@90soft/parse-server-kit 2.10.1 → 2.12.0

package/CHANGELOG.md

@@ -8,6 +8,172 @@ All notable changes to `@90soft/parse-server-kit`.
 
 ---
 
+## [2.12.0]
+
+### Added
+
+- **File access rules — a file's PATH can now carry a permission.**
+
+  Parse has no per-file permission and cannot have one: the file router is
+  handed a name, and a name does not know which row references it. So a file
+  url is a bearer capability — anyone holding the string gets the bytes, with
+  no session, no ACL check and no expiry. Fine for published pictures; not fine
+  for a document, where a url that leaks once works forever, for anyone.
+
+  Parse does give one hook, `beforeFind` on `Parse.File`. This release owns it
+  and makes it usable:
+
+  ```ts
+  import {registerFileAccessRule, privateFileRule, attachPrivateFile} from '@90soft/parse-server-kit';
+
+  registerFileAccessRule(privateFileRule());        // once, in cloud code
+  await attachPrivateFile(row, 'document', upload); // stores under private/<Class>/<objectId>/
+  ```
+
+  A file stored under `private/<ClassName>/<objectId>/` is then served only to
+  a caller who can read THAT row, loaded **as the caller** so Parse evaluates
+  the row's ACL and the class's CLP exactly as it would for a query. The
+  permission is not a copy of the row's ACL; it IS the row's ACL — nothing to
+  stamp, nothing to sync, no second source of truth.
+
+  Why not signed urls: a signed url is the same bearer token on a timer. It
+  leaks the same ways, forces a refresh dance and cache invalidation on every
+  client, and cannot express "this account was banned thirty seconds ago". The
+  rule re-checks every request.
+
+  **Nothing is registered until you add a rule**, so upgrading changes no
+  behaviour in a project that does not opt in, and a project that already
+  registers its own file trigger is not quietly overridden.
+
+  **Five traps this exists to absorb**, each of which cost real debugging:
+
+  1. **There is exactly ONE slot.** File triggers are keyed on the pseudo-class
+     `@File`, so a second `beforeFind(Parse.File)` anywhere REPLACES the first
+     — Parse logs "Only the last one will be used" and keeps serving. Two
+     features each registering a rule would silently disable one. Hence a
+     registry: the kit holds the slot, rules compose in registration order.
+  2. **Response headers come from `afterFind`.** `beforeFind`'s
+     `responseHeaders` are discarded. A rule's `headers` are applied in the
+     right place, including on a refusal, so a denial is not cached either.
+  3. **Only a header authenticates.** The file GET route reads the session from
+     `X-Parse-Session-Token` and nowhere else — no query parameter, no cookie.
+     A browser `<img src>` therefore cannot fetch a governed file; fetch it and
+     bind a blob. The upside: nobody can "simplify" this by putting a session
+     token in a url, because Parse will not read one there.
+  4. **A throw is global.** This runs on every file download in the app, so a
+     mistake does not break documents — it blanks every image at once. The
+     public path is one string comparison before any `await`, a rule whose
+     predicate throws is skipped rather than fatal, and the behaviour is
+     tested.
+  5. **Fail-open is the invisible failure.** "I cannot tell who owns this" must
+     mean refuse. `isPrivatePath` (is it governed?) and `privateOwnerOf` (who
+     owns it?) are deliberately separate functions, because a single predicate
+     returning `owner | null` conflates them: it answers `null` both for an
+     ordinary image and for `private/<Class>/<id>/extra/doc.jpg`, one directory
+     deeper than expected — and would serve that document to anybody, with the
+     symptom that it loads perfectly.
+
+  `Parse.File.setDirectory` / `.name()` / `.directory()` are now declared, and
+  `Parse.Cloud.beforeFind` / `afterFind` accept a class as well as a class name.
+  `@types/parse` is a hand-written stub that predates file directories (and is
+  empty from 6.x), so these are declared once here rather than cast at every
+  call site.
+
+  Requires Parse Server **>= 9.5.0** for file directories; verified against
+  9.10.4. 20 tests.
+
+### Changed
+
+- Development now runs against `parse-server` **9.10.4** (was 9.10.1). The peer
+  range is unchanged at `>=9.0.0` — nothing here needs the newer server except
+  the file directories above, which are a 9.5.0 feature.
+
+---
+
+## [2.11.0]
+
+### Security
+
+- **`rateLimit` could be bypassed completely, by anyone, without an account.**
+  The bucket key was `req.headers['x-parse-session-token'] || req.ip`. That
+  header is supplied by the caller and is **not validated at this point in the
+  pipeline** — the entity-route middleware runs before Parse Server resolves the
+  session — so sending a fresh random token on every request minted a fresh
+  bucket each time.
+
+  Measured against a limit of `max: 3`: ten requests with ten different random
+  tokens all succeeded. The limiter was decorative.
+
+  The key is now the **client address** (`req.ip`, falling back to the socket
+  address). An optional `keyBy` is available for apps that can derive a
+  trustworthy identity themselves.
+
+  ```ts
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5 } })          // keyed on address
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5, keyBy: r => r.apiKeyId } })
+  ```
+
+  **Two things to know when you adopt this:**
+
+  1. **Configure Express `trust proxy` precisely** — a hop count, or the proxy's
+     address — if you run behind nginx or a load balancer. `req.ip` honours that
+     setting, so a permissive `true` lets a caller spoof the key with
+     `X-Forwarded-For`. This is the same bypass Parse Server fixed for its own
+     limiter in 9.10.1. Unset, Express ignores the header, which is safe.
+  2. **Limits were previously per session token and are now per address**, so
+     several users behind one NAT now share a bucket. Raise `max` where that
+     matters, or supply `keyBy`.
+
+- **The bucket store is now bounded** (10,000 clients per function, oldest
+  evicted). A caller rotating addresses could previously grow the map without
+  limit, turning the rate limiter into a memory-exhaustion vector.
+
+### Added
+
+- `resetRateLimits()`, exported for tests.
+- `test/rateLimit.test.ts` — eight tests, including the bypass above as a
+  regression. Rate limiting previously had **no test coverage at all**; the
+  regression test was verified to fail against the old implementation.
+
+### Changed
+
+- **`engines.node` is now `>=20.19.0`** (was `>=18.0.0`). Parse Server 9
+  requires it, so the old floor advertised a combination that cannot work.
+- **Peer floors raised** to `parse >= 8.0.0` and `parse-server >= 9.0.0` (were
+  `>= 5.0.0` and `>= 8.3.0`). Development and tests now run against
+  `parse@8.6.2` / `parse-server@9.10.1`; previously the kit was tested against
+  Parse JS SDK **5** while every consuming app ran 8.x. That gap matters:
+  SDK 6 made `Parse.Object.set`/`setACL`/`unset` and `Role.setName` **throw**
+  instead of taking an error callback, so such a failure escapes the
+  `catchError` convention entirely.
+
+  The floors stay permissive deliberately — nothing in a consuming app breaks on
+  install. **Parse Server ≥ 9.10.1 is strongly recommended**: the 9.5→9.10 line
+  is almost entirely security fixes, including account takeover through
+  auth-adapter identity spoofing, protected-field bypasses via logical
+  operators, dot-notation, relation counts and LiveQuery, and several stored-XSS
+  routes through file upload.
+
+### Notes
+
+- Rate limiting remains **per process**: with N app instances the effective
+  limit is N × `max`. For cross-instance enforcement use Parse Server's own
+  `rateLimit` server option with `redisUrl`.
+- A unique index with a **value** predicate (e.g. "one active row per pair")
+  needs `partialFilterExpression`, not `partialFilterNulls` — the latter only
+  emits `$exists: true`. Use the `options` escape hatch, which is passed
+  straight through to MongoDB:
+
+  ```ts
+  compoundIndexes: [{
+    fields: ['trainee', 'sport'],
+    unique: true,
+    options: { partialFilterExpression: { status: 'active' } },
+  }]
+  ```
+
+---
+
 ## [2.10.1]
 
