limited to one class
+  could search any other searchable class, including rows its per-agent filter
+  excludes. The per-agent filter is ANDed into the post-search match after the
+  caller's filter is checked, so a caller filter on the same field narrows the
+  result but cannot replace it. A retrieval profile's hybrid lexical filter is
+  likewise ANDed with it instead of merged over it. Per-agent filter fields
+  resolve through the class's declared properties, so a declared server name
+  such as `PublicState` addresses that column and a pointer uses its `_p_`
+  column; a field the class does not declare raises
+  `Parse::Agent::ValidationError` instead of being guessed.
+- **FIXED**: A `$relatedTo` constraint built by an agent must name the owning
+  object with a plain objectId string. An operator or other non-String value
+  (`"objectId" => { "$exists" => true }`) now raises a
+  `ConstraintSecurityError` with reason `:invalid_object_id`. Against Parse
+  Server below 9.10.5 that shape matches the relation of every owning object
+  without checking the owning object's ACL (GHSA-58m4-cqvw-4vgh). The relation
+  `key` must be a field name (`:invalid_key`), and a constraint that names
+  `object` or `key` under both a String and a Symbol key is refused
+  (`:duplicate_key`).
+- **FIXED**: The agent constraint translator refuses a `__type` value (Pointer,
+  Date, and the other Parse types) that also carries an operator key, with
+  reason `:operator_in_parse_type`. Such a hash was passed through without
+  validation, so `{ "__type" => "Pointer", "$relatedTo" => ... }` inside an
+  `$or` skipped the operator checks.
+
+#### MCP and agent identity
+
+- **FIXED**: An agent on a client whose master key is empty or whitespace is
+  treated as having no master key, as the HTTP layer already did. Before, it
+  took master posture: the `acl_user:` / `acl_role:` and `impersonate`
+  refusals were skipped while requests went out without the key.
+- **FIXED**: MCP resource subscriptions apply the agent's tenant scope and
+  per-agent filter as the LiveQuery subscription constraint. Before, a
+  subscription covered the whole class, so `resources/updated` notifications
+  reported writes in other tenants and in rows the filter excludes.
+- **NEW**: A loopback-bound MCP server refuses requests whose `Host` header is
+  not a loopback host (DNS-rebinding defense from the MCP specification).
+  `allowed_hosts:` on `Parse::Agent::MCPServer` and `MCPRackApp` lists
+  additional hosts.
+
+#### Atlas Search
+
+- **FIXED**: Atlas Search refuses Parse Server's internal columns
+  (`_hashed_password`, `_perishable_token`, `_email_verify_token`,
+  `_session_token`, `_auth_data_*`, `_rperm`, and the rest of the internal
+  field list) when named as a search path, highlight path, sort key,
+  autocomplete field, or facet path, for every caller including master. A
+  wildcard path glob that matches one of them (`*token`, `?hashed*`) and a
+  `queryString` query that names one (`_perishable_token:a*`) are refused the
+  same way, including a field name written with Lucene escapes
+  (`_hashed\_password:a*`) and globs over the `_auth_data_<provider>`
+  columns, and the native hybrid search applies the check to its lexical
+  branch. Globs are tested against stored column names only. A glob that
+  starts with `_` (which no Parse field does) is refused on every class when
+  it reaches a credential column; a glob that starts with a wildcard counts
+  credential columns only on `_User` and `_Session`, so `s*` or `*count` on
+  another class is not refused. On a dynamically mapped index, a `wildcard` or `regex` operator over
+  `_perishable_token` let a caller count matches per prefix and recover a
+  password-reset token. On
+  `_User` and `_Session`, a non-master caller is also refused a path that
+  reaches every field, including a wildcard path object inside a path array,
+  since on such an index it includes those columns.
+  Refusals raise `Parse::CLPScope::Denied` before the pipeline runs.
+
+#### Mongo-direct
+
+- **FIXED**: `$jsonSchema` is refused at any depth in mongo-direct filters and
+  pipelines, alongside `$where` and `$function`. Its `properties` name fields
+  inside the operator value, out of reach of the protectedFields key checks,
+  so `{ $jsonSchema: { properties: { email: { pattern: "^a" } } } }` on
+  `_User` read a protected field one character at a time. Its `pattern` also
+  skipped the SDK's regex checks and the default regex time limit.
+- **FIXED**: `Parse::MongoDB.find` is refused inside `Parse.with_session`
+  (with a token or anonymous), as it already was inside
+  `Parse.without_master_key`. `find` reads raw documents with no ACL, CLP, or
+  protectedFields, so inside a session block it returned every row with
+  master authority. A `Parse.with_master_key` block entered inside the session
+  block still allows it; one wrapped around the session block does not.
