@90soft/parse-server-kit 2.11.0 → 2.13.0

package/CHANGELOG.md

@@ -8,6 +8,131 @@ All notable changes to `@90soft/parse-server-kit`.
 
 ---
 
+## [2.13.0]
+
+### Changed — BREAKING (file access rules, added in 2.12.0)
+
+- **The governed prefix is `acl/`, not `private/`, and the API is renamed to
+  match.**
+
+  `private` was wrong in the most confusing way possible. The commonest case is
+  a **publicly readable** row — a login background, say — whose file is then
+  correctly served to everybody, from a url that said `private`. The prefix
+  never meant "secret". It means **the owning row decides**, and a public row
+  decides "everyone".
+
+  Renamed now because the prefix is baked into stored filenames: changing it
+  later orphans every file already written under the old one. 2.12.0 was hours
+  old and had one consumer.
+
+  | 2.12.0 | 2.13.0 |
+  |---|---|
+  | `private/<Class>/<objectId>/` | `acl/<Class>/<objectId>/` |
+  | `PRIVATE_PREFIX` | `ACL_PREFIX` |
+  | `isPrivatePath` | `isAclGoverned` |
+  | `privateOwnerOf` | `aclOwnerOf` |
+  | `privateDirectoryFor` | `aclDirectoryFor` |
+  | `attachPrivateFile` | `attachAclFile` |
+  | `privateFileRule` | `aclFileRule` |
+  | `PrivateFileOwner` | `AclFileOwner` |
+  | `PrivateFileRuleOptions` | `AclFileRuleOptions` |
+
+  **Migrating:** rename the imports, then **re-upload** anything already stored
+  under `private/`. Those files keep working — but as ordinary public Parse
+  files, because the guard no longer recognises their path. There is no
+  rewriting a stored filename.
+
+  The `Cache-Control: private, no-store` default is unchanged: that `private`
+  is the HTTP cache directive and has nothing to do with the prefix.
+
+  Version 2.13.0 rather than 3.0.0 despite being breaking: 3.0.0 is reserved
+  for the public `parse-server-kit` package (see the note at the top of this
+  file).
+
+---
+
+## [2.12.0]
+
+### Added
+
+- **File access rules — a file's PATH can now carry a permission.**
+
+  Parse has no per-file permission and cannot have one: the file router is
+  handed a name, and a name does not know which row references it. So a file
+  url is a bearer capability — anyone holding the string gets the bytes, with
+  no session, no ACL check and no expiry. Fine for published pictures; not fine
+  for a document, where a url that leaks once works forever, for anyone.
+
+  Parse does give one hook, `beforeFind` on `Parse.File`. This release owns it
+  and makes it usable:
+
+  ```ts
+  import {registerFileAccessRule, privateFileRule, attachPrivateFile} from '@90soft/parse-server-kit';
+
+  registerFileAccessRule(privateFileRule());        // once, in cloud code
+  await attachPrivateFile(row, 'document', upload); // stores under private/<Class>/<objectId>/
+  ```
+
+  A file stored under `private/<ClassName>/<objectId>/` is then served only to
+  a caller who can read THAT row, loaded **as the caller** so Parse evaluates
+  the row's ACL and the class's CLP exactly as it would for a query. The
+  permission is not a copy of the row's ACL; it IS the row's ACL — nothing to
+  stamp, nothing to sync, no second source of truth.
+
+  Why not signed urls: a signed url is the same bearer token on a timer. It
+  leaks the same ways, forces a refresh dance and cache invalidation on every
+  client, and cannot express "this account was banned thirty seconds ago". The
+  rule re-checks every request.
+
+  **Nothing is registered until you add a rule**, so upgrading changes no
+  behaviour in a project that does not opt in, and a project that already
+  registers its own file trigger is not quietly overridden.
+
+  **Five traps this exists to absorb**, each of which cost real debugging:
+
+  1. **There is exactly ONE slot.** File triggers are keyed on the pseudo-class
+     `@File`, so a second `beforeFind(Parse.File)` anywhere REPLACES the first
+     — Parse logs "Only the last one will be used" and keeps serving. Two
+     features each registering a rule would silently disable one. Hence a
+     registry: the kit holds the slot, rules compose in registration order.
+  2. **Response headers come from `afterFind`.** `beforeFind`'s
+     `responseHeaders` are discarded. A rule's `headers` are applied in the
+     right place, including on a refusal, so a denial is not cached either.
+  3. **Only a header authenticates.** The file GET route reads the session from
+     `X-Parse-Session-Token` and nowhere else — no query parameter, no cookie.
+     A browser `<img src>` therefore cannot fetch a governed file; fetch it and
+     bind a blob. The upside: nobody can "simplify" this by putting a session
+     token in a url, because Parse will not read one there.
+  4. **A throw is global.** This runs on every file download in the app, so a
+     mistake does not break documents — it blanks every image at once. The
+     public path is one string comparison before any `await`, a rule whose
+     predicate throws is skipped rather than fatal, and the behaviour is
+     tested.
+  5. **Fail-open is the invisible failure.** "I cannot tell who owns this" must
+     mean refuse. `isPrivatePath` (is it governed?) and `privateOwnerOf` (who
+     owns it?) are deliberately separate functions, because a single predicate
+     returning `owner | null` conflates them: it answers `null` both for an
+     ordinary image and for `private/<Class>/<id>/extra/doc.jpg`, one directory
+     deeper than expected — and would serve that document to anybody, with the
+     symptom that it loads perfectly.
+
+  `Parse.File.setDirectory` / `.name()` / `.directory()` are now declared, and
+  `Parse.Cloud.beforeFind` / `afterFind` accept a class as well as a class name.
+  `@types/parse` is a hand-written stub that predates file directories (and is
+  empty from 6.x), so these are declared once here rather than cast at every
+  call site.
+
+  Requires Parse Server **>= 9.5.0** for file directories; verified against
+  9.10.4. 20 tests.
+
+### Changed
+
+- Development now runs against `parse-server` **9.10.4** (was 9.10.1). The peer
+  range is unchanged at `>=9.0.0` — nothing here needs the newer server except
+  the file directories above, which are a 9.5.0 feature.