 Twelve fixes found by a full read of the source, each verified against a running

package/CLAUDE.md

@@ -187,7 +187,7 @@ Static-method decorator. Registers the function and wraps it with role checking.
 interface RouteConfig {
   methods: HttpMethod[];                      // 'GET'|'POST'|'PUT'|'DELETE'|'PATCH'
   requiresAuth?: boolean;
-  rateLimit?: {windowMs: number; max: number};
+  rateLimit?: {windowMs: number; max: number; keyBy?: (req) => string};  // keyed on client ADDRESS
   validation?: Parse.Cloud.Validator;
   description?: string;
   requireRoles?: string[];
@@ -454,11 +454,35 @@ parent's final ACL and **before** saving. For status-derived visibility set in a
 | `removeResultMiddleware` | Unwraps Parse's `{result: …}` response |
 | `conditionalJsonMiddleware` | `express.json({limit:'10mb', type:['text/plain']})`, skipping `{mountPath}/files` |
 | `validateFunctionRoutes` | Legacy `/functions/*` validation |
-| `checkRateLimit(req,res,name,cfg)` | In-process token bucket; returns `false` after sending 429 |
+| `checkRateLimit(req,res,name,cfg)` | In-process token bucket keyed on client address; returns `false` after sending 429 |
 
 **Master key** is read from the `X-Parse-Master-Key` header (preferred) or the
-request body (deprecated, warns once). Rate limiting is **per process** — no
-enforcement across instances.
+request body (deprecated, warns once).
+
+### Rate limiting — read before relying on it
+
+The bucket key is the **client address** (`req.ip`, falling back to the socket
+address). Pass `keyBy` only if the app can derive an identity it actually trusts.
+
+> Before 2.11.0 the key was `x-parse-session-token || req.ip`. That header is
+> caller-supplied and unvalidated here — this middleware runs **before** Parse
+> resolves the session — so a rotating random token minted a fresh bucket per
+> request and the limit did nothing. Ten requests passed a limit of three.
+
+Three constraints:
+
+1. **`trust proxy` must be exact** — a hop count or the proxy's address — when
+   behind nginx or a load balancer. `req.ip` honours it, so a permissive `true`
+   lets a caller spoof the key via `X-Forwarded-For` (the bypass Parse Server
+   fixed for its own limiter in 9.10.1). Unset is safe: Express ignores the
+   header.
+2. **Per process.** With N instances the effective limit is N × `max`. For
+   cross-instance enforcement use Parse Server's `rateLimit` option with
+   `redisUrl`.
+3. **Per address, not per user.** Users behind one NAT share a bucket.
+
+The store is bounded at 10,000 clients per function, oldest evicted, so a caller
+rotating addresses cannot grow it without limit.
 
 ---
 
@@ -488,7 +512,9 @@ interface CompoundIndex {
   unique?: boolean;
   name?: string;
   sparse?: boolean;
-  partialFilterNulls?: boolean;                       // only index docs where all fields exist
+  partialFilterNulls?: boolean;                       // only index docs where all fields EXIST
+  // For a VALUE predicate (e.g. one active row per pair) use the options escape hatch:
+  //   options: {partialFilterExpression: {status: 'active'}}   -> passed straight to MongoDB
   fieldTypes?: Record<string, 1|-1|'text'|'2dsphere'|'hashed'>;
   options?: Record<string, unknown>;                  // e.g. default_language
 }
@@ -688,11 +714,21 @@ output for `[Versioning]`.
 
 | | Requirement |
 |---|---|
-| Node | ≥ 18 for this package; **≥ 20.19** with parse-server 9 |
-| parse-server | ≥ 8.3 (optional peer) — `keepUnknownIndexes`, adapter internals |
+| Node | **≥ 20.19** |
+| parse-server | ≥ 9.0 (optional peer); **≥ 9.10.1 strongly recommended** — see below. ≥ 9.10.0 is required on MongoDB 8.3+ (GeoPoint distance queries 500 otherwise) |
 | MongoDB | ≥ 7.0.16 for parse-server 9; **replica set** for transactions |
-| Parse SDK | ≥ 5; verified on 5.3.0 and 8.6.0 |
+| Parse SDK | ≥ 8; developed and tested on 8.6.2 |
 | TypeScript | any, with `experimentalDecorators: true` |
 
+**Why ≥ 9.10.1 rather than merely 9.x:** the 9.5→9.10 releases are almost
+entirely security fixes — account takeover through auth-adapter identity
+spoofing, protected-field bypasses via logical operators, dot-notation, relation
+counts and LiveQuery, multiple rate-limit bypasses, and several stored-XSS routes
+through file upload. An older 9.x is not "stable", it is unpatched.
+
+**`@types/parse` is far behind the runtime** (3.0.x against an 8.x SDK), which is
+why reaching newer Parse APIs sometimes needs an `as unknown as` cast. That is
+the types package, not this kit.
+
 **Transactions and `@ParseVersionField` are MongoDB-only.** On Postgres the
 version field is declared but never enforced.

package/dist/decorators/types/cloudTypes.d.ts

@@ -12,9 +12,21 @@ export interface SwaggerDocConfig {
 export interface RouteConfig {
     methods: HttpMethod[];
     requiresAuth?: boolean;
+    /**
+     * Per-function rate limit, keyed on the CLIENT ADDRESS.
+     *
+     * Enforced per process: with N app instances the effective limit is N x `max`.
+     * For cross-instance enforcement use Parse Server's own `rateLimit` server
+     * option with `redisUrl`.
+     *
+     * Requires Express `trust proxy` to be configured precisely (a hop count or
+     * the proxy's address) when running behind a reverse proxy. A permissive
+     * value lets a caller spoof the key with `X-Forwarded-For`.
+     */
     rateLimit?: {
         windowMs: number;
         max: number;
+        keyBy?: (req: any) => string;
     };
     validation?: Parse.Cloud.Validator;
     description?: string;

package/dist/decorators/types/cloudTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudTypes.d.ts","sourceRoot":"","sources":["../../../src/decorators/types/cloudTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,UAAU,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtE,2EAA2E;IAC3E,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"cloudTypes.d.ts","sourceRoot":"","sources":["../../../src/decorators/types/cloudTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAA;KAAE,CAAC;IAC5E,UAAU,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtE,2EAA2E;IAC3E,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/files/fileAccess.d.ts