+- **FIXED**: The protectedFields and internal-field checks cover
+  `$setWindowFields`, `$densify`, `$fill`, `$bucket`, `$bucketAuto`,
+  `$sortByCount`, and a top-level `$search` / `$searchMeta`. A scoped pipeline
+  could sort, partition, or fill on a protected field there and read its order.
+  Credential columns are refused in those stage arguments for every caller.
+- **FIXED**: The mongo-direct field conversion resolves a pointer's declared
+  server name (`belongs_to :owner_ref, field: "OwnerRef"`) to its `_p_OwnerRef`
+  column on every path. A constraint keyed by `OwnerRef` reached the wrong
+  column, where a `$ne` or `$exists: false` matched every row.
+
+#### Schema consistency for scoped reads
+
+- **FIXED**: The mongo-direct protected-field check read the class schema
+  through the default client and treated an unresolvable schema as having
+  no protected fields, while the CLP gate and the protected-field strip read
+  it separately through the requesting app's client. Two outcomes followed
+  for a scoped caller. If the schema fetch failed and then succeeded between
+  the check and the gate, a `$match` on a protected field ran. In a
+  multi-app process whose default app had no protectedFields on the class,
+  a pipeline such as `$group: { _id: "$ssn" }` returned the protected value,
+  since the strip removes only the key. The check now uses the requesting
+  app's client, refuses a scoped caller when the schema cannot be resolved,
+  and each `Parse::MongoDB.aggregate`, Atlas Search, vector search, and
+  hybrid search call reads one schema snapshot for every step.
+
+#### Regular-expression validation
+
+- **FIXED**: `Parse::RegexSecurity` no longer compiles any part of a caller's
+  pattern with Ruby's `Regexp`. Its separator check passed a character class,
+  braced escape, or `\Q...\E` atom from the caller's `$regex` to
+  `Regexp.new`, so agent and MCP `$regex` arguments, `:field.like` and
+  `:field.regex` values, raw `where` hashes, and mongo-direct and Atlas
+  Search filters reached Ruby's regular-expression compiler. That compiler
+  has memory-safety bugs fixed in Ruby 3.3.13, 3.4.12, and 4.0.9 (GitLab-assigned
+  CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264), and
+  `\Q...\E` reached it as live syntax because it does not support that
+  construct. Character membership is now decided from the validator's own
+  parse (literals, `\d \w \s` and their negations, ranges); any construct
+  it cannot evaluate counts as a possible match, which refuses the pattern
+  rather than passing it. Patterns are still sent to Parse Server and MongoDB
+  as strings and compiled only by MongoDB's PCRE engine.
+
+#### Transport and caching
+
+- **FIXED**: `Parse::Client` refuses an absolute (`https://host/...`, any case)
+  or protocol-relative (`//host`, `\\host`) request path with `ArgumentError`
+  before sending, so a caller-supplied path cannot send the master key or a
+  session token to another host. `connected?` raises on such a path.
+- **FIXED**: `PARSE_REQUIRE_HTTPS` accepts `true`, `1`, or `yes` in any case.
+  Before, only the exact string `true` enabled it.
+- **FIXED**: Credentials embedded in the server URL (`https://user:pass@...`)
+  are shown as `[FILTERED]` in `inspect`, `as_json`, and warnings, with a
+  one-time warning that the URL contains them.
+- **CHANGED**: A `cache:` store that deserializes with Marshal (Moneta's
+  default value serializer) over an external backend is refused with
+  `ArgumentError`; anyone able to write to that backend could run code on each
+  cache read. Use `Parse::Cache::Redis` (or a `redis://` URL string), an
+  in-process store, or pass `allow_marshal_cache: true` to accept the risk. The embedding cache's `MonetaStore` applies the same rule with
+  `allow_marshal: true`. In-process stores (`:Memory`, `:LRUHash`, `:Null`)
+  are accepted.
+
+#### File fetches
+
+- **FIXED**: Remote `Parse::File` fetches also refuse the NAT64
+  (`64:ff9b::/96`) and 6to4 (`2002::/16`) ranges, which embed an IPv4
+  address that can be internal on networks that route them.
+
+#### Webhooks and LiveQuery
+
+- **FIXED**: A whitespace-only webhook signing secret counts as unset, so it
+  can no longer serve as a guessable HMAC key that grants master trust. A blank
+  `PARSE_SERVER_WEBHOOK_KEY` no longer hides `PARSE_WEBHOOK_KEY`.
+- **FIXED**: The webhook handler refuses a declared `Content-Length` over 1 MB
+  before reading, and reads at most 1 MB plus one byte. Before, it read the
+  whole body and then checked the size.
