parse-stack-next 5.8.3 → 5.8.4

data/lib/parse/agent/mcp_rack_app.rb

@@ -253,7 +253,12 @@ module Parse
       #   and raise an exception responding to `#retry_after` (such as
       #   `Parse::Agent::RateLimiter::RateLimitExceeded`) when exhausted.
       #   Defaults to `nil` (no pre-auth limiter). On exhaustion the request
-      #   is rejected with HTTP 429 and a `Retry-After` header.
+      #   is rejected with HTTP 429 and a `Retry-After` header. `#check!` is
+      #   called with no arguments, so this limits total volume, not any one
+      #   client. A per-agent {Parse::Agent::RateLimiter} built inside a
+      #   per-request factory does not limit across requests. Enforce
+      #   per-client limits at a reverse proxy or API gateway as well; see
+      #   "Deployment-layer limits" in docs/mcp_guide.md.
       # @param allowed_origins [Array<String>, nil] when set, the `Origin`
       #   request header must match one of these entries (case-insensitive,
       #   exact host match — wildcard via leading `.` matches subdomains).
@@ -263,6 +268,21 @@ module Parse
       #   as allowed regardless of this setting. The default loopback
       #   bind makes this check optional in development; operators who
       #   bind MCP to a routable interface should configure it.
+      # @param allowed_hosts [Array<String>, nil] `Host` header values this app
+      #   answers to, as a hostname (`"mcp.example.com"`, any port) or
+      #   `host:port` (`"mcp.example.com:8443"`, that port only), compared
+      #   case-insensitively. This is the MCP spec's DNS-rebinding guidance: a
+      #   rebinding page reaches a loopback server under the attacker's
+      #   hostname, so its requests carry that hostname in `Host` even when it
+      #   strips or spoofs nothing else. When set, a request whose `Host` is not
+      #   listed (and, on a loopback bind, is not a loopback host) is refused
+      #   with 403. `nil` (default) applies the check only on a loopback bind.
+      # @param loopback_bind [Boolean] the app is served on a loopback
+      #   interface. Enables the `Host` check with `localhost`, `127.0.0.1`,
+      #   and `[::1]` (any port) allowed, plus any `allowed_hosts:` entries.
+      #   Implied by `loopback_csrf_default: true`. {MCPServer} sets it from its
+      #   bind address. A request with no `Host` header is allowed: browsers
+      #   always send one, so its absence is a native client.
       # @param require_custom_header [String, nil] when set (e.g.
       #   `"X-MCP-Client"`), requests must carry that header with any
       #   non-empty value. Custom headers can't be set by a `<form>`
@@ -333,6 +353,8 @@ module Parse
                      allowed_origins: nil,
                      require_custom_header: nil,
                      loopback_csrf_default: false,
+                     allowed_hosts: nil,
+                     loopback_bind: false,
                      resource_subscriptions: false,
                      subscription_manager: nil,
                      notifications: nil,
@@ -401,6 +423,12 @@ module Parse
         # browser UI sends a loopback Origin and is allowed. Ignored when an
         # explicit allowlist is configured (operator owns the policy then).
         @loopback_csrf_default = loopback_csrf_default && @allowed_origins.nil?
+        # Host header gate (DNS-rebinding). Keyed off the raw
+        # `loopback_csrf_default` argument, not the Origin-suppressed value
+        # above: an explicit Origin allowlist does not change the fact that
+        # the app is reachable on a loopback interface.
+        @allowed_hosts = normalize_allowed_hosts(allowed_hosts)
+        @loopback_host_check = loopback_bind == true || loopback_csrf_default == true
         @health_path = health_path.is_a?(String) && !health_path.empty? ? health_path : nil
         # Per-app registry of in-flight cancellable requests. Keyed by
         # [correlation_id, request_id]. A `notifications/cancelled` POST
@@ -619,6 +647,14 @@ module Parse
           return [200, json_headers, ['{"status":"ok"}']]
         end
 
+        # 0a2. Host header gate (DNS-rebinding). Runs ahead of every method
+        #      branch (POST, GET listening stream, DELETE) so a rebinding page
+        #      cannot reach any of them under its own hostname.
+        if host_refused?(env)
+          @logger&.warn("[Parse::Agent::MCPRackApp] Host refused: #{env["HTTP_HOST"].to_s.strip[0, 255].inspect}")
+          return [403, json_headers, [json_rpc_error(-32_700, "Host not allowed")]]
+        end
+
         # 0b. NEW-MCP-6: pre-auth rate limit. Runs BEFORE the agent_factory
         #     so a malformed body / missing key / empty `{}` cannot force
         #     the operator-supplied factory to round-trip to Parse Server
@@ -2585,6 +2621,59 @@ module Parse
         arr.empty? ? nil : arr.freeze
       end
 
+      # Normalize the `allowed_hosts:` kwarg into a frozen Array of
+      # downcased entries, or nil when none are configured.
+      def normalize_allowed_hosts(value)
+        return nil if value.nil?
+        arr = Array(value).map { |v| v.to_s.strip.downcase }.reject(&:empty?)
+        arr.empty? ? nil : arr.freeze
+      end
+
+      # Hostnames accepted on a loopback bind (IPv6 without brackets).
+      LOOPBACK_HOST_NAMES = %w[localhost 127.0.0.1 ::1].freeze
+
+      # Split a `Host` header value into `[hostname, port]`. The hostname is
+      # downcased with IPv6 brackets removed; the port is a String or nil.
+      # Returns nil for a malformed value.
+      def split_host_header(value)
+        v = value.downcase
+        if v.start_with?("[")
+          m = v.match(/\A\[([0-9a-f:.]+)\](?::(\d{1,5}))?\z/)
+          return nil unless m
+          [m[1], m[2]]
+        else
+          m = v.match(/\A([a-z0-9._-]+)(?::(\d{1,5}))?\z/)
+          return nil unless m
+          [m[1], m[2]]
+        end
+      end
+
+      # Single chokepoint for the Host header gate. Inactive unless the app
+      # is on a loopback bind or `allowed_hosts:` is configured. A missing or
+      # empty Host is allowed (browsers always send one); a malformed Host is
+      # refused.
+      def host_refused?(env)
+        return false unless @loopback_host_check || @allowed_hosts
+        raw = env["HTTP_HOST"].to_s.strip
+        return false if raw.empty?
+        parts = split_host_header(raw)
+        return true if parts.nil?
+        name, port = parts
+        return false if @loopback_host_check && LOOPBACK_HOST_NAMES.include?(name)
+        return false if @allowed_hosts&.any? { |entry| host_entry_matches?(entry, name, port) }
+        true
+      end
+
+      # An `allowed_hosts:` entry matches by hostname alone (any port) or by
+      # `host:port` exactly.
+      def host_entry_matches?(entry, name, port)
+        entry_parts = split_host_header(entry)
+        return false if entry_parts.nil?
+        entry_name, entry_port = entry_parts
+        return false unless entry_name == name
+        entry_port.nil? || entry_port == port
+      end
+
       # Normalize the `require_custom_header:` kwarg into a
       # `[env_key, expected_value]` pair, or nil when no check is
       # configured. Accepts:

data/lib/parse/agent/mcp_server.rb

@@ -72,7 +72,10 @@ module Parse
         # @param session_token [String, nil] optional session token
         # @param host [String] host to bind to
         # @param rate_limiter [#check!, nil] optional external rate limiter
-        def run(port: nil, permissions: :readonly, session_token: nil, host: "127.0.0.1", api_key: nil, rate_limiter: nil)
+        # @param allowed_hosts [Array<String>, nil] extra `Host` header values
+        #   to accept (see {#initialize})
+        def run(port: nil, permissions: :readonly, session_token: nil, host: "127.0.0.1", api_key: nil,
+                rate_limiter: nil, allowed_hosts: nil)
           unless Parse::Agent.mcp_enabled?
             raise "MCP server not enabled. Call Parse::Agent.enable_mcp! first"
           end
@@ -84,6 +87,7 @@ module Parse
             host: host,
             api_key: api_key,
             rate_limiter: rate_limiter,
+            allowed_hosts: allowed_hosts,
           )
           server.start
         end
@@ -111,6 +115,19 @@ module Parse
       #   Redis-backed). When provided, replaces the default in-process
       #   {Parse::Agent::RateLimiter}. Must respond to `#check!` and raise
       #   {Parse::Agent::RateLimitExceeded} when the budget is exhausted.
+      #   One limiter serves the whole server and is shared by every
+      #   principal, so it does not limit any single client. Enforce
+      #   per-client limits at a reverse proxy or API gateway; see
+      #   "Deployment-layer limits" in docs/mcp_guide.md.
+      # @param pre_auth_rate_limiter [#check!, nil] limiter consulted before
+      #   authentication on every request (see
+      #   {Parse::Agent::MCPRackApp#initialize}). Not forwarded by {.run};
+      #   construct the server with {#initialize} and call {#start} to use it.
+      # @param allowed_hosts [Array<String>, nil] `Host` header values to accept
+      #   besides the loopback hosts, as `"name"` (any port) or `"name:port"`.
+      #   On a loopback bind every request whose `Host` is not a loopback host
+      #   or listed here is refused with 403 (DNS-rebinding protection). On a
+      #   non-loopback bind, setting it restricts `Host` to the listed values.
       # @raise [ArgumentError] if rate_limiter is provided but does not respond to :check!
       # Loopback hosts that are safe to bind to without an API key.
       LOOPBACK_HOSTS = %w[127.0.0.1 ::1 localhost].freeze
@@ -144,7 +161,8 @@ module Parse
       def initialize(port: 3001, host: "127.0.0.1", permissions: :readonly,
                      session_token: nil, api_key: nil, rate_limiter: nil,
                      pre_auth_rate_limiter: nil,
-                     allowed_origins: nil, require_custom_header: nil)
+                     allowed_origins: nil, require_custom_header: nil,
+                     allowed_hosts: nil)
         if rate_limiter && !rate_limiter.respond_to?(:check!)
           raise ArgumentError, "rate_limiter must respond to #check!"
         end
@@ -233,6 +251,10 @@ module Parse
           allowed_origins: allowed_origins,
           require_custom_header: require_custom_header,
           loopback_csrf_default: loopback_csrf_default,
+          # DNS-rebinding: on a loopback bind, refuse any request whose Host
+          # header is not a loopback host or listed in allowed_hosts:.
+          loopback_bind: LOOPBACK_HOSTS.include?(host.to_s),
+          allowed_hosts: allowed_hosts,
         )
       end
 

