Commit Graph

58 Commits

Author SHA1 Message Date
Daniel
03fba97e05 feat: Add zones for rate limiting by ip, user, session, global (#8508) 2023-06-09 13:27:56 +02:00
Daniel
82da30842a feat: Add new Parse Server option preventSignupWithUnverifiedEmail to prevent returning a user without session token on sign-up with unverified email address (#8451) 2023-06-07 21:51:53 +02:00
Manuel
a27482c57e refactor: Add new Parse Server option fileUpload.fileExtensions to restrict file upload by file extension (#8539) 2023-05-21 01:31:52 +02:00
Daniel
6f885d36b9 feat: extendSessionOnUse to automatically renew Parse Sessions (#8505) 2023-05-17 19:49:25 +02:00
alljinx
2caea310be feat: Add option to change the log level of logs emitted by Cloud Functions (#8530) 2023-05-09 15:03:00 +02:00
Marc Derhammer
4f15539ac2 feat: Allow multiple origins for header Access-Control-Allow-Origin (#8517) 2023-05-01 22:25:22 +02:00
Daniel
34833e42ee feat: Add rate limiting across multiple servers via Redis (#8394) 2023-03-06 17:43:15 +01:00
Daniel
b3b76de71b feat: Add option schemaCacheTtl for schema cache pulling as alternative to enableSchemaHooks (#8436) 2023-02-27 01:55:47 +01:00
Daniel
e5d610e5e4 feat: Add Parse Server option resetPasswordSuccessOnInvalidEmail to choose success or error response on password reset with invalid email (#7551) 2023-02-24 20:30:48 +01:00
Daniel
f3bcc9365c feat: Access the internal scope of Parse Server using the new maintenanceKey; the internal scope contains unofficial and undocumented fields (prefixed with underscore _) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the maintenanceKey for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) (#8212)
BREAKING CHANGE: Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212)
2023-01-08 22:02:12 +01:00
Daniel
6c79f6a69e feat: Add request rate limiter based on IP address (#8174) 2023-01-06 13:39:02 +01:00
Manuel
892040dc2f fix: The client IP address may be determined incorrectly in some cases; this fixes a security vulnerability in which the Parse Server option masterKeyIps may be circumvented, see [GHSA-vm5r-c87r-pf6x](https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x) (#8372)
BREAKING CHANGE: The mechanism to determine the client IP address has been rewritten; to correctly determine the IP address it is now required to set the Parse Server option `trustProxy` accordingly if Parse Server runs behind a proxy server, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting (#8372)
2023-01-05 14:26:54 +01:00
Daniel
99fcf45e55 feat: Asynchronous initialization of Parse Server (#8232)
BREAKING CHANGE: This release introduces the asynchronous initialization of Parse Server to prevent mounting Parse Server before being ready to receive request; it changes how Parse Server is imported, initialized and started; it also removes the callback `serverStartComplete`; see the [Parse Server 6 migration guide](https://github.com/parse-community/parse-server/blob/alpha/6.0.0.md) for more details (#8232)
2022-12-21 15:30:13 +01:00
alljinx
8f3b694e39 feat: Add option to change the log level of the logs emitted by triggers (#8328) 2022-12-07 22:55:45 +01:00
Daniel
ab82635b0d fix: Parse Server option masterKeyIps does not include localhost by default for IPv6 (#8322) 2022-11-25 23:19:14 +01:00
dblythy
6c16021a1f feat: Restrict use of masterKey to localhost by default (#8281)
BREAKING CHANGE: This release restricts the use of `masterKey` to localhost by default; if you are using Parse Dashboard on a different server to connect to Parse Server you need to add the IP address of the server that hosts Parse Dashboard to this option (#8281)
2022-11-11 03:24:48 +01:00
dblythy
5bbf9cade9 feat: Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters (#8156) 2022-11-10 17:35:39 +01:00
vzukanov
0388956808 feat: add option to change the default value of the Parse.Query.limit() constraint (#8152) 2022-09-30 00:38:57 +02:00
dblythy
df12ba3ba2 docs: regenerate API docs (#8179) 2022-09-19 12:40:15 +02:00
dblythy
c1e808f9e8 feat: selectively enable / disable default authentication adapters (#7953) 2022-05-29 01:50:43 +02:00
Antoine Cormouls
a169663304 refactor: add missing schema definitions (#7917) 2022-05-01 04:21:33 +02:00
Manuel
971adb5438 fix: security vulnerability that allows remote code execution (GHSA-p6h4-93qp-jhcm) (#7843) 2022-03-12 13:49:57 +01:00
dblythy
484c2e81ca fix: improve security by deprecating creating users with public access by default (#7319) 2021-10-08 05:24:20 +02:00
Lukáš Smilek
b185fad695 Additional explication for expireInactiveSessions in ParseServerOptions (#7552)
* Update docs.js

Additional explication for `expireInactiveSessions`

* Update index.js

Additional explication for `expireInactiveSessions`

* Update docs.js

correcting spelling error

* Update index.js

correcting spelling error

* Update Definitions.js

Co-authored-by: Manuel <5673677+mtrezza@users.noreply.github.com>
2021-09-10 15:49:20 +02:00
Manuel
a28433f16e Replace mailgun adapter with mock adapter (#7321) 2021-04-06 16:32:48 +02:00
Manuel
7042552507 Enable direct access by default (#6636)
* enabled direct access by default

* removed obsolete direct access option test case

* quick fix test

* Set RESTController during tests

* Properly handle RESTController

* Documentation

* revert changes

* rerun tests

* remove extra parse instance

* Revert "remove extra parse instance"

This reverts commit 21422f45f1548ebddddd1c4ccbc03a94b4994429.

* Ensure restcontroller is set

* Fix test

* improved option docs

* renamed direct access env var

* added deprecations to README

* added deprecation definition

* fixed docs typo

* improve promise rejection warning test

* added renaming of env var to deprecation warning

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2021-04-05 02:28:28 +02:00
Manuel
637326d3af bump mongodb version in CI (#7272)
* