@90soft/parse-server-kit 2.0.0 → 2.0.1

package/README.md

@@ -0,0 +1,424 @@
+# @90soft/parse-server-kit
+
+Decorator-driven development kit for Parse Server. Write models and cloud functions with TypeScript decorators — no boilerplate.
+
+## Install
+
+```bash
+npm install @90soft/parse-server-kit
+```
+
+Peer dependencies: `parse`, `reflect-metadata`, `express`
+Optional: `node-cron` (for @Cron), `swagger-ui-express` (for Swagger)
+
+---
+
+## Quick Start
+
+### 1. Define a Model
+
+```ts
+import { ParseClass, ParseField, BaseModel } from '@90soft/parse-server-kit';
+import { UserRoles, roleKey } from '@90soft/parse-server-kit';
+
+@ParseClass('Product', {
+  clp: {
+    find:   { [roleKey(UserRoles.ADMIN)]: true, [roleKey(UserRoles.EMPLOYEE)]: true },
+    get:    { [roleKey(UserRoles.ADMIN)]: true, [roleKey(UserRoles.EMPLOYEE)]: true },
+    create: { [roleKey(UserRoles.ADMIN)]: true, [roleKey(UserRoles.EMPLOYEE)]: true },
+    update: { [roleKey(UserRoles.ADMIN)]: true, [roleKey(UserRoles.EMPLOYEE)]: true },
+    delete: { [roleKey(UserRoles.ADMIN)]: true },
+    count:  { [roleKey(UserRoles.ADMIN)]: true, [roleKey(UserRoles.EMPLOYEE)]: true },
+  },
+})
+export default class Product extends BaseModel {
+  @ParseField({ type: 'String', required: true })
+  name!: string;
+
+  @ParseField({ type: 'Number', required: true, min: 0 })
+  price!: number;
+
+  @ParseField({ type: 'String', enum: ['active', 'draft', 'archived'] })
+  status!: string;
+
+  @ParseField({ type: 'Pointer', targetClass: 'Category', required: true })
+  category!: any;
+
+  @ParseField({ type: 'Boolean' })
+  available!: boolean;
+
+  @ParseField({ type: 'Date' })
+  createdDate!: Date;
+}
+```
+
+### 2. Write Cloud Functions
+
+```ts
+import { CloudFunction, Route, catchError, UserRoles } from '@90soft/parse-server-kit';
+import Product from '../../models/Product';
+import User from '../../models/User';
+
+@Route(Product) // → /api/products/create, /api/products/list, etc.
+class ProductFunctions {
+
+  @CloudFunction({
+    methods: ['POST'],
+    validation: { requireUser: true, fields: { name: { required: true } } },
+  })
+  static async createProduct(req: Parse.Cloud.FunctionRequest) {
+    const user = req.user! as User;
+    const product = Product.fromParams(req.params);
+    const [err, saved] = await catchError(
+      product.save(null, { sessionToken: user.getSessionToken() })
+    );
+    if (err) throw err;
+    return saved;
+  }
+
+  @CloudFunction({
+    methods: ['GET'],
+    validation: { requireUser: true, fields: { skip: { type: String }, limit: { type: String } } },
+  })
+  static async listProducts(req: Parse.Cloud.FunctionRequest) {
+    const query = new Parse.Query(Product);
+    query.include('category');
+    const skip = Number(req.params.skip) || 0;
+    const limit = Number(req.params.limit) || 10;
+    query.skip(skip).limit(limit);
+
+    if (req.params.search) {
+      const search = req.params.search;
+      query.matches('name', new RegExp(search, 'i'));
+    }
+
+    const [err, results] = await catchError(query.find({ sessionToken: req.user!.getSessionToken() }));
+    if (err) throw err;
+
+    const [countErr, count] = await catchError(query.count({ sessionToken: req.user!.getSessionToken() }));
+    return { results, count: countErr ? 0 : count };
+  }
+
+  @CloudFunction({
+    methods: ['POST'],
+    validation: { requireUser: true, fields: { id: { required: true } } },
+  })
+  static async getProduct(req: Parse.Cloud.FunctionRequest) {
+    const query = new Parse.Query(Product);
+    query.include('category');