data/lib/parse/agent/mcp_subscriptions.rb

@@ -119,6 +119,33 @@ module Parse
         [class_name, kind]
       end
 
+      # Build the LiveQuery `where` for a resource subscription so change
+      # events only fire for rows the agent may read. Composes the same row
+      # scoping the read tools apply: the class's agent tenant scope and the
+      # operator's per-agent filter (`Parse::Agent.new(filters: ...)`). Both
+      # are security boundaries, so neither can be dropped. The class's
+      # canonical filter is not applied: it is an LLM-controllable
+      # convenience on the read path, and a row leaving the canonical state
+      # still produces a LiveQuery `leave` event for the scoped subscription.
+      #
+      # Without this, a subscription opened the whole class: a tenant-scoped
+      # or filtered agent received a notification (a change and timing
+      # signal) for every write in every tenant.
+      #
+      # @param agent [Parse::Agent]
+      # @param class_name [String]
+      # @return [Hash] REST wire-format `where` (empty when no scoping applies).
+      # @raise [Parse::Agent::AccessDenied] when the class is tenant-scoped and
+      #   the agent has no tenant binding.
+      def self.subscription_where_for(agent, class_name)
+        tools = Parse::Agent::Tools
+        scope = tools.resolve_tenant_scope!(agent, class_name)
+        where = tools.apply_tenant_scope_to_where(nil, scope, class_name)
+        where = tools.apply_per_agent_filter_to_where(where, class_name, agent: agent)
+        return {} if where.nil? || where.empty?
+        Parse::Agent::ConstraintTranslator.translate(where, agent, class_name)
+      end
+
       # Derive LiveQuery subscribe credentials from a subscribing agent.
       #
       # @param agent [Parse::Agent]
@@ -541,6 +568,9 @@ module Parse
           Parse::Agent::Tools.assert_class_accessible!(class_name, agent: agent, op: op)
 
           creds = MCPSubscriptions.live_query_credentials_for(agent)
+          # Row scoping parity with the read path: tenant scope plus the
+          # per-agent filter become the subscription's server-side `where`.
+          where = MCPSubscriptions.subscription_where_for(agent, class_name)
 
           # Idempotent: a repeat subscribe to the same URI is a no-op rather
           # than a second LiveQuery socket subscription. Enforce the per-session
@@ -573,7 +603,8 @@ module Parse
             publish_update(session_id, uri)
           end
 
-          sub = client_for(creds).subscribe(class_name, **creds)
+          sub_opts = where.empty? ? creds : creds.merge(where: where)
+          sub = client_for(creds).subscribe(class_name, **sub_opts)
           Parse::LiveQuery::EVENTS.each do |event|
             sub.on(event) { debouncer.trigger }
           end

data/lib/parse/agent/tools.rb

@@ -1634,8 +1634,8 @@ module Parse
         # boundary if the class's CLP doesn't grant that op to any
         # entry in the agent's claim set. Master-key posture
         # (`acl_permission_strings` is nil) bypasses — same contract
-        # as Parse::ACLScope. Lookup failures fail-open (Parse Server
-        # still enforces CLP on its own REST surface).
+        # as Parse::ACLScope. A schema lookup that fails refuses the call
+        # (Parse::CLPScope.permits? fails closed).
         if op && agent && agent.respond_to?(:acl_permission_strings)
           perms = agent.acl_permission_strings
           unless Parse::CLPScope.permits?(class_name.to_s, op, perms)
@@ -4785,7 +4785,7 @@ module Parse
         # Allow some keys to be nil (missing values) — they pass through.
         return [nil, pairs] unless pairs.all? { |k, _| k.nil? || (k.is_a?(String) && k.include?("$")) }
         cls = classes.compact.first
-        rewritten = pairs.map { |k, v| [k.is_a?(String) ? k.sub(/\A#{cls}\$/, "") : k, v] }
+        rewritten = pairs.map { |k, v| [k.is_a?(String) ? k.delete_prefix("#{cls}$") : k, v] }
         [cls, rewritten]
       end
 

data/lib/parse/agent.rb

@@ -1353,7 +1353,7 @@ module Parse
         @auth_context = nil
         @scope_failed_at = nil
         @scope_failed_token = nil
-        no_master_key = @client.respond_to?(:master_key) && @client.master_key.nil?
+        no_master_key = client_lacks_master_key?
         @client_mode = no_master_key && !@session_token.to_s.empty?
       end
       self
@@ -1936,7 +1936,7 @@ module Parse
       # constructor assertions with no REST equivalent — Parse Server's
       # REST surface offers no "act as user-pointer" affordance, so the
       # SDK cannot honor them without a master key.
-      no_master_key = @client.respond_to?(:master_key) && @client.master_key.nil?
+      no_master_key = client_lacks_master_key?
       session_token_present = !@session_token.nil? && !@session_token.to_s.empty?
       @client_mode = no_master_key && session_token_present
 
