@sashido/mcp-server 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 SashiDo (https://www.sashido.io)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,202 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="https://dka575ofm4ao0.cloudfront.net/pages-transactional_logos/retina/27162/FDedZYhLRraWlTG8tqDP" alt="SashiDo Logo" width="200"/>
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h1 align="center">SashiDo MCP Server</h1>
+
+<p align="center">
+  <strong>Manage your SashiDo Parse Server apps from Claude, Cursor, VS Code and any MCP client</strong>
+</p>
+
+<p align="center">
+  <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
+  <a href="https://nodejs.org/"><img src="https://img.shields.io/badge/node-%3E%3D18.17-brightgreen.svg" alt="Node.js Version"></a>
+  <a href="https://modelcontextprotocol.io/"><img src="https://img.shields.io/badge/MCP-Compatible-purple.svg" alt="MCP Compatible"></a>
+</p>
+
+---
+
+A [Model Context Protocol](https://modelcontextprotocol.io/) server for [SashiDo](https://www.sashido.io). An AI assistant connected to it can work with your apps the way you do in the dashboard: read the schema and data, deploy, scale, read logs, send push notifications, run jobs, check an app for security problems and plan a Parse Server upgrade.
+
+It acts with a **personal access token** that you create in the dashboard, with only the permissions you choose. Every call is recorded in your account's Activity.
+
+## Connect
+
+### 1. Create an access token
+
+In the [SashiDo Dashboard](https://dashboard.sashido.io) open **Account › Access Tokens** and create a token. Choose:
+
+- **Scopes**: what the token may do. *Read-only* is the safe choice to start with.
+- **Apps**: all apps, or only some.
+- **Expiry**: optional.
+
+The dashboard shows ready configurations for the clients below.
+
+### 2. Add the server to your client
+
+The hosted server is at **`https://mcp.sashido.io/mcp`** (Streamable HTTP), with `https://mcp.sashido.io/sse` for clients that only speak SSE. The token goes in the `Authorization` header.
+
+**Claude Code**
+
+```bash
+claude mcp add --transport http sashido https://mcp.sashido.io/mcp \
+  --header "Authorization: Bearer sashido_pat_..."
+```
+
+**Cursor** (`~/.cursor/mcp.json`) and other clients with remote servers
+
+```json
+{
+  "mcpServers": {
+    "sashido": {
+      "url": "https://mcp.sashido.io/mcp",
+      "headers": { "Authorization": "Bearer sashido_pat_..." }
+    }
+  }
+}
+```
+
+**Claude Desktop** and clients that run local servers (stdio)
+
+```json
+{
+  "mcpServers": {
+    "sashido": {
+      "command": "npx",
+      "args": ["-y", "@sashido/mcp-server"],
+      "env": { "SASHIDO_ACCESS_TOKEN": "sashido_pat_..." }
+    }
+  }
+}
+```
+
+The local server also has the tools that read your files or fetch URLs (`upload_file_from_path`, `upload_file_from_url`). The hosted one doesn't.
+
+### Narrowing a connection
+
+A connection can do less than its token allows. Over HTTP, add options to the URL. Over stdio, set the matching environment variables.
+
+| URL option | stdio variable | Effect |
+|---|---|---|
+| `read_only=true` | `SASHIDO_READ_ONLY=true` | Only tools that change nothing |
+| `apps=id1,id2` | `SASHIDO_APPS=id1,id2` | Only these apps |
+| `features=objects,logs` | `SASHIDO_FEATURES=objects,logs` | Only these tool groups (see below) |
+
+For example: `https://mcp.sashido.io/mcp?read_only=true&apps=AbC123`
+
+## Scopes
+
+| Scope | Allows |
+|---|---|
+| `account:read` | List apps, read the Activity (audit log), see an app's infrastructure |
+| `apps:read` | Builds, deployments, engines, health, Parse Server versions |
+| `apps:write` | Create and rename apps, change engines, scale, high availability, Parse Server version |
+| `deploy` | Build, deploy and cancel |
+| `env:read` / `env:write` | Environment variables |
+| `logs:read` | Logs |
+| `data:read` | Schema, objects, cloud code, push status, jobs, webhooks, advisor |
+| `data:write` | Change data and schema, call functions, send push, run jobs, webhooks |
+
+A client only sees the tools its token and options allow. The SashiDo API checks the same scopes again on every call.
+
+## Tools
+
+71 tools in these groups (the names are what `features` takes):
+
+| Group | Tools |
+|---|---|
+| `apps` | `list_apps`, `get_app`, `create_app`, `update_app_name` |
+| `audit` | `get_audit_log`: who did what and through which client (dashboard, API, MCP) |
+| `builds` | `list_builds`, `get_build_log`, `trigger_build`, `cancel_build` |
+| `deployments` | `get_deployment_info`, `deploy_app`, `cancel_deployment` |
+| `infrastructure` | `get_app_infrastructure`, `wait_for_deployment`, `list_parse_server_versions`, `change_parse_server_version` |
+| `engines` | `list_engines`, `set_engine`, `scale_app`, `set_high_availability` |
+| `health` | `check_app_health` |
+| `env` | `list_env_vars`, `set_env_var`, `delete_env_var` |
+| `classes` | `list_classes`, `get_class`, `get_class_permissions`, `create_class`, `add_field`, `update_class_permissions`, `delete_field`, `delete_class` |
+| `types` | `generate_types`: typed classes from the schema for TypeScript, Swift, Kotlin and Dart |
+| `advisor` | `get_app_advice`: security, data, cloud code and runtime checks, each with what to do; `plan_parse_server_upgrade`: what breaks in your cloud code on a newer version, where, and how to fix it |
+| `objects` | `query_objects`, `get_object`, `create_object`, `update_object`, `delete_object` |
+| `files` | `upload_file`, `upload_file_from_url`*, `upload_file_from_path`* |
+| `cloud-functions` | `call_cloud_function`, `list_cloud_files`, `read_cloud_code` |
+| `push` | `send_push`, `send_push_to_channels`, `get_push_status`, `list_audiences`, `create_audience`, `delete_audience`, `list_available_devices` |
+| `jobs` | `list_available_jobs`, `list_scheduled_jobs`, `get_job_status`, `schedule_job`, `run_job`, `delete_job` |
+| `logs` | `get_logs`, `get_error_logs` |
+| `webhooks` | `list_/get_/create_/update_/delete_function_webhook`, `list_/get_/create_/update_/delete_trigger_webhook` |
+
+\* local (stdio) only.
+
+Tools carry MCP annotations (read-only, destructive, idempotent), so clients can ask before a change. Changes that are hard to undo, such as `change_parse_server_version`, show a preview first.
+
+Things to ask:
+
+- *"Check my-app for security problems and tell me what to fix."*
+- *"What breaks in my cloud code if I move to Parse Server 6?"*
+- *"Generate TypeScript types for my classes."*
+- *"Deploy my-app and tell me when it's live."*
+- *"Show the errors from the last hour."*
+- *"Who changed my-app's environment variables this week?"*
+
+## Security
+
+- **Tokens, not passwords.** The server never sees your password or a dashboard session. A token has only the scopes and apps you gave it. You can revoke it at any time in the dashboard.
+- **Over HTTP, credentials come only from the request.** Each request brings its own token in the `Authorization` header. The server stores no tokens, and the token is never placed in a URL.
+- **Audit log.** Every call is recorded in the account's Activity: the token, the client (e.g. Claude Code), the tool, the result and a request ID.
+- **Hosted limits.** Browser origins must be allowed (`ALLOWED_ORIGINS`), requests are rate-limited per IP, and the tools that read local files or URLs are off.
+- **Keys stay on the server side.** Calls to your app go through SashiDo's API with your token. The app's master key is never sent to the client or the model.
