parse-stack-next 5.8.3 → 5.8.4

data/lib/parse/client.rb

@@ -414,7 +414,7 @@ module Parse
     # a client is logged or surfaced in an error reporter. Show only the
     # connection identity and a boolean for each credential's presence.
     def inspect
-      "#<#{self.class.name} server_url=#{@server_url.inspect} " \
+      "#<#{self.class.name} server_url=#{self.class.redact_url_userinfo(@server_url).inspect} " \
       "app_id=#{@application_id.inspect} master_key=#{@master_key ? "[FILTERED]" : "nil"} " \
       "session_token=#{@session_token ? "[FILTERED]" : "nil"}>"
     end
@@ -426,7 +426,7 @@ module Parse
     # @return [Hash]
     def as_json(*)
       {
-        "server_url" => @server_url,
+        "server_url" => self.class.redact_url_userinfo(@server_url),
         "app_id" => @application_id,
         "master_key" => @master_key ? "[FILTERED]" : nil,
         "session_token" => @session_token ? "[FILTERED]" : nil,
@@ -673,6 +673,16 @@ module Parse
     #    You may set the default expiration time with the expires option.
     #    At any point in time you may clear the cache by calling the {Parse::Client#clear_cache!}
     #    method on the client connection. See {https://github.com/minad/moneta Moneta}.
+    #    A store that deserializes values with Marshal over a backend outside
+    #    this process (Moneta's default, e.g. `Moneta.new(:Redis, url: ...)`)
+    #    raises ArgumentError. Use {Parse::Cache::Redis} (or a `redis://` URL
+    #    string), which stores JSON. In-process stores such as
+    #    `Moneta.new(:Memory)` are accepted. A plain `value_serializer: nil`
+    #    is not a substitute: the response cache stores Hash values, which a
+    #    file or Redis backend cannot hold without a serializer.
+    # @option opts [Boolean] :allow_marshal_cache Accept a :cache store that
+    #    deserializes values with Marshal over an external backend. Logs a
+    #    security warning. Default false.
     # @option opts [Integer] :expires Sets the default cache expiration time
     #    (in seconds) for successful non-empty GET requests when using the caching
     #    middleware. The default value is 3 seconds. If :expires is set to 0,
@@ -739,20 +749,30 @@ module Parse
       bound_token = bound_token.to_s.strip
       @session_token = bound_token.empty? ? nil : bound_token
 
-      @require_https = opts.fetch(:require_https, ENV["PARSE_REQUIRE_HTTPS"] == "true")
+      @require_https = opts.fetch(:require_https) { self.class.env_flag_enabled?(ENV["PARSE_REQUIRE_HTTPS"]) }
       @allow_faraday_proxy = opts.fetch(:allow_faraday_proxy, false)
 
       # Security check for HTTP usage (except localhost/127.0.0.1 for development)
       # The scheme and host come from URI parsing, so `HTTP://` and leading
       # whitespace are treated as plain http, not as a secure URL.
+      # Credentials embedded in the URL (`https://user:pass@host/parse`) are
+      # sent as a Basic Authorization header and would otherwise appear in
+      # every message below, in #inspect, and in #as_json. Those surfaces
+      # print a redacted form; warn once so the operator can move them out.
+      if self.class.url_userinfo?(@server_url) && !Parse::Client.instance_variable_get(:@userinfo_warned)
+        Parse::Client.instance_variable_set(:@userinfo_warned, true)
+        warn "[Parse::Client] SECURITY WARNING: the Parse server URL contains embedded credentials " \
+             "(user:password@). They are redacted from logs, but prefer configuring them outside the URL: " \
+             "#{self.class.redact_url_userinfo(@server_url)}"
+      end
       if self.class.url_scheme(@server_url) == "http" && !self.class.loopback_host?(self.class.url_host(@server_url))
         if @require_https
-          raise ArgumentError, "[Parse::Client] HTTPS required but server URL uses HTTP: #{@server_url}. " \
+          raise ArgumentError, "[Parse::Client] HTTPS required but server URL uses HTTP: #{self.class.redact_url_userinfo(@server_url)}. " \
                                "Set require_https: false or use an HTTPS URL."
         else
           warn "[Parse::Client] SECURITY WARNING: Using HTTP instead of HTTPS for Parse server. " \
                "This exposes credentials and data to network interception. " \
-               "Use HTTPS in production: #{@server_url}"
+               "Use HTTPS in production: #{self.class.redact_url_userinfo(@server_url)}"
         end
       end
 