+
+---
+
 ## [2.11.0]
 
 ### Security

package/dist/files/fileAccess.d.ts

@@ -0,0 +1,235 @@
+/**
+ * File access rules — turn a file's PATH into a permission.
+ *
+ * Parse has no per-file permission and cannot have one: the file router is
+ * handed a name, and a name does not know which row references it. So a file
+ * url is a bearer capability — anyone holding the string gets the bytes, with
+ * no session, no ACL check and no expiry. For published pictures that is
+ * correct and cheap. For a document (a certificate, an ID photo, an invoice) it
+ * is not: a url that leaks once works forever, for anyone, which is a
+ * REVOCATION problem that signed urls do not solve — a signed url is the same
+ * bearer token on a timer, and it cannot express "this account was banned
+ * thirty seconds ago".
+ *
+ * Parse does give us one hook: `beforeFind` on `Parse.File`, which runs on
+ * every `GET /files/...` and can throw to refuse. This module owns that hook
+ * and makes it usable, because using it directly has five traps:
+ *
+ *   1. **There is exactly ONE slot.** File triggers are keyed on the
+ *      pseudo-class `@File`, not on a class, so a second
+ *      `beforeFind(Parse.File)` anywhere REPLACES the first — Parse logs
+ *      "Only the last one will be used" and carries on serving. Two features
+ *      each registering their own rule would silently disable one of them.
+ *      Hence a registry: this module holds the slot, rules compose.
+ *   2. **The headers come from `afterFind`.** `beforeFind`'s `responseHeaders`
+ *      are discarded; only the `afterFind` request's are written to the
+ *      response. A rule that marks a response uncacheable has to act there.
+ *   3. **Only a header authenticates.** The file GET route reads the session
+ *      from `X-Parse-Session-Token` and nowhere else — no query parameter, no
+ *      cookie. A browser `<img src>` therefore cannot fetch a governed file;
+ *      the client must fetch it and bind a blob. The upside is that nobody can
+ *      "simplify" this by putting a session token in a url.
+ *   4. **A throw is global.** This runs on every file download in the app, so
+ *      a mistake does not break documents, it blanks every image at once.
+ *      Everything on the public path here is a string comparison, before any
+ *      `await`, and cannot throw.
+ *   5. **Fail-open is the invisible failure.** If "I cannot tell who owns
+ *      this" is treated as "public", the document is served and the symptom is
+ *      that it loads perfectly. So governed-but-unidentifiable must REFUSE.
+ *
+ * **Nothing is registered until a rule is added.** Upgrading the kit therefore
+ * changes no behaviour in a project that does not opt in, and a project that
+ * already registers its own file trigger is not quietly overridden.
+ *
+ * The usual setup, in cloud code:
+ *
+ * ```ts
+ * import {registerFileAccessRule, aclFileRule} from '@90soft/parse-server-kit';
+ * registerFileAccessRule(aclFileRule());
+ * ```
+ *
+ * [aclFileRule] is the general case: a file stored under
+ * `acl/<ClassName>/<objectId>/` is served only to a caller who can read
+ * THAT row, judged by Parse's own ACL and CLP. The permission is not a copy of
+ * the row's ACL; it IS the row's ACL — nothing to stamp, nothing to sync.
+ */
+/**
+ * What a FILE trigger is handed, which is not what a class trigger gets: there
+ * is no `object` and no `query`, only the file.
+ *
+ * Declared HERE rather than taken from the ambient Parse types on purpose.
+ * `@types/parse` does not describe file triggers at all, so a consumer relying
+ * on it could not name the argument of [evaluateFileAccess] — a published
+ * library should not require its callers to declare types for its own API.
+ */
+export interface FileTriggerRequest {
+    file?: Parse.File;
+    fileSize?: number;
+    master?: boolean;
+    isReadOnly?: boolean;
+    user?: Parse.User;
+    ip?: string;
+    forceDownload?: boolean;
+    responseHeaders?: Record<string, string>;
+}
+/** The decision a rule is asked to make. */
+export interface FileAccessContext {
+    /** The stored path, including any directory prefix. */
+    path: string;
+    /** The caller, when they sent a session token. */
+    user?: Parse.User;
+    /** True for a master-key request. */
+    master: boolean;
+}
+/** One rule, governing some subset of stored files. */
+export interface FileAccessRule {
+    /**
+     * Identifies the rule in diagnostics, and makes replacing one deliberate:
+     * registering the same name twice warns rather than stacking silently.
+     */
+    name: string;
+    /**
+     * Does this rule govern that path?
+     *
+     * **Must not throw and should not await.** It is consulted for every file
+     * download in the application, including every public image.
+     */
+    governs(path: string): boolean;
+    /**
+     * Decide. Throw a `Parse.Error` to refuse.
+     *
+     * Returning normally allows the download. Only called when [governs] said
+     * yes and the request is not master-key.
+     */
+    authorize(context: FileAccessContext): Promise<void> | void;
+    /**
+     * Headers to add to a governed response, e.g. `Cache-Control`.
+     *
+     * Applied whenever [governs] matches — including on a refusal, so that a
+     * denial is not cached either.
+     */
+    headers?: Record<string, string>;
+}
+/**
+ * The gate. Public files leave before anything is awaited.
+ *
+ * Exported so a project can unit-test its rules without going through HTTP.
+ */
+export declare function evaluateFileAccess(request: FileTriggerRequest): Promise<void>;
+/**
+ * Add the governed response's headers.
+ *
+ * Separate from [evaluateFileAccess] because Parse reads response headers from
+ * the `afterFind` request and ignores `beforeFind`'s.
+ */
+export declare function applyFileAccessHeaders(request: FileTriggerRequest): void;
+/**
+ * Register a rule, attaching the Parse hooks on the first call.
+ *
+ * Order matters: rules are consulted in registration order and the first match
+ * decides, so register the most specific first.
+ */
+export declare function registerFileAccessRule(rule: FileAccessRule): void;
+/** Registered rules, in order. For diagnostics and tests. */
+export declare function getFileAccessRules(): FileAccessRule[];
+/**
+ * Drop every rule. For tests.
