@90soft/parse-server-kit 2.9.0 → 2.11.0

package/CHANGELOG.md

@@ -0,0 +1,183 @@
+# Changelog
+
+All notable changes to `@90soft/parse-server-kit`.
+
+> The public continuation of this library is published as **`parse-server-kit`**,
+> starting at 3.0.0. Same source; the two are not interchangeable at matching
+> version numbers.
+
+---
+
+## [2.11.0]
+
+### Security
+
+- **`rateLimit` could be bypassed completely, by anyone, without an account.**
+  The bucket key was `req.headers['x-parse-session-token'] || req.ip`. That
+  header is supplied by the caller and is **not validated at this point in the
+  pipeline** — the entity-route middleware runs before Parse Server resolves the
+  session — so sending a fresh random token on every request minted a fresh
+  bucket each time.
+
+  Measured against a limit of `max: 3`: ten requests with ten different random
+  tokens all succeeded. The limiter was decorative.
+
+  The key is now the **client address** (`req.ip`, falling back to the socket
+  address). An optional `keyBy` is available for apps that can derive a
+  trustworthy identity themselves.
+
+  ```ts
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5 } })          // keyed on address
+  @CloudFunction({ rateLimit: { windowMs: 60_000, max: 5, keyBy: r => r.apiKeyId } })
+  ```
+
+  **Two things to know when you adopt this:**
+
+  1. **Configure Express `trust proxy` precisely** — a hop count, or the proxy's
+     address — if you run behind nginx or a load balancer. `req.ip` honours that
+     setting, so a permissive `true` lets a caller spoof the key with
+     `X-Forwarded-For`. This is the same bypass Parse Server fixed for its own
+     limiter in 9.10.1. Unset, Express ignores the header, which is safe.
+  2. **Limits were previously per session token and are now per address**, so
+     several users behind one NAT now share a bucket. Raise `max` where that
+     matters, or supply `keyBy`.
+
+- **The bucket store is now bounded** (10,000 clients per function, oldest
+  evicted). A caller rotating addresses could previously grow the map without
+  limit, turning the rate limiter into a memory-exhaustion vector.
+
+### Added
+
+- `resetRateLimits()`, exported for tests.
+- `test/rateLimit.test.ts` — eight tests, including the bypass above as a
+  regression. Rate limiting previously had **no test coverage at all**; the
+  regression test was verified to fail against the old implementation.
+
+### Changed
+
+- **`engines.node` is now `>=20.19.0`** (was `>=18.0.0`). Parse Server 9
+  requires it, so the old floor advertised a combination that cannot work.
+- **Peer floors raised** to `parse >= 8.0.0` and `parse-server >= 9.0.0` (were
+  `>= 5.0.0` and `>= 8.3.0`). Development and tests now run against
+  `parse@8.6.2` / `parse-server@9.10.1`; previously the kit was tested against
+  Parse JS SDK **5** while every consuming app ran 8.x. That gap matters:
+  SDK 6 made `Parse.Object.set`/`setACL`/`unset` and `Role.setName` **throw**
+  instead of taking an error callback, so such a failure escapes the
+  `catchError` convention entirely.
+
+  The floors stay permissive deliberately — nothing in a consuming app breaks on
+  install. **Parse Server ≥ 9.10.1 is strongly recommended**: the 9.5→9.10 line
+  is almost entirely security fixes, including account takeover through
+  auth-adapter identity spoofing, protected-field bypasses via logical
+  operators, dot-notation, relation counts and LiveQuery, and several stored-XSS
+  routes through file upload.
+
+### Notes
+
+- Rate limiting remains **per process**: with N app instances the effective
+  limit is N × `max`. For cross-instance enforcement use Parse Server's own
+  `rateLimit` server option with `redisUrl`.
+- A unique index with a **value** predicate (e.g. "one active row per pair")
+  needs `partialFilterExpression`, not `partialFilterNulls` — the latter only
+  emits `$exists: true`. Use the `options` escape hatch, which is passed
+  straight through to MongoDB:
+
+  ```ts
+  compoundIndexes: [{
+    fields: ['trainee', 'sport'],
+    unique: true,
+    options: { partialFilterExpression: { status: 'active' } },
+  }]
+  ```
+
+---
+
+## [2.10.1]
+
+Twelve fixes found by a full read of the source, each verified against a running
+server rather than by inspection. Two change behaviour; both are noted.