@@ -0,0 +1,224 @@
+/**
+ * File access rules — turn a file's PATH into a permission.
+ *
+ * Parse has no per-file permission and cannot have one: the file router is
+ * handed a name, and a name does not know which row references it. So a file
+ * url is a bearer capability — anyone holding the string gets the bytes, with
+ * no session, no ACL check and no expiry. For published pictures that is
+ * correct and cheap. For a document (a certificate, an ID photo, an invoice) it
+ * is not: a url that leaks once works forever, for anyone, which is a
+ * REVOCATION problem that signed urls do not solve — a signed url is the same
+ * bearer token on a timer, and it cannot express "this account was banned
+ * thirty seconds ago".
+ *
+ * Parse does give us one hook: `beforeFind` on `Parse.File`, which runs on
+ * every `GET /files/...` and can throw to refuse. This module owns that hook
+ * and makes it usable, because using it directly has five traps:
+ *
+ *   1. **There is exactly ONE slot.** File triggers are keyed on the
+ *      pseudo-class `@File`, not on a class, so a second
+ *      `beforeFind(Parse.File)` anywhere REPLACES the first — Parse logs
+ *      "Only the last one will be used" and carries on serving. Two features
+ *      each registering their own rule would silently disable one of them.
+ *      Hence a registry: this module holds the slot, rules compose.
+ *   2. **The headers come from `afterFind`.** `beforeFind`'s `responseHeaders`
+ *      are discarded; only the `afterFind` request's are written to the
+ *      response. A rule that marks a response uncacheable has to act there.
+ *   3. **Only a header authenticates.** The file GET route reads the session
+ *      from `X-Parse-Session-Token` and nowhere else — no query parameter, no
+ *      cookie. A browser `<img src>` therefore cannot fetch a governed file;
+ *      the client must fetch it and bind a blob. The upside is that nobody can
+ *      "simplify" this by putting a session token in a url.
+ *   4. **A throw is global.** This runs on every file download in the app, so
+ *      a mistake does not break documents, it blanks every image at once.
+ *      Everything on the public path here is a string comparison, before any
+ *      `await`, and cannot throw.
+ *   5. **Fail-open is the invisible failure.** If "I cannot tell who owns
+ *      this" is treated as "public", the document is served and the symptom is
+ *      that it loads perfectly. So governed-but-unidentifiable must REFUSE.
+ *
+ * **Nothing is registered until a rule is added.** Upgrading the kit therefore
+ * changes no behaviour in a project that does not opt in, and a project that
+ * already registers its own file trigger is not quietly overridden.
+ *
+ * The usual setup, in cloud code:
+ *
+ * ```ts
+ * import {registerFileAccessRule, privateFileRule} from '@90soft/parse-server-kit';
+ * registerFileAccessRule(privateFileRule());
+ * ```
+ *
+ * [privateFileRule] is the general case: a file stored under
+ * `private/<ClassName>/<objectId>/` is served only to a caller who can read
+ * THAT row, judged by Parse's own ACL and CLP. The permission is not a copy of
+ * the row's ACL; it IS the row's ACL — nothing to stamp, nothing to sync.
+ */
+/**
+ * What a FILE trigger is handed, which is not what a class trigger gets: there
+ * is no `object` and no `query`, only the file.
+ *
+ * Declared HERE rather than taken from the ambient Parse types on purpose.
+ * `@types/parse` does not describe file triggers at all, so a consumer relying
+ * on it could not name the argument of [evaluateFileAccess] — a published
+ * library should not require its callers to declare types for its own API.
+ */
+export interface FileTriggerRequest {
+    file?: Parse.File;
+    fileSize?: number;
+    master?: boolean;
+    isReadOnly?: boolean;
+    user?: Parse.User;
+    ip?: string;
+    forceDownload?: boolean;
+    responseHeaders?: Record<string, string>;
+}
+/** The decision a rule is asked to make. */
+export interface FileAccessContext {
+    /** The stored path, including any directory prefix. */
+    path: string;
+    /** The caller, when they sent a session token. */
+    user?: Parse.User;
+    /** True for a master-key request. */
+    master: boolean;
+}
+/** One rule, governing some subset of stored files. */
+export interface FileAccessRule {
+    /**
+     * Identifies the rule in diagnostics, and makes replacing one deliberate:
+     * registering the same name twice warns rather than stacking silently.
+     */
+    name: string;
+    /**
+     * Does this rule govern that path?
+     *
+     * **Must not throw and should not await.** It is consulted for every file
+     * download in the application, including every public image.
+     */
+    governs(path: string): boolean;
+    /**
+     * Decide. Throw a `Parse.Error` to refuse.
+     *
+     * Returning normally allows the download. Only called when [governs] said
+     * yes and the request is not master-key.
+     */
+    authorize(context: FileAccessContext): Promise<void> | void;
+    /**
+     * Headers to add to a governed response, e.g. `Cache-Control`.
+     *
+     * Applied whenever [governs] matches — including on a refusal, so that a
+     * denial is not cached either.
+     */
+    headers?: Record<string, string>;
+}
+/**
+ * The gate. Public files leave before anything is awaited.
+ *
+ * Exported so a project can unit-test its rules without going through HTTP.
+ */
+export declare function evaluateFileAccess(request: FileTriggerRequest): Promise<void>;
+/**
+ * Add the governed response's headers.
+ *
+ * Separate from [evaluateFileAccess] because Parse reads response headers from
+ * the `afterFind` request and ignores `beforeFind`'s.
+ */
+export declare function applyFileAccessHeaders(request: FileTriggerRequest): void;
+/**
+ * Register a rule, attaching the Parse hooks on the first call.
+ *
+ * Order matters: rules are consulted in registration order and the first match
+ * decides, so register the most specific first.
+ */
+export declare function registerFileAccessRule(rule: FileAccessRule): void;
+/** Registered rules, in order. For diagnostics and tests. */
+export declare function getFileAccessRules(): FileAccessRule[];
+/**
+ * Drop every rule. For tests.
+ *
+ * The Parse hooks stay attached — they are harmless with no rules, since every
+ * path is then public — and re-attaching would hit Parse's duplicate warning.
+ */
+export declare function clearFileAccessRules(): void;
+/**
+ * The directory prefix marking a file as governed by [privateFileRule].
+ *
+ * Parse's own `validateDirectory` reserves `metadata` and requires a directory
+ * to match `^[a-zA-Z0-9][a-zA-Z0-9_\-/]*$`, so a single lowercase word is safe.
+ * It is baked into stored file names, so changing it would orphan every file
+ * already written under the old one.
+ */
+export declare const PRIVATE_PREFIX = "private";
+/** Who a private file's path says owns it. */
+export interface PrivateFileOwner {
+    className: string;
+    objectId: string;
+}
+/**
+ * Is this path governed at all?
+ *
+ * Deliberately separate from [privateOwnerOf], and the separation is the
+ * safety property: "under the prefix" and "parses into an owner" are different
+ * questions, and a single predicate returning `owner | null` conflates them
+ * into a fail-OPEN. It would answer `null` both for an ordinary image and for
+ * `private/<Class>/<id>/extra/doc.jpg` — one directory deeper than expected —
+ * and so serve that document to anybody.
+ */
+export declare function isPrivatePath(path: string): boolean;
+/**
+ * Read the owner out of a governed path, or null if it is not well formed.
+ *
+ * `null` means "I cannot tell who owns this", which the rule treats as a
+ * refusal — never as permission.
+ */
+export declare function privateOwnerOf(path: string): PrivateFileOwner | null;
+/**
+ * The directory a row's private files live in.
+ *
+ * Throws rather than quietly producing something Parse will reject: a class
+ * whose name cannot be a path segment (`_User`, since a directory must start
+ * alphanumeric) surfaces here, at the one call site, instead of as a confusing
+ * upload failure later.
+ */
+export declare function privateDirectoryFor(className: string, objectId: string): string;
+/**
+ * Store a file so that the owning row's ACL governs it.
+ *
+ * The row must already be saved — its objectId is part of the path, which is
+ * what lets the rule find the owner with no index and no second source of
+ * truth. For a new record that means save, attach, save again: one extra write
+ * on a rare operation.
+ *
+ * **This should be the only way an application stores a private file.** The
+ * prefix is the entire boundary: a document saved without it is simply public,
+ * and nothing anywhere will complain.
+ *
+ * Private files deliberately get no derivatives — no converted copy, no
+ * thumbnail, and no blurhash, which is a small preview of the document and
+ * travels inside DTOs where the document itself does not.
+ */
+export declare function attachPrivateFile(row: Parse.Object, field: string, upload: {
+    base64: string;
+    name?: string;
+}): Promise<void>;
+/** Options for [privateFileRule]. */
+export interface PrivateFileRuleOptions {
+    /**
+     * Headers for a private response. Defaults to `private, no-store`.
+     *
+     * One cached private response served to the next caller undoes the whole
+     * check, and the symptom is that the document loads — so this defaults to
+     * the strict value rather than being left to the caller.
+     */
+    headers?: Record<string, string>;
+}
+/**
+ * Serve a private file only to a caller who can read its owning row.
+ *
+ * The caller is resolved from their session token, so Parse evaluates the
+ * row's ACL and the class's CLP exactly as it would for a query. With no
+ * session the row is loaded with no auth, which is right rather than a
+ * shortcut: if the owning row is publicly readable then its file is public
+ * too, because the row's ACL is the whole rule.
+ */
+export declare function privateFileRule(options?: PrivateFileRuleOptions): FileAccessRule;
+//# sourceMappingURL=fileAccess.d.ts.map