+
+## Self-hosting
+
+```bash
+git clone https://github.com/sashido/sashido-mcp-server.git
+cd sashido-mcp-server
+npm ci && npm run build
+npm run start:http      # HTTP on 127.0.0.1:3100
+npm run start:stdio     # stdio, with SASHIDO_ACCESS_TOKEN set
+```
+
+| Variable | Default | |
+|---|---|---|
+| `SASHIDO_API_URL` | `https://api.sashido.io` | |
+| `SASHIDO_ACCESS_TOKEN` | – | stdio only; over HTTP every request brings its own |
+| `SASHIDO_READ_ONLY`, `SASHIDO_APPS`, `SASHIDO_FEATURES` | – | stdio only: narrow the connection |
+| `HOST` | `127.0.0.1` | `0.0.0.0` in a container |
+| `PORT` / `MCP_SERVER_PORT` | `3100` | `PORT` wins |
+| `ALLOWED_ORIGINS` | – | Comma-separated browser origins; clients that aren't browsers send none |
+| `TRUST_PROXY` | – | `true` behind a load balancer, so rate limits see the client's IP |
+| `RATE_LIMIT_PER_MINUTE` | `300` | Per client IP |
+| `REDIS_URL`, `REDIS_PASSWORD`, `REDIS_DB` | – | SSE across several instances (Streamable HTTP needs no Redis) |
+| `SESSION_TTL_SECONDS` | `3600` | SSE sessions in Redis |
+| `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` |
+
+### HTTP endpoints
+
+| Method | Path | |
+|---|---|---|
+| `POST` | `/mcp` | Streamable HTTP, stateless: any instance can answer |
+| `GET` | `/sse`, `POST` `/sse/messages` | SSE for older clients; needs Redis with more than one instance |
+| `GET` | `/health` | Status, version, SSE connections, Redis |
+
+### In a container
+
+Any Node.js 20+ image works: `npm ci && npm run build`, then `npm start` with `HOST=0.0.0.0` (and `TRUST_PROXY=true` behind a load balancer). Put TLS in front of it, and use `/health` for the readiness and liveness probes.
+
+## Development
+
+```bash
+npm run dev         # stdio with reload
+npm run typecheck
+npm run test:run    # vitest
+```
+
+Tool calls are logged to stderr as JSON lines (tool, app, client, result, duration, request ID, a short fingerprint of the token), never with the arguments or the token itself.
+
+## Support
+
+- [SashiDo documentation](https://www.sashido.io/en/docs)
+- [support@sashido.io](mailto:support@sashido.io)
+- [GitHub issues](https://github.com/sashido/sashido-mcp-server/issues)
+
+## License
+
+MIT, see [LICENSE](LICENSE).

package/dist/access.d.ts

@@ -0,0 +1,47 @@
+import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * What each tool needs and does. A tool is registered only when the access
+ * token has its scope, it isn't a change in read-only mode, its group is
+ * enabled, and (for local-only tools) the server runs locally over stdio.
+ * The API enforces the same scopes; this keeps clients from seeing tools
+ * that would only fail.
+ */
+export type Scope = "account:read" | "apps:read" | "apps:write" | "deploy" | "env:read" | "env:write" | "logs:read" | "data:read" | "data:write";
+/** read: no changes; write: changes; destructive: deletes or overwrites */
+export type ToolKind = "read" | "write" | "destructive";
+export interface ToolPolicy {
+    scope: Scope;
+    kind: ToolKind;
+    /** Reads local files or fetches URLs: only on the user's own machine */
+    localOnly?: boolean;
+    /** Needs a token for all apps: one limited to some can't, e.g., add apps */
+    allApps?: boolean;
+}
+export declare const TOOL_POLICY: Record<string, ToolPolicy>;
+/** Tool groups for the `features` option: the folders under src/tools */
+export type ToolGroup = string;
+export interface Access {
+    /** Scopes of the access token */
+    scopes: string[];
+    /** null: every app the token may use */
+    appIds: string[] | null;
+    /** Register only tools that change nothing */
+    readOnly: boolean;
+    /** null: every group */
+    groups: ToolGroup[] | null;
+    /** stdio: local files and URLs may be read */
+    local: boolean;
+}
+export declare function isToolAllowed(name: string, group: ToolGroup, access: Access): boolean;
+/** MCP annotations, so clients can ask before changes and deletions */
+export declare function annotationsFor(name: string): ToolAnnotations;
+/**
+ * Options a client adds to the MCP URL (or env vars locally). They can only
+ * narrow what the token allows: ?read_only=true&apps=id1,id2&features=objects,logs
+ */
+export declare function narrowAccess(base: Access, options: {
+    readOnly?: string;
+    apps?: string;
+    features?: string;
+}): Access;