+ *
+ * The Parse hooks stay attached — they are harmless with no rules, since every
+ * path is then public — and re-attaching would hit Parse's duplicate warning.
+ */
+export declare function clearFileAccessRules(): void;
+/**
+ * The directory prefix marking a file as governed by [aclFileRule].
+ *
+ * **Named for the mechanism, not the outcome.** It was `private` first, which
+ * was wrong in the most confusing way: the commonest case is a PUBLICLY
+ * readable row, whose file is then served to everybody — from a path that
+ * said "private". The prefix does not mean secret. It means **the owning row
+ * decides**, and a public row decides "everyone".
+ *
+ * Renamed before anything depended on it, because the prefix is baked into
+ * stored filenames: changing it later orphans every file already written.
+ *
+ * Parse's own `validateDirectory` reserves `metadata` and requires a directory
+ * to match `^[a-zA-Z0-9][a-zA-Z0-9_\-/]*$`, so a single lowercase word is safe.
+ * It is baked into stored file names, so changing it would orphan every file
+ * already written under the old one.
+ */
+export declare const ACL_PREFIX = "acl";
+/** Who an ACL-governed file's path says owns it. */
+export interface AclFileOwner {
+    className: string;
+    objectId: string;
+}
+/**
+ * Is this path governed at all?
+ *
+ * Deliberately separate from [aclOwnerOf], and the separation is the
+ * safety property: "under the prefix" and "parses into an owner" are different
+ * questions, and a single predicate returning `owner | null` conflates them
+ * into a fail-OPEN. It would answer `null` both for an ordinary image and for
+ * `acl/<Class>/<id>/extra/doc.jpg` — one directory deeper than expected —
+ * and so serve that document to anybody.
+ */
+export declare function isAclGoverned(path: string): boolean;
+/**
+ * Read the owner out of a governed path, or null if it is not well formed.
+ *
+ * `null` means "I cannot tell who owns this", which the rule treats as a
+ * refusal — never as permission.
+ */
+export declare function aclOwnerOf(path: string): AclFileOwner | null;
+/**
+ * The directory a row's ACL-governed files live in.
+ *
+ * Throws rather than quietly producing something Parse will reject: a class
+ * whose name cannot be a path segment (`_User`, since a directory must start
+ * alphanumeric) surfaces here, at the one call site, instead of as a confusing
+ * upload failure later.
+ */
+export declare function aclDirectoryFor(className: string, objectId: string): string;
+/**
+ * Store a file so that the owning row's ACL governs it.
+ *
+ * The row must already be saved — its objectId is part of the path, which is
+ * what lets the rule find the owner with no index and no second source of
+ * truth. For a new record that means save, attach, save again: one extra write
+ * on a rare operation.
+ *
+ * **This should be the only way an application stores a governed file.** The
+ * prefix is the entire boundary: a document saved without it is simply public,
+ * and nothing anywhere will complain.
+ *
+ * Private files deliberately get no derivatives — no converted copy, no
+ * thumbnail, and no blurhash, which is a small preview of the document and
+ * travels inside DTOs where the document itself does not.
+ */
+export declare function attachAclFile(row: Parse.Object, field: string, upload: {
+    base64: string;
+    name?: string;
+}): Promise<void>;
+/** Options for [aclFileRule]. */
+export interface AclFileRuleOptions {
+    /**
+     * Headers for a governed response. Defaults to `private, no-store`.
+     *
+     * That `private` is the HTTP cache directive, unrelated to the prefix.
+     *
+     * One cached governed response served to the next caller undoes the whole
+     * check, and the symptom is that the document loads — so this defaults to
+     * the strict value rather than being left to the caller.
+     */
+    headers?: Record<string, string>;
+}
+/**
+ * Serve a governed file only to a caller who can read its owning row.
+ *
+ * The caller is resolved from their session token, so Parse evaluates the
+ * row's ACL and the class's CLP exactly as it would for a query. With no
+ * session the row is loaded with no auth, which is right rather than a
+ * shortcut: if the owning row is publicly readable then its file is public
+ * too, because the row's ACL is the whole rule.
+ */
+export declare function aclFileRule(options?: AclFileRuleOptions): FileAccessRule;
+//# sourceMappingURL=fileAccess.d.ts.map

package/dist/files/fileAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAccess.d.ts","sourceRoot":"","sources":["../../src/files/fileAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC;IAClB,qCAAqC;IACrC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAiCD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAsBjE;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,IAAI,cAAc,EAAE,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,QAAQ,CAAC;AAEhC,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAW5D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAc3E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,CAAC,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,iCAAiC;AACjC,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,kBAAuB,GAC/B,cAAc,CA8BhB"}

package/dist/files/fileAccess.js

@@ -0,0 +1,303 @@
+"use strict";
+/**
+ * File access rules — turn a file's PATH into a permission.
+ *
+ * Parse has no per-file permission and cannot have one: the file router is
+ * handed a name, and a name does not know which row references it. So a file
+ * url is a bearer capability — anyone holding the string gets the bytes, with
+ * no session, no ACL check and no expiry. For published pictures that is
+ * correct and cheap. For a document (a certificate, an ID photo, an invoice) it
+ * is not: a url that leaks once works forever, for anyone, which is a
+ * REVOCATION problem that signed urls do not solve — a signed url is the same
+ * bearer token on a timer, and it cannot express "this account was banned
+ * thirty seconds ago".
+ *
+ * Parse does give us one hook: `beforeFind` on `Parse.File`, which runs on
+ * every `GET /files/...` and can throw to refuse. This module owns that hook
+ * and makes it usable, because using it directly has five traps:
+ *
+ *   1. **There is exactly ONE slot.** File triggers are keyed on the
+ *      pseudo-class `@File`, not on a class, so a second
+ *      `beforeFind(Parse.File)` anywhere REPLACES the first — Parse logs
+ *      "Only the last one will be used" and carries on serving. Two features
+ *      each registering their own rule would silently disable one of them.
+ *      Hence a registry: this module holds the slot, rules compose.
+ *   2. **The headers come from `afterFind`.** `beforeFind`'s `responseHeaders`
+ *      are discarded; only the `afterFind` request's are written to the
+ *      response. A rule that marks a response uncacheable has to act there.
+ *   3. **Only a header authenticates.** The file GET route reads the session
+ *      from `X-Parse-Session-Token` and nowhere else — no query parameter, no
+ *      cookie. A browser `<img src>` therefore cannot fetch a governed file;
+ *      the client must fetch it and bind a blob. The upside is that nobody can
+ *      "simplify" this by putting a session token in a url.
+ *   4. **A throw is global.** This runs on every file download in the app, so
+ *      a mistake does not break documents, it blanks every image at once.
+ *      Everything on the public path here is a string comparison, before any
+ *      `await`, and cannot throw.
+ *   5. **Fail-open is the invisible failure.** If "I cannot tell who owns
+ *      this" is treated as "public", the document is served and the symptom is
+ *      that it loads perfectly. So governed-but-unidentifiable must REFUSE.
+ *
+ * **Nothing is registered until a rule is added.** Upgrading the kit therefore
+ * changes no behaviour in a project that does not opt in, and a project that
+ * already registers its own file trigger is not quietly overridden.
+ *
+ * The usual setup, in cloud code:
+ *
+ * ```ts
+ * import {registerFileAccessRule, aclFileRule} from '@90soft/parse-server-kit';
+ * registerFileAccessRule(aclFileRule());
+ * ```
+ *
+ * [aclFileRule] is the general case: a file stored under
+ * `acl/<ClassName>/<objectId>/` is served only to a caller who can read
+ * THAT row, judged by Parse's own ACL and CLP. The permission is not a copy of
+ * the row's ACL; it IS the row's ACL — nothing to stamp, nothing to sync.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACL_PREFIX = void 0;
+exports.evaluateFileAccess = evaluateFileAccess;
+exports.applyFileAccessHeaders = applyFileAccessHeaders;
+exports.registerFileAccessRule = registerFileAccessRule;
+exports.getFileAccessRules = getFileAccessRules;
+exports.clearFileAccessRules = clearFileAccessRules;
+exports.isAclGoverned = isAclGoverned;
+exports.aclOwnerOf = aclOwnerOf;
+exports.aclDirectoryFor = aclDirectoryFor;
+exports.attachAclFile = attachAclFile;
+exports.aclFileRule = aclFileRule;
+/** Ordered; the first rule that governs a path decides it. */
+const rules = [];
+/** The hook is attached once, lazily, on the first registration. */
+let attached = false;
+/**
+ * 404, never 403.
+ *
+ * A 403 confirms the file is there and merely forbidden, which for a document
+ * is itself the leak — it tells the caller that a particular row has one.
+ * "Not found" is the same answer an invented name would get.
+ */
+function notFound() {
+    return new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'File not found');
+}
+/** The first rule governing this path, or undefined when the file is public. */
+function ruleFor(path) {
+    for (const rule of rules) {
+        // A rule that throws here would blank every image in the app, so one
+        // misbehaving rule must not take the public path down with it.
+        try {
+            if (rule.governs(path))
+                return rule;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+/**
+ * The gate. Public files leave before anything is awaited.
+ *
+ * Exported so a project can unit-test its rules without going through HTTP.
+ */
+async function evaluateFileAccess(request) {
+    const path = request.file?.name() ?? '';
+    const rule = ruleFor(path);
+    if (!rule)
+        return;
+    // Cloud code reading deliberately with the master key. Note this is NOT how
+    // a worker that fetches a url reaches a file: a plain GET carries no key.
+    if (request.master)
+        return;
+    await rule.authorize({
+        path,
+        user: request.user,
+        master: false,
+    });
+}
+/**
+ * Add the governed response's headers.
+ *
+ * Separate from [evaluateFileAccess] because Parse reads response headers from
+ * the `afterFind` request and ignores `beforeFind`'s.
+ */
+function applyFileAccessHeaders(request) {
+    const rule = ruleFor(request.file?.name() ?? '');
+    if (!rule?.headers)
+        return;
+    // The incoming object already carries `X-Content-Type-Options: nosniff`, so
+    // extend it rather than replacing it.
+    request.responseHeaders = { ...(request.responseHeaders ?? {}), ...rule.headers };
+}
+/**
+ * Register a rule, attaching the Parse hooks on the first call.
+ *
+ * Order matters: rules are consulted in registration order and the first match
+ * decides, so register the most specific first.
+ */
+function registerFileAccessRule(rule) {
+    const existing = rules.findIndex(r => r.name === rule.name);
+    if (existing >= 0) {
+        console.warn(`[FileAccess] Replacing existing rule "${rule.name}". Two rules with one name is almost always an accident.`);
+        rules.splice(existing, 1, rule);
+    }
+    else {
+        rules.push(rule);
+    }
+    if (attached)
+        return;
+    attached = true;
+    /*
+     * `Parse.File` is passed as the class, which Parse maps to `@File`. This is
+     * the only pair of triggers in a kit project that is not declared on a model
+     * with `@BeforeFind` / `@AfterFind`, because there is no model to declare it
+     * on.
+     */
+    Parse.Cloud.beforeFind(Parse.File, evaluateFileAccess);
+    Parse.Cloud.afterFind(Parse.File, applyFileAccessHeaders);
+}
+/** Registered rules, in order. For diagnostics and tests. */
+function getFileAccessRules() {
+    return [...rules];
+}
+/**
+ * Drop every rule. For tests.
+ *
+ * The Parse hooks stay attached — they are harmless with no rules, since every
+ * path is then public — and re-attaching would hit Parse's duplicate warning.
+ */
+function clearFileAccessRules() {
+    rules.length = 0;
+}
+// ── The ACL-governed rule ───────────────────────────────────────────────────
+/**
+ * The directory prefix marking a file as governed by [aclFileRule].
+ *
+ * **Named for the mechanism, not the outcome.** It was `private` first, which
+ * was wrong in the most confusing way: the commonest case is a PUBLICLY
+ * readable row, whose file is then served to everybody — from a path that
+ * said "private". The prefix does not mean secret. It means **the owning row
+ * decides**, and a public row decides "everyone".
+ *
+ * Renamed before anything depended on it, because the prefix is baked into
+ * stored filenames: changing it later orphans every file already written.
+ *
+ * Parse's own `validateDirectory` reserves `metadata` and requires a directory
+ * to match `^[a-zA-Z0-9][a-zA-Z0-9_\-/]*$`, so a single lowercase word is safe.
+ * It is baked into stored file names, so changing it would orphan every file
+ * already written under the old one.
+ */
+exports.ACL_PREFIX = 'acl';
+/**
+ * Is this path governed at all?
+ *
+ * Deliberately separate from [aclOwnerOf], and the separation is the
+ * safety property: "under the prefix" and "parses into an owner" are different
+ * questions, and a single predicate returning `owner | null` conflates them
+ * into a fail-OPEN. It would answer `null` both for an ordinary image and for
+ * `acl/<Class>/<id>/extra/doc.jpg` — one directory deeper than expected —
+ * and so serve that document to anybody.
+ */
+function isAclGoverned(path) {
+    return typeof path === 'string' && path.startsWith(`${exports.ACL_PREFIX}/`);
+}
+/**
+ * Read the owner out of a governed path, or null if it is not well formed.
+ *
+ * `null` means "I cannot tell who owns this", which the rule treats as a
+ * refusal — never as permission.
+ */
+function aclOwnerOf(path) {
+    if (!isAclGoverned(path))
+        return null;
+    // Exactly: acl / ClassName / objectId / filename
+    const parts = path.split('/');
+    if (parts.length !== 4)
+        return null;
+    const [, className, objectId, filename] = parts;
+    if (!className || !objectId || !filename)
+        return null;
+    return { className, objectId };
+}
+/**
+ * The directory a row's ACL-governed files live in.
+ *
+ * Throws rather than quietly producing something Parse will reject: a class
+ * whose name cannot be a path segment (`_User`, since a directory must start
+ * alphanumeric) surfaces here, at the one call site, instead of as a confusing
+ * upload failure later.
+ */
+function aclDirectoryFor(className, objectId) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_]*$/.test(className)) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, `${className} cannot own ACL-governed files: Parse requires a directory segment to start with a letter or digit`);
+    }
+    if (!/^[a-zA-Z0-9]+$/.test(objectId)) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, 'An ACL-governed file needs the owning row saved first, so that it has an objectId');
+    }
+    return `${exports.ACL_PREFIX}/${className}/${objectId}`;
+}
+/**
+ * Store a file so that the owning row's ACL governs it.
+ *
+ * The row must already be saved — its objectId is part of the path, which is
+ * what lets the rule find the owner with no index and no second source of
+ * truth. For a new record that means save, attach, save again: one extra write
+ * on a rare operation.
+ *
+ * **This should be the only way an application stores a governed file.** The
+ * prefix is the entire boundary: a document saved without it is simply public,
+ * and nothing anywhere will complain.
+ *
+ * Private files deliberately get no derivatives — no converted copy, no
+ * thumbnail, and no blurhash, which is a small preview of the document and
+ * travels inside DTOs where the document itself does not.
+ */
+async function attachAclFile(row, field, upload) {
+    if (!row.id) {
+        throw new Parse.Error(Parse.Error.OTHER_CAUSE, 'Save the row before attaching a governed file — its objectId is part of the path');
+    }
+    const file = new Parse.File(encodeURIComponent(upload.name ?? 'document'), {
+        base64: upload.base64,
+    });
+    // Sent as `X-Parse-File-Directory`; honoured by Parse Server from 9.5.0.
+    file.setDirectory(aclDirectoryFor(row.className, row.id));
+    const saved = await file.save({ useMasterKey: true });
+    row.set(field, saved);
+}
+/**
+ * Serve a governed file only to a caller who can read its owning row.
+ *
+ * The caller is resolved from their session token, so Parse evaluates the
+ * row's ACL and the class's CLP exactly as it would for a query. With no
+ * session the row is loaded with no auth, which is right rather than a
+ * shortcut: if the owning row is publicly readable then its file is public
+ * too, because the row's ACL is the whole rule.
+ */
+function aclFileRule(options = {}) {
+    const headers = options.headers ?? { 'Cache-Control': 'private, no-store' };
+    return {
+        name: 'acl-prefix',
+        headers,
+        governs: isAclGoverned,
+        async authorize({ path, user }) {
+            /*
+             * Under the prefix but not a shape we understand: REFUSE.
+             *
+             * Treating it as public because no owner could be found is the one
+             * failure mode of this design that nobody would notice, because the
+             * document would load perfectly.
+             */
+            const owner = aclOwnerOf(path);
+            if (!owner)
+                throw notFound();
+            const sessionToken = user?.getSessionToken();
+            const query = new Parse.Query(owner.className);
+            const row = await (sessionToken
+                ? query.get(owner.objectId, { sessionToken })
+                : query.get(owner.objectId)).catch(() => null);
+            if (!row)
+                throw notFound();
+        },
+    };
+}
+//# sourceMappingURL=fileAccess.js.map

package/dist/files/fileAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileAccess.js","sourceRoot":"","sources":["../../src/files/fileAccess.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAqGH,gDAiBC;AAQD,wDASC;AAQD,wDAsBC;AAGD,gDAEC;AAQD,oDAEC;AAuCD,sCAEC;AAQD,gCAWC;AAUD,0CAcC;AAkBD,sCAoBC;AAyBD,kCAgCC;AAtSD,8DAA8D;AAC9D,MAAM,KAAK,GAAqB,EAAE,CAAC;AAEnC,oEAAoE;AACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB;;;;;;GAMG;AACH,SAAS,QAAQ;IACf,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAExC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO;IAE3B,MAAM,IAAI,CAAC,SAAS,CAAC;QACnB,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,OAAO;QAAE,OAAO;IAE3B,4EAA4E;IAC5E,sCAAsC;IACtC,OAAO,CAAC,eAAe,GAAG,EAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAoB;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,yCAAyC,IAAI,CAAC,IAAI,0DAA0D,CAC7G,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAEhB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACvD,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAED,6DAA6D;AAC7D,SAAgB,kBAAkB;IAChC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB;IAClC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,UAAU,GAAG,KAAK,CAAC;AAQhC;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,kBAAU,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,iDAAiD;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,SAAiB,EAAE,QAAgB;IACjE,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,GAAG,SAAS,oGAAoG,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,kBAAU,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,aAAa,CACjC,GAAiB,EACjB,KAAa,EACb,MAAuC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,KAAK,CAAC,WAAW,EACvB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QACzE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,yEAAyE;IACzE,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAgBD;;;;;;;;GAQG;AACH,SAAgB,WAAW,CACzB,UAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAC,eAAe,EAAE,mBAAmB,EAAC,CAAC;IAE1E,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,OAAO;QACP,OAAO,EAAE,aAAa;QAEtB,KAAK,CAAC,SAAS,CAAC,EAAC,IAAI,EAAE,IAAI,EAAC;YAC1B;;;;;;eAMG;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK;gBAAE,MAAM,QAAQ,EAAE,CAAC;YAE7B,MAAM,YAAY,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE/C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY;gBAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAC,YAAY,EAAC,CAAC;gBAC3C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC5B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAEpB,IAAI,CAAC,GAAG;gBAAE,MAAM,QAAQ,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -24,6 +24,8 @@ export { configureRoleCache, invalidateRoles, roleCacheEnabled, roleCacheStats }
 export type { RoleCacheOptions } from './utils/roleCache';
 export { validateFunctionRoutes, validateEntityRoutes, restrictRoutes, removeResultMiddleware, conditionalJsonMiddleware } from './middleware/middleware';
 export { checkRateLimit } from './middleware/rateLimit';
+export { registerFileAccessRule, getFileAccessRules, clearFileAccessRules, evaluateFileAccess, applyFileAccessHeaders, aclFileRule, attachAclFile, isAclGoverned, aclOwnerOf, aclDirectoryFor, ACL_PREFIX } from './files/fileAccess';
+export type { FileAccessRule, FileAccessContext, FileTriggerRequest, AclFileOwner, AclFileRuleOptions } from './files/fileAccess';
 export { createSchemaConfig } from './database/schema';
 export type { SchemaConfigOptions } from './database/schema';
 export { applyAllIndexes, applyUniqueIndexes, getUniqueIndexes, getCompoundIndexes, getFieldIndexes } from './database/indexes';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjI,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAC9E,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAChE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAChE,cAAc,EAAE,aAAa,EAC7B,gBAAgB,EAAE,eAAe,EACjC,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EACnF,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEpJ,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAChF,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAG1H,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAC3D,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC1G,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EACnE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGhI,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGvG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EACpE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG3F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjI,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAC9E,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAChE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAChE,cAAc,EAAE,aAAa,EAC7B,gBAAgB,EAAE,eAAe,EACjC,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EACnF,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEpJ,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtH,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAChF,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAG1H,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAC3D,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC1G,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,cAAc,EACnE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOxD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,EACvE,kBAAkB,EAAE,sBAAsB,EAC1C,WAAW,EAAE,aAAa,EAC1B,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrF,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAC/E,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGhI,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGvG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EACpE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG3F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -2,7 +2,8 @@