package/dist/files/fileAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAccess.d.ts","sourceRoot":"","sources":["../../src/files/fileAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,qCAAqC;IACrC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAiCD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAsBjE;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,IAAI,cAAc,EAAE,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAWpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAc/E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,KAAK,CAAC,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,qCAAqC;AACrC,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE,sBAA2B,GACnC,cAAc,CA8BhB"}

package/dist/files/fileAccess.js

@@ -0,0 +1,294 @@
+"use strict";
+/**
+ * File access rules — turn a file's PATH into a permission.
+ *
+ * Parse has no per-file permission and cannot have one: the file router is
+ * handed a name, and a name does not know which row references it. So a file
+ * url is a bearer capability — anyone holding the string gets the bytes, with
+ * no session, no ACL check and no expiry. For published pictures that is
+ * correct and cheap. For a document (a certificate, an ID photo, an invoice) it
+ * is not: a url that leaks once works forever, for anyone, which is a
+ * REVOCATION problem that signed urls do not solve — a signed url is the same
+ * bearer token on a timer, and it cannot express "this account was banned
+ * thirty seconds ago".
+ *
+ * Parse does give us one hook: `beforeFind` on `Parse.File`, which runs on
+ * every `GET /files/...` and can throw to refuse. This module owns that hook
+ * and makes it usable, because using it directly has five traps:
+ *
+ *   1. **There is exactly ONE slot.** File triggers are keyed on the
+ *      pseudo-class `@File`, not on a class, so a second
+ *      `beforeFind(Parse.File)` anywhere REPLACES the first — Parse logs
+ *      "Only the last one will be used" and carries on serving. Two features
+ *      each registering their own rule would silently disable one of them.
+ *      Hence a registry: this module holds the slot, rules compose.
+ *   2. **The headers come from `afterFind`.** `beforeFind`'s `responseHeaders`
+ *      are discarded; only the `afterFind` request's are written to the
+ *      response. A rule that marks a response uncacheable has to act there.
+ *   3. **Only a header authenticates.** The file GET route reads the session
+ *      from `X-Parse-Session-Token` and nowhere else — no query parameter, no
+ *      cookie. A browser `<img src>` therefore cannot fetch a governed file;
+ *      the client must fetch it and bind a blob. The upside is that nobody can
+ *      "simplify" this by putting a session token in a url.
+ *   4. **A throw is global.** This runs on every file download in the app, so
+ *      a mistake does not break documents, it blanks every image at once.
+ *      Everything on the public path here is a string comparison, before any
+ *      `await`, and cannot throw.
+ *   5. **Fail-open is the invisible failure.** If "I cannot tell who owns
+ *      this" is treated as "public", the document is served and the symptom is
+ *      that it loads perfectly. So governed-but-unidentifiable must REFUSE.
+ *
+ * **Nothing is registered until a rule is added.** Upgrading the kit therefore
+ * changes no behaviour in a project that does not opt in, and a project that
+ * already registers its own file trigger is not quietly overridden.
+ *
+ * The usual setup, in cloud code:
+ *
+ * ```ts
+ * import {registerFileAccessRule, privateFileRule} from '@90soft/parse-server-kit';
+ * registerFileAccessRule(privateFileRule());
+ * ```
+ *
+ * [privateFileRule] is the general case: a file stored under
+ * `private/<ClassName>/<objectId>/` is served only to a caller who can read
+ * THAT row, judged by Parse's own ACL and CLP. The permission is not a copy of
+ * the row's ACL; it IS the row's ACL — nothing to stamp, nothing to sync.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVATE_PREFIX = void 0;
+exports.evaluateFileAccess = evaluateFileAccess;
+exports.applyFileAccessHeaders = applyFileAccessHeaders;
+exports.registerFileAccessRule = registerFileAccessRule;
+exports.getFileAccessRules = getFileAccessRules;
+exports.clearFileAccessRules = clearFileAccessRules;
+exports.isPrivatePath = isPrivatePath;
+exports.privateOwnerOf = privateOwnerOf;
+exports.privateDirectoryFor = privateDirectoryFor;
+exports.attachPrivateFile = attachPrivateFile;
+exports.privateFileRule = privateFileRule;
+/** Ordered; the first rule that governs a path decides it. */
+const rules = [];
+/** The hook is attached once, lazily, on the first registration. */
+let attached = false;
+/**
+ * 404, never 403.
+ *
+ * A 403 confirms the file is there and merely forbidden, which for a document
+ * is itself the leak — it tells the caller that a particular row has one.
+ * "Not found" is the same answer an invented name would get.
+ */
+function notFound() {
+    return new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'File not found');
+}
+/** The first rule governing this path, or undefined when the file is public. */
+function ruleFor(path) {
+    for (const rule of rules) {
+        // A rule that throws here would blank every image in the app, so one
+        // misbehaving rule must not take the public path down with it.
+        try {
+            if (rule.governs(path))
+                return rule;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+/**
+ * The gate. Public files leave before anything is awaited.
+ *
+ * Exported so a project can unit-test its rules without going through HTTP.
+ */
+async function evaluateFileAccess(request) {
+    const path = request.file?.name() ?? '';
+    const rule = ruleFor(path);
+    if (!rule)
+        return;
+    // Cloud code reading deliberately with the master key. Note this is NOT how
+    // a worker that fetches a url reaches a file: a plain GET carries no key.
+    if (request.master)
+        return;
+    await rule.authorize({
+        path,
+        user: request.user,
+        master: false,
+    });
+}
+/**
+ * Add the governed response's headers.
+ *
+ * Separate from [evaluateFileAccess] because Parse reads response headers from
+ * the `afterFind` request and ignores `beforeFind`'s.
+ */
+function applyFileAccessHeaders(request) {
+    const rule = ruleFor(request.file?.name() ?? '');
+    if (!rule?.headers)
+        return;
+    // The incoming object already carries `X-Content-Type-Options: nosniff`, so
+    // extend it rather than replacing it.
+    request.responseHeaders = { ...(request.responseHeaders ?? {}), ...rule.headers };
+}
+/**
+ * Register a rule, attaching the Parse hooks on the first call.
+ *
+ * Order matters: rules are consulted in registration order and the first match
+ * decides, so register the most specific first.
+ */
+function registerFileAccessRule(rule) {
+    const existing = rules.findIndex(r => r.name === rule.name);
+    if (existing >= 0) {
+        console.warn(`[FileAccess] Replacing existing rule "${rule.name}". Two rules with one name is almost always an accident.`);
+        rules.splice(existing, 1, rule);
+    }
+    else {
+        rules.push(rule);
+    }
+    if (attached)
+        return;
+    attached = true;
+    /*
+     * `Parse.File` is passed as the class, which Parse maps to `@File`. This is
+     * the only pair of triggers in a kit project that is not declared on a model
+     * with `@BeforeFind` / `@AfterFind`, because there is no model to declare it
+     * on.
+     */
+    Parse.Cloud.beforeFind(Parse.File, evaluateFileAccess);
+    Parse.Cloud.afterFind(Parse.File, applyFileAccessHeaders);
+}
+/** Registered rules, in order. For diagnostics and tests. */
+function getFileAccessRules() {
+    return [...rules];
+}
+/**
+ * Drop every rule. For tests.
+ *
+ * The Parse hooks stay attached — they are harmless with no rules, since every
+ * path is then public — and re-attaching would hit Parse's duplicate warning.
+ */
+function clearFileAccessRules() {
+    rules.length = 0;
+}
+// ── The private-file rule ───────────────────────────────────────────────────
+/**
+ * The directory prefix marking a file as governed by [privateFileRule].
+ *
+ * Parse's own `validateDirectory` reserves `metadata` and requires a directory
+ * to match `^[a-zA-Z0-9][a-zA-Z0-9_\-/]*$`, so a single lowercase word is safe.
+ * It is baked into stored file names, so changing it would orphan every file
+ * already written under the old one.
+ */
+exports.PRIVATE_PREFIX = 'private';
+/**
+ * Is this path governed at all?
+ *
+ * Deliberately separate from [privateOwnerOf], and the separation is the
+ * safety property: "under the prefix" and "parses into an owner" are different
+ * questions, and a single predicate returning `owner | null` conflates them
+ * into a fail-OPEN. It would answer `null` both for an ordinary image and for
+ * `private/<Class>/<id>/extra/doc.jpg` — one directory deeper than expected —
+ * and so serve that document to anybody.
+ */
+function isPrivatePath(path) {
+    return typeof path === 'string' && path.startsWith(`${exports.PRIVATE_PREFIX}/`);
+}
+/**
+ * Read the owner out of a governed path, or null if it is not well formed.
+ *
+ * `null` means "I cannot tell who owns this", which the rule treats as a
+ * refusal — never as permission.
+ */
+function privateOwnerOf(path) {
+    if (!isPrivatePath(path))
+        return null;
+    // Exactly: private / ClassName / objectId / filename
+    const parts = path.split('/');
+    if (parts.length !== 4)
+        return null;
+    const [, className, objectId, filename] = parts;
+    if (!className || !objectId || !filename)
+        return null;
+    return { className, objectId };
+}
+/**
+ * The directory a row's private files live in.
+ *
+ * Throws rather than quietly producing something Parse will reject: a class
+ * whose name cannot be a path segment (`_User`, since a directory must start
+ * alphanumeric) surfaces here, at the one call site, instead of as a confusing
+ * upload failure later.
+ */
+function privateDirectoryFor(className, objectId) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_]*$/.test(className)) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, `${className} cannot own private files: Parse requires a directory segment to start with a letter or digit`);
+    }
+    if (!/^[a-zA-Z0-9]+$/.test(objectId)) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, 'A private file needs the owning row saved first, so that it has an objectId');
+    }
+    return `${exports.PRIVATE_PREFIX}/${className}/${objectId}`;
+}
+/**
+ * Store a file so that the owning row's ACL governs it.
+ *
+ * The row must already be saved — its objectId is part of the path, which is
+ * what lets the rule find the owner with no index and no second source of
+ * truth. For a new record that means save, attach, save again: one extra write
+ * on a rare operation.
+ *
+ * **This should be the only way an application stores a private file.** The
+ * prefix is the entire boundary: a document saved without it is simply public,
+ * and nothing anywhere will complain.
+ *
+ * Private files deliberately get no derivatives — no converted copy, no
+ * thumbnail, and no blurhash, which is a small preview of the document and
+ * travels inside DTOs where the document itself does not.
+ */
+async function attachPrivateFile(row, field, upload) {
+    if (!row.id) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, 'Save the row before attaching a private file — its objectId is part of the path');
+    }
+    const file = new Parse.File(encodeURIComponent(upload.name ?? 'document'), {
+        base64: upload.base64,
+    });
+    // Sent as `X-Parse-File-Directory`; honoured by Parse Server from 9.5.0.
+    file.setDirectory(privateDirectoryFor(row.className, row.id));
+    const saved = await file.save({ useMasterKey: true });
+    row.set(field, saved);
+}
+/**
+ * Serve a private file only to a caller who can read its owning row.
+ *
+ * The caller is resolved from their session token, so Parse evaluates the
+ * row's ACL and the class's CLP exactly as it would for a query. With no
+ * session the row is loaded with no auth, which is right rather than a
+ * shortcut: if the owning row is publicly readable then its file is public
+ * too, because the row's ACL is the whole rule.
+ */
+function privateFileRule(options = {}) {
+    const headers = options.headers ?? { 'Cache-Control': 'private, no-store' };
+    return {
+        name: 'private-prefix',
+        headers,
+        governs: isPrivatePath,
+        async authorize({ path, user }) {
+            /*
+             * Under the prefix but not a shape we understand: REFUSE.
+             *
+             * Treating it as public because no owner could be found is the one
+             * failure mode of this design that nobody would notice, because the
+             * document would load perfectly.
+             */
+            const owner = privateOwnerOf(path);
+            if (!owner)
+                throw notFound();
+            const sessionToken = user?.getSessionToken();
+            const query = new Parse.Query(owner.className);
+            const row = await (sessionToken
+                ? query.get(owner.objectId, { sessionToken })
+                : query.get(owner.objectId)).catch(() => null);
+            if (!row)
+                throw notFound();
+        },
+    };
+}
+//# sourceMappingURL=fileAccess.js.map