+- **FIXED**: LiveQuery events for `_User` and `_Session` have `sessionToken`,
+  `authData`, and other credential columns removed before hydration. On a
+  Parse Server affected by GHSA-349r-988w-x3jp, an `$or` subscription could
+  receive other users' events carrying their session tokens.
+
+#### Ambient identity lifetime
+
+- **NEW**: `Parse.with_session` documents its identity contract: the session
+  token and master-key state last for the block on the current fiber and are
+  restored on exit, including on exception, so reused request threads carry
+  nothing between requests. Threads and Fibers created inside the block
+  inherit the identity for their whole lifetime, which suits short-lived
+  work for that user. `Parse.without_ambient_identity { }` runs a block with
+  no inherited identity, for workers started inside a session block.
+- **FIXED**: LiveQuery's event, reader, reconnect, and health-check threads
+  start without the caller's ambient identity, so callbacks no longer run
+  with a session token inherited from whichever block first started the
+  client. A thread started from restricted code (a session block or
+  `Parse.without_master_key`) keeps the master key suppressed, so callbacks
+  never gain authority the starting code lacked;
+  `Parse.without_ambient_identity(keep_restrictions: true)` applies the same
+  rule to application workers. A reconnect scheduled inside `Parse.without_master_key` keeps the
+  master key withheld.
+
+#### GraphQL, MFA, and cursors
+
+- **FIXED**: `Parse::GraphQL::TypeGenerator` never emits credential fields
+  (`session_token`, `auth_data`, `password`, `device_token`, and the internal
+  field list). Field resolution bypassed `as_json` redaction, so a generated
+  `Session` type served bearer tokens. `include_sensitive: [:field]` opts a
+  field back in.
+- **NEW**: The generator takes an explicit field policy: `exclude_fields:`
+  (an Array, or a Hash per class) and `protected_fields:`, either a Hash per
+  class or `:fetch`, which loads each class's public protectedFields from
+  the server and raises `ProtectedFieldsUnavailable` if it cannot. Without
+  those options it reads no CLP at all, so the same models always produce
+  the same types. Generated types are a schema shape, not an authorization
+  layer: resolvers must still enforce ACL, CLP, and protectedFields for the
+  requesting user.
+- **FIXED**: `mfa_required?` requires a String username. A Hash value became
+  a query operator run under the master key, which let a pre-login endpoint
+  report MFA status for an arbitrary matching account.
+- **NEW**: `Parse::MFA.verify(secret, code, after:)` passes `after:` to ROTP,
+  and `Parse::MFA.verify_timestamp` returns the accepted time step, so an
+  application using `verify` as its own second factor can refuse a code used
+  again within the drift window.
+- **NEW**: `Parse::Cursor` state can be signed with HMAC-SHA256
+  (`Parse::Cursor.signing_secret=`, or `secret:`), and
+  `deserialize(json, expected_class:)` refuses a different class. A signing
+  secret must be a String of at least 32 bytes; a blank, short, or non-String
+  secret raises `ArgumentError`. Length does not make a key strong, so the
+  documentation calls for 32 bytes from a cryptographic random source
+  (`SecureRandom.hex(32)`). With a secret configured, `trusted: true` does
+  not bypass signature verification. Unsigned state is meant only for trusted
+  persistence (state the process stored where clients cannot change it):
+  pass `trusted: true` to load it silently. Without that flag it still loads
+  in this release with a one-time warning; a future minor release will
+  require it. Saved date positions now round-trip as dates.
+- **CHANGED**: `parse-console -m` warns that a master key on the command line
+  is visible in the process list and shell history.
+
+#### Documentation
+
+- **CHANGED**: The MCP guide states that the per-agent rate limiter does not
+  limit across requests when an agent is built per request, and that
+  deployments must enforce limits per client at the proxy or gateway.
+- **CHANGED**: The MFA documentation states that `Parse::MFA.verify` and the
+  SDK's MFA-disable flow are client-side checks, that Parse Server is the
+  enforcement boundary (disabling MFA must be guarded server-side), that
+  replay protection needs an atomic compare-and-set on the stored
+  timestamp, and that `authorized_by:` must be the authenticated operator.
+- **CHANGED**: `Parse::File` documents that a file built from a URL records
+  the remote server's Content-Type, which is attacker-controlled when the URL
+  is, and that applications decoding stored files must sniff content and
+  disable untrusted decoders (for libvips, `VIPS_BLOCK_UNTRUSTED` or
+  `Vips.block_untrusted(true)`).
+
+#### Dependencies, CI, and release workflow
+
+- **CHANGED**: The gemspec requires `faraday` 2.14.3 or later (CVE-2026-54297,
+  CVE-2026-33637, GHSA-33mh-2634-fwr2). The 2026-04 rack advisories are fixed
+  per branch in 2.2.23, 3.1.21, and 3.2.6, with no fixed 3.0 release. The
+  `rack` requirement is 2.2.23 or later, and loading the SDK on a vulnerable
+  Rack 3.x release (3.0.x, 3.1.0 to 3.1.20, or 3.2.0 to 3.2.5) prints a
+  one-time warning naming the fixed release. RubyGems limits a requirement
+  string to 255 characters, too short to exclude each of those releases by
+  name. Rack 2.2 applications remain supported. The optional `mongo` guidance is 2.26 or later (CVE-2026-88030)
+  and `graphql` 2.6.9 or later.
+- **CHANGED**: The integration test stack runs Parse Server 9.10.7 and Atlas
+  Local 8.0.34. CI uses `ruby/setup-ruby` 1.334.0, which installs the patched
+  Ruby 3.3.13, 3.4.12, and 4.0.9 for those matrix legs, and pins every action
+  to a commit SHA. The Ruby 3.2 leg remains for legacy compatibility; 3.2 is
+  end of life and has no release with the October 2026 regular-expression
+  compiler fixes.
+- **FIXED**: The release workflow waits up to 45 minutes for Gem Tests on the
+  release commit to be created and finish before judging it. A release
+  published right after its merge commit landed failed the gate because the
+  tests on that commit had not finished yet.
+- **CHANGED**: The local Ruby version is now 3.4.12, which includes the
+  October 2026 regular-expression compilation fixes.
+- **NEW**: Gem Tests runs `bundle exec bundle-audit check --update` against
+  the committed lockfile on pull requests and pushes to main. Known gem
+  vulnerabilities or an advisory-database update failure fail the check,
+  and the release workflow's Gem Tests gate includes this job.
+
+#### Behavior Notes
+
+- A `cache:` store with Moneta's default Marshal serializer over a file or
+  network backend now raises `ArgumentError` at `Parse.setup`.
+- `Parse::Client#get`/`post`/`put`/`delete` and `connected?` raise
+  `ArgumentError` for an absolute or protocol-relative path.
+- A loopback-bound MCP server refuses requests whose `Host` is not a loopback
+  host or listed in `allowed_hosts:`.
+- An application subscribed to its own `_User` through LiveQuery no longer
+  receives its `sessionToken` in events.
+- `faraday` below 2.14.3 and `rack` below 2.2.23 no longer satisfy the
+  gemspec. A vulnerable `rack` 3.x release still installs and prints a
+  load-time warning.
+- `Parse::Cursor` signing secrets shorter than 32 bytes, blank, or not
+  Strings raise `ArgumentError`.
+- `mfa_required?(nil)` and other non-String usernames raise `ArgumentError`
+  instead of returning false.
+- A per-agent filter (including a `:default` filter) that names a field the
+  searched class does not declare makes `semantic_search` raise
+  `Parse::Agent::ValidationError`; the other read tools return no rows in
+  that case.
+- A scoped mongo-direct, Atlas Search, or vector search call on a class
+  whose schema cannot be resolved is refused before it runs.
+- Applications that compile regular expressions from untrusted input
+  themselves should run Ruby 3.3.13, 3.4.12, or 4.0.9 or later. The SDK no
+  longer does so. Ruby 3.2 remains supported for legacy compatibility only:
+  it is end of life and does not receive these fixes.
+- An agent `call_method` handler that runs under a session-scoped agent is
+  executed inside `Parse.with_session`, so a handler that calls
+  `Parse::MongoDB.find` now raises `Parse::ACLScope::ACLRequired`. Use
+  `Parse::Query#results_direct`, which applies the ambient session,
+  `Parse::MongoDB.aggregate` with an explicit `session_token:`, or wrap a
+  deliberate master read in `Parse.with_master_key`.
+- A pipeline or filter that used `$jsonSchema` on the mongo-direct path now
+  raises `Parse::PipelineSecurity::Error` (or
+  `Parse::MongoDB::DeniedOperator`).
+- A non-master Atlas Search over `_User` or `_Session` with no `fields:` is
+  refused; name the fields to search.
+
+### 5.8.3
+
+A maintenance release that refreshes locked dependencies to their latest
+compatible versions. No SDK behavior changes.