@@ -887,6 +907,29 @@ module Parse
               raise ArgumentError, "Parse::Client option :cache needs to be a type of Moneta store"
             end
 
+            # SECURITY: a caller-built Moneta store keeps Moneta's default
+            # Marshal value serializer unless told otherwise, so every cache
+            # hit would `Marshal.load` the bytes stored in the backend. For a
+            # shared or network-reachable backend (Redis over `redis://`, a
+            # cache another service can write) that is a code-execution
+            # primitive. Refuse it unless the caller opts in explicitly.
+            # In-process stores (`:Memory`, `:LRUHash`, `:Null`) are exempt:
+            # only this process can write the values they hold.
+            if self.class.marshal_value_cache?(opts[:cache])
+              unless opts[:allow_marshal_cache]
+                raise ArgumentError,
+                      "[Parse::Client] The :cache store deserializes values with Marshal " \
+                      "(Moneta's default value serializer), which allows code execution by anyone " \
+                      "able to write to the cache backend. Use Parse::Cache::Redis (or a redis:// URL " \
+                      "string), an in-process store such as Moneta.new(:Memory), or pass " \
+                      "`allow_marshal_cache: true` " \
+                      "to accept the risk."
+              end
+              warn "[Parse::Client] SECURITY WARNING: allow_marshal_cache: true accepts a cache store " \
+                   "that deserializes values with Marshal. Anyone able to write to the cache backend " \
+                   "can execute code in this process."
+            end
+
             # If the caller passed a `Parse::Cache::Redis` wrapper, let its
             # built-in namespace flow through automatically. An explicit
             # `cache_namespace:` still wins so callers can override.
@@ -1148,6 +1191,95 @@ module Parse
       nil
     end
 