@@ -4256,6 +4256,17 @@ module Parse
 
     private
 
+    # True when the underlying client will not send a master key. A blank
+    # key (nil, empty, or whitespace only) counts as absent, matching the
+    # HTTP authentication middleware, which never sends a blank key. A
+    # client that does not expose `master_key` keeps the historical
+    # master-key posture.
+    # @return [Boolean]
+    def client_lacks_master_key?
+      return false unless @client.respond_to?(:master_key)
+      @client.master_key.to_s.strip.empty?
+    end
+
     public
 
     # A redacted one-line summary. Never includes the session token, the
@@ -4521,7 +4532,7 @@ module Parse
     # Fail-closed: raises rather than silently widening to master-key
     # posture.
     def resolve_impersonation_token!(user, mint:)
-      if @client.respond_to?(:master_key) && @client.master_key.nil?
+      if client_lacks_master_key?
         raise ArgumentError,
               "impersonate_user: requires a Parse::Client with a master_key to " \
               "resolve a session token for another user."

data/lib/parse/atlas_search/protected_paths.rb

@@ -120,6 +120,169 @@ module Parse
         nil
       end
 
+      # Collections whose documents carry Parse Server's credential columns
+      # (`_hashed_password`, `_perishable_token`, `_session_token`, ...).
+      CREDENTIAL_COLLECTIONS = %w[_User _Session].freeze
+
+      # Sample names a wildcard glob is tested against: every internal
+      # column, plus a representative `_auth_data_<provider>` column.
+      # ACL columns present in every Parse collection.
+      ACL_COLUMNS = %w[_rperm _wperm _tombstone].freeze
+
+      # Stored credential column names a wildcard glob is tested against on
+      # `_User` / `_Session` (or an unknown collection). Only stored,
+      # underscore-prefixed names are listed: `sessionToken` is a REST field
+      # name, not a stored column, so `s*` does not count as reaching it.
+      CREDENTIAL_GLOB_SAMPLES = (
+        Parse::PipelineSecurity::INTERNAL_FIELDS_DENYLIST.select { |n| n.start_with?("_") } - ACL_COLUMNS +
+        %w[anonymous apple facebook github google instagram linkedin mfa twitter].map { |p| "_auth_data_#{p}" } +
+        %w[_perishable_token_expires_at _email_verify_token_expires_at _password_changed_at]
+      ).uniq.freeze
+
+      # Whether `path` names one of Parse Server's internal columns
+      # ({Parse::PipelineSecurity::INTERNAL_FIELDS_DENYLIST} or an
+      # `_auth_data_<provider>` column). A wildcard path object counts when
+      # its glob (other than the bare `*`, handled as reaching every field)
+      # matches one of them, so `*token` and `?hashed*` are caught.
+      #
+      # @return [Boolean]
+      def internal_path?(path, collection_name: nil)
+        case path
+        when String, Symbol
+          head = path.to_s.split(".").first.to_s
+          Parse::PipelineSecurity::INTERNAL_FIELDS_DENYLIST.include?(head) ||
+            Parse::PipelineSecurity::INTERNAL_FIELDS_PREFIX_DENYLIST.any? { |p| head.start_with?(p) }
+        when Array
+          path.any? { |p| internal_path?(p, collection_name: collection_name) }
+        when Hash
+          value = path.key?("value") ? path["value"] : path[:value]
+          glob = path.key?("wildcard") ? path["wildcard"] : path[:wildcard]
+          (!value.nil? && internal_path?(value)) || internal_glob?(glob, collection_name: collection_name)
+        else
+          false
+        end
+      end
+
+      # Whether an Atlas wildcard path glob matches an internal column.
+      # @!visibility private
+      def internal_glob?(glob, collection_name: nil, include_acl: true)
+        return false unless glob.is_a?(String) || glob.is_a?(Symbol)
+        g = glob.to_s
+        return false if g == "*"
+        samples = include_acl ? ACL_COLUMNS.dup : []
+        prefix = g[/\A[^*?\[\\]*/].to_s
+        # Parse fields never start with `_`, so a glob whose literal prefix
+        # does can only reach internal columns: test it against the
+        # credential columns on every class. A glob that starts with a
+        # wildcard (`*token`, `s*`) can match ordinary fields, so the
+        # credential columns count only where they are stored.
+        if prefix.start_with?("_") || collection_name.nil? ||
+           CREDENTIAL_COLLECTIONS.include?(collection_name.to_s)
+          samples.concat(CREDENTIAL_GLOB_SAMPLES)
+          # `_auth_data_<provider>` columns are open-ended: refuse a glob whose
+          # literal prefix reaches into that namespace (`_auth_data_f*`, `_a*`).
+          return true if !prefix.empty? &&
+                         (prefix.start_with?("_auth_data_") || "_auth_data_".start_with?(prefix))
