parse-stack-next 5.4.0 → 5.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3568759074455238e0addc957d2b46db3616a26057eb4d1fdd8ec70c1be577c7
-  data.tar.gz: c31228426dfa4dbbcb49ab5df47662104e1d91100e2a92040f699ce92b09db7a
+  metadata.gz: 842a9a2d8d24afbb8e0444d995ea6c1d8707ec5fc2c9a40405d40f71b46495b8
+  data.tar.gz: 8e54c583a6bf251818144b2ae6e1589197b4b0153093e0dd36048798a696346a
 SHA512:
-  metadata.gz: 54e3ecd41d651aa918809f247799e00edcb79ad5da331ad2b33f669b3bdb989b727b4cb3cf39f8e1150c9778ca4326084cc7d8c31994ab0c2e5c04b82247833a
-  data.tar.gz: fbb24fcacd678d5ad060d4e1ce772c646aed2ff61bcaaa232be42903eee416965cd06b9eab7b4f2f68b1980272ed059fd4e216e78c8896b77741bdf1d3377d69
+  metadata.gz: 264a5574513616b8cb9ebe662c9e1109746d688c191affe3faefd11f20b0911039f09e895e535874e8715ddf5f53b30e863f6cdc5fa54f4cafabe2f5044398db
+  data.tar.gz: d61b36d12ef78eb05b701ff1e45858c7dc2f911bd548d912db9e061fe9027fed86c3b2b2808f2a89cbeb5115c603fd279425ccec2d184f567b9ef00f8eb901af

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## parse-stack-next Changelog
 
+### 5.4.1
+
+#### Webhook after_save callback fix
+
+- **FIXED**: an `afterSave` webhook handler that returns a `Parse::Object`
+  (instead of `true` or `nil`) no longer suppresses the model's `after_create`
+  and `after_save` callbacks on client-initiated saves. Parse Server discards
+  the `afterSave` response body entirely — it resolves the request as a success
+  even when the handler raises — so the handler's return value must not gate
+  callback dispatch. The decision now depends only on the request origin: a
+  trusted Ruby-initiated save still skips the webhook-side callbacks (the local
+  `run_callbacks :save` fires them, avoiding a double-run), while a
+  client-initiated save always fires them. Returning the object — the
+  recommended `beforeSave` pattern, easy to copy into an `afterSave` by mistake
+  — previously skipped an `after_save :send_email` and similar side effects
+  silently. The result is also normalized to `true`, so a returned object can
+  no longer leak into the response body or the debug log.
+
 ### 5.4.0
 
 #### Parse Server 8.x / 9.x compatibility fixes

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    parse-stack-next (5.4.0)
+    parse-stack-next (5.4.1)
       activemodel (>= 6.1, < 9)
       activesupport (>= 6.1, < 9)
       connection_pool (>= 2.2, < 4)

data/lib/parse/stack/version.rb

@@ -6,6 +6,6 @@ module Parse
   # The Parse Server SDK for Ruby
   module Stack
     # The current version.
-    VERSION = "5.4.0"
+    VERSION = "5.4.1"
   end
 end

data/lib/parse/webhooks.rb

@@ -454,7 +454,7 @@ module Parse
           end
         end
 
-        if type == :after_save && (result == true || result.nil?) && payload&.parse_object.present? && payload.parse_object.is_a?(Parse::Object)
+        if type == :after_save && payload&.parse_object.present? && payload.parse_object.is_a?(Parse::Object)
           # Handle after_save callbacks intelligently based on request origin.
           # For trusted-Ruby-initiated saves (both `_RB_` header AND master
           # key), Parse Stack's local `run_callbacks :save` will fire
@@ -464,6 +464,14 @@ module Parse
           # per save). For everything else -- client-initiated saves, or a
           # spoofed `_RB_` from a non-master client -- Parse Stack never had
           # a chance to run callbacks, so we fire them here.
+          #
+          # The decision depends ONLY on request origin, never on what the
+          # handler returned. Parse Server discards the afterSave response
+          # body entirely (it resolves {success} even if the handler throws),
+          # so a handler that returns the parse_object -- the recommended
+          # before_save pattern, easy to copy by mistake -- must NOT silently
+          # suppress these callbacks. We normalize the result to `true` below
+          # so a returned object never leaks into the response or the log.
           is_new = payload.original.nil?
           unless trusted_ruby_initiated
             payload.parse_object.run_after_create_callbacks if is_new

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.4.0
+  version: 5.4.1
 platform: ruby
 authors:
 - Adrian Curtin