+    const [err, product] = await catchError(query.get(req.params.id, { sessionToken: req.user!.getSessionToken() }));
+    if (err) throw err;
+    return product;
+  }
+
+  @CloudFunction({
+    methods: ['POST'],
+    validation: { requireUser: true, fields: { id: { required: true } } },
+  })
+  static async updateProduct(req: Parse.Cloud.FunctionRequest) {
+    const user = req.user! as User;
+    const product = Product.fromParams(req.params);
+    const [err, saved] = await catchError(
+      product.save(null, { sessionToken: user.getSessionToken() })
+    );
+    if (err) throw err;
+    return saved;
+  }
+
+  @CloudFunction({
+    methods: ['POST'],
+    validation: { requireUser: true, fields: { id: { required: true } } },
+  })
+  static async deleteProduct(req: Parse.Cloud.FunctionRequest) {
+    const query = new Parse.Query(Product);
+    const [err, product] = await catchError(query.get(req.params.id, { useMasterKey: true }));
+    if (err) throw err;
+    const [delErr] = await catchError(product!.destroy({ useMasterKey: true }));
+    if (delErr) throw delErr;
+    return { success: true };
+  }
+}
+```
+
+### 3. Add Triggers
+
+```ts
+import { ParseClass, ParseField, BaseModel, BeforeSave, AfterDelete } from '@90soft/parse-server-kit';
+
+@ParseClass('Product', { /* clp... */ })
+export default class Product extends BaseModel {
+  @ParseField({ type: 'String', required: true })
+  name!: string;
+
+  @BeforeSave()
+  static async onBeforeSave(req: Parse.Cloud.BeforeSaveRequest<Product>) {
+    // Validate or modify before saving
+    if (!req.object.get('name')) {
+      throw new Parse.Error(142, 'Name is required');
+    }
+  }
+
+  @AfterDelete()
+  static async onAfterDelete(req: Parse.Cloud.AfterDeleteRequest<Product>) {
+    // Cleanup after deletion
+    console.log(`Product ${req.object.id} deleted`);
+  }
+}
+```
+
+### 4. Add Cron Jobs
+
+```ts
+import { Cron, CronSchedule } from '@90soft/parse-server-kit';
+
+class MyCronJobs {
+  @Cron({ schedule: CronSchedule.DAILY_MIDNIGHT, description: 'Cleanup expired sessions' })
+  static async cleanupSessions() {
+    // job logic
+  }
+
+  @Cron({ schedule: '*/30 * * * *', description: 'Sync data every 30 minutes' })
+  static async syncData() {
+    // job logic
+  }
+}
+```
+
+### 5. Server Setup (app.ts)
+
+```ts
+import express from 'express';
+import {
+  CloudFunctionRegistry, TriggerRegistry, CronRegistry,
+  importFiles, catchError, applyMongoValidators,
+  validateEntityRoutes, restrictRoutes, removeResultMiddleware,
+  conditionalJsonMiddleware, setupSwagger,
+} from '@90soft/parse-server-kit';
+
+const app = express();
+
+// 1. Load models (must be before Parse Server init)
+importFiles(join(__dirname, 'cloudCode/models'));
+
+// 2. Init Parse Server
+const parseServer = await initializeParseServer();
+
+// 3. Middleware
+app.use(removeResultMiddleware);
+app.use(cors());
+app.use(process.env.mountPath, validateEntityRoutes);
+app.use(conditionalJsonMiddleware);
+app.use(process.env.mountPath, restrictRoutes);
+
+// 4. Mount Parse Server
+app.use(process.env.mountPath, parseServer.app);
+
+// 5. Initialize registries (after Parse Server mount)
+CloudFunctionRegistry.initialize();  // also initializes RouteRegistry
+TriggerRegistry.initialize();
+CronRegistry.initialize();
+
+// 6. Swagger docs
+setupSwagger(app, { title: 'My API', version: '1.0.0' });
+
+// 7. Start server
+server.listen(1337);
+```
+
+---
+
+## API Reference
+
+### Decorators
+
+| Decorator | Target | Description |
+|---|---|---|
+| `@ParseClass(name, options)` | Class | Registers a Parse model with CLP, ACL, indexes |