+        end
+        samples.any? { |name| ::File.fnmatch?(g, name) }
+      end
+
+      # Field names written into a `queryString` query, with Lucene escapes
+      # removed first (`_hashed\_password:a*` names `_hashed_password`).
+      # A match starts only at a token boundary and the quantifiers are
+      # possessive, so a long run of field characters with no colon is
+      # scanned in linear time.
+      # @!visibility private
+      QUERY_STRING_FIELD_RE = /(?<![A-Za-z0-9_.*?])([A-Za-z0-9_.*?]++)\s*+:/.freeze
+
+      def query_string_fields(text)
+        text.to_s.gsub(/\\(.)/m, "\\1").scan(QUERY_STRING_FIELD_RE).map(&:first)
+      end
+
+      # Whether a path reference reaches fields by glob: the all-fields
+      # sentinel, a `{ wildcard: ... }` path object, or an Array path with
+      # one of those at any depth (`[{ wildcard: "*" }]`).
+      # @!visibility private
+      def wildcard_path?(ref)
+        return true if ref == ALL_FIELDS
+        case ref
+        when Array
+          ref.any? { |r| wildcard_path?(r) }
+        when Hash
+          ref.key?("wildcard") || ref.key?(:wildcard)
+        else
+          false
+        end
+      end
+
+      # Field names written into `queryString` query texts in a stage
+      # (`_perishable_token:a*` names `_perishable_token`).
+      # @!visibility private
+      def each_query_string_field(node, &block)
+        case node
+        when Array
+          node.each { |child| each_query_string_field(child, &block) }
+        when Hash
+          node.each do |key, value|
+            if key.to_s == "queryString" && value.is_a?(Hash)
+              text = value["query"] || value[:query]
+              query_string_fields(text).each { |field| yield field }
+            end
+            each_query_string_field(value, &block)
+          end
+        end
+        nil
+      end
+
+      # Refuse a `$search` / `$searchMeta` body, or a list of paths, that
+      # references a Parse Server internal column. Unlike the protectedFields
+      # checks this runs for every caller, master included: a `wildcard`,
+      # `regex`, or `autocomplete` operator over `_perishable_token` or
+      # `_hashed_password` returns which documents match a prefix, so row
+      # counts reveal the value. On `_User` and `_Session` a non-master
+      # caller is also refused a path that reaches every field, since on a
+      # dynamically mapped index that includes those columns.
+      #
+      # @param stage [Hash, nil] a `$search` / `$searchMeta` stage to walk.
+      # @param paths [Object, nil] a path, or an Array of paths.
+      # @raise [Parse::CLPScope::Denied]
+      def assert_no_internal_paths!(stage: nil, paths: nil, collection_name: nil, resolution: nil,
+                                    method_name: "Parse::AtlasSearch.search", what: "path")
+        refs = []
+        unless stage.nil?
+          each_search_reference(stage) { |ref| refs << ref }
+          each_query_string_field(stage) do |field|
+            next unless internal_path?(field, collection_name: collection_name) ||
+                        internal_glob?(field, collection_name: collection_name)
+            raise Parse::CLPScope::Denied.new(
+              collection_name, :find,
+              "#{method_name} refused: a queryString query names the Parse Server " \
+              "internal field #{field.inspect}; matching on it would reveal its value.",
+            )
+          end
+        end
+        refs.concat(paths.is_a?(Array) ? paths : [paths]) unless paths.nil?
+        all_fields_refused = CREDENTIAL_COLLECTIONS.include?(collection_name.to_s) &&
+                             !(resolution.respond_to?(:master?) && resolution.master?)
+        refs.each do |ref|
+          if ref != ALL_FIELDS && internal_path?(ref, collection_name: collection_name)
+            raise Parse::CLPScope::Denied.new(
+              collection_name, :find,
+              "#{method_name} refused: #{what} #{ref.inspect} names a Parse Server " \
+              "internal field; matching, ranking, or filtering on it would reveal its value.",
+            )
+          end
+          next unless all_fields_refused && wildcard_path?(ref)
+          raise Parse::CLPScope::Denied.new(
+            collection_name, :find,
+            "#{method_name} refused: a #{what} that reaches every field of " \
+            "#{collection_name} would include its credential columns; name the " \
+            "fields to search explicitly.",
+          )
+        end
+        nil
+      end
+
       # Yield every field reference in a `$search`-style body.
       # @!visibility private
       def each_search_reference(node, &block)