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,KAAK,GACb,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,CAAC;AAEjB,2EAA2E;AAC3E,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AASD,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAwFlD,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,MAAM;IACrB,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,wBAAwB;IACxB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAuBT;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAW5D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,MAAM,CAqBR"}

package/dist/access.js

@@ -0,0 +1,156 @@
+const read = (scope) => ({ scope, kind: "read" });
+const write = (scope) => ({ scope, kind: "write" });
+const destructive = (scope) => ({
+    scope,
+    kind: "destructive",
+});
+export const TOOL_POLICY = {
+    // apps
+    list_apps: read("account:read"),
+    // audit log: the account's activity
+    get_audit_log: read("account:read"),
+    get_app: read("account:read"),
+    create_app: { ...write("apps:write"), allApps: true },
+    update_app_name: write("apps:write"),
+    // builds and deployments
+    list_builds: read("apps:read"),
+    get_build_log: read("apps:read"),
+    trigger_build: write("deploy"),
+    cancel_build: write("deploy"),
+    deploy_app: write("deploy"),
+    cancel_deployment: write("deploy"),
+    get_deployment_info: read("apps:read"),
+    // infrastructure: what runs an app, versions
+    get_app_infrastructure: read("account:read"),
+    wait_for_deployment: read("apps:read"),
+    list_parse_server_versions: read("apps:read"),
+    // a new major version can break cloud code and clients
+    change_parse_server_version: destructive("apps:write"),
+    // engines, scale and health
+    list_engines: read("apps:read"),
+    set_engine: write("apps:write"),
+    scale_app: write("apps:write"),
+    set_high_availability: write("apps:write"),
+    check_app_health: read("apps:read"),
+    // environment variables
+    list_env_vars: read("env:read"),
+    set_env_var: write("env:write"),
+    delete_env_var: destructive("env:write"),
+    // classes (schema)
+    list_classes: read("data:read"),
+    generate_types: read("data:read"),
+    // advisor: checks and upgrade plans, read only
+    get_app_advice: read("data:read"),
+    plan_parse_server_upgrade: read("data:read"),
+    get_class: read("data:read"),
+    get_class_permissions: read("data:read"),
+    create_class: write("data:write"),
+    add_field: write("data:write"),
+    update_class_permissions: write("data:write"),
+    delete_field: destructive("data:write"),
+    delete_class: destructive("data:write"),
+    // objects
+    query_objects: read("data:read"),
+    get_object: read("data:read"),
+    create_object: write("data:write"),
+    update_object: write("data:write"),
+    delete_object: destructive("data:write"),
+    // files
+    upload_file: write("data:write"),
+    upload_file_from_url: { ...write("data:write"), localOnly: true },
+    upload_file_from_path: { ...write("data:write"), localOnly: true },
+    // cloud code
+    call_cloud_function: write("data:write"),
+    list_cloud_files: read("data:read"),
+    read_cloud_code: read("data:read"),
+    // push
+    send_push: write("data:write"),
+    send_push_to_channels: write("data:write"),
+    get_push_status: read("data:read"),
+    list_audiences: read("data:read"),
+    list_available_devices: read("data:read"),
+    create_audience: write("data:write"),
+    delete_audience: destructive("data:write"),
+    // jobs
+    list_available_jobs: read("data:read"),
+    list_scheduled_jobs: read("data:read"),
+    get_job_status: read("data:read"),
+    schedule_job: write("data:write"),
+    run_job: write("data:write"),
+    delete_job: destructive("data:write"),
+    // logs
+    get_logs: read("logs:read"),
+    get_error_logs: read("logs:read"),
+    // webhooks
+    list_function_webhooks: read("data:read"),
+    get_function_webhook: read("data:read"),
+    create_function_webhook: write("data:write"),
+    update_function_webhook: write("data:write"),
+    delete_function_webhook: destructive("data:write"),
+    list_trigger_webhooks: read("data:read"),
+    get_trigger_webhook: read("data:read"),
+    create_trigger_webhook: write("data:write"),
+    update_trigger_webhook: write("data:write"),
+    delete_trigger_webhook: destructive("data:write"),
+};
+export function isToolAllowed(name, group, access) {
+    const policy = TOOL_POLICY[name];
+    if (!policy) {