+    # Matches an authority whose userinfo (`user:pass@`) precedes the host.
+    # Greedy up to the last `@` before the path, so an unencoded `@` in the
+    # password is still covered.
+    URL_USERINFO_PATTERN = %r{\A([[:space:]]*[a-z][a-z0-9+.\-]*://)[^/?#]*@}i
+    private_constant :URL_USERINFO_PATTERN
+
+    # Whether a URL String embeds userinfo (`user:pass@host`).
+    # @param url [String, nil]
+    # @return [Boolean]
+    # @api private
+    def self.url_userinfo?(url)
+      !url.nil? && URL_USERINFO_PATTERN.match?(url.to_s)
+    end
+
+    # The URL with any userinfo replaced by `[FILTERED]`, for logging and
+    # serialization. Other parts of the URL are unchanged.
+    # @param url [String, nil]
+    # @return [String, nil]
+    # @api private
+    def self.redact_url_userinfo(url)
+      return url if url.nil?
+      url.to_s.sub(URL_USERINFO_PATTERN, '\1[FILTERED]@')
+    end
+
+    # Whether an environment flag is set to a true value: `true`, `1`, or
+    # `yes`, ignoring case and surrounding whitespace.
+    # @param value [String, nil]
+    # @return [Boolean]
+    # @api private
+    def self.env_flag_enabled?(value)
+      %w[true 1 yes].include?(value.to_s.strip.downcase)
+    end
+
+    # Whether a request path would leave the configured server: it has a URI
+    # scheme (`https:`, `HTTP:`, any other `scheme:`) or is protocol-relative
+    # (`//host`, or the `\\host`, `/\host` and `\/host` forms some URL
+    # parsers normalize to it). Leading whitespace and control characters are
+    # ignored. Relative paths, with or without a query string, are safe.
+    # @param uri [String, URI, nil]
+    # @return [Boolean]
+    # @api private
+    def self.unsafe_request_path?(uri)
+      return false if uri.nil?
+      path = uri.to_s.sub(/\A[[:space:][:cntrl:]]+/, "")
+      path.match?(/\A[a-z][a-z0-9+.\-]*:/i) || path.match?(%r{\A[/\\]{2}})
+    end
+
+    # In-process Moneta adapters. Values they hold were written by this
+    # process, so a Marshal value serializer on them is not reachable from
+    # outside it.
+    IN_PROCESS_CACHE_ADAPTERS = %w[
+      Moneta::Adapters::Memory
+      Moneta::Adapters::LRUHash
+      Moneta::Adapters::Null
+    ].freeze
+    private_constant :IN_PROCESS_CACHE_ADAPTERS
+
+    # Whether a Moneta store applies a Marshal value transformer over a
+    # backend outside this process. Walks the proxy chain through `adapter`
+    # (Expires, Logger, Transformer, ...) to the innermost adapter. Moneta
+    # names each compiled transformer class after its chains, for example
+    # `MarshalPrefixKeyMarshalValue`, so the value chain is the part after the
+    # last `Key`. {Parse::Cache::Redis} disables Moneta's value serializer and
+    # is never flagged.
+    # @param store [Object]
+    # @return [Boolean]
+    # @api private
+    def self.marshal_value_cache?(store)
+      return false if defined?(Parse::Cache::Redis) && store.is_a?(Parse::Cache::Redis)
+      marshal_value = false
+      innermost = store
+      node = store
+      16.times do
+        break if node.nil?
+        innermost = node
+        name = node.class.name.to_s.split("::").last.to_s
+        if node.class.name.to_s.start_with?("Moneta::Transformer::") && name.end_with?("Value")
+          marshal_value ||= name.sub(/\A.*Key/, "").include?("Marshal")
+        end
+        break unless node.respond_to?(:adapter)
+        nxt = node.adapter
+        break if nxt.equal?(node)
+        node = nxt
+      end
+      marshal_value && !IN_PROCESS_CACHE_ADAPTERS.include?(innermost.class.name.to_s)
+    rescue StandardError
+      false
+    end
+
     # Configure LiveQuery with the given options
     # @param opts [Hash] configuration options
     # @option opts [String] :live_query_url WebSocket URL for LiveQuery server (wss://...)
@@ -1321,7 +1453,9 @@ module Parse
     # is raised.
     # @param method [Symbol] The method type of the HTTP request (ex. :get, :post).
     #   - This parameter can also be a {Parse::Request} object.
-    # @param uri [String] the url path. It should not be an absolute url.
+    # @param uri [String] the url path, relative to the configured server URL.
+    #   An absolute (`https://...`) or protocol-relative (`//host/...`) path
+    #   raises ArgumentError.
     # @param body [Hash] the body of the request.
     # @param query [Hash] the set of url query parameters to use in a GET request.
     # @param headers [Hash] additional headers to apply to this request.
@@ -1452,6 +1586,14 @@ module Parse
 
         # http method
         method = method.downcase.to_sym
+        # Faraday resolves an absolute or protocol-relative path against the
+        # configured base URL by replacing its host, so a caller-supplied
+        # path such as `https://other.example/x` or `//other.example/x` would
+        # carry the master key and session token to that host.
+        if self.class.unsafe_request_path?(uri)
+          raise ArgumentError, "[Parse::Client] Refusing request path #{uri.to_s.strip[0, 80].inspect}: " \
+                               "paths must be relative to the configured server URL."
+        end
         # set the User-Agent
         headers[USER_AGENT_HEADER] = USER_AGENT_VERSION
 

data/lib/parse/clp_scope.rb

@@ -92,6 +92,10 @@ module Parse
     # stops a down server from being refetched on every read in the block.
     SUPPRESSED_NEGATIVE_TTL = 2
 
+    # Fiber-local key for the per-request entry snapshot ({.with_snapshot}).
+    SNAPSHOT_KEY = :__parse_clp_scope_snapshot
+    private_constant :SNAPSHOT_KEY
+
     @cache = {}
     @suppressed_failures = {}
     @cache_mutex = Mutex.new
@@ -291,7 +295,12 @@ module Parse
         access_evaluation(:denied, role_claims: role_claims, reason: reason)
       end
 