+
+Checked against SMC before shipping: it uses neither `requiresAuth` nor
+`rateLimit`, and has no intermediate model base classes — so nothing here
+changes how it behaves.
+
+### Fixed
+
+- **Field and trigger metadata leaked across an inheritance tree.**
+  `Reflect.getMetadata` walks the prototype chain, so a subclass with no
+  metadata of its own was handed the *parent's* object — which was then mutated
+  in place. Every class in the tree ended up sharing one record:
+
+  ```ts
+  class Auditable extends BaseModel { @ParseField() declare createdBy }
+  class Product   extends Auditable { @ParseField() declare name }
+  class Order     extends Auditable { @ParseField() declare total }
+  // Product gained `total`, Order gained `name`, Auditable gained both
+  ```
+
+  The result was wrong schemas, `fromParams` converting fields the model does
+  not have, `validateObject` demanding foreign required fields, and
+  `applyAllIndexes` indexing columns that do not exist — none of it reported.
+
+  Both `parse:fields` and `parse:pendingTriggers` now copy on first write.
+  **Identical for a class extending `BaseModel` directly**, which carries no
+  field metadata — so the common case is unchanged.
+
+- **`requiresAuth` enforced nothing.** It was read only by the OpenAPI renderer,
+  so an endpoint declaring it was reachable with no session *while the docs drew
+  a padlock on it*. It is now checked in the handler wrapper before the body
+  runs; a call carrying the master key still passes.
+  **Behaviour change** — endpoints that were accidentally open are now closed.
+
+- **`rateLimit` could be skipped entirely.** It was applied only in
+  `validateEntityRoutes`, which returns early for anything that is not a
+  registered entity prefix — so asking for `/functions/{name}` directly bypassed
+  it. `restrictRoutes` now applies it on that path too. **Behaviour change.**
+
+  The declared `methods` deliberately do **not** follow. `/functions/{name}` is
+  Parse's own protocol endpoint and every SDK's `Parse.Cloud.run` POSTs to it,
+  so enforcing them there would make any GET-declared function unreachable from
+  a Parse client.
+
+- **Declaring a field `unique` dropped compound indexes containing it.** The
+  conflict check matched any non-unique index *containing* the field, so
+  `unique: true` on `status` alongside a compound index on
+  `['status', 'createdAt']` dropped the compound one on every boot. An index
+  created outside this library was dropped for good.
+
+- **The master key was compared with `===`**, which short-circuits on the first
+  differing character and leaks the key a character at a time under timing
+  analysis. Now `crypto.timingSafeEqual`.
+
+- **`restrictRoutes` matched `/functions` by prefix**, so `/functionsX` passed.
+  Now an exact segment match.
+
+- **Malformed JSON mentioning a master key both answered 400 and threw**,
+  leaving Express reporting "Cannot set headers after they are sent" on top of
+  the real error. It throws only; body-parser answers 400. *The response body
+  for that narrow case is body-parser's rather than this library's.*
+
+- **`readCachedRoles` returned the cache's own array.** A caller sorting or
+  filtering it in place rewrote what every later permission check saw.
+
+- **`fromParams` wrote `className` into the caller's `req.params`.** It works on
+  a copy, so a retried transaction no longer sees an input the first attempt
+  altered.
+
+- **`validateFunctionRoutes` 404'd everything** unless mounted at
+  `{mountPath}/functions`, because it read the path segment blindly. It now
+  works at either mount point.
+
+### Added
+
+- `test/inheritance.test.ts` — pins the metadata fix, including the sibling-leak
+  case and version fields across inheritance.
+
+---
+
+## [2.10.0]
+
+- Decorator order between `@CloudFunction` and `@Transactional` no longer
+  matters; the registry re-reads the method when it registers it.
+- `@ParseField` properties are repaired when a class field shadows the prototype
+  accessor, so `title!: string` no longer silently drops writes.