+
+#### Dependency updates
+
+- **CHANGED**: Bumped locked dependencies to their latest compatible releases:
+  `faraday` 2.14.4 → 2.15.0, `faraday-net_http` 3.4.4 → 3.5.0, `graphql`
+  2.6.11 → 2.6.13, `json` 3.0.2 → 3.1.0, `net-http` 0.9.1 → 0.10.0,
+  `prettyprint` 0.2.0 → 0.2.1, `pry` 0.16.0 → 0.16.1, `rack-test` 2.2.0 →
+  2.3.0, and `uri` 1.1.1 → 1.1.2. `net-http` 0.10.0 adds `net-protocol` 0.4.0
+  and `timeout` 0.6.1 as new transitive dependencies.
+
 ### 5.8.2
 
 A security and correctness patch. No new features beyond the `session:`

data/README.md

@@ -102,7 +102,7 @@ See [CHANGELOG.md](./CHANGELOG.md) for the full 5.1 entry, including breaking ch
 - **MCP transport hardening** — Streamable HTTP `Mcp-Session-Id` header (renamed from `X-MCP-Session-Id`, **breaking**), `MCP-Protocol-Version` validation, `DELETE /` session termination, structured-content (`outputSchema`) on built-in tools, optional `health_path:` liveness probe
 - **`Parse::GraphQL::TypeGenerator`** — generate `graphql-ruby` types directly from your `Parse::Object` subclasses (no Parse Server round-trip), with `:vector` columns surfaced as `[Float]` and association registries (`has_one_associations`, `has_many_associations`) populated at DSL time
 - **LiveQuery promoted to stable** — the experimental warning is removed; `Parse.live_query_enabled = true` is retained as a network-egress safety toggle, not a stability gate
-- **Server-version deprecation warning**: a one-shot warning when connecting to a Parse Server older than the configured threshold (default `7.0.0`, override with `PARSE_DEPRECATED_SERVER_VERSION_BELOW`); silence with `Parse.suppress_server_version_warning = true`. The **supported baseline is Parse Server 9.x** (the SDK is developed and tested against a pinned `parse-server:9.10.3`); the default warning threshold is intentionally conservative so older deployments only get an advisory, not a hard break.
+- **Server-version deprecation warning**: a one-shot warning when connecting to a Parse Server older than the configured threshold (default `7.0.0`, override with `PARSE_DEPRECATED_SERVER_VERSION_BELOW`); silence with `Parse.suppress_server_version_warning = true`. The **supported baseline is Parse Server 9.x** (the SDK is developed and tested against a pinned `parse-server:9.10.7`); the default warning threshold is intentionally conservative so older deployments only get an advisory, not a hard break.
 - **`mongo_relation_index :field, dedup: true`** — register a compound `{owningId, relatedId}` UNIQUE on relation join collections to prevent duplicate-pair subscriptions without breaking `has_many` semantics
 
 See [CHANGELOG.md](./CHANGELOG.md) for the full 5.0 entry, including security-hardening notes and Ruby 3.x cleanup.
@@ -286,7 +286,7 @@ Runnable, self-contained scripts live in [`examples/`](examples/) — see
 
 ## Release History
 
-**Current version: 5.5.5** | **Ruby 3.2+ required**
+**Current version: 5.8.4** | **Ruby 3.2+ required** (3.3.13, 3.4.12, or 4.0.9 or later recommended for their regular-expression compiler fixes)
 
 The 5.0 highlights (vector search / RAG, pooled Redis cache, AS::N instrumentation, MCP transport hardening, GraphQL type generation) are summarized in the [What's new in 5.0](#whats-new-in-50) section above. Earlier releases are recorded below.
 
@@ -689,9 +689,13 @@ A caching adapter of type `Moneta::Transformer`. Caching queries and object fetc
   Parse.setup(cache: store, expires: 10, ...)
 ```
 
-If you supply your own raw `Moneta.new(:Redis, ...)` store instead of the
-wrapper, build it with `value_serializer: nil` to keep Marshal off the cache
-read path.
+Use the wrapper rather than a raw `Moneta.new(:Redis, ...)` store. A store that
+keeps Moneta's default Marshal serializer over an external backend is refused
+with `ArgumentError` unless you pass `allow_marshal_cache: true`. Setting
+`value_serializer: nil` on a raw store is not a substitute: the response cache
+stores Hash values, which a file or Redis backend cannot hold without a
+serializer, so every lookup misses. In-process stores (`:Memory`, `:LRUHash`,
+`:Null`) are accepted as they are.
 
 As a shortcut, if you are planning on using REDIS and have configured the use of `redis` in your `Gemfile`, you can just pass the REDIS connection string directly to the cache option. The string form builds a `Parse::Cache::Redis` wrapper for you, so it is JSON-serialized and safe by default.