-      def protected_fields_for(class_name, permission_strings, client: nil)
+      # @param strict [Boolean] when true, an unresolvable schema raises
+      #   {Denied} instead of returning an empty set. Callers that use the
+      #   set to REFUSE a request (the pipeline reference scanner) pass
+      #   true: an empty set there would let the request through.
+      # @raise [Denied] when `strict` and the schema is unresolvable.
+      def protected_fields_for(class_name, permission_strings, client: nil, strict: false)
         return EMPTY_SET if permission_strings.nil?
 
         entry = fetch(class_name, client: client)
@@ -299,7 +308,15 @@ module Parse
         # `permits?` already refused the query, so this branch is only
         # reached when callers ask for the protected-fields set directly
         # (e.g. for documentation or audit tooling).
-        return EMPTY_SET if entry.kind == :unresolvable
+        if entry.kind == :unresolvable
+          if strict
+            warn_unresolvable_once!(class_name)
+            raise Denied.new(class_name, :find,
+                             "protectedFields for '#{class_name}' are unresolvable; " \
+                             "refusing the pipeline for the current scope.")
+          end
+          return EMPTY_SET
+        end
         stored_map = if entry.kind == :no_clp
             nil
           else
@@ -539,6 +556,30 @@ module Parse
         @warned_unresolvable_classes = Set.new
       end
 
+      # Pin every schema entry read inside the block to the first value
+      # read for its cache key, for the current thread (fiber).
+      #
+      # A scoped mongo-direct request reads the schema several times: the
+      # protected-field reference scanner, the CLP row gate, the join gate,
+      # and the protected-field strip. Each read used to consult the shared
+      # cache on its own, so a TTL expiry and refetch between two reads
+      # could give the scanner one schema and the gate another (an
+      # unresolvable scan with an empty protected set, then a successful
+      # gate). Inside this block every read for a class sees one entry, so
+      # the decisions agree. Nested calls reuse the outer snapshot.
+      #
+      # @yield the request whose schema reads should agree.
+      # @return [Object] the block's value.
+      def with_snapshot
+        return yield if Thread.current[SNAPSHOT_KEY]
+        Thread.current[SNAPSHOT_KEY] = {}
+        begin
+          yield
+        ensure
+          Thread.current[SNAPSHOT_KEY] = nil
+        end
+      end
+
       private
 
       # Collect one field set per protectedFields group that applies to the
@@ -606,6 +647,16 @@ module Parse
         resolved_client = client || schema_client || default_client_safe
         key = cache_key(class_key, resolved_client)
 
+        snapshot = Thread.current[SNAPSHOT_KEY]
+        return snapshot[key] if snapshot&.key?(key)
+        entry = fetch_entry(class_key, resolved_client, key)
+        snapshot[key] = entry if snapshot
+        entry
+      end
+
+      # Resolve the cached or freshly fetched entry for one cache key.
+      # @!visibility private
+      def fetch_entry(class_key, resolved_client, key)
         cached = @cache_mutex.synchronize { @cache[key] }
         return cached if cached && !stale?(cached)
 