+| `@ParseField(options)` | Property | Defines a field with type, validation, index |
+| `@CloudFunction(config)` | Static method | Registers a cloud function with HTTP method, validation, roles |
+| `@ProtectedCloudFunction(config)` | Static method | Same as @CloudFunction but requires auth by default |
+| `@Route(ModelOrString)` | Class | Maps cloud functions to `/api/{entity}/{action}` routes |
+| `@Cron(config)` | Static method | Registers a cron job with schedule |
+| `@BeforeSave(config?)` | Static method | Before save trigger |
+| `@AfterSave(config?)` | Static method | After save trigger |
+| `@BeforeDelete(config?)` | Static method | Before delete trigger |
+| `@AfterDelete(config?)` | Static method | After delete trigger |
+| `@BeforeFind(config?)` | Static method | Before find trigger |
+| `@AfterFind(config?)` | Static method | After find trigger |
+| `@BeforeLogin(config?)` | Static method | Before login trigger |
+| `@AfterLogin(config?)` | Static method | After login trigger |
+| `@AfterLogout(config?)` | Static method | After logout trigger |
+
+### @ParseField Options
+
+| Option | Type | Description |
+|---|---|---|
+| `type` | `'String' \| 'Number' \| 'Boolean' \| 'Date' \| 'Pointer' \| 'Array' \| ...` | Field type |
+| `required` | `boolean` | Whether the field is required |
+| `targetClass` | `string` | Target class for Pointer/Relation |
+| `index` | `boolean \| 1 \| -1` | Create an index |
+| `unique` | `boolean` | Create a unique index |
+| `min` / `max` | `number` | Number range validation |
+| `minLength` / `maxLength` | `number` | String length validation |
+| `enum` | `string[]` | Allowed values for String fields |
+| `pattern` | `string` | Regex pattern for String fields |
+| `description` | `string` | Swagger documentation |
+
+### @Route
+
+```ts
+// Import model class — auto-generates route from className
+@Route(Product)  // → /api/products/*
+
+// Custom string — full control over route prefix
+@Route('menu-items')  // → /api/menu-items/*
+```
+
+Routes are automatically mapped:
+```
+createProduct  → POST /api/products/create
+getProduct     → POST /api/products/get
+listProducts   → GET  /api/products/list
+updateProduct  → POST /api/products/update
+deleteProduct  → POST /api/products/delete
+```
+
+### BaseModel
+
+```ts
+// Create from request params (auto-maps fields, handles pointers)
+const product = Product.fromParams(req.params);
+
+// Create a pointer reference by ID
+const category = Category.pointer('abc123');
+
+// Override excluded pointer classes (default: ['IMG', 'File'])
+class MyModel extends BaseModel {
+  protected static EXCLUDED_POINTER_CLASSES = ['IMG', 'File', 'CustomFile'];
+}
+```
+
+### ACL
+
+```ts
+import { implementACL, UserRoles } from '@90soft/parse-server-kit';
+
+obj.setACL(implementACL({
+  roleRules: [
+    { role: UserRoles.ADMIN, read: true, write: true },
+    { role: UserRoles.EMPLOYEE, read: true },
+  ],
+  owner: [
+    { user: userId, read: true, write: true },
+  ],
+}));
+```
+
+### Utilities
+
+```ts
+import {
+  catchError,          // Wraps promises: const [err, data] = await catchError(promise)
+  getUserRoles,        // Get role names for a user
+  getUsersRoles,       // Batch get roles for multiple users
+  importFiles,         // Auto-import all .js files in a directory
+  generateRandomPassword,
+  generateRandomString,
+  sleep,
+  formatCount,
+} from '@90soft/parse-server-kit';
+```
+
+### Middleware
+
+```ts
+import {
+  validateEntityRoutes,       // Maps /api/{entity}/{action} → cloud functions
+  restrictRoutes,             // Blocks /classes, /schemas, etc.