data/lib/parse/atlas_search.rb

@@ -359,6 +359,7 @@ module Parse
         # highlights" state — fail loudly instead.
         protected_fields = Parse::CLPScope.protected_fields_for(
           collection_name, resolution.permission_strings,
+          client: Parse::MongoDB.clp_client_for(resolution), strict: true,
         )
         assert_highlight_field_allowed!(options[:highlight_field], protected_fields, resolution)
 
@@ -436,6 +437,7 @@ module Parse
         pointer_fields = resolve_pointer_fields!(collection_name, resolution)
         protected_fields = Parse::CLPScope.protected_fields_for(
           collection_name, resolution.permission_strings,
+          client: Parse::MongoDB.clp_client_for(resolution), strict: true,
         )
         assert_highlight_field_allowed!(options[:highlight_field], protected_fields, resolution)
         # The caller built this stage, so any operator path, sort key, or
@@ -521,8 +523,13 @@ module Parse
         # protectedFields contract.
         protected_fields = Parse::CLPScope.protected_fields_for(
           collection_name, resolution.permission_strings,
+          client: Parse::MongoDB.clp_client_for(resolution), strict: true,
         )
         field_str = field.to_s
+        ProtectedPaths.assert_no_internal_paths!(
+          paths: field_str, collection_name: collection_name, resolution: resolution,
+          method_name: "Parse::AtlasSearch.autocomplete", what: "autocomplete field",
+        )
         if ProtectedPaths.enforce?(resolution, protected_fields) &&
            ProtectedPaths.touches?(field_str, protected_fields)
           raise Parse::CLPScope::Denied.new(
@@ -713,6 +720,13 @@ module Parse
           end
         end
 