data/lib/parse/embeddings/cache.rb

@@ -110,8 +110,9 @@ module Parse
       # MITM, and the cache key is derived from (often user-supplied)
       # embedded text. `MonetaStore` JSON-(de)serializes values itself, but
       # that only closes the vector IF Moneta is not also Marshaling on top;
-      # `value_serializer: nil` ensures it is not. `MonetaStore` emits a
-      # one-time warning if it is handed a Marshal-serializing store.
+      # `value_serializer: nil` ensures it is not. `MonetaStore` raises
+      # ArgumentError if it is handed a Marshal-serializing store over an
+      # external backend, unless constructed with `allow_marshal: true`.
       # TTL is forwarded via Moneta's `expires:` option when the
       # backend supports it, ignored otherwise.
       #
@@ -130,18 +131,29 @@ module Parse
         #   forwarded as `expires:` when the backend supports
         #   `store(key, value, expires:)`. nil = no expiry.
         # @param namespace [String] key prefix.
-        def initialize(moneta, ttl: nil, namespace: "emb:")
+        # @param allow_marshal [Boolean] accept a store that deserializes
+        #   values with Marshal over a backend outside this process. Logs a
+        #   security warning. Default false.
+        # @raise [ArgumentError] when the store deserializes values with
+        #   Marshal over an external backend and `allow_marshal` is not set.
+        def initialize(moneta, ttl: nil, namespace: "emb:", allow_marshal: false)
           unless moneta.respond_to?(:[]) && moneta.respond_to?(:[]=)
             raise ArgumentError,
                   "Parse::Embeddings::Cache::MonetaStore expects a Moneta-compatible " \
                   "store responding to #[] and #[]= (got #{moneta.class})."
           end
           if marshaling_value_store?(moneta)
-            warn "[Parse::Embeddings::Cache::MonetaStore] SECURITY: the supplied Moneta " \
-                 "store deserializes values with Marshal. A cache read Marshal.loads bytes " \
-                 "from the backing store, which is a remote-code-execution vector when the " \
-                 "store is shared/untrusted. Rebuild it with value_serializer: nil, e.g. " \
-                 "Moneta.new(:Redis, url: ..., value_serializer: nil)."
+            unless allow_marshal
+              raise ArgumentError,
+                    "Parse::Embeddings::Cache::MonetaStore: the supplied Moneta store " \
+                    "deserializes values with Marshal, which allows code execution by anyone " \
+                    "able to write to the backing store. Rebuild it with value_serializer: nil, " \
+                    "e.g. Moneta.new(:Redis, url: ..., value_serializer: nil), or pass " \
+                    "allow_marshal: true to accept the risk."
+            end
+            warn "[Parse::Embeddings::Cache::MonetaStore] SECURITY: allow_marshal: true accepts " \
+                 "a Moneta store that deserializes values with Marshal. Anyone able to write to " \
+                 "the backing store can execute code in this process."
           end
           @moneta = moneta
           @ttl = ttl && Float(ttl)
@@ -204,8 +216,16 @@ module Parse
         # Marshal. Moneta names its transformer proxy after the active
         # serializers (e.g. "...MarshalValue"); a store built with
         # value_serializer: nil has no "...Value" segment. Used only to warn.
+        # Shares the detection {Parse::Client} applies to its :cache option:
+        # a Marshal value transformer anywhere in the proxy chain over a
+        # backend outside this process. In-process stores (`:Memory`,
+        # `:LRUHash`, `:Null`) only hold values this process wrote.
         def marshaling_value_store?(moneta)
-          moneta.class.name.to_s.include?("MarshalValue")
+          if defined?(Parse::Client) && Parse::Client.respond_to?(:marshal_value_cache?)
+            Parse::Client.marshal_value_cache?(moneta)
+          else
+            moneta.class.name.to_s.include?("MarshalValue")
+          end
         rescue StandardError
           false
         end

