@openinc/parse-server-opendash 1.13.0 → 1.13.3

package/dist/functions/getSchemaForAdmin.js

@@ -4,7 +4,10 @@ exports.init = void 0;
 const __1 = require("..");
 async function init(name) {
     Parse.Cloud.define(name, async (request) => {
-        await (0, __1.requirePermission)(request, "parse-admin", "You are not allowed to fetch the schema");
+        await (0, __1.requirePermission)({
+            sessionToken: request.user?.getSessionToken(),
+            master: request.master,
+        }, "parse-admin", "You are not allowed to fetch the schema");
         return await Parse.Schema.all();
     });
 }

package/dist/hooks/Maintenance_Issuecategory.js

@@ -10,7 +10,7 @@ async function init() {
         await (0, __1.defaultAclHandler)(request, {
             allowTenantUserWrite: true,
         });
-        (0, __1.requirePermission)(request, "maintenance:can-update-issuecategory", "Permission denied.");
+        await (0, __1.requirePermission)(request, "maintenance:can-update-issuecategory", "Permission denied.");
         // TODO
     });
     (0, __1.afterSaveHook)(types_1.Maintenance_Issuecategory, async (request) => {

package/dist/hooks/Maintenance_Ticket_Kanban_State.js

@@ -10,7 +10,7 @@ async function init() {
         await (0, __1.defaultAclHandler)(request, {
             allowTenantUserWrite: true,
         });
-        (0, __1.requirePermission)(request, "maintenance:can-update-kanbanstate", "Permission denied.");
+        await (0, __1.requirePermission)(request, "maintenance:can-update-kanbanstate", "Permission denied.");
         // TODO
     });
     (0, __1.afterSaveHook)(types_1.Maintenance_Ticket_Kanban_State, async (request) => {

package/dist/hooks/_User.js

@@ -37,11 +37,13 @@ async function init() {
             request.context.tenantChanged = true;
         }
         // fetch user groups
-        const groups = await new Parse.Query(types_1.Group)
-            .equalTo("users", user)
-            .equalTo("usersSeeEachOther", true)
-            .limit(1000000)
-            .find({ useMasterKey: true });
+        const groups = user.id
+            ? await new Parse.Query(types_1.Group)
+                .equalTo("users", user)
+                .equalTo("usersSeeEachOther", true)
+                .limit(1000000)
+                .find({ useMasterKey: true })
+            : [];
         user.setACL(new Parse.ACL({
             ...(tenantId && {
                 [`role:od-tenant-user-${tenantId}`]: { read: true },

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export declare function init(cfg?: ConfigInterface): Promise<void>;
 export declare function hasPermission(sessionToken: string, key: string): Promise<boolean>;
 export declare function requirePermission(request: {
     master?: boolean;
-    user?: Parse.User;
+    sessionToken: string | undefined;
 }, key: string | null, message: string): Promise<void>;
 export declare function getConfig(key: string): Promise<string | undefined>;
 export declare function getConfigBoolean(key: string): Promise<boolean>;
@@ -19,26 +19,45 @@ export declare function ensureRole(name: string, options?: {
     childRoles?: string[];
 }): Promise<void>;
 export declare function ensureUserRole(user: Parse.User, roleName: string, add?: boolean): Promise<void>;
-export declare function immutableField(request: Parse.Cloud.BeforeSaveRequest, fieldName: string, permissionName?: string | null): Promise<void>;
-export declare function defaultHandler(request: Parse.Cloud.BeforeSaveRequest): Promise<void>;
+export declare function immutableField(request: {
+    original?: Parse.Object;
+    object: Parse.Object;
+    master?: boolean;
+    sessionToken: string | undefined;
+}, fieldName: string, permissionName?: string | null): Promise<void>;
+export declare function defaultHandler(request: {
+    original?: Parse.Object;
+    object: Parse.Object;
+    user?: Parse.User;
+    master?: boolean;
+    sessionToken: string | undefined;
+}): Promise<void>;
 export declare function defaultAclHandler(request: Parse.Cloud.BeforeSaveRequest, options?: {
     allowCustomACL?: boolean;
     allowTenantUserWrite?: boolean;
     denyTenantUserRead?: boolean;
 }): Promise<void>;
-declare type beforeSaveHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.BeforeSaveRequest<T>) => Promise<void>;
+declare type beforeSaveHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.BeforeSaveRequest<T> & {
+    sessionToken: string | undefined;
+}) => Promise<void>;
 export declare function beforeSaveHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
     new (): T;
 }, callback: beforeSaveHookType<T>): void;
-declare type afterSaveHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.AfterSaveRequest<T>) => Promise<void>;
+declare type afterSaveHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.AfterSaveRequest<T> & {
+    sessionToken: string | undefined;
+}) => Promise<void>;
 export declare function afterSaveHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
     new (): T;
 }, callback: afterSaveHookType<T>): void;
-declare type beforeDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.BeforeDeleteRequest<T>) => Promise<void>;
+declare type beforeDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.BeforeDeleteRequest<T> & {
+    sessionToken: string | undefined;
+}) => Promise<void>;
 export declare function beforeDeleteHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
     new (): T;
 }, callback: beforeDeleteHookType<T>): void;
-declare type afterDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.AfterDeleteRequest<T>) => Promise<void>;
+declare type afterDeleteHookType<T extends Parse.Object<Parse.Attributes>> = (request: ParseCloud.AfterDeleteRequest<T> & {
+    sessionToken: string | undefined;
+}) => Promise<void>;
 export declare function afterDeleteHook<T extends Parse.Object<Parse.Attributes>>(target: string | {
     new (): T;
 }, callback: afterDeleteHookType<T>): void;

