@90soft/parse-server-kit 2.8.2 → 2.10.1

package/CHANGELOG.md

@@ -0,0 +1,99 @@
+# Changelog
+
+All notable changes to `@90soft/parse-server-kit`.
+
+> The public continuation of this library is published as **`parse-server-kit`**,
+> starting at 3.0.0. Same source; the two are not interchangeable at matching
+> version numbers.
+
+---
+
+## [2.10.1]
+
+Twelve fixes found by a full read of the source, each verified against a running
+server rather than by inspection. Two change behaviour; both are noted.
+
+Checked against SMC before shipping: it uses neither `requiresAuth` nor
+`rateLimit`, and has no intermediate model base classes — so nothing here
+changes how it behaves.
+
+### Fixed
+
+- **Field and trigger metadata leaked across an inheritance tree.**
+  `Reflect.getMetadata` walks the prototype chain, so a subclass with no
+  metadata of its own was handed the *parent's* object — which was then mutated
+  in place. Every class in the tree ended up sharing one record:
+
+  ```ts
+  class Auditable extends BaseModel { @ParseField() declare createdBy }
+  class Product   extends Auditable { @ParseField() declare name }
+  class Order     extends Auditable { @ParseField() declare total }
+  // Product gained `total`, Order gained `name`, Auditable gained both
+  ```
+
+  The result was wrong schemas, `fromParams` converting fields the model does
+  not have, `validateObject` demanding foreign required fields, and
+  `applyAllIndexes` indexing columns that do not exist — none of it reported.
+
+  Both `parse:fields` and `parse:pendingTriggers` now copy on first write.
+  **Identical for a class extending `BaseModel` directly**, which carries no
+  field metadata — so the common case is unchanged.
+
+- **`requiresAuth` enforced nothing.** It was read only by the OpenAPI renderer,
+  so an endpoint declaring it was reachable with no session *while the docs drew
+  a padlock on it*. It is now checked in the handler wrapper before the body
+  runs; a call carrying the master key still passes.
+  **Behaviour change** — endpoints that were accidentally open are now closed.
+
+- **`rateLimit` could be skipped entirely.** It was applied only in
+  `validateEntityRoutes`, which returns early for anything that is not a
+  registered entity prefix — so asking for `/functions/{name}` directly bypassed
+  it. `restrictRoutes` now applies it on that path too. **Behaviour change.**
+
+  The declared `methods` deliberately do **not** follow. `/functions/{name}` is
+  Parse's own protocol endpoint and every SDK's `Parse.Cloud.run` POSTs to it,
+  so enforcing them there would make any GET-declared function unreachable from
+  a Parse client.
+
+- **Declaring a field `unique` dropped compound indexes containing it.** The
+  conflict check matched any non-unique index *containing* the field, so
+  `unique: true` on `status` alongside a compound index on
+  `['status', 'createdAt']` dropped the compound one on every boot. An index
+  created outside this library was dropped for good.
+
+- **The master key was compared with `===`**, which short-circuits on the first
+  differing character and leaks the key a character at a time under timing
+  analysis. Now `crypto.timingSafeEqual`.
+
+- **`restrictRoutes` matched `/functions` by prefix**, so `/functionsX` passed.
+  Now an exact segment match.
+
+- **Malformed JSON mentioning a master key both answered 400 and threw**,
+  leaving Express reporting "Cannot set headers after they are sent" on top of
+  the real error. It throws only; body-parser answers 400. *The response body
+  for that narrow case is body-parser's rather than this library's.*
+
+- **`readCachedRoles` returned the cache's own array.** A caller sorting or
+  filtering it in place rewrote what every later permission check saw.
+
+- **`fromParams` wrote `className` into the caller's `req.params`.** It works on
+  a copy, so a retried transaction no longer sees an input the first attempt
+  altered.
+
+- **`validateFunctionRoutes` 404'd everything** unless mounted at
+  `{mountPath}/functions`, because it read the path segment blindly. It now
+  works at either mount point.
+
+### Added
+
+- `test/inheritance.test.ts` — pins the metadata fix, including the sibling-leak
+  case and version fields across inheritance.
+
+---
+
+## [2.10.0]
+
+- Decorator order between `@CloudFunction` and `@Transactional` no longer
+  matters; the registry re-reads the method when it registers it.
+- `@ParseField` properties are repaired when a class field shadows the prototype
+  accessor, so `title!: string` no longer silently drops writes.