feat: Allow read and write of internal fields with `maintenanceKey` #8212

dblythy · 2022-10-06T11:23:20Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

Related issue: #8218
Closes #8218

Approach

Introduce new maintenanceKey and define scope of masterKey vs. maintenanceKey.

TODOs before merging

Add tests
A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

parse-github-assistant · 2022-10-06T11:23:24Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

codecov · 2022-10-06T11:31:46Z

Codecov Report

Base: 94.04% // Head: 94.32% // Increases project coverage by +0.27% 🎉

Coverage data is based on head (43f1d0e) compared to base (ffa4974).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8212      +/-   ##
==========================================
+ Coverage   94.04%   94.32%   +0.27%     
==========================================
  Files         181      181              
  Lines       14368    14388      +20     
==========================================
+ Hits        13513    13571      +58     
+ Misses        855      817      -38

Impacted Files	Coverage Δ
src/LiveQuery/ParseLiveQueryServer.js	`95.85% <ø> (+0.21%)`	⬆️
src/Options/Definitions.js	`100.00% <ø> (ø)`
src/Options/index.js	`100.00% <ø> (ø)`
src/ParseServer.js	`92.64% <ø> (+0.39%)`	⬆️
src/Routers/UsersRouter.js	`96.23% <ø> (ø)`
src/Auth.js	`99.57% <100.00%> (+<0.01%)`	⬆️
src/Config.js	`90.41% <100.00%> (+0.09%)`	⬆️
src/Controllers/DatabaseController.js	`93.94% <100.00%> (+0.02%)`	⬆️
src/Controllers/SchemaController.js	`97.41% <100.00%> (+0.19%)`	⬆️
src/Controllers/UserController.js	`96.15% <100.00%> (-1.54%)`	⬇️
... and 11 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

mtrezza · 2022-10-06T13:06:30Z

The masterKey should be able to access internal fields such as _email_verified_token for example.

I am not sure about that. I think Parse Server needs an internal scope that is unreachable even with the master key. Otherwise we won't have any scope to restrict the master key. I don't think that the master key is intended as a "maintenance key" as Parse Dashboard requires the master key for its normal operation. So master key should still be constrained not be able to mess with server internals.

I think the scopes should be:

Scope	Internal variables	Non-internal data	Key
Internal	r/w	r/w	maintenanceKey*
Master	-/-	r/w	masterKey
ReadOnlyMaster	-/-	r/-	readOnlyMasterKey
CLP, ALC	-/-	custom	sessionToken

_{* doesn't exist yet as a feature}

If an internal field should be accessible with the master key, it needs to be downgraded - on a per-field basis - from the "Internal" to the Master" scope.

Could you please open a separate Parse Server issue for this PR, to discuss this? The issue should link to the Parse Dashboard issue, this PR should link to the Parse Server issue.

dblythy · 2022-10-06T13:23:50Z

The masterKey can override protected and internal fields in other classes, so I don’t see why it wouldn’t be able to override keys. It seems like a bit of extra complexity to add a maintenance key

mtrezza · 2022-10-06T14:09:01Z

Let's discuss this in #8218.

To bring this PR ahead, I suggest to expose a bridge to the internal field, not the internal field itself.

…into fix-master

parse-github-assistant · 2022-11-03T00:59:51Z

I will reformat the title to use the proper commit message syntax.

dblythy · 2022-11-06T02:12:59Z

This is a breaking change which could be merged for Parse Server v6 as currently Parse returns internal keys with masterKey. This change only returns internal keys with maintenanceKey

mtrezza · 2022-11-06T12:48:01Z

Could you write a list of internal keys that are retuned only with maintenance key?

I think we should also add the scope table to the README.

We could then add this all under a new section to the README.

dblythy · 2022-11-06T15:44:17Z

Currently masterKey allows unrestricted read of internal keys (prefixed by _) but does not allow writing of them.

This PR removed that functionality (which is why it's breaking) and makes internal keys only accessible for read and write with the maintenanceKey.

mtrezza

Will this break Parse Dashboard? It could if it relies on fields that are "internal" since the dashboard it only using the master key.

…into fix-master

Co-authored-by: Manuel <[email protected]>

mtrezza

Looks good

spec/ParseUser.spec.js

# [6.0.0-alpha.23](6.0.0-alpha.22...6.0.0-alpha.23) (2023-01-08) ### Features * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([#8212](#8212)) ([f3bcc93](f3bcc93)) ### BREAKING CHANGES * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212) ([f3bcc93](f3bcc93))

parseplatformorg · 2023-01-08T21:04:37Z

🎉 This change has been released in version 6.0.0-alpha.23

# [6.0.0-beta.1](5.4.0...6.0.0-beta.1) (2023-01-31) ### Bug Fixes * `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([#8391](#8391)) ([1c37a7c](1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([#8320](#8320)) ([f29d972](f29d972)) * ES6 modules do not await the import of Cloud Code files ([#8368](#8368)) ([a7bd180](a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([#8209](#8209)) ([1412666](1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([#8322](#8322)) ([ab82635](ab82635)) * Rate limiter may reject requests that contain a session token ([#8399](#8399)) ([c114dc8](c114dc8)) * Remove Node 12 and Node 17 support ([#8279](#8279)) ([2546cc8](2546cc8)) * Schema without class level permissions may cause error ([#8409](#8409)) ([aa2cd51](aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([#8372](#8372)) ([892040d](892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([#8280](#8280)) ([130d290](130d290)) ### Features * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([#8212](#8212)) ([f3bcc93](f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([#8366](#8366)) ([ffa4974](ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([#8028](#8028)) ([fc92faa](fc92faa)) * Add Node 19 support ([#8363](#8363)) ([a4990dc](a4990dc)) * Add option to change the log level of the logs emitted by triggers ([#8328](#8328)) ([8f3b694](8f3b694)) * Add request rate limiter based on IP address ([#8174](#8174)) ([6c79f6a](6c79f6a)) * Asynchronous initialization of Parse Server ([#8232](#8232)) ([99fcf45](99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([#8156](#8156)) ([5bbf9ca](5bbf9ca)) * Reduce Docker image size by improving stages ([#8359](#8359)) ([40810b4](40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([#8362](#8362)) ([d0d30c4](d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([#8284](#8284)) ([f535ee6](f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([#8283](#8283)) ([ed499e3](ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([#8287](#8287)) ([2d79c08](2d79c08)) * Remove support for MongoDB 4.0 ([#8292](#8292)) ([37245f6](37245f6)) * Restrict use of `masterKey` to localhost by default ([#8281](#8281)) ([6c16021](6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([#8285](#8285)) ([ee72467](ee72467)) * Upgrade Redis 3 to 4 ([#8293](#8293)) ([7d622f0](7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([#8333](#8333)) ([b2761fb](b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([#8332](#8332)) ([9092874](9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([#8350](#8350)) ([e22b73d](e22b73d)) ### BREAKING CHANGES * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

parseplatformorg · 2023-01-31T03:21:31Z

🎉 This change has been released in version 6.0.0-beta.1

# [6.0.0](5.4.0...6.0.0) (2023-01-31) ### Bug Fixes * `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([#8391](#8391)) ([1c37a7c](1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([#8320](#8320)) ([f29d972](f29d972)) * ES6 modules do not await the import of Cloud Code files ([#8368](#8368)) ([a7bd180](a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([#8209](#8209)) ([1412666](1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([#8322](#8322)) ([ab82635](ab82635)) * Rate limiter may reject requests that contain a session token ([#8399](#8399)) ([c114dc8](c114dc8)) * Remove Node 12 and Node 17 support ([#8279](#8279)) ([2546cc8](2546cc8)) * Schema without class level permissions may cause error ([#8409](#8409)) ([aa2cd51](aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([#8372](#8372)) ([892040d](892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([#8280](#8280)) ([130d290](130d290)) ### Features * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([#8212](#8212)) ([f3bcc93](f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([#8366](#8366)) ([ffa4974](ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([#8028](#8028)) ([fc92faa](fc92faa)) * Add Node 19 support ([#8363](#8363)) ([a4990dc](a4990dc)) * Add option to change the log level of the logs emitted by triggers ([#8328](#8328)) ([8f3b694](8f3b694)) * Add request rate limiter based on IP address ([#8174](#8174)) ([6c79f6a](6c79f6a)) * Asynchronous initialization of Parse Server ([#8232](#8232)) ([99fcf45](99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([#8156](#8156)) ([5bbf9ca](5bbf9ca)) * Reduce Docker image size by improving stages ([#8359](#8359)) ([40810b4](40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([#8362](#8362)) ([d0d30c4](d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([#8284](#8284)) ([f535ee6](f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([#8283](#8283)) ([ed499e3](ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([#8287](#8287)) ([2d79c08](2d79c08)) * Remove support for MongoDB 4.0 ([#8292](#8292)) ([37245f6](37245f6)) * Restrict use of `masterKey` to localhost by default ([#8281](#8281)) ([6c16021](6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([#8285](#8285)) ([ee72467](ee72467)) * Upgrade Redis 3 to 4 ([#8293](#8293)) ([7d622f0](7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([#8333](#8333)) ([b2761fb](b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([#8332](#8332)) ([9092874](9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([#8350](#8350)) ([e22b73d](e22b73d)) ### BREAKING CHANGES * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

parseplatformorg · 2023-01-31T03:39:40Z

🎉 This change has been released in version 6.0.0

…nanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) (parse-community#8212) BREAKING CHANGE: Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (parse-community#8212)

* Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([parse-community#8212](parse-community#8212)) ([f3bcc93](parse-community@f3bcc93)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (parse-community#8212) ([f3bcc93](f3bcc93))

* `ParseServer.verifyServerUrl` may fail if server response headers are missing; remove unnecessary logging ([parse-community#8391](parse-community#8391)) ([1c37a7c](parse-community@1c37a7c)) * Cloud Code trigger `beforeSave` does not work with `Parse.Role` ([parse-community#8320](parse-community#8320)) ([f29d972](parse-community@f29d972)) * ES6 modules do not await the import of Cloud Code files ([parse-community#8368](parse-community#8368)) ([a7bd180](parse-community@a7bd180)) * Nested objects are encoded incorrectly for MongoDB ([parse-community#8209](parse-community#8209)) ([1412666](parse-community@1412666)) * Parse Server option `masterKeyIps` does not include localhost by default for IPv6 ([parse-community#8322](parse-community#8322)) ([ab82635](parse-community@ab82635)) * Rate limiter may reject requests that contain a session token ([parse-community#8399](parse-community#8399)) ([c114dc8](parse-community@c114dc8)) * Remove Node 12 and Node 17 support ([parse-community#8279](parse-community#8279)) ([2546cc8](parse-community@2546cc8)) * Schema without class level permissions may cause error ([parse-community#8409](parse-community#8409)) ([aa2cd51](parse-community@aa2cd51)) * The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option `masterKeyIps` may be circumvented, see [GHSA-vm5r-c87r-pf6x](GHSA-vm5r-c87r-pf6x) ([parse-community#8372](parse-community#8372)) ([892040d](parse-community@892040d)) * Throwing error in Cloud Code Triggers `afterLogin`, `afterLogout` crashes server ([parse-community#8280](parse-community#8280)) ([130d290](parse-community@130d290)) * Access the internal scope of Parse Server using the new `maintenanceKey`; the internal scope contains unofficial and undocumented fields (prefixed with underscore `_`) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the `maintenanceKey` for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) ([parse-community#8212](parse-community#8212)) ([f3bcc93](parse-community@f3bcc93)) * Adapt `verifyServerUrl` for new asynchronous Parse Server start-up states ([parse-community#8366](parse-community#8366)) ([ffa4974](parse-community@ffa4974)) * Add `ParseQuery.watch` to trigger LiveQuery only on update of specific fields ([parse-community#8028](parse-community#8028)) ([fc92faa](parse-community@fc92faa)) * Add Node 19 support ([parse-community#8363](parse-community#8363)) ([a4990dc](parse-community@a4990dc)) * Add option to change the log level of the logs emitted by triggers ([parse-community#8328](parse-community#8328)) ([8f3b694](parse-community@8f3b694)) * Add request rate limiter based on IP address ([parse-community#8174](parse-community#8174)) ([6c79f6a](parse-community@6c79f6a)) * Asynchronous initialization of Parse Server ([parse-community#8232](parse-community#8232)) ([99fcf45](parse-community@99fcf45)) * Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters ([parse-community#8156](parse-community#8156)) ([5bbf9ca](parse-community@5bbf9ca)) * Reduce Docker image size by improving stages ([parse-community#8359](parse-community#8359)) ([40810b4](parse-community@40810b4)) * Remove deprecation `DEPPS1`: Native MongoDB syntax in aggregation pipeline ([parse-community#8362](parse-community#8362)) ([d0d30c4](parse-community@d0d30c4)) * Remove deprecation `DEPPS2`: Config option `directAccess` defaults to true ([parse-community#8284](parse-community#8284)) ([f535ee6](parse-community@f535ee6)) * Remove deprecation `DEPPS3`: Config option `enforcePrivateUsers` defaults to `true` ([parse-community#8283](parse-community#8283)) ([ed499e3](parse-community@ed499e3)) * Remove deprecation `DEPPS4`: Remove convenience method