 
@@ -1220,6 +1224,8 @@ The default MIME type for all files is `image/jpeg`. This can be default can be
   file = Parse::File.new parse_file
 ```
 
+A URL String passed to `Parse::File.new` or `Parse::File.create`, or assigned to a `:file` property, is downloaded and the remote server's `Content-Type` header is recorded as the file's mime type. That type is controlled by whoever controls the URL. Do not assign request strings to file properties; build files from bytes (`Parse::File.new(name, bytes, type)`) and determine the type server-side. Code that decodes stored files (libvips or ImageMagick, Active Storage variants, document parsers) should treat the stored mime type as untrusted, sniff the content, and disable untrusted decoders (for libvips 8.13 and later, `VIPS_BLOCK_UNTRUSTED` or `Vips.block_untrusted(true)` with ruby-vips 2.2.1 and later). Keep `Parse::File.allowed_remote_hosts` restricted to expected hosts.
+
 If you are using displaying these files on a secure site and want to make sure that urls returned by a call to `url` are `https`, you can set `Parse::File.force_ssl` to true.
 
 ```ruby
@@ -1955,6 +1961,14 @@ user.disable_mfa_master_key!(authorized_by: admin_user, admin_role: "Admin")
 # or: user.disable_mfa_master_key!(authorized_by: admin_user, allow_unverified: true)
 ```
 
+**MFA enforcement boundary:**
+
+`Parse::MFA.verify`, `Parse::MFA.verify_timestamp` and `disable_mfa!` are client-side checks. Parse Server's MFA adapter enforces MFA at login and is the enforcement boundary. Removing MFA is a user update (`authData: { mfa: nil }`) that any holder of the session token can send to the REST API directly, so protect it server-side, for example with a `beforeSave` trigger on `_User` or a Cloud Code function that requires a fresh code verified on the server.
+
+When using `Parse::MFA.verify(secret, code, after:)` as an application's own second factor, store the last accepted timestamp per user and update it atomically: a compare-and-set keyed on the previous value, or a database unique constraint on user and time step. Otherwise two concurrent requests with the same code can both succeed.
+
+`authorized_by:` on `disable_mfa_master_key!` must be the authenticated operator from the caller's verified session, never a user id taken from the request.
+
 **SMS MFA (requires Parse Server SMS callback):**
 ```ruby
 # Initiate SMS setup
@@ -5735,7 +5749,7 @@ For high traffic applications that may be performing several server tasks on sim
 # Parse::Cache::Redis serializes cached responses as JSON, not Marshal — a raw
 # Moneta.new(:Redis) store Marshals values by default and a cache read would
 # Marshal.load Redis bytes (RCE if the cache is shared/untrusted). Prefer the
-# wrapper; if you supply a raw Moneta-Redis store, pass value_serializer: nil.
+# wrapper over a raw Moneta-Redis store.
 store = Parse::Cache::Redis.new(url: 'redis://localhost:6379')
  # use a Redis cache store with an automatic expire of 10 seconds.
 Parse.setup(cache: store, expires: 10, ...)

data/bin/parse-console

@@ -111,13 +111,19 @@ opt_parser = OptionParser.new do |o|
   o.separator  "#{File.basename($0)} -a APP_ID -m MASTER_KEY https://your-parse-server-url"
   o.separator  "#{File.basename($0)} -c ./config.json"
   o.separator  ""
-  o.separator  "If you use the -m option, parse-console will automatically"
+  o.separator  "With a master key (-m or -c), parse-console will automatically"
   o.separator  "import your schema as ruby models."
   o.separator  ""
   o.separator  "Options"
   o.on('-a APP_ID', '--appId APP_ID', 'Parse App ID (required)') { |a| opts[:app_id] = a }
   o.on('-k REST_API_KEY', '--restAPIKey REST_API_KEY', 'Parse REST API Key') { |a| opts[:api_key] = a }
-  o.on('-m MASTER_KEY', '--masterKey MASTER_KEY', 'Parse Master Key') { |a| opts[:master_key] = a }
+  o.on('-m MASTER_KEY', '--masterKey MASTER_KEY', 'Parse Master Key (prefer -c CONFIG_JSON)') do |a|
+    # A key on the command line is visible to other local users through the
+    # process list and is saved in shell history. Keep accepting it, but say so.
+    $stderr.puts "Warning: passing the master key with -m exposes it in the process list " \
+                 "and shell history. Put it in a config file and use -c CONFIG_JSON instead."