+  removeResultMiddleware,     // Unwraps Parse {result: ...} wrapper
+  conditionalJsonMiddleware,  // JSON parsing with master key extraction
+  validateFunctionRoutes,     // Legacy /functions/* validation
+} from '@90soft/parse-server-kit';
+```
+
+### Swagger
+
+```ts
+import { setupSwagger, SwaggerRegistry } from '@90soft/parse-server-kit';
+
+// Auto-generates API docs from @ParseClass and @CloudFunction metadata
+setupSwagger(app, {
+  title: 'My API',
+  version: '1.0.0',
+  description: 'Auto-generated docs',
+});
+// Access at: http://localhost:1337/api-docs
+```
+
+### Hooks (for integrations)
+
+```ts
+import { onClassRegistered, onFieldRegistered, onFunctionRegistered } from '@90soft/parse-server-kit';
+
+// Runs when @ParseClass is applied
+onClassRegistered((className, constructor, fields, options) => {
+  // Register with Swagger, setup triggers, etc.
+});
+
+// Runs when @CloudFunction is applied
+onFunctionRegistered((name, config, target) => {
+  // Register with Swagger docs
+});
+```
+
+### Constants
+
+```ts
+import { UserRoles, roleKey, MAX_QUERY_LIMIT, CronSchedule } from '@90soft/parse-server-kit';
+
+UserRoles.ADMIN      // 'SuperAdmin'
+UserRoles.EMPLOYEE   // 'Employee'
+roleKey(UserRoles.ADMIN)  // 'role:SuperAdmin'
+MAX_QUERY_LIMIT      // 10000
+
+CronSchedule.EVERY_HOUR      // '0 * * * *'
+CronSchedule.DAILY_MIDNIGHT  // '0 0 * * *'
+CronSchedule.WEEKLY_MONDAY   // '0 0 * * 1'
+```
+
+### Validation
+
+```ts
+import { validateObject, validateOrThrow, applyMongoValidators } from '@90soft/parse-server-kit';
+
+// Validate against @ParseField constraints (min, max, enum, pattern, etc.)
+const result = validateObject(parseObject);
+// { valid: false, errors: [{ field: 'price', message: 'must be at least 0' }] }
+
+// Throw Parse.Error if invalid (use in BeforeSave triggers)
+validateOrThrow(parseObject);
+
+// Apply MongoDB schema validators from decorator metadata
+await applyMongoValidators(parseServerInstance);
+```
+
+---
+
+## File Structure Convention
+
+```
+backend/src/cloudCode/
+  ├── models/
+  │   └── Product.ts              ← @ParseClass + @ParseField + triggers
+  ├── modules/
+  │   └── Product/
+  │       └── functions.ts        ← @Route + @CloudFunction
+  ├── cron.ts                     ← @Cron jobs
+  ├── main.ts                     ← importFiles for models + modules
+  └── decorator/
+      └── setupHooks.ts           ← connects package hooks to Swagger + Triggers
+```
+
+## License
+
+MIT

package/dist/middleware/middleware.d.ts

@@ -1,36 +1,41 @@
 import express, { NextFunction, Request, Response } from 'express';
 /**
- * Validates cloud function routes — supports both entity routes and legacy /functions routes.
- *
- * Entity routes:  /api/students/create → resolves to 'createStudent'
- * Legacy routes:  /api/functions/createStudent → resolves directly
- *
- * Converts all requests to POST for Parse Server internal handling.