 // @90soft/parse-server-kit — complete toolkit for Parse Server
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserRoles = exports.catchError = exports.MAX_QUERY_LIMIT = exports.roleKey = exports.UserRoles = exports.cloneAcl = exports.syncImageAcl = exports.implementACL = exports.BaseModel = exports.applyMongoValidators = exports.getValidators = exports.validateOrThrow = exports.validateObject = exports.classNames = exports.RouteRegistry = exports.Route = exports.CronRegistry = exports.CronSchedule = exports.Cron = exports.TriggerRegistry = exports.AfterEvent = exports.BeforeSubscribe = exports.BeforeConnect = exports.AfterSaveConfig = exports.BeforeSaveConfig = exports.AfterFindFile = exports.BeforeFindFile = exports.AfterDeleteFile = exports.BeforeDeleteFile = exports.AfterSaveFile = exports.BeforeSaveFile = exports.BeforePasswordResetRequest = exports.AfterLogout = exports.AfterLogin = exports.BeforeLogin = exports.AfterFind = exports.BeforeFind = exports.AfterDelete = exports.BeforeDelete = exports.AfterSave = exports.BeforeSave = exports.CloudFunctionRegistry = exports.onFunctionRegistered = exports.ProtectedCloudFunction = exports.CloudFunction = exports.onFieldRegistered = exports.onClassRegistered = exports.getSchemaDefinition = exports.ParseField = exports.ParseClass = void 0;
-exports.setupSwagger = exports.getSwaggerJson = exports.generateSwaggerSpec = exports.SwaggerRegistry = exports.NO_AMBIENT_TRANSACTION = exports.withAmbientSession = exports.CONFLICT_MESSAGE = exports.CONFLICT = exports.useTransactionAdapter = exports.currentSession = exports.inTransaction = exports.withTransaction = exports.Transactional = exports.VERSION_CONFLICT_MESSAGE = exports.VERSION_CONFLICT = exports.createVersionedMongoAdapter = exports.VersionRegistry = exports.ParseVersionField = exports.getFieldIndexes = exports.getCompoundIndexes = exports.getUniqueIndexes = exports.applyUniqueIndexes = exports.applyAllIndexes = exports.createSchemaConfig = exports.checkRateLimit = exports.conditionalJsonMiddleware = exports.removeResultMiddleware = exports.restrictRoutes = exports.validateEntityRoutes = exports.validateFunctionRoutes = exports.roleCacheStats = exports.roleCacheEnabled = exports.invalidateRoles = exports.configureRoleCache = exports.importFiles = exports.sleep = exports.generateRandomString = exports.generateRandomInteger = exports.generateRandomPassword = exports.formatCount = exports.getUsersRoles = void 0;
+exports.generateSwaggerSpec = exports.SwaggerRegistry = exports.NO_AMBIENT_TRANSACTION = exports.withAmbientSession = exports.CONFLICT_MESSAGE = exports.CONFLICT = exports.useTransactionAdapter = exports.currentSession = exports.inTransaction = exports.withTransaction = exports.Transactional = exports.VERSION_CONFLICT_MESSAGE = exports.VERSION_CONFLICT = exports.createVersionedMongoAdapter = exports.VersionRegistry = exports.ParseVersionField = exports.getFieldIndexes = exports.getCompoundIndexes = exports.getUniqueIndexes = exports.applyUniqueIndexes = exports.applyAllIndexes = exports.createSchemaConfig = exports.ACL_PREFIX = exports.aclDirectoryFor = exports.aclOwnerOf = exports.isAclGoverned = exports.attachAclFile = exports.aclFileRule = exports.applyFileAccessHeaders = exports.evaluateFileAccess = exports.clearFileAccessRules = exports.getFileAccessRules = exports.registerFileAccessRule = exports.checkRateLimit = exports.conditionalJsonMiddleware = exports.removeResultMiddleware = exports.restrictRoutes = exports.validateEntityRoutes = exports.validateFunctionRoutes = exports.roleCacheStats = exports.roleCacheEnabled = exports.invalidateRoles = exports.configureRoleCache = exports.importFiles = exports.sleep = exports.generateRandomString = exports.generateRandomInteger = exports.generateRandomPassword = exports.formatCount = exports.getUsersRoles = void 0;
+exports.setupSwagger = exports.getSwaggerJson = void 0;
 // ── Decorators ──
 var parseDecorators_1 = require("./decorators/parseDecorators");
 Object.defineProperty(exports, "ParseClass", { enumerable: true, get: function () { return parseDecorators_1.ParseClass; } });
@@ -96,6 +97,23 @@ Object.defineProperty(exports, "removeResultMiddleware", { enumerable: true, get
 Object.defineProperty(exports, "conditionalJsonMiddleware", { enumerable: true, get: function () { return middleware_1.conditionalJsonMiddleware; } });
 var rateLimit_1 = require("./middleware/rateLimit");
 Object.defineProperty(exports, "checkRateLimit", { enumerable: true, get: function () { return rateLimit_1.checkRateLimit; } });
+// ── File access ──────────────────────────────────────────────────────────────
+// Parse has no per-file permission; these turn a file's PATH into one. The kit
+// owns the single `beforeFind(Parse.File)` slot so that rules compose instead
+// of silently replacing each other, and nothing is registered until a rule is
+// added — so upgrading changes no behaviour for a project that does not opt in.
+var fileAccess_1 = require("./files/fileAccess");
+Object.defineProperty(exports, "registerFileAccessRule", { enumerable: true, get: function () { return fileAccess_1.registerFileAccessRule; } });
+Object.defineProperty(exports, "getFileAccessRules", { enumerable: true, get: function () { return fileAccess_1.getFileAccessRules; } });
+Object.defineProperty(exports, "clearFileAccessRules", { enumerable: true, get: function () { return fileAccess_1.clearFileAccessRules; } });
+Object.defineProperty(exports, "evaluateFileAccess", { enumerable: true, get: function () { return fileAccess_1.evaluateFileAccess; } });
+Object.defineProperty(exports, "applyFileAccessHeaders", { enumerable: true, get: function () { return fileAccess_1.applyFileAccessHeaders; } });
+Object.defineProperty(exports, "aclFileRule", { enumerable: true, get: function () { return fileAccess_1.aclFileRule; } });
+Object.defineProperty(exports, "attachAclFile", { enumerable: true, get: function () { return fileAccess_1.attachAclFile; } });
+Object.defineProperty(exports, "isAclGoverned", { enumerable: true, get: function () { return fileAccess_1.isAclGoverned; } });
+Object.defineProperty(exports, "aclOwnerOf", { enumerable: true, get: function () { return fileAccess_1.aclOwnerOf; } });