+        // every tool must be listed above; failing closed keeps a forgotten
+        // tool from being exposed with unknown access
+        return false;
+    }
+    if (access.scopes.indexOf(policy.scope) === -1) {
+        return false;
+    }
+    if (access.readOnly && policy.kind !== "read") {
+        return false;
+    }
+    if (policy.localOnly && !access.local) {
+        return false;
+    }
+    if (policy.allApps && access.appIds) {
+        return false;
+    }
+    if (access.groups && access.groups.indexOf(group) === -1) {
+        return false;
+    }
+    return true;
+}
+/** MCP annotations, so clients can ask before changes and deletions */
+export function annotationsFor(name) {
+    const policy = TOOL_POLICY[name];
+    if (!policy) {
+        throw new Error(`Tool ${name} has no access policy`);
+    }
+    return {
+        readOnlyHint: policy.kind === "read",
+        destructiveHint: policy.kind === "destructive",
+        // these act on SashiDo, not on an open-ended world
+        openWorldHint: false,
+    };
+}
+/**
+ * Options a client adds to the MCP URL (or env vars locally). They can only
+ * narrow what the token allows: ?read_only=true&apps=id1,id2&features=objects,logs
+ */
+export function narrowAccess(base, options) {
+    const list = (value) => value
+        ? value
+            .split(",")
+            .map((v) => v.trim())
+            .filter(Boolean)
+        : null;
+    const apps = list(options.apps);
+    let appIds = base.appIds;
+    if (apps) {
+        appIds = base.appIds ? apps.filter((id) => base.appIds.indexOf(id) !== -1) : apps;
+    }
+    return {
+        ...base,
+        readOnly: base.readOnly || options.readOnly === "true" || options.readOnly === "1",
+        appIds,
+        groups: list(options.features) || base.groups,
+    };
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAgCA,MAAM,IAAI,GAAG,CAAC,KAAY,EAAc,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,MAAM,KAAK,GAAG,CAAC,KAAY,EAAc,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,MAAM,WAAW,GAAG,CAAC,KAAY,EAAc,EAAE,CAAC,CAAC;IACjD,KAAK;IACL,IAAI,EAAE,aAAa;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAA+B;IACrD,OAAO;IACP,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC;IAC/B,oCAAoC;IACpC,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC;IAC7B,UAAU,EAAE,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;IACrD,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC;IACpC,yBAAyB;IACzB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;IAC9B,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAChC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC;IAC9B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;IAC7B,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;IAC3B,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC;IAClC,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC;IACtC,6CAA6C;IAC7C,sBAAsB,EAAE,IAAI,CAAC,cAAc,CAAC;IAC5C,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC;IACtC,0BAA0B,EAAE,IAAI,CAAC,WAAW,CAAC;IAC7C,uDAAuD;IACvD,2BAA2B,EAAE,WAAW,CAAC,YAAY,CAAC;IACtD,4BAA4B;IAC5B,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;IAC/B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;IAC/B,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;IAC9B,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC1C,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC;IACnC,wBAAwB;IACxB,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;IAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC;IAC/B,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC;IACxC,mBAAmB;IACnB,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;IAC/B,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;IACjC,+CAA+C;IAC/C,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;IACjC,yBAAyB,EAAE,IAAI,CAAC,WAAW,CAAC;IAC5C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;IAC5B,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC;IACxC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;IACjC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;IAC9B,wBAAwB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC7C,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;IACvC,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;IACvC,UAAU;IACV,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAChC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC;IAC7B,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;IAClC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC;IAClC,aAAa,EAAE,WAAW,CAAC,YAAY,CAAC;IACxC,QAAQ;IACR,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC;IAChC,oBAAoB,EAAE,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;IACjE,qBAAqB,EAAE,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;IAClE,aAAa;IACb,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC;IACxC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC;IACnC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC;IAClC,OAAO;IACP,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;IAC9B,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC1C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC;IAClC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;IACjC,sBAAsB,EAAE,IAAI,CAAC,WAAW,CAAC;IACzC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC;IACpC,eAAe,EAAE,WAAW,CAAC,YAAY,CAAC;IAC1C,OAAO;IACP,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC;IACtC,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC;IACtC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;IACjC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;IACjC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC;IACrC,OAAO;IACP,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;IACjC,WAAW;IACX,sBAAsB,EAAE,IAAI,CAAC,WAAW,CAAC;IACzC,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC;IACvC,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5C,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC5C,uBAAuB,EAAE,WAAW,CAAC,YAAY,CAAC;IAClD,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC;IACxC,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC;IACtC,sBAAsB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC3C,sBAAsB,EAAE,KAAK,CAAC,YAAY,CAAC;IAC3C,sBAAsB,EAAE,WAAW,CAAC,YAAY,CAAC;CAClD,CAAC;AAkBF,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,KAAgB,EAChB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,oEAAoE;QACpE,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;QACpC,eAAe,EAAE,MAAM,CAAC,IAAI,KAAK,aAAa;QAC9C,mDAAmD;QACnD,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAAgE;IAEhE,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAC9B,KAAK;QACH,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG;QAClF,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM;KAC9C,CAAC;AACJ,CAAC"}

package/dist/advice/format.d.ts

@@ -0,0 +1,22 @@
+import type { AppCheck } from "../client/parse.js";
+import { UpgradeRule } from "../upgrade/rules.js";
+import { Finding } from "../upgrade/scan.js";
+/** Problems first, each with what to do; the passing ones in one line */
+export declare function formatChecks(checks: Array<AppCheck & {
+    group?: string;
+}>): string[];
+export interface UpgradeReport {
+    app: string;
+    from: string;
+    to: string;
+    /** the target's imageTag, for create_app */
+    toTag: string;
+    majors: number[];
+    rules: UpgradeRule[];
+    findings: Finding[];
+    filesScanned: number;
+    filesSkipped: string[];
+    rollback: string | null;
+}
+export declare function formatUpgrade(r: UpgradeReport): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/advice/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/advice/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAY,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAU,MAAM,oBAAoB,CAAC;AAIrD,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,EAAE,CAiBnF;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAUD,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CA6CtD"}

package/dist/advice/format.js

@@ -0,0 +1,70 @@
+import { PLATFORM } from "../upgrade/rules.js";
+import { byRule } from "../upgrade/scan.js";
+const MARK = { fail: "❗", warning: "⚠️", error: "⏱️", ok: "✓" };
+/** Problems first, each with what to do; the passing ones in one line */
+export function formatChecks(checks) {
+    const order = ["fail", "warning", "error"];
+    const problems = checks
+        .filter((c) => c.state !== "ok")
+        .sort((a, b) => order.indexOf(a.state) - order.indexOf(b.state));
+    const lines = [];
+    for (const c of problems) {
+        lines.push(`${MARK[c.state] || "•"} ${c.title}${c.group ? ` (${c.group})` : ""}: ${c.message}`);
+        if (c.solution) {
+            lines.push(`   What to do: ${c.solution}`);
+        }
+    }
+    const ok = checks.filter((c) => c.state === "ok");
+    if (ok.length) {
+        lines.push(`${MARK.ok} Fine: ${ok.map((c) => c.title).join(", ")}.`);
+    }
+    return lines;
+}