package/dist/files/fileAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAccess.js","sourceRoot":"","sources":["../../src/files/fileAccess.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAqGH,gDAiBC;AAQD,wDASC;AAQD,wDAsBC;AAGD,gDAEC;AAQD,oDAEC;AA8BD,sCAEC;AAQD,wCAWC;AAUD,kDAcC;AAkBD,8CAoBC;AAuBD,0CAgCC;AA3RD,8DAA8D;AAC9D,MAAM,KAAK,GAAqB,EAAE,CAAC;AAEnC,oEAAoE;AACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB;;;;;;GAMG;AACH,SAAS,QAAQ;IACf,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAExC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO;IAE3B,MAAM,IAAI,CAAC,SAAS,CAAC;QACnB,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,OAAO;QAAE,OAAO;IAE3B,4EAA4E;IAC5E,sCAAsC;IACtC,OAAO,CAAC,eAAe,GAAG,EAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAoB;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,CAAC,IAAI,0DAA0D,CAC7G,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAEhB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACvD,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAED,6DAA6D;AAC7D,SAAgB,kBAAkB;IAChC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB;IAClC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACU,QAAA,cAAc,GAAG,SAAS,CAAC;AAQxC;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,sBAAc,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,qDAAqD;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,SAAiB,EAAE,QAAgB;IACrE,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,GAAG,SAAS,+FAA+F,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,sBAAc,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAAiB,EACjB,KAAa,EACb,MAAuC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QACzE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,yEAAyE;IACzE,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAcD;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAC7B,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAC,eAAe,EAAE,mBAAmB,EAAC,CAAC;IAE1E,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO;QACP,OAAO,EAAE,aAAa;QAEtB,KAAK,CAAC,SAAS,CAAC,EAAC,IAAI,EAAE,IAAI,EAAC;YAC1B;;;;;;eAMG;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,MAAM,QAAQ,EAAE,CAAC;YAE7B,MAAM,YAAY,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE/C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY;gBAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAC,YAAY,EAAC,CAAC;gBAC3C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAEpB,IAAI,CAAC,GAAG;gBAAE,MAAM,QAAQ,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -24,6 +24,8 @@ export { configureRoleCache, invalidateRoles, roleCacheEnabled, roleCacheStats }
 export type { RoleCacheOptions } from './utils/roleCache';
 export { validateFunctionRoutes, validateEntityRoutes, restrictRoutes, removeResultMiddleware, conditionalJsonMiddleware } from './middleware/middleware';
 export { checkRateLimit } from './middleware/rateLimit';
+export { registerFileAccessRule, getFileAccessRules, clearFileAccessRules, evaluateFileAccess, applyFileAccessHeaders, privateFileRule, attachPrivateFile, isPrivatePath, privateOwnerOf, privateDirectoryFor, PRIVATE_PREFIX } from './files/fileAccess';
+export type { FileAccessRule, FileAccessContext, FileTriggerRequest, PrivateFileOwner, PrivateFileRuleOptions } from './files/fileAccess';
 export { createSchemaConfig } from './database/schema';
 export type { SchemaConfigOptions } from './database/schema';
 export { applyAllIndexes, applyUniqueIndexes, getUniqueIndexes, getCompoundIndexes, getFieldIndexes } from './database/indexes';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjI,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAC9E,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAChE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAChE,cAAc,EAAE,aAAa,EAC7B,gBAAgB,EAAE,eAAe,EACjC,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EACnF,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEpJ,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAChF,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAG1H,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAC3D,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC1G,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EACnE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGhI,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGvG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EACpE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG3F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjI,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAC9E,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAChE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAChE,cAAc,EAAE,aAAa,EAC7B,gBAAgB,EAAE,eAAe,EACjC,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EACnF,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEpJ,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAChF,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAG1H,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAC3D,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC1G,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EACnE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOxD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,EACvE,kBAAkB,EAAE,sBAAsB,EAC1C,eAAe,EAAE,iBAAiB,EAClC,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EACnF,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGhI,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGvG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EACpE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG3F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -2,7 +2,8 @@
 // @90soft/parse-server-kit — complete toolkit for Parse Server
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserRoles = exports.catchError = exports.MAX_QUERY_LIMIT = exports.roleKey = exports.UserRoles = exports.cloneAcl = exports.syncImageAcl = exports.implementACL = exports.BaseModel = exports.applyMongoValidators = exports.getValidators = exports.validateOrThrow = exports.validateObject = exports.classNames = exports.RouteRegistry = exports.Route = exports.CronRegistry = exports.CronSchedule = exports.Cron = exports.TriggerRegistry = exports.AfterEvent = exports.BeforeSubscribe = exports.BeforeConnect = exports.AfterSaveConfig = exports.BeforeSaveConfig = exports.AfterFindFile = exports.BeforeFindFile = exports.AfterDeleteFile = exports.BeforeDeleteFile = exports.AfterSaveFile = exports.BeforeSaveFile = exports.BeforePasswordResetRequest = exports.AfterLogout = exports.AfterLogin = exports.BeforeLogin = exports.AfterFind = exports.BeforeFind = exports.AfterDelete = exports.BeforeDelete = exports.AfterSave = exports.BeforeSave = exports.CloudFunctionRegistry = exports.onFunctionRegistered = exports.ProtectedCloudFunction = exports.CloudFunction = exports.onFieldRegistered = exports.onClassRegistered = exports.getSchemaDefinition = exports.ParseField = exports.ParseClass = void 0;
-exports.setupSwagger = exports.getSwaggerJson = exports.generateSwaggerSpec = exports.SwaggerRegistry = exports.NO_AMBIENT_TRANSACTION = exports.withAmbientSession = exports.CONFLICT_MESSAGE = exports.CONFLICT = exports.useTransactionAdapter = exports.currentSession = exports.inTransaction = exports.withTransaction = exports.Transactional = exports.VERSION_CONFLICT_MESSAGE = exports.VERSION_CONFLICT = exports.createVersionedMongoAdapter = exports.VersionRegistry = exports.ParseVersionField = exports.getFieldIndexes = exports.getCompoundIndexes = exports.getUniqueIndexes = exports.applyUniqueIndexes = exports.applyAllIndexes = exports.createSchemaConfig = exports.checkRateLimit = exports.conditionalJsonMiddleware = exports.removeResultMiddleware = exports.restrictRoutes = exports.validateEntityRoutes = exports.validateFunctionRoutes = exports.roleCacheStats = exports.roleCacheEnabled = exports.invalidateRoles = exports.configureRoleCache = exports.importFiles = exports.sleep = exports.generateRandomString = exports.generateRandomInteger = exports.generateRandomPassword = exports.formatCount = exports.getUsersRoles = void 0;
+exports.generateSwaggerSpec = exports.SwaggerRegistry = exports.NO_AMBIENT_TRANSACTION = exports.withAmbientSession = exports.CONFLICT_MESSAGE = exports.CONFLICT = exports.useTransactionAdapter = exports.currentSession = exports.inTransaction = exports.withTransaction = exports.Transactional = exports.VERSION_CONFLICT_MESSAGE = exports.VERSION_CONFLICT = exports.createVersionedMongoAdapter = exports.VersionRegistry = exports.ParseVersionField = exports.getFieldIndexes = exports.getCompoundIndexes = exports.getUniqueIndexes = exports.applyUniqueIndexes = exports.applyAllIndexes = exports.createSchemaConfig = exports.PRIVATE_PREFIX = exports.privateDirectoryFor = exports.privateOwnerOf = exports.isPrivatePath = exports.attachPrivateFile = exports.privateFileRule = exports.applyFileAccessHeaders = exports.evaluateFileAccess = exports.clearFileAccessRules = exports.getFileAccessRules = exports.registerFileAccessRule = exports.checkRateLimit = exports.conditionalJsonMiddleware = exports.removeResultMiddleware = exports.restrictRoutes = exports.validateEntityRoutes = exports.validateFunctionRoutes = exports.roleCacheStats = exports.roleCacheEnabled = exports.invalidateRoles = exports.configureRoleCache = exports.importFiles = exports.sleep = exports.generateRandomString = exports.generateRandomInteger = exports.generateRandomPassword = exports.formatCount = exports.getUsersRoles = void 0;