+        # No caller, master included, may facet on or search a Parse Server
+        # internal column.
+        ProtectedPaths.assert_no_internal_paths!(
+          stage: search_meta_stage, collection_name: collection_name, resolution: resolution,
+          method_name: "Parse::AtlasSearch.faceted_search", what: "facet or search path",
+        )
+
         # A non-master caller (the public fallback when no auth kwargs are
         # passed) must not facet on, or text-match against, a protected
         # field: bucket values and counts would reveal it directly, and a
@@ -720,6 +734,7 @@ module Parse
         unless resolution.master?
           facet_protected = Parse::CLPScope.protected_fields_for(
             collection_name, resolution.permission_strings,
+            client: Parse::MongoDB.clp_client_for(resolution), strict: true,
           )
           ProtectedPaths.assert_search_stage_allowed!(
             search_meta_stage, facet_protected, resolution,
@@ -807,6 +822,23 @@ module Parse
         # .autocomplete callers build safe stages via SearchBuilder, so this
         # only ever fires for a caller-supplied stage.
         assert_search_stage_safe!(search_stage)
+        # Parse Server's internal columns are refused as a search path,
+        # highlight path, or sort key for every caller (see
+        # ProtectedPaths.assert_no_internal_paths!).
+        ProtectedPaths.assert_no_internal_paths!(
+          stage: search_stage, collection_name: collection_name, resolution: resolution,
+          method_name: "Parse::AtlasSearch.search", what: "$search path",
+        )
+        ProtectedPaths.assert_no_internal_paths!(
+          paths: highlight_field, collection_name: collection_name, resolution: resolution,
+          what: "highlight path",
+        ) unless highlight_field.nil?
+        if sort.is_a?(Hash) && !sort.empty?
+          ProtectedPaths.assert_no_internal_paths!(
+            paths: sort.keys.map(&:to_s), collection_name: collection_name,
+            resolution: resolution, what: "sort key",
+          )
+        end
         pipeline = [search_stage]
 
         # Score projection.
@@ -1058,6 +1090,7 @@ module Parse
         # user, and role grants first; then pointerFields / readUserFields).
         # Raises Parse::CLPScope::Denied when the scope cannot find at all.
         Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            client: Parse::MongoDB.clp_client_for(resolution),
                                             label: "Atlas Search")
         nil
       end
@@ -1073,6 +1106,7 @@ module Parse
         # permits? / pointer_fields_for pair missed readUserFields entirely
         # and over-restricted a public grant that also listed pointerFields.
         Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            client: Parse::MongoDB.clp_client_for(resolution),
                                             label: "Atlas Search")
       end
 
@@ -1288,6 +1322,7 @@ module Parse
           unless resolution.master?
             protected_fields = Parse::CLPScope.protected_fields_for(
               collection_name, resolution.permission_strings,
+              client: Parse::MongoDB.clp_client_for(resolution), strict: true,
             )
             ProtectedPaths.assert_filter_allowed!(
               filter, protected_fields, resolution, collection_name: collection_name,
@@ -1398,5 +1433,32 @@ module Parse
     # cannot hold a second, divergent copy. Initializing them at load time
     # would also require a configured client before one exists.
     @master_warned = false
+
+    # Each public entry point resolves the class schema once: the CLP gate,
+    # pointerFields check, and protectedFields lookups inside one call share
+    # a single Parse::CLPScope snapshot, so a cache expiry between them
+    # cannot change the decision.
+    class << self
+      alias_method :search_without_schema_snapshot, :search
+      # @!visibility private
+      def search(*args, **kwargs, &block)
+        Parse::CLPScope.with_snapshot { search_without_schema_snapshot(*args, **kwargs, &block) }
+      end
+      alias_method :search_with_stage_without_schema_snapshot, :search_with_stage
+      # @!visibility private
+      def search_with_stage(*args, **kwargs, &block)
+        Parse::CLPScope.with_snapshot { search_with_stage_without_schema_snapshot(*args, **kwargs, &block) }
+      end
+      alias_method :autocomplete_without_schema_snapshot, :autocomplete
+      # @!visibility private
+      def autocomplete(*args, **kwargs, &block)
+        Parse::CLPScope.with_snapshot { autocomplete_without_schema_snapshot(*args, **kwargs, &block) }
+      end
+      alias_method :faceted_search_without_schema_snapshot, :faceted_search
+      # @!visibility private
+      def faceted_search(*args, **kwargs, &block)
+        Parse::CLPScope.with_snapshot { faceted_search_without_schema_snapshot(*args, **kwargs, &block) }
+      end
+    end
   end
 end