+ * Validates legacy /functions/* routes.
+ * Skips if already handled by validateEntityRoutes.
  */
 export declare function validateFunctionRoutes(req: Request, res: Response, next: NextFunction): void | express.Response<any, Record<string, any>>;
 /**
  * Validates entity-based routes: /api/{entity}/{action}
- * Resolves the route to a cloud function name and rewrites the URL
- * to /functions/{functionName} so Parse Server can handle it.
+ * Resolves to a cloud function name and rewrites the URL for Parse Server.
+ *
+ * Flow:
+ *   1. Skip CORS preflight (OPTIONS)
+ *   2. Skip non-entity routes (pass to next middleware)
+ *   3. Resolve route → cloud function name
+ *   4. Validate HTTP method
+ *   5. Rewrite URL to /functions/{name} with query string preserved
+ *   6. Merge GET query params into body (Parse reads from body)
+ *   7. Convert to POST for Parse Server
  */
 export declare function validateEntityRoutes(req: Request, res: Response, next: NextFunction): void | express.Response<any, Record<string, any>>;
 /**
- * Extracts master key from the request body during JSON parsing
+ * Extracts master key from the request body during JSON parsing.
+ * Used as the `verify` callback in express.json().
  */
 export declare function extractMasterKey(req: any, res: Response, buf: Buffer, encoding: BufferEncoding): void;
 /**
- * Restricts access to specific routes unless master key is provided.
- * Only registered entity routes and system routes are allowed.
- * /functions is NO LONGER allowed — use entity routes instead.
+ * Restricts access to internal Parse Server endpoints.
+ * Only entity routes, system routes, and rewritten /functions routes pass through.
+ * Direct /classes, /schemas, /batch access is blocked.
  */
-export declare function restrictRoutes(req: any, res: Response, next: NextFunction): void;
+export declare function restrictRoutes(req: any, res: Response, next: NextFunction): void | express.Response<any, Record<string, any>>;
 /**
- * Conditionally applies JSON parsing middleware, skipping file routes
+ * Conditionally applies JSON parsing middleware, skipping file upload routes.
  */
 export declare function conditionalJsonMiddleware(req: Request, res: Response, next: NextFunction): void;
 /**
- * Removes the 'result' wrapper from Parse Server responses.
- * Applies to all registered entity routes (no longer just /functions).
+ * Removes the {result: ...} wrapper from Parse Server cloud function responses.
+ * Applies to entity routes and rewritten /functions routes.
  */
 export declare function removeResultMiddleware(req: any, res: any, next: any): any;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAKjE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,qDAenB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,qDAuBnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,cAAc,QAUzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,QAwBzE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,QAYnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAoBnE"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAKjE;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,qDAoBnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,qDA0CnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,cAAc,QAUzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,qDAwBzE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,QAWnB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAmBnE"}

package/dist/middleware/middleware.js

@@ -13,14 +13,14 @@ const express_1 = __importDefault(require("express"));
 const cloudRegistry_1 = require("../decorators/cloudRegistry");
 const routeDecorator_1 = require("../decorators/routeDecorator");
 /**
- * Validates cloud function routes — supports both entity routes and legacy /functions routes.
- *
- * Entity routes:  /api/students/create → resolves to 'createStudent'
- * Legacy routes:  /api/functions/createStudent → resolves directly
- *
- * Converts all requests to POST for Parse Server internal handling.
+ * Validates legacy /functions/* routes.
+ * Skips if already handled by validateEntityRoutes.