+exports.setupSwagger = exports.getSwaggerJson = void 0;
 // ── Decorators ──
 var parseDecorators_1 = require("./decorators/parseDecorators");
 Object.defineProperty(exports, "ParseClass", { enumerable: true, get: function () { return parseDecorators_1.ParseClass; } });
@@ -96,6 +97,23 @@ Object.defineProperty(exports, "removeResultMiddleware", { enumerable: true, get
 Object.defineProperty(exports, "conditionalJsonMiddleware", { enumerable: true, get: function () { return middleware_1.conditionalJsonMiddleware; } });
 var rateLimit_1 = require("./middleware/rateLimit");
 Object.defineProperty(exports, "checkRateLimit", { enumerable: true, get: function () { return rateLimit_1.checkRateLimit; } });
+// ── File access ──────────────────────────────────────────────────────────────
+// Parse has no per-file permission; these turn a file's PATH into one. The kit
+// owns the single `beforeFind(Parse.File)` slot so that rules compose instead
+// of silently replacing each other, and nothing is registered until a rule is
+// added — so upgrading changes no behaviour for a project that does not opt in.
+var fileAccess_1 = require("./files/fileAccess");
+Object.defineProperty(exports, "registerFileAccessRule", { enumerable: true, get: function () { return fileAccess_1.registerFileAccessRule; } });
+Object.defineProperty(exports, "getFileAccessRules", { enumerable: true, get: function () { return fileAccess_1.getFileAccessRules; } });
+Object.defineProperty(exports, "clearFileAccessRules", { enumerable: true, get: function () { return fileAccess_1.clearFileAccessRules; } });
+Object.defineProperty(exports, "evaluateFileAccess", { enumerable: true, get: function () { return fileAccess_1.evaluateFileAccess; } });
+Object.defineProperty(exports, "applyFileAccessHeaders", { enumerable: true, get: function () { return fileAccess_1.applyFileAccessHeaders; } });
+Object.defineProperty(exports, "privateFileRule", { enumerable: true, get: function () { return fileAccess_1.privateFileRule; } });
+Object.defineProperty(exports, "attachPrivateFile", { enumerable: true, get: function () { return fileAccess_1.attachPrivateFile; } });
+Object.defineProperty(exports, "isPrivatePath", { enumerable: true, get: function () { return fileAccess_1.isPrivatePath; } });
+Object.defineProperty(exports, "privateOwnerOf", { enumerable: true, get: function () { return fileAccess_1.privateOwnerOf; } });
+Object.defineProperty(exports, "privateDirectoryFor", { enumerable: true, get: function () { return fileAccess_1.privateDirectoryFor; } });
+Object.defineProperty(exports, "PRIVATE_PREFIX", { enumerable: true, get: function () { return fileAccess_1.PRIVATE_PREFIX; } });
 // ── Database ──
 var schema_1 = require("./database/schema");
 Object.defineProperty(exports, "createSchemaConfig", { enumerable: true, get: function () { return schema_1.createSchemaConfig; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,+DAA+D;;;;AAE/D,mBAAmB;AACnB,gEAAiI;AAAxH,6GAAA,UAAU,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAG1F,8DAA0G;AAAjG,+GAAA,aAAa,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AACpE,4DAAmE;AAA1D,sHAAA,qBAAqB,OAAA;AAE9B,kEAKoF;AAL3E,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAC9E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8HAAA,0BAA0B,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC7B,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AACjC,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,8GAAA,UAAU,OAAA;AAC5C,gEAA+D;AAAtD,kHAAA,eAAe,OAAA;AAExB,4DAA8E;AAArE,qGAAA,IAAI,OAAA;AAAE,6GAAA,YAAY,OAAA;AAAE,6GAAA,YAAY,OAAA;AAEzC,8DAAmE;AAA1D,uGAAA,KAAK,OAAA;AAAE,+GAAA,aAAa,OAAA;AAE7B,cAAc;AACd,8DAA4D;AAAnD,yGAAA,UAAU,OAAA;AASnB,mBAAmB;AACnB,sEAA0H;AAAjH,iHAAA,cAAc,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAE7E,eAAe;AACf,gDAA+C;AAAtC,sGAAA,SAAS,OAAA;AAElB,0BAA0B;AAC1B,mCAA2C;AAAlC,mGAAA,YAAY,OAAA;AACrB,6CAA0D;AAAjD,wGAAA,YAAY,OAAA;AAAE,oGAAA,QAAQ,OAAA;AAC/B,+CAAwE;AAA/D,sGAAA,SAAS,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,4GAAA,eAAe,OAAA;AAG5C,kBAAkB;AAClB,yCACqG;AAD5F,oGAAA,UAAU,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,qGAAA,WAAW,OAAA;AAC3D,gHAAA,sBAAsB,OAAA;AAAE,+GAAA,qBAAqB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,+FAAA,KAAK,OAAA;AAC5E,uDAAoD;AAA3C,4GAAA,WAAW,OAAA;AAEpB,4BAA4B;AAC5B,+CAA0G;AAAjG,+GAAA,kBAAkB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAG9E,mBAAmB;AACnB,sDACqF;AAD5E,oHAAA,sBAAsB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,4GAAA,cAAc,OAAA;AACnE,oHAAA,sBAAsB,OAAA;AAAE,uHAAA,yBAAyB,OAAA;AACnD,oDAAwD;AAA/C,2GAAA,cAAc,OAAA;AAEvB,iBAAiB;AACjB,4CAAuD;AAA9C,4GAAA,kBAAkB,OAAA;AAE3B,8CAAgI;AAAvH,0GAAA,eAAe,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,0GAAA,eAAe,OAAA;AAEnG,2BAA2B;AAC3B,8DAAgF;AAAvE,oHAAA,iBAAiB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC3C,0EAA2H;AAAlH,oIAAA,2BAA2B,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAAE,iIAAA,wBAAwB,OAAA;AAGhF,qBAAqB;AACrB,kDACoF;AAD3E,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,yGAAA,cAAc,OAAA;AACpE,gHAAA,qBAAqB,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAEnD,gEAA2F;AAAlF,oHAAA,kBAAkB,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAEnD,gBAAgB;AAChB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AAExB,qDAA4E;AAAnE,kHAAA,mBAAmB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAC5C,yCAA+C;AAAtC,qGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,+DAA+D;;;;;AAE/D,mBAAmB;AACnB,gEAAiI;AAAxH,6GAAA,UAAU,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAG1F,8DAA0G;AAAjG,+GAAA,aAAa,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AACpE,4DAAmE;AAA1D,sHAAA,qBAAqB,OAAA;AAE9B,kEAKoF;AAL3E,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAC9E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8HAAA,0BAA0B,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC7B,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AACjC,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,8GAAA,UAAU,OAAA;AAC5C,gEAA+D;AAAtD,kHAAA,eAAe,OAAA;AAExB,4DAA8E;AAArE,qGAAA,IAAI,OAAA;AAAE,6GAAA,YAAY,OAAA;AAAE,6GAAA,YAAY,OAAA;AAEzC,8DAAmE;AAA1D,uGAAA,KAAK,OAAA;AAAE,+GAAA,aAAa,OAAA;AAE7B,cAAc;AACd,8DAA4D;AAAnD,yGAAA,UAAU,OAAA;AASnB,mBAAmB;AACnB,sEAA0H;AAAjH,iHAAA,cAAc,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAE7E,eAAe;AACf,gDAA+C;AAAtC,sGAAA,SAAS,OAAA;AAElB,0BAA0B;AAC1B,mCAA2C;AAAlC,mGAAA,YAAY,OAAA;AACrB,6CAA0D;AAAjD,wGAAA,YAAY,OAAA;AAAE,oGAAA,QAAQ,OAAA;AAC/B,+CAAwE;AAA/D,sGAAA,SAAS,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,4GAAA,eAAe,OAAA;AAG5C,kBAAkB;AAClB,yCACqG;AAD5F,oGAAA,UAAU,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,qGAAA,WAAW,OAAA;AAC3D,gHAAA,sBAAsB,OAAA;AAAE,+GAAA,qBAAqB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,+FAAA,KAAK,OAAA;AAC5E,uDAAoD;AAA3C,4GAAA,WAAW,OAAA;AAEpB,4BAA4B;AAC5B,+CAA0G;AAAjG,+GAAA,kBAAkB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAG9E,mBAAmB;AACnB,sDACqF;AAD5E,oHAAA,sBAAsB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,4GAAA,cAAc,OAAA;AACnE,oHAAA,sBAAsB,OAAA;AAAE,uHAAA,yBAAyB,OAAA;AACnD,oDAAwD;AAA/C,2GAAA,cAAc,OAAA;AAEvB,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,iDAGiG;AAHxF,oHAAA,sBAAsB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AACvE,gHAAA,kBAAkB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAC1C,6GAAA,eAAe,OAAA;AAAE,+GAAA,iBAAiB,OAAA;AAClC,2GAAA,aAAa,OAAA;AAAE,4GAAA,cAAc,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,4GAAA,cAAc,OAAA;AAIpE,iBAAiB;AACjB,4CAAuD;AAA9C,4GAAA,kBAAkB,OAAA;AAE3B,8CAAgI;AAAvH,0GAAA,eAAe,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,0GAAA,eAAe,OAAA;AAEnG,2BAA2B;AAC3B,8DAAgF;AAAvE,oHAAA,iBAAiB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC3C,0EAA2H;AAAlH,oIAAA,2BAA2B,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAAE,iIAAA,wBAAwB,OAAA;AAGhF,qBAAqB;AACrB,kDACoF;AAD3E,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,yGAAA,cAAc,OAAA;AACpE,gHAAA,qBAAqB,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAEnD,gEAA2F;AAAlF,oHAAA,kBAAkB,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAEnD,gBAAgB;AAChB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AAExB,qDAA4E;AAAnE,kHAAA,mBAAmB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAC5C,yCAA+C;AAAtC,qGAAA,YAAY,OAAA"}