+function placesOf(places) {
+    const shown = places.slice(0, 8).map((p) => `     ${p.file}:${p.line}  ${p.text}`);
+    if (places.length > 8) {
+        shown.push(`     … and ${places.length - 8} more`);
+    }
+    return shown;
+}
+export function formatUpgrade(r) {
+    const groups = byRule(r.findings);
+    const breaks = groups.filter((g) => g.rule.severity === "breaks");
+    const checks = groups.filter((g) => g.rule.severity === "check");
+    const clean = r.rules.filter((rule) => !groups.some((g) => g.rule.id === rule.id));
+    const lines = [
+        `Upgrade plan for ${r.app}: Parse Server ${r.from} → ${r.to}`,
+        r.majors.length ? `Major versions crossed: ${r.majors.join(", ")}.` : "Same major version: no breaking changes expected.",
+        `Cloud code scanned: ${r.filesScanned} file${r.filesScanned === 1 ? "" : "s"}${r.filesSkipped.length ? ` (not read: ${r.filesSkipped.join(", ")})` : ""}.`,
+        "",
+    ];
+    if (breaks.length) {
+        lines.push("Fix before upgrading (breaks on the new version):");
+        for (const g of breaks) {
+            lines.push(`❗ ${g.rule.title} (Parse Server ${g.rule.major})`, `   ${g.rule.fix}`, ...placesOf(g.places), `   Source: ${g.rule.source}`);
+        }
+        lines.push("");
+    }
+    if (checks.length) {
+        lines.push("Check (may behave differently):");
+        for (const g of checks) {
+            lines.push(`⚠️ ${g.rule.title} (Parse Server ${g.rule.major})`, `   ${g.rule.fix}`, ...placesOf(g.places), `   Source: ${g.rule.source}`);
+        }
+        lines.push("");
+    }
+    if (!breaks.length && !checks.length) {
+        lines.push("No breaking changes found in the cloud code.", "");
+    }
+    if (clean.length) {
+        lines.push(`Not used in the cloud code: ${clean.map((rule) => rule.title).join("; ")}.`, "");
+    }
+    const platform = PLATFORM.filter((p) => r.majors.includes(p.major));
+    if (platform.length) {
+        lines.push("Handled by SashiDo or in App Settings:", ...platform.map((p) => `• Parse Server ${p.major}: ${p.note}`), "");
+    }
+    lines.push("Plan:", `1. ${breaks.length ? "Fix the code above in the app's cloud code (its GitHub repository) and deploy it." : "Nothing in the cloud code has to change first."}`, `2. Try it on a test app: create_app with parseServerVersion "${r.toTag}", deploy the same cloud code, test your clients against it.`, `3. change_parse_server_version on ${r.app} (it shows a preview first, and refuses when the app's settings need a change first, e.g. Google login client IDs), then wait_for_deployment, check_app_health and get_error_logs.`, r.rollback
+        ? `4. If something breaks: change_parse_server_version back to "${r.rollback}".`
+        : "4. The current version isn't offered anymore, so there is no switching back: test well in step 2.");
+    return lines.join("\n");
+}
+//# sourceMappingURL=format.js.map

package/dist/advice/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/advice/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAe,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAW,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AAExF,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,MAA4C;IACvE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD,SAAS,QAAQ,CAAC,MAAiB;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAgB;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG;QACZ,oBAAoB,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,EAAE;QAC7D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,mDAAmD;QACzH,uBAAuB,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1J,EAAE;KACH,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5I,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,wCAAwC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,KAAK,CAAC,IAAI,CACR,OAAO,EACP,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,mFAAmF,CAAC,CAAC,CAAC,gDAAgD,EAAE,EAC9J,gEAAgE,CAAC,CAAC,KAAK,8DAA8D,EACrI,qCAAqC,CAAC,CAAC,GAAG,oLAAoL,EAC9N,CAAC,CAAC,QAAQ;QACR,CAAC,CAAC,gEAAgE,CAAC,CAAC,QAAQ,IAAI;QAChF,CAAC,CAAC,mGAAmG,CACxG,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/advice/schemaChecks.d.ts

@@ -0,0 +1,17 @@
+import type { ParseSchema } from "../client/parse.js";
+/**
+ * The security checks of the app servers' GET /app_checks (Parse Server
+ * 6.5.11+ on SashiDo) that
+ * need only the schema, for apps on older versions; same wording, so the
+ * advice reads the same everywhere.