  */
 function validateFunctionRoutes(req, res, next) {
+    // Skip if already handled by entity route middleware
+    if (req._entityRouteHandled) {
+        return next();
+    }
     const functionName = req.path.split('/')[1];
     const metadata = cloudRegistry_1.CloudFunctionRegistry.getFunction(functionName);
     if (!metadata) {
@@ -29,17 +29,32 @@ function validateFunctionRoutes(req, res, next) {
     if (!metadata.config.methods.includes(req.method)) {
         return res.status(405).json({ message: 'Method not allowed' });
     }
-    req.method = 'POST'; // Convert method to POST for Parse Server
+    req.method = 'POST';
     return next();
 }
 /**
  * Validates entity-based routes: /api/{entity}/{action}
- * Resolves the route to a cloud function name and rewrites the URL
- * to /functions/{functionName} so Parse Server can handle it.
+ * Resolves to a cloud function name and rewrites the URL for Parse Server.
+ *
+ * Flow:
+ *   1. Skip CORS preflight (OPTIONS)
+ *   2. Skip non-entity routes (pass to next middleware)
+ *   3. Resolve route → cloud function name
+ *   4. Validate HTTP method
+ *   5. Rewrite URL to /functions/{name} with query string preserved
+ *   6. Merge GET query params into body (Parse reads from body)
+ *   7. Convert to POST for Parse Server
  */
 function validateEntityRoutes(req, res, next) {
-    // Build route path from URL: /students/create
     const routePath = req.path;
+    // Skip CORS preflight — let cors() middleware handle them
+    if (req.method === 'OPTIONS') {
+        return next();
+    }
+    // Only handle requests that match a registered entity prefix
+    if (!routeDecorator_1.RouteRegistry.isRegisteredPrefix(routePath)) {
+        return next();
+    }
     const functionName = routeDecorator_1.RouteRegistry.resolve(routePath);
     if (!functionName) {
         return res.status(404).json({ message: 'Route not found' });
@@ -52,12 +67,20 @@ function validateEntityRoutes(req, res, next) {
         return res.status(405).json({ message: 'Method not allowed' });
     }
     // Rewrite URL to /functions/{functionName} so Parse Server handles it
-    req.url = `/functions/${functionName}`;
-    req.method = 'POST'; // Convert method to POST for Parse Server
+    // Preserve query string for GET requests
+    const queryString = req.originalUrl.split('?')[1];
+    req.url = `/functions/${functionName}${queryString ? '?' + queryString : ''}`;
+    // Merge GET query params into body — Parse Server reads params from body
+    if (req.method === 'GET' && req.query && Object.keys(req.query).length > 0) {
+        req.body = { ...req.body, ...req.query };
+    }
+    req.method = 'POST';
+    req._entityRouteHandled = true;
     return next();
 }
 /**
- * Extracts master key from the request body during JSON parsing
+ * Extracts master key from the request body during JSON parsing.
+ * Used as the `verify` callback in express.json().
  */
 function extractMasterKey(req, res, buf, encoding) {
     try {
@@ -71,9 +94,9 @@ function extractMasterKey(req, res, buf, encoding) {
     }
 }
 /**
- * Restricts access to specific routes unless master key is provided.
- * Only registered entity routes and system routes are allowed.
- * /functions is NO LONGER allowed — use entity routes instead.
+ * Restricts access to internal Parse Server endpoints.
+ * Only entity routes, system routes, and rewritten /functions routes pass through.
+ * Direct /classes, /schemas, /batch access is blocked.
  */
 function restrictRoutes(req, res, next) {
     const systemRoutes = ['/health', '/serverInfo', '/files'];
@@ -89,18 +112,17 @@ function restrictRoutes(req, res, next) {
     if (routeDecorator_1.RouteRegistry.isRegisteredPrefix(req.path)) {
         return next();
     }
-    // Allow /functions for internal Parse Server use (rewritten by validateEntityRoutes)
+    // Allow /functions for internal use (rewritten by validateEntityRoutes)
     if (req.path.startsWith('/functions')) {
         return next();
     }
-    throw res.status(403).json({ message: 'Route not allowed' });
+    return res.status(403).json({ message: 'Route not allowed' });
 }
 /**
- * Conditionally applies JSON parsing middleware, skipping file routes
+ * Conditionally applies JSON parsing middleware, skipping file upload routes.