for http request `Parse.Cloud.httpRequest` ([parse-community#8287](parse-community#8287)) ([2d79c08](parse-community@2d79c08)) * Remove support for MongoDB 4.0 ([parse-community#8292](parse-community#8292)) ([37245f6](parse-community@37245f6)) * Restrict use of `masterKey` to localhost by default ([parse-community#8281](parse-community#8281)) ([6c16021](parse-community@6c16021)) * Upgrade Node Package Manager lock file `package-lock.json` to version 2 ([parse-community#8285](parse-community#8285)) ([ee72467](parse-community@ee72467)) * Upgrade Redis 3 to 4 ([parse-community#8293](parse-community#8293)) ([7d622f0](parse-community@7d622f0)) * Upgrade Redis 3 to 4 for LiveQuery ([parse-community#8333](parse-community#8333)) ([b2761fb](parse-community@b2761fb)) * Upgrade to Parse JavaScript SDK 4 ([parse-community#8332](parse-community#8332)) ([9092874](parse-community@9092874)) * Write log entry when request with master key is rejected as outside of `masterKeyIps` ([parse-community#8350](parse-community#8350)) ([e22b73d](parse-community@e22b73d)) * The Docker image does not contain the git dependency anymore; if you have been using git as a transitive dependency it now needs to be explicitly installed in your Docker file, for example with `RUN apk --no-cache add git` (parse-community#8359) ([40810b4](40810b4)) * Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (parse-community#8212) ([f3bcc93](f3bcc93)) * The method `ParseServer.verifyServerUrl` now returns a promise instead of a callback. ([ffa4974](ffa4974)) * The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (parse-community#8362) ([d0d30c4](d0d30c4)) * The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (parse-community#8372) ([892040d](892040d)) * The Node Package Manager lock file `package-lock.json` is upgraded to version 2; while it is backwards with version 1 for the npm installer, consider this if you run any non-npm analysis tools that use the lock file (parse-community#8285) ([ee72467](ee72467)) * This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (parse-community#8232) ([99fcf45](99fcf45)) * Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (parse-community#8209) ([1412666](1412666)) * The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (parse-community#8283) ([ed499e3](ed499e3)) * This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (parse-community#8281) ([6c16021](6c16021)) * This release upgrades to Redis 4; if you are using the Redis cache adapter with Parse Server then this is a breaking change as the Redis client options have changed; see the [Redis migration guide](https://github.com/redis/node-redis/blob/redis%404.0.0/docs/v3-to-v4.md) for more details (parse-community#8293) ([7d622f0](7d622f0)) * This release removes support for MongoDB 4.0; the new minimum supported MongoDB version is 4.2. which also removes support for the deprecated MongoDB MMAPv1 storage engine ([37245f6](37245f6)) * Throwing an error in Cloud Code Triggers `afterLogin`, `afterLogout` returns a rejected promise; in previous releases it crashed the server if you did not handle the error on the Node.js process level; consider adapting your code if your app currently handles these errors on the Node.js process level with `process.on('unhandledRejection', ...)` ([130d290](130d290)) * Config option `directAccess` defaults to true; set this to `false` in environments where multiple Parse Server instances run behind a load balancer and Parse requests within the current Node.js environment should be routed via the load balancer and distributed as HTTP requests among all instances via the `serverURL`. ([f535ee6](f535ee6)) * The convenience method for HTTP requests `Parse.Cloud.httpRequest` is removed; use your preferred 3rd party library for making HTTP requests ([2d79c08](2d79c08)) * This release removes Node 12 and Node 17 support ([2546cc8](2546cc8))