+    opts[:master_key] = a
+  end
   o.on('-s SERVER_URL', '--serverURL SERVER_URL', 'The Parse server url.', 'Defaults to http://localhost:1337/parse') { |a| opts[:server_url] = a }
   o.on('-v','--[no-]verbose', 'Run verbosely') { |v| opts[:verbose] ||= v }
   o.on('--pry', 'Use Pry instead of IRB') { |v| opts[:pry] = v }
@@ -212,7 +218,7 @@ Parse.setup server_url: opts[:server_url],
             master_key: opts[:master_key]
 Parse.logging = true if opts[:verbose]
 # Both of these can have come from a remote config document, so escape them.
-puts "Server : #{Parse::TerminalSafe.sanitize_line(Parse.client.server_url)}"
+puts "Server : #{Parse::TerminalSafe.sanitize_line(Parse::Client.redact_url_userinfo(Parse.client.server_url))}"
 puts "App Id : #{Parse::TerminalSafe.sanitize_line(Parse.client.app_id)}"
 puts "Master : #{Parse.client.master_key.present?}"
 

data/docs/TEST_SERVER.md

@@ -62,7 +62,7 @@ default.
 - **`PSNEXT_PREFIX`** (default `psnext-it`) names the Compose project and every
   container. Set it (e.g. `PSNEXT_PREFIX=psnext-ci`) to run a second, fully
   separate copy.
-- **Versions**: Parse Server is pinned to `parseplatform/parse-server:9.10.3`
+- **Versions**: Parse Server is pinned to `parseplatform/parse-server:9.10.7`
   (see `scripts/docker/Dockerfile.parse`), MongoDB `mongo:9` (`MONGO_VERSION`), Redis
   `redis:7-alpine`, Dashboard `parseplatform/parse-dashboard:9`.
 - **Database**: Parse uses `parse_stack_next_it`.

data/docs/caching.md

@@ -87,8 +87,13 @@ Use the wrapper rather than a bare `Moneta.new(:Redis, ...)`. Moneta serializes
 values with Marshal by default, so every cache read would `Marshal.load` bytes
 returned by Redis, which is a remote-code-execution primitive when that Redis is
 shared, unauthenticated, or reachable over a plaintext connection. The wrapper
-forces `value_serializer: nil` and encodes values as JSON itself. If you supply
-your own Moneta store, build it with `value_serializer: nil`.
+forces `value_serializer: nil` and encodes values as JSON itself. A raw Moneta
+store that keeps the Marshal serializer over an external backend is refused with
+`ArgumentError` unless you pass `allow_marshal_cache: true`; in-process stores
+(`:Memory`, `:LRUHash`, `:Null`) are accepted. Setting `value_serializer: nil` on
+a raw file or Redis store is not a substitute for the wrapper: the response
+cache stores Hash values, which such a backend cannot hold without a
+serializer, so every lookup misses.
 
 The wrapper refuses a Moneta `prefix:` option, because it would rewrite the
 physical key layout underneath the SCAN patterns that scoped clearing depends

data/docs/mcp_guide.md

@@ -1424,6 +1424,40 @@ The `Parse::Agent::RateLimitExceeded` constant is a stable top-level alias — e
 
 Per-user rate limiting follows the same pattern: key the Redis counter on the verified user identity extracted during authentication.
 
+### Deployment-layer limits
+
+The SDK's limiters are not a substitute for limits at the deployment layer.
+
+- `Parse::Agent::RateLimiter` is created per `Parse::Agent` instance. With an `agent_factory:` that builds an agent per request, it does not limit anything across requests.
+- `MCPServer` keeps one limiter for the whole server. Every principal (every API key holder, every client IP) draws from that one budget, so a single noisy client can exhaust it for all others, and it does not limit any one client.
+- `pre_auth_rate_limiter:` is called as `check!` with no arguments, before authentication. It sees no client identity, so it limits total request volume rather than any one caller.
+
+Production deployments should enforce a per-client limit (keyed on API key, user, or IP) at a reverse proxy or API gateway in front of the MCP endpoint, and also pass a shared `pre_auth_rate_limiter:` so unauthenticated traffic cannot drive unbounded Parse Server session lookups. Back the limiter with a shared store (for example Redis) when more than one process serves the endpoint.
+
+```ruby
+$pre_auth_limiter = MyRedisRateLimiter.new(key: "mcp_pre_auth", limit: 600, window: 60)
+
+# Rack mount (MCPRackApp, or Parse::Agent.rack_app which forwards kwargs)
+mcp_app = Parse::Agent::MCPRackApp.new(
+  pre_auth_rate_limiter: $pre_auth_limiter,
+  agent_factory: ->(env) {
+    # ... auth ...
+    Parse::Agent.new(permissions: :readonly, rate_limiter: $shared_redis_limiter)
+  },
+)
+
+# Standalone server. MCPServer.run does not forward pre_auth_rate_limiter:,
+# so construct the server directly.