data/lib/parse/graphql/type_generator.rb

@@ -1,6 +1,8 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
+require_relative "../pipeline_security"
+
 module Parse
   module GraphQL
     # Generates `GraphQL::Schema::Object` subclasses from Parse::Object
@@ -15,6 +17,47 @@ module Parse
     # Pagination arguments, Loaders, and Relay connections are deferred
     # until query/mutation passthrough lands (TODO §7).
     #
+    # == Schema shape, not an authorization layer
+    #
+    # The generated types describe the shape of a Parse class. They do not
+    # authorize anything. Default graphql-ruby resolution reads whatever is
+    # on the object handed to the resolver, so the resolvers (or the objects
+    # passed to them) must enforce ACL, CLP, and protectedFields for the
+    # requesting user. The usual way is to resolve through queries run with
+    # that user's session token, so Parse Server applies its own checks.
+    # Omitting a field from a type does not stop a resolver from loading or
+    # returning it through another path.
+    #
+    # == Field policy
+    #
+    # Output is deterministic: the same model and the same options always
+    # produce the same fields. Without `protected_fields: :fetch`, no CLP
+    # cache or ambient state is consulted.
+    #
+    # * Credential denylist (always on). Session tokens, auth data,
+    #   passwords, device tokens, and every column in
+    #   {Parse::PipelineSecurity::INTERNAL_FIELDS_DENYLIST} (see
+    #   {SENSITIVE_FIELD_NAMES}) are dropped, matched by local accessor or
+    #   wire name. The denylist only keeps known credential columns out; it
+    #   is not a substitute for protectedFields.
+    # * `exclude_fields:` drops caller-listed fields.
+    # * `protected_fields:` applies the class's public (`"*"`)
+    #   protectedFields, only when supplied or explicitly fetched. With the
+    #   default (`nil`) no protectedFields lookup happens at all, so a field
+    #   such as `_User.email` is emitted unless it is excluded or supplied
+    #   here. Pass a Hash (`{ "ClassName" => [:field, ...] }`) to supply the
+    #   lists, or `:fetch` to load each class's CLP from the server through
+    #   `Parse::CLPScope.protected_fields_for` (a schema request per class,
+    #   which includes `Parse::CLPScope.default_protected_fields`). A failed
+    #   fetch raises {ProtectedFieldsUnavailable}.
+    # * `include_sensitive:` emits a field the denylist or protectedFields
+    #   would drop. `exclude_fields:` still wins over it.
+    #
+    # has_many fields are emitted as plain unpaginated lists (`[Type]`), and
+    # nested selections are not bounded here. A schema built from these
+    # types should set `max_depth` and `max_complexity` (graphql-ruby schema
+    # class methods) so a single query cannot walk an unbounded object graph.
+    #
     # Cross-class references (pointers, has_many) require all referenced
     # model types to be in the registry BEFORE field emission. Use
     # `generate_all` to codegen a list of models in one call (two-pass:
@@ -57,14 +100,53 @@ module Parse
       # `id: ID` field separately.
       OMITTED_TYPES = %i[acl].freeze
 