+ */
+export type CheckState = "ok" | "warning" | "fail" | "error";
+export interface CheckResult {
+    id: string;
+    title: string;
+    state: CheckState;
+    message: string;
+    solution?: string;
+}
+export declare function schemaChecks(classes: ParseSchema[]): CheckResult[];
+//# sourceMappingURL=schemaChecks.d.ts.map

package/dist/advice/schemaChecks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaChecks.d.ts","sourceRoot":"","sources":["../../src/advice/schemaChecks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AAEH,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA2ED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAElE"}

package/dist/advice/schemaChecks.js

@@ -0,0 +1,64 @@
+const CHECKED_SYSTEM_CLASSES = ["_User"];
+const MAX_CLASSES = 50;
+const PUBLIC_KEYS = "Your client keys are public, anyone can read them from your web app or your mobile app. ";
+// a class-level permission is public when it isn't set or allows everyone
+function isPublic(clp, operation) {
+    return !clp || !clp[operation] || clp[operation]["*"] === true;
+}
+function checkedClasses(classes) {
+    return classes.filter((c) => !c.className.startsWith("_") || CHECKED_SYSTEM_CLASSES.includes(c.className));
+}
+function classList(names) {
+    const shown = names.slice(0, MAX_CLASSES);
+    const more = names.length - shown.length;
+    return shown.join(", ") + (more > 0 ? ` and ${more} more` : "");
+}
+const clpOf = (c) => c.classLevelPermissions;
+function userListing(classes) {
+    const user = classes.find((c) => c.className === "_User");
+    const base = { id: "public-user-find", title: "Public listing of users" };
+    if (!user || !isPublic(clpOf(user), "find")) {
+        return { ...base, state: "ok", message: "The users can't be listed by everyone." };
+    }
+    return {
+        ...base,
+        state: "warning",
+        message: `${PUBLIC_KEYS}So anyone can list the users of your app and read their public fields (e.g. usernames).`,
+        solution: "In the Data Browser open _User > Security and allow Find only for authenticated users, roles or the master key. Sign up, login and fetching the current user keep working.",
+    };
+}
+function addField(classes) {
+    const open = checkedClasses(classes)
+        .filter((c) => isPublic(clpOf(c), "addField"))
+        .map((c) => c.className);
+    const base = { id: "public-add-field", title: "Adding fields from the clients" };
+    if (!open.length) {
+        return { ...base, state: "ok", message: "The clients can't add new fields to the classes." };
+    }
+    return {
+        ...base,
+        state: "warning",
+        message: `${PUBLIC_KEYS}So anyone can add new fields to ${open.length} classes by saving objects with new keys: ${classList(open)}. It is a risk when your cloud code trusts fields like isAdmin.`,
+        solution: "In the Data Browser open the class > Security and turn off Add Field for the public. You can still add fields from the dashboard and with the master key.",
+    };
+}
+function publicWrite(classes) {
+    const open = checkedClasses(classes)
+        .filter((c) => c.className !== "_User")
+        .filter((c) => ["create", "update", "delete"].every((op) => isPublic(clpOf(c), op)))
+        .map((c) => c.className);
+    const base = { id: "public-write", title: "Classes writable by everyone" };
+    if (!open.length) {
+        return { ...base, state: "ok", message: "No class can be changed by everyone." };
+    }
+    return {
+        ...base,
+        state: "fail",
+        message: `${PUBLIC_KEYS}So anyone can create objects in ${open.length} classes and change or delete the objects saved without an ACL: ${classList(open)}.`,
+        solution: "In the Data Browser open the class > Security and allow Create, Update and Delete only for authenticated users, roles or the master key, or make sure every object is saved with an ACL (e.g. set it in a beforeSave trigger).",
+    };
+}
+export function schemaChecks(classes) {
+    return [userListing(classes), addField(classes), publicWrite(classes)];
+}
+//# sourceMappingURL=schemaChecks.js.map

package/dist/advice/schemaChecks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaChecks.js","sourceRoot":"","sources":["../../src/advice/schemaChecks.ts"],"names":[],"mappings":"AAmBA,MAAM,sBAAsB,GAAG,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,0FAA0F,CAAC;AAI/G,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,GAAQ,EAAE,SAAiB;IAC3C,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,OAAsB;IAC5C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,qBAA4B,CAAC;AAEjE,SAAS,WAAW,CAAC,OAAsB;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACrF,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,GAAG,WAAW,yFAAyF;QAChH,QAAQ,EACN,4KAA4K;KAC/K,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAsB;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,GAAG,WAAW,mCAAmC,IAAI,CAAC,MAAM,6CAA6C,SAAS,CAAC,IAAI,CAAC,iEAAiE;QAClM,QAAQ,EACN,2JAA2J;KAC9J,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;SACnF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACnF,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,GAAG,WAAW,mCAAmC,IAAI,CAAC,MAAM,mEAAmE,SAAS,CAAC,IAAI,CAAC,GAAG;QAC1J,QAAQ,EACN,gOAAgO;KACnO,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC"}