package/dist/middleware/rateLimit.d.ts

@@ -1,10 +1,29 @@
 import { Request, Response } from 'express';
-/**
- * Check rate limit for a function + client.
- * Returns null if allowed, or an error response object if exceeded.
- */
-export declare function checkRateLimit(req: Request, res: Response, functionName: string, config: {
+/** Per-function configuration, as declared on `@CloudFunction({rateLimit})`. */
+export interface RateLimitConfig {
     windowMs: number;
     max: number;
-}): boolean;
+    /**
+     * Optional custom bucket key.
+     *
+     * This middleware runs BEFORE Parse Server validates the session, so there is
+     * no authenticated user here. Supply this only if the app can derive a
+     * trustworthy identity on its own (e.g. a validated API key). Returning
+     * anything the caller controls freely re-opens the bypass described below.
+     */
+    keyBy?: (req: Request) => string;
+}
+/**
+ * Check the rate limit for a function + client.
+ *
+ * Returns true when the request may proceed. Returns false after sending a 429,
+ * in which case the caller must not continue the chain.
+ *
+ * NOTE — the store is in-memory and therefore PER PROCESS. With N app instances
+ * the effective limit is N x `max`. For cross-instance enforcement use Parse
+ * Server's own `rateLimit` server option with `redisUrl`.
+ */
+export declare function checkRateLimit(req: Request, res: Response, functionName: string, config: RateLimitConfig): boolean;
+/** Clear all buckets. Intended for tests. */
+export declare function resetRateLimits(): void;
 //# sourceMappingURL=rateLimit.d.ts.map

package/dist/middleware/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAuC1C;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAiCT"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAO1C,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AA8DD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,eAAe,GACtB,OAAO,CAwCT;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/middleware/rateLimit.js