+      # Credential field names that are never emitted, whatever their
+      # declared type. Compared against both the local accessor and the
+      # Parse wire name. Columns starting with `_auth_data_` are also
+      # dropped.
+      SENSITIVE_FIELD_NAMES = (
+        %w[session_token sessionToken auth_data authData password
+           device_token deviceToken] +
+        Parse::PipelineSecurity::INTERNAL_FIELDS_DENYLIST
+      ).to_set.freeze
+
+      # Prefixes of credential columns that are never emitted.
+      SENSITIVE_FIELD_PREFIXES = Parse::PipelineSecurity::INTERNAL_FIELDS_PREFIX_DENYLIST
+
+      # Raised when `protected_fields: :fetch` was requested and a class's
+      # CLP could not be loaded. The generator refuses to emit the type
+      # rather than emit fields the caller asked to have filtered.
+      class ProtectedFieldsUnavailable < StandardError; end
+
       # Generate types for a list of models in one call. Two-pass:
       # creates empty stub classes for every model first so cross-class
       # references resolve regardless of declaration order.
       #
+      # The result is a schema shape, not an authorization layer: resolvers
+      # must enforce ACL, CLP, and protectedFields for the requesting user
+      # (for example by resolving through queries run with that user's
+      # session token). has_many fields are unpaginated lists, so set
+      # `max_depth` and `max_complexity` on the schema.
+      #
       # @param model_classes [Array<Class>] Parse::Object subclasses.
+      # @param include_sensitive [Array<Symbol, String>] fields to emit even
+      #   though they are in {SENSITIVE_FIELD_NAMES} or the class's public
+      #   protectedFields. Matched by local accessor or wire name.
+      # @param exclude_fields [Array<Symbol, String>, Hash] fields never to
+      #   emit. An Array applies to every class; a Hash maps a Parse class
+      #   name or model class to that class's Array. Matched by local
+      #   accessor or wire name, and applied even over `include_sensitive:`.
+      # @param protected_fields [nil, :fetch, Hash] source of each class's
+      #   public protectedFields. `nil` (default) performs no lookup.
+      #   `:fetch` loads each class's CLP from the server and raises
+      #   {ProtectedFieldsUnavailable} when it cannot. A Hash maps a Parse
+      #   class name or model class to its protected field list.
       # @return [Hash{String => Class}] registry of generated types
       #   keyed by Parse class name.
-      def self.generate_all(model_classes)
+      # @raise [ProtectedFieldsUnavailable] when `protected_fields: :fetch`
+      #   cannot load a class's CLP.
+      def self.generate_all(model_classes, include_sensitive: [], exclude_fields: [], protected_fields: nil)
+        validate_protected_fields_option!(protected_fields)
         registry = {}
         # Pass 1: stub classes registered by parse_class name.
         model_classes.each do |model|
@@ -73,7 +155,10 @@ module Parse
         end
         # Pass 2: populate fields. Cross-references now resolve.
         model_classes.each do |model|
-          new(model, registry: registry, _prebuilt: registry[model.parse_class]).populate_fields
+          new(model, registry: registry, _prebuilt: registry[model.parse_class],
+                     include_sensitive: include_sensitive,
+                     exclude_fields: exclude_fields,
+                     protected_fields: protected_fields).populate_fields
         end
         detect_name_collisions!(registry)
         registry
@@ -101,17 +186,45 @@ module Parse
       # in the registry — otherwise an error is raised at field-emit
       # time. Prefer `generate_all` when you have a graph of models.
       #
+      # The result is a schema shape, not an authorization layer; see
+      # {generate_all}.
+      #
       # @param model_class [Class] a Parse::Object subclass.
       # @param registry [Hash, nil] shared registry; mutated in place.
+      # @param include_sensitive [Array<Symbol, String>] see {generate_all}.
+      # @param exclude_fields [Array<Symbol, String>, Hash] see {generate_all}.
+      # @param protected_fields [nil, :fetch, Hash] see {generate_all}.
       # @return [Class] anonymous `GraphQL::Schema::Object` subclass.
-      def self.generate(model_class, registry: nil)
+      # @raise [ProtectedFieldsUnavailable] see {generate_all}.
+      def self.generate(model_class, registry: nil, include_sensitive: [], exclude_fields: [], protected_fields: nil)
         validate!(model_class)
+        validate_protected_fields_option!(protected_fields)
         registry ||= {}
         stub = registry[model_class.parse_class] ||= build_stub(model_class)
-        new(model_class, registry: registry, _prebuilt: stub).populate_fields
+        new(model_class, registry: registry, _prebuilt: stub,
+                         include_sensitive: include_sensitive,
+                         exclude_fields: exclude_fields,
+                         protected_fields: protected_fields).populate_fields
         stub
       end
 
+      def self.validate_protected_fields_option!(value)
+        return if value.nil? || value == :fetch || value.is_a?(Hash)
+        raise ArgumentError,
+              "Parse::GraphQL::TypeGenerator: protected_fields: must be nil, :fetch, " \
+              "or a Hash of class name => field list, got #{value.inspect}"
+      end
+
+      # Look up a per-class option keyed by Parse class name (String or
+      # Symbol) or by the model class itself.
+      def self.per_class_value(map, model_class)
+        name = model_class.parse_class
+        [name, name.to_sym, model_class].each do |key|
+          return map[key] if map.key?(key)
+        end
+        nil
+      end
+
       def self.validate!(model_class)
         unless model_class.is_a?(Class) && model_class < Parse::Object
           raise ArgumentError,
@@ -128,10 +241,15 @@ module Parse
         end
       end
 
-      def initialize(model_class, registry:, _prebuilt:)
+      def initialize(model_class, registry:, _prebuilt:, include_sensitive: [],
+                     exclude_fields: [], protected_fields: nil)
         @model_class = model_class
         @registry = registry
         @klass = _prebuilt
+        @include_sensitive = Array(include_sensitive).map(&:to_s).to_set
+        excluded = exclude_fields.is_a?(Hash) ? self.class.per_class_value(exclude_fields, model_class) : exclude_fields
+        @exclude_fields = Array(excluded).map(&:to_s).to_set
+        @protected_fields_option = protected_fields
       end
 