+Parse::Agent::MCPServer.new(
+  port:                  3001,
+  api_key:               ENV["MCP_API_KEY"],
+  rate_limiter:          $shared_redis_limiter,
+  pre_auth_rate_limiter: $pre_auth_limiter,
+).start
+```
+
+On exhaustion the pre-auth limiter must raise an exception responding to `#retry_after` (such as `Parse::Agent::RateLimitExceeded`); the request is answered with HTTP 429 and a `Retry-After` header.
+
 ---
 
 ## Custom Tools

data/lib/parse/agent/constraint_translator.rb

@@ -233,8 +233,18 @@ module Parse
 
       # Translate a hash value (could be operators or a pointer/object)
       def translate_hash_value(hash, depth:, agent: nil)
-        # Check if it's a Parse type (Pointer, Date, File, GeoPoint)
-        return hash if parse_type?(hash)
+        # Check if it's a Parse type (Pointer, Date, File, GeoPoint). A Parse
+        # type value carries no operators, so a `__type` hash that also has a
+        # `$` key is refused instead of being passed through unvalidated.
+        if parse_type?(hash)
+          op_key = hash.keys.find { |k| k.to_s.start_with?("$") }
+          return hash if op_key.nil?
+          raise ConstraintSecurityError.new(
+            "SECURITY: a `__type` value cannot also carry the operator #{op_key}.",
+            operator: op_key.to_s,
+            reason: :operator_in_parse_type,
+          )
+        end
 
         # Classify each key INDEPENDENTLY rather than branching on whether
         # *every* key is an operator. A hash that mixes an operator key with a
@@ -366,10 +376,64 @@ module Parse
             reason: :cross_class_denied,
           )
         end
+        # The owning object must be one concrete object. An operator or any
+        # other non-String objectId (`{ "$exists" => true }`) makes Parse
+        # Server below 9.10.5 match relations of every owning object, without
+        # the owning object's ACL (GHSA-58m4-cqvw-4vgh).
+        # A Hash holding both "object" and :object (or "key" and :key) would
+        # let the checks read one entry while the other is sent.
+        %w[object key].each do |slot|
+          next unless val.is_a?(Hash) && val.key?(slot) && val.key?(slot.to_sym)
+          raise ConstraintSecurityError.new(
+            "SECURITY: $relatedTo names `#{slot}` twice (String and Symbol keys).",
+            operator: "$relatedTo",
+            reason: :duplicate_key,
+          )
+        end
+        key = val["key"] || val[:key]
+        unless key.is_a?(String) && RELATED_TO_KEY_RE.match?(key)
+          raise ConstraintSecurityError.new(
+            "SECURITY: $relatedTo requires `key` to be a relation field name.",
+            operator: "$relatedTo",
+            reason: :invalid_key,
+          )
+        end
+        object_id = related_to_object_id(val)
+        unless object_id.is_a?(String) && RELATED_TO_OBJECT_ID_RE.match?(object_id)
+          raise ConstraintSecurityError.new(
+            "SECURITY: $relatedTo requires the owning object's objectId to be a " \
+            "plain objectId string.",
+            operator: "$relatedTo",
+            reason: :invalid_object_id,
+          )
+        end
         assert_embedded_class_accessible!("$relatedTo", owning_class, agent: agent)
         translate_value(val, depth: depth, agent: agent)
       end
 
+      # objectId shape accepted for a `$relatedTo` owning object (the same
+      # character set the agent tools accept for an object_id argument).
+      RELATED_TO_OBJECT_ID_RE = /\A[A-Za-z0-9_-]{1,32}\z/.freeze
+
+      # Field-name shape accepted for a `$relatedTo` relation key.
+      RELATED_TO_KEY_RE = /\A[A-Za-z][A-Za-z0-9_]{0,127}\z/.freeze
+
+      # The objectId of a `$relatedTo` constraint's owning object, in
+      # whichever of the forms {.related_to_owning_class} accepts. Returns
+      # the raw value (possibly a Hash) so the caller can reject non-Strings.
+      def related_to_object_id(val)
+        return nil unless val.is_a?(Hash)
+        obj = val["object"] || val[:object]
+        return obj.id if obj.respond_to?(:parse_class) && obj.respond_to?(:id)
+        case obj
+        when Hash
+          o = obj.transform_keys(&:to_s)
+          o["objectId"]
+        when String
+          obj.include?("$") ? obj.split("$", 2).last : nil
+        end
+      end
+
       # Extract the Parse class name of a `$relatedTo` constraint's owning
       # object from its `object` slot, which may be a Parse::Pointer, a Parse
       # pointer/relation hash (`{__type:, className:, objectId:}`, string or