+Object.defineProperty(exports, "aclDirectoryFor", { enumerable: true, get: function () { return fileAccess_1.aclDirectoryFor; } });
+Object.defineProperty(exports, "ACL_PREFIX", { enumerable: true, get: function () { return fileAccess_1.ACL_PREFIX; } });
 // ── Database ──
 var schema_1 = require("./database/schema");
 Object.defineProperty(exports, "createSchemaConfig", { enumerable: true, get: function () { return schema_1.createSchemaConfig; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,+DAA+D;;;;AAE/D,mBAAmB;AACnB,gEAAiI;AAAxH,6GAAA,UAAU,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAG1F,8DAA0G;AAAjG,+GAAA,aAAa,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AACpE,4DAAmE;AAA1D,sHAAA,qBAAqB,OAAA;AAE9B,kEAKoF;AAL3E,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAC9E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8HAAA,0BAA0B,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC7B,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AACjC,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,8GAAA,UAAU,OAAA;AAC5C,gEAA+D;AAAtD,kHAAA,eAAe,OAAA;AAExB,4DAA8E;AAArE,qGAAA,IAAI,OAAA;AAAE,6GAAA,YAAY,OAAA;AAAE,6GAAA,YAAY,OAAA;AAEzC,8DAAmE;AAA1D,uGAAA,KAAK,OAAA;AAAE,+GAAA,aAAa,OAAA;AAE7B,cAAc;AACd,8DAA4D;AAAnD,yGAAA,UAAU,OAAA;AASnB,mBAAmB;AACnB,sEAA0H;AAAjH,iHAAA,cAAc,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAE7E,eAAe;AACf,gDAA+C;AAAtC,sGAAA,SAAS,OAAA;AAElB,0BAA0B;AAC1B,mCAA2C;AAAlC,mGAAA,YAAY,OAAA;AACrB,6CAA0D;AAAjD,wGAAA,YAAY,OAAA;AAAE,oGAAA,QAAQ,OAAA;AAC/B,+CAAwE;AAA/D,sGAAA,SAAS,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,4GAAA,eAAe,OAAA;AAG5C,kBAAkB;AAClB,yCACqG;AAD5F,oGAAA,UAAU,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,qGAAA,WAAW,OAAA;AAC3D,gHAAA,sBAAsB,OAAA;AAAE,+GAAA,qBAAqB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,+FAAA,KAAK,OAAA;AAC5E,uDAAoD;AAA3C,4GAAA,WAAW,OAAA;AAEpB,4BAA4B;AAC5B,+CAA0G;AAAjG,+GAAA,kBAAkB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAG9E,mBAAmB;AACnB,sDACqF;AAD5E,oHAAA,sBAAsB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,4GAAA,cAAc,OAAA;AACnE,oHAAA,sBAAsB,OAAA;AAAE,uHAAA,yBAAyB,OAAA;AACnD,oDAAwD;AAA/C,2GAAA,cAAc,OAAA;AAEvB,iBAAiB;AACjB,4CAAuD;AAA9C,4GAAA,kBAAkB,OAAA;AAE3B,8CAAgI;AAAvH,0GAAA,eAAe,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,0GAAA,eAAe,OAAA;AAEnG,2BAA2B;AAC3B,8DAAgF;AAAvE,oHAAA,iBAAiB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC3C,0EAA2H;AAAlH,oIAAA,2BAA2B,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAAE,iIAAA,wBAAwB,OAAA;AAGhF,qBAAqB;AACrB,kDACoF;AAD3E,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,yGAAA,cAAc,OAAA;AACpE,gHAAA,qBAAqB,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAEnD,gEAA2F;AAAlF,oHAAA,kBAAkB,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAEnD,gBAAgB;AAChB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AAExB,qDAA4E;AAAnE,kHAAA,mBAAmB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAC5C,yCAA+C;AAAtC,qGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,+DAA+D;;;;;AAE/D,mBAAmB;AACnB,gEAAiI;AAAxH,6GAAA,UAAU,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAG1F,8DAA0G;AAAjG,+GAAA,aAAa,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AACpE,4DAAmE;AAA1D,sHAAA,qBAAqB,OAAA;AAE9B,kEAKoF;AAL3E,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,6GAAA,SAAS,OAAA;AAC9E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,+GAAA,WAAW,OAAA;AAAE,8HAAA,0BAA0B,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAChE,kHAAA,cAAc,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC7B,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AACjC,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,8GAAA,UAAU,OAAA;AAC5C,gEAA+D;AAAtD,kHAAA,eAAe,OAAA;AAExB,4DAA8E;AAArE,qGAAA,IAAI,OAAA;AAAE,6GAAA,YAAY,OAAA;AAAE,6GAAA,YAAY,OAAA;AAEzC,8DAAmE;AAA1D,uGAAA,KAAK,OAAA;AAAE,+GAAA,aAAa,OAAA;AAE7B,cAAc;AACd,8DAA4D;AAAnD,yGAAA,UAAU,OAAA;AASnB,mBAAmB;AACnB,sEAA0H;AAAjH,iHAAA,cAAc,OAAA;AAAE,kHAAA,eAAe,OAAA;AAAE,gHAAA,aAAa,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAE7E,eAAe;AACf,gDAA+C;AAAtC,sGAAA,SAAS,OAAA;AAElB,0BAA0B;AAC1B,mCAA2C;AAAlC,mGAAA,YAAY,OAAA;AACrB,6CAA0D;AAAjD,wGAAA,YAAY,OAAA;AAAE,oGAAA,QAAQ,OAAA;AAC/B,+CAAwE;AAA/D,sGAAA,SAAS,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,4GAAA,eAAe,OAAA;AAG5C,kBAAkB;AAClB,yCACqG;AAD5F,oGAAA,UAAU,OAAA;AAAE,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,qGAAA,WAAW,OAAA;AAC3D,gHAAA,sBAAsB,OAAA;AAAE,+GAAA,qBAAqB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,+FAAA,KAAK,OAAA;AAC5E,uDAAoD;AAA3C,4GAAA,WAAW,OAAA;AAEpB,4BAA4B;AAC5B,+CAA0G;AAAjG,+GAAA,kBAAkB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAG9E,mBAAmB;AACnB,sDACqF;AAD5E,oHAAA,sBAAsB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,4GAAA,cAAc,OAAA;AACnE,oHAAA,sBAAsB,OAAA;AAAE,uHAAA,yBAAyB,OAAA;AACnD,oDAAwD;AAA/C,2GAAA,cAAc,OAAA;AAEvB,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,iDAGqF;AAH5E,oHAAA,sBAAsB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AACvE,gHAAA,kBAAkB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAC1C,yGAAA,WAAW,OAAA;AAAE,2GAAA,aAAa,OAAA;AAC1B,2GAAA,aAAa,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,wGAAA,UAAU,OAAA;AAIxD,iBAAiB;AACjB,4CAAuD;AAA9C,4GAAA,kBAAkB,OAAA;AAE3B,8CAAgI;AAAvH,0GAAA,eAAe,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,0GAAA,eAAe,OAAA;AAEnG,2BAA2B;AAC3B,8DAAgF;AAAvE,oHAAA,iBAAiB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC3C,0EAA2H;AAAlH,oIAAA,2BAA2B,OAAA;AAAE,yHAAA,gBAAgB,OAAA;AAAE,iIAAA,wBAAwB,OAAA;AAGhF,qBAAqB;AACrB,kDACoF;AAD3E,wGAAA,aAAa,OAAA;AAAE,0GAAA,eAAe,OAAA;AAAE,wGAAA,aAAa,OAAA;AAAE,yGAAA,cAAc,OAAA;AACpE,gHAAA,qBAAqB,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAEnD,gEAA2F;AAAlF,oHAAA,kBAAkB,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAEnD,gBAAgB;AAChB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AAExB,qDAA4E;AAAnE,kHAAA,mBAAmB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAC5C,yCAA+C;AAAtC,qGAAA,YAAY,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@90soft/parse-server-kit",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -68,7 +68,7 @@
     "mongodb-memory-server": "^11.2.0",
     "node-cron": "^4.0.0",
     "parse": "^8.6.2",
-    "parse-server": "^9.10.1",
+    "parse-server": "^9.10.4",
     "reflect-metadata": "^0.2.2",
     "swagger-ui-express": "^5.0.1",
     "ts-jest": "^29.2.0",