@@ -1,8 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRateLimit = checkRateLimit;
+exports.resetRateLimits = resetRateLimits;
 // Map<functionName, Map<clientKey, RateLimitEntry>>
 const store = new Map();
+/**
+ * Hard ceiling on tracked clients per function. A caller rotating addresses
+ * would otherwise grow this map without bound — turning the rate limiter into
+ * a memory-exhaustion vector. When the ceiling is hit we drop the oldest
+ * entries rather than stop limiting.
+ */
+const MAX_CLIENTS_PER_FUNCTION = 10000;
 // Cleanup old entries every 5 minutes
 const cleanupTimer = setInterval(() => {
     const now = Date.now();
@@ -24,34 +32,68 @@ const cleanupTimer = setInterval(() => {
 // which is the only time it has anything to do.
 cleanupTimer.unref();
 /**
- * Get client key — session token if available, fallback to IP.
+ * Resolve the bucket key for a request.
+ *
+ * SECURITY — why this is the client address and NOT the session token:
+ *
+ * Until v2.11.0 the key was `req.headers['x-parse-session-token'] || req.ip`.
+ * That header is supplied by the caller and is NOT validated at this point in
+ * the pipeline, so sending a fresh random token on every request minted a fresh
+ * bucket each time and the limit did nothing at all. No account was needed.
+ *
+ * The address is the only identifier available here that the caller cannot
+ * multiply at will.
+ *
+ * `req.ip` honours Express's `trust proxy` setting. The app MUST configure that
+ * precisely — a hop count, or the proxy's address. With a permissive value
+ * (`true`) a caller sets `X-Forwarded-For: 127.0.0.1` and spoofs the key, which
+ * is the same bypass Parse Server fixed in 9.10.1 for its own limiter. When
+ * `trust proxy` is unset, Express already ignores the header and `req.ip` is
+ * the socket address, which is what we want.
  */
-function getClientKey(req) {
-    return req.headers['x-parse-session-token'] || req.ip || 'unknown';
+function getClientKey(req, config) {
+    if (config.keyBy) {
+        return config.keyBy(req);
+    }
+    return req.ip || req.socket?.remoteAddress || 'unknown';
 }
 /**
- * Check rate limit for a function + client.
- * Returns null if allowed, or an error response object if exceeded.
+ * Check the rate limit for a function + client.
+ *
+ * Returns true when the request may proceed. Returns false after sending a 429,
+ * in which case the caller must not continue the chain.
+ *
+ * NOTE — the store is in-memory and therefore PER PROCESS. With N app instances
+ * the effective limit is N x `max`. For cross-instance enforcement use Parse
+ * Server's own `rateLimit` server option with `redisUrl`.
  */
 function checkRateLimit(req, res, functionName, config) {
-    const clientKey = getClientKey(req);
+    const clientKey = getClientKey(req, config);
     const now = Date.now();
-    // Get or create function map
     if (!store.has(functionName)) {
         store.set(functionName, new Map());
     }
     const clients = store.get(functionName);
-    // Get or create client entry
     const entry = clients.get(clientKey);
     if (!entry || now > entry.resetAt) {
-        // First request or window expired — start fresh
+        // First request in this window — start fresh.
+        if (!entry && clients.size >= MAX_CLIENTS_PER_FUNCTION) {
+            // Evict the oldest-expiring entries to make room. Map preserves insertion
+            // order, so the head is the least recently added.
+            const toEvict = Math.ceil(MAX_CLIENTS_PER_FUNCTION * 0.1);
+            let evicted = 0;
+            for (const key of clients.keys()) {
+                clients.delete(key);
+                if (++evicted >= toEvict)
+                    break;
+            }
+        }
         clients.set(clientKey, { count: 1, resetAt: now + config.windowMs });
-        return true; // allowed
+        return true;
     }
     if (entry.count < config.max) {
-        // Under limit
         entry.count++;
-        return true; // allowed
+        return true;
     }
     // Exceeded — send 429
     const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
@@ -60,6 +102,10 @@ function checkRateLimit(req, res, functionName, config) {
         message: `Too many requests. Try again in ${retryAfter} seconds.`,
         retryAfter,
     });
-    return false; // blocked
+    return false;
+}
+/** Clear all buckets. Intended for tests. */
+function resetRateLimits() {
+    store.clear();
 }
 //# sourceMappingURL=rateLimit.js.map

package/dist/middleware/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":";;AA2CA,wCAsCC;AA1ED,oDAAoD;AACpD,MAAM,KAAK,GAA6C,IAAI,GAAG,EAAE,CAAC;AAElE,sCAAsC;AACtC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAElB,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,gDAAgD;AAChD,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB;;GAEG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,OAAQ,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAY,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,YAAoB,EACpB,MAAyC;IAEzC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,6BAA6B;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;IAEzC,6BAA6B;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,cAAc;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,mCAAmC,UAAU,WAAW;QACjE,UAAU;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,CAAC,UAAU;AAC1B,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/middleware/rateLimit.ts"],"names":[],"mappings":";;AA4FA,wCA6CC;AAGD,0CAEC;AAxHD,oDAAoD;AACpD,MAAM,KAAK,GAA6C,IAAI,GAAG,EAAE,CAAC;AAElE;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAExC,sCAAsC;AACtC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAElB,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,gDAAgD;AAChD,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,MAAuB;IACzD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,YAAoB,EACpB,MAAuB;IAEvB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,8CAA8C;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;YACvD,0EAA0E;YAC1E,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,EAAE,OAAO,IAAI,OAAO;oBAAE,MAAM;YAClC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,mCAAmC,UAAU,WAAW;QACjE,UAAU;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,SAAgB,eAAe;IAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@90soft/parse-server-kit",
-  "version": "2.10.1",
+  "version": "2.12.0",
   "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -34,14 +34,14 @@
     "url": "https://git.90-soft.com/90_soft/parse-server-kit.git"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "peerDependencies": {
     "@types/parse": ">=3.0.0",
     "express": ">=4.0.0",
     "node-cron": ">=3.0.0",
-    "parse": ">=5.0.0",
-    "parse-server": ">=8.3.0",
+    "parse": ">=8.0.0",
+    "parse-server": ">=9.0.0",
     "reflect-metadata": ">=0.1.13",
     "swagger-ui-express": ">=4.0.0"
   },
@@ -67,8 +67,8 @@
     "jest": "^29.7.0",
     "mongodb-memory-server": "^11.2.0",
     "node-cron": "^4.0.0",
-    "parse": "^5.3.0",
-    "parse-server": "^9.10.0",
+    "parse": "^8.6.2",
+    "parse-server": "^9.10.4",
     "reflect-metadata": "^0.2.2",
     "swagger-ui-express": "^5.0.1",
     "ts-jest": "^29.2.0",