       def populate_fields
@@ -153,6 +271,7 @@ module Parse
 
         @model_class.field_map.each do |local_key, _remote_field|
           next if skip_keys.include?(local_key)
+          next if withheld?(local_key)
           parse_type = @model_class.fields[local_key]
           next if parse_type.nil?
           next if OMITTED_TYPES.include?(parse_type)
@@ -176,6 +295,7 @@ module Parse
       def emit_belongs_to_fields
         @model_class.references.each do |parse_field, target_class_name|
           accessor = field_to_accessor(parse_field)
+          next if withheld?(accessor)
           target = registry_lookup!(target_class_name)
           @klass.field(accessor, target, null: true)
         end
@@ -184,6 +304,7 @@ module Parse
       def emit_has_one_fields
         return unless @model_class.respond_to?(:has_one_associations)
         @model_class.has_one_associations.each do |name, meta|
+          next if withheld?(name)
           target = registry_lookup!(meta[:target_class])
           @klass.field(name, target, null: true)
         end
@@ -192,6 +313,7 @@ module Parse
       def emit_has_many_fields
         return unless @model_class.respond_to?(:has_many_associations)
         @model_class.has_many_associations.each do |name, meta|
+          next if withheld?(name)
           target = registry_lookup!(meta[:target_class])
           @klass.field(name, [target], null: true)
         end
@@ -218,6 +340,63 @@ module Parse
         end
       end
 
+      # True when a field must not be emitted. Order: an explicit
+      # `exclude_fields:` entry always drops the field; `include_sensitive:`
+      # then keeps it; otherwise a credential name or a public protectedField
+      # from the `protected_fields:` source drops it.
+      def withheld?(local_key)
+        local = local_key.to_s
+        remote = (@model_class.field_map[local_key.to_sym] || local).to_s
+        names = [local, remote]
+        return true if names.any? { |n| @exclude_fields.include?(n) }
+        return false if names.any? { |n| @include_sensitive.include?(n) }
+        return true if names.any? { |n| sensitive_name?(n) }
+        names.any? { |n| public_protected_fields.include?(n) }
+      end
+
+      def sensitive_name?(name)
+        SENSITIVE_FIELD_NAMES.include?(name) ||
+          SENSITIVE_FIELD_PREFIXES.any? { |prefix| name.start_with?(prefix) }
+      end
+
+      # Public protectedFields for this class from the explicit
+      # `protected_fields:` source. `nil` performs no lookup, a Hash supplies
+      # the list, and `:fetch` loads the CLP from the server.
+      def public_protected_fields
+        return @public_protected_fields if defined?(@public_protected_fields)
+        list = case @protected_fields_option
+               when nil then []
+               when :fetch then fetch_public_protected_fields
+               when Hash then self.class.per_class_value(@protected_fields_option, @model_class)
+               end
+        @public_protected_fields = Array(list).map(&:to_s).to_set
+      end
+
+      # Loads the class's CLP through Parse::CLPScope, which the caller opted
+      # into with `protected_fields: :fetch`. Parse::CLPScope records a failed
+      # schema request as unresolvable and reports an empty protected set for
+      # it, so resolvability is checked first and a failure raises instead of
+      # emitting every field.
+      def fetch_public_protected_fields
+        class_name = @model_class.parse_class
+        evaluation = Parse::CLPScope.evaluate_access(class_name, :get, claims: ["*"], authenticated: false)
+        if evaluation.reason == :clp_unresolvable
+          raise ProtectedFieldsUnavailable,
+                "Parse::GraphQL::TypeGenerator: could not load the CLP for #{class_name} " \
+                "(protected_fields: :fetch). Check the schema request, or supply " \
+                "protected_fields: as a Hash."
+        end
+        # strict: an entry that expires and fails to refetch after the check
+        # above raises instead of reading as "nothing protected".
+        Parse::CLPScope.protected_fields_for(class_name, ["*"], strict: true)
+      rescue ProtectedFieldsUnavailable
+        raise
+      rescue StandardError => e
+        raise ProtectedFieldsUnavailable,
+              "Parse::GraphQL::TypeGenerator: could not load protectedFields for " \
+              "#{class_name} (protected_fields: :fetch): #{e.class}: #{e.message}"
+      end
+
       def registry_lookup!(target_class_name)
         target = @registry[target_class_name]
         if target.nil?