dblythy added 3 commits October 6, 2022 21:18

fix: prevent stripping of user fields with masterKey

4bd135c

feat: allow read and write of internal fields with masterKey

906072d

Update ParseUser.spec.js

7e9bb67

fix lint

1be7ff5

run prettier

62c14eb

add maintenance

5797d43

dblythy changed the title ~~feat: allow read and write of internal fields with masterKey~~ feat: allow read and write of internal fields with maintenanceKey Oct 27, 2022

dblythy added 10 commits October 27, 2022 21:52

Update UsersRouter.js

7fc8227

Merge branch 'alpha' into fix-master

9473747

fix tests

d06ae11

Merge branch 'fix-master' of https://github.com/dblythy/parse-server …

7538dec

…into fix-master

Merge branch 'alpha' into fix-master

bf8c511

run lint

3f14373

Merge branch 'fix-master' of https://github.com/dblythy/parse-server …

4b88000

…into fix-master

Update UserController.js

da1f421

fix tests

f2bcdcc

Merge branch 'alpha' into fix-master

9388f6a

parse-github-assistant bot changed the title ~~feat: allow read and write of internal fields with maintenanceKey~~ feat: Allow read and write of internal fields with maintenanceKey Nov 3, 2022

dblythy requested a review from a team November 6, 2022 02:12

mtrezza changed the title ~~feat: Allow read and write of internal fields with maintenanceKey~~ feat: Allow read and write of internal fields with maintenanceKey Nov 11, 2022

mtrezza reviewed Nov 11, 2022

View reviewed changes

dblythy and others added 10 commits December 22, 2022 14:37

Merge branch 'alpha' into fix-master

cae5680

Update Middlewares.spec.js

1987968

Merge branch 'fix-master' of https://github.com/dblythy/parse-server …

012c1ad

…into fix-master

Update ParseUser.spec.js

57abc1f

Update src/Options/index.js

82bf8a9

Co-authored-by: Manuel <[email protected]>

Update src/Options/index.js

c57efb1

Co-authored-by: Manuel <[email protected]>

docs

687893b

Update Middlewares.spec.js

5fce261

Update ParseUser.spec.js

4e24693

Merge branch 'alpha' into fix-master

60fd5d6

dblythy requested a review from a team January 8, 2023 04:03

mtrezza previously approved these changes Jan 8, 2023

View reviewed changes

spec/ParseUser.spec.js Outdated Show resolved Hide resolved

use example domain

746c978

mtrezza dismissed their stale review via 746c978 January 8, 2023 16:42

mtrezza added 2 commits January 8, 2023 18:23

Merge branch 'alpha' into fix-master

1f199fe

Merge branch 'alpha' into fix-master

43f1d0e

mtrezza merged commit f3bcc93 into parse-community:alpha Jan 8, 2023

parseplatformorg added the state:released-alpha Released as alpha version label Jan 8, 2023

parseplatformorg added the state:released-beta Released as beta version label Jan 31, 2023

parseplatformorg added the state:released Released as stable version label Jan 31, 2023

mtrezza mentioned this pull request Jan 13, 2024

Parse Server option emailVerifyTokenReuseIfValid: true generates new token on every email verification request #8886

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Allow read and write of internal fields with `maintenanceKey` #8212

feat: Allow read and write of internal fields with `maintenanceKey` #8212

dblythy commented Oct 6, 2022 •

edited by mtrezza

Loading

parse-github-assistant bot commented Oct 6, 2022 •

edited

Loading

codecov bot commented Oct 6, 2022 •

edited

Loading

mtrezza commented Oct 6, 2022 •

edited

Loading

dblythy commented Oct 6, 2022 •

edited

Loading

mtrezza commented Oct 6, 2022 •

edited

Loading

parse-github-assistant bot commented Nov 3, 2022

dblythy commented Nov 6, 2022

mtrezza commented Nov 6, 2022 •

edited

Loading

dblythy commented Nov 6, 2022

mtrezza left a comment

mtrezza left a comment

parseplatformorg commented Jan 8, 2023

parseplatformorg commented Jan 31, 2023

parseplatformorg commented Jan 31, 2023

feat: Allow read and write of internal fields with maintenanceKey #8212

feat: Allow read and write of internal fields with maintenanceKey #8212

Conversation

dblythy commented Oct 6, 2022 • edited by mtrezza Loading

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Oct 6, 2022 • edited Loading

Thanks for opening this pull request!

codecov bot commented Oct 6, 2022 • edited Loading

Codecov Report

mtrezza commented Oct 6, 2022 • edited Loading

dblythy commented Oct 6, 2022 • edited Loading

mtrezza commented Oct 6, 2022 • edited Loading

parse-github-assistant bot commented Nov 3, 2022

dblythy commented Nov 6, 2022

mtrezza commented Nov 6, 2022 • edited Loading

dblythy commented Nov 6, 2022

mtrezza left a comment

Choose a reason for hiding this comment

mtrezza left a comment

Choose a reason for hiding this comment

parseplatformorg commented Jan 8, 2023

parseplatformorg commented Jan 31, 2023

parseplatformorg commented Jan 31, 2023

feat: Allow read and write of internal fields with `maintenanceKey` #8212

feat: Allow read and write of internal fields with `maintenanceKey` #8212

dblythy commented Oct 6, 2022 •

edited by mtrezza

Loading

parse-github-assistant bot commented Oct 6, 2022 •

edited

Loading

codecov bot commented Oct 6, 2022 •

edited

Loading

mtrezza commented Oct 6, 2022 •

edited

Loading

dblythy commented Oct 6, 2022 •

edited

Loading

mtrezza commented Oct 6, 2022 •

edited

Loading

mtrezza commented Nov 6, 2022 •

edited

Loading