package/dist/index.js

@@ -76,15 +76,14 @@ async function requirePermission(request, key, message) {
         return;
     }
     if (!key) {
-        throw new Parse.Error(119, "Missing Permission: " + (message || key || "Master Key Only"));
+        throw new Parse.Error(119, "Missing Permission (1): " + (message || key || "Master Key Only"));
     }
-    const sessionToken = request.user?.getSessionToken();
-    if (!sessionToken) {
-        throw new Parse.Error(119, "Missing Permission: " + (message || key || "Master Key Only"));
+    if (!request.sessionToken) {
+        throw new Parse.Error(119, "Missing Permission (2): " + (message || key || "Master Key Only"));
     }
-    const p = await hasPermission(sessionToken, key);
+    const p = await hasPermission(request.sessionToken, key);
     if (!p) {
-        throw new Parse.Error(119, "Missing Permission: " + (message || key || "Master Key Only"));
+        throw new Parse.Error(119, "Missing Permission (3): " + (message || key || "Master Key Only"));
     }
 }
 exports.requirePermission = requirePermission;
@@ -273,8 +272,10 @@ function beforeSaveHook(target, callback) {
     if (!beforeSaveHooks[className]) {
         beforeSaveHooks[className] = [];
         Parse.Cloud.beforeSave(className, async function beforeSaveHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            const newRequest = { ...request, sessionToken };
             for (const fn of beforeSaveHooks[className]) {
-                await fn(request);
+                await fn(newRequest);
             }
         });
     }
@@ -288,8 +289,10 @@ function afterSaveHook(target, callback) {
     if (!afterSaveHooks[className]) {
         afterSaveHooks[className] = [];
         Parse.Cloud.afterSave(className, async function afterSaveHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            const newRequest = { ...request, sessionToken };
             for (const fn of afterSaveHooks[className]) {
-                await fn(request);
+                await fn(newRequest);
             }
         });
     }
@@ -303,8 +306,10 @@ function beforeDeleteHook(target, callback) {
     if (!beforeDeleteHooks[className]) {
         beforeDeleteHooks[className] = [];
         Parse.Cloud.beforeDelete(className, async function beforeDeleteHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            const newRequest = { ...request, sessionToken };
             for (const fn of beforeDeleteHooks[className]) {
-                await fn(request);
+                await fn(newRequest);
             }
         });
     }
@@ -318,8 +323,10 @@ function afterDeleteHook(target, callback) {
     if (!afterDeleteHooks[className]) {
         afterDeleteHooks[className] = [];
         Parse.Cloud.afterDelete(className, async function afterDeleteHookFunction(request) {
+            const sessionToken = request.user?.getSessionToken();
+            const newRequest = { ...request, sessionToken };
             for (const fn of afterDeleteHooks[className]) {
-                await fn(request);
+                await fn(newRequest);
             }
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openinc/parse-server-opendash",
-  "version": "1.13.0",
+  "version": "1.13.3",
   "description": "Parse Server Cloud Code for open.DASH",
   "keywords": [
     "parse",