  */
 function conditionalJsonMiddleware(req, res, next) {
     if (req.path.startsWith(`${process.env.mountPath}/files`)) {
-        console.log('Skipping JSON middleware for /files route');
         return next();
     }
     express_1.default.json({
@@ -110,12 +132,11 @@ function conditionalJsonMiddleware(req, res, next) {
     })(req, res, next);
 }
 /**
- * Removes the 'result' wrapper from Parse Server responses.
- * Applies to all registered entity routes (no longer just /functions).
+ * Removes the {result: ...} wrapper from Parse Server cloud function responses.
+ * Applies to entity routes and rewritten /functions routes.
  */
 function removeResultMiddleware(req, res, next) {
     const mountPath = process.env.mountPath || '/api';
-    // Check if this is a registered entity route or a rewritten /functions route
     const pathAfterMount = req.path.replace(mountPath, '');
     const isEntityRoute = routeDecorator_1.RouteRegistry.isRegisteredPrefix(pathAfterMount);
     const isFunctionRoute = req.path.includes('/functions');

package/dist/middleware/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":";;;;;AAaA,wDAkBC;AAOD,oDA0BC;AAKD,4CAcC;AAOD,wCAwBC;AAKD,8DAeC;AAMD,wDAoBC;AAhKD,sDAAiE;AACjE,+DAAkE;AAClE,iEAA2D;AAG3D;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,qCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAoB,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,0CAA0C;IAC/D,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,8CAA8C;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;IAC3B,MAAM,YAAY,GAAG,8BAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,iBAAiB,EAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,qCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAoB,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,sEAAsE;IACtE,GAAG,CAAC,GAAG,GAAG,cAAc,YAAY,EAAE,CAAC;IACvC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,0CAA0C;IAC/D,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,GAAQ,EACR,GAAa,EACb,GAAW,EACX,QAAwB;IAExB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,GAAQ,EAAE,GAAa,EAAE,IAAkB;IACxE,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE1D,uCAAuC;IACvC,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAClD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IAAI,8BAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,mBAAmB,EAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,iBAAO,CAAC,IAAI,CAAC;QACX,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAElD,6EAA6E;IAC7E,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,8BAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAExD,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,EAAE,CAAC;IAEtD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAS,EAAE,EAAE;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACzD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":";;;;;AASA,wDAuBC;AAeD,oDA6CC;AAMD,4CAcC;AAOD,wCAwBC;AAKD,8DAcC;AAMD,wDAmBC;AA3LD,sDAAiE;AACjE,+DAAkE;AAClE,iEAA2D;AAG3D;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,qDAAqD;IACrD,IAAK,GAAW,CAAC,mBAAmB,EAAE,CAAC;QACrC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,qCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAoB,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;IAE3B,0DAA0D;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,8BAAa,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,8BAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,iBAAiB,EAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,qCAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAoB,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,oBAAoB,EAAC,CAAC,CAAC;IAC/D,CAAC;IAED,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,GAAG,cAAc,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAE9E,yEAAyE;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,GAAG,EAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,EAAC,CAAC;IACzC,CAAC;IAED,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACnB,GAAW,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACxC,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,GAAQ,EACR,GAAa,EACb,GAAW,EACX,QAAwB;IAExB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,GAAQ,EAAE,GAAa,EAAE,IAAkB;IACxE,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE1D,uCAAuC;IACvC,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAClD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IAAI,8BAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,mBAAmB,EAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAgB,yBAAyB,CACvC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,iBAAO,CAAC,IAAI,CAAC;QACX,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAClD,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEvD,MAAM,aAAa,GAAG,8BAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAExD,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,EAAE,CAAC;IAEtD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAS,EAAE,EAAE;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACzD,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC;AACT,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@90soft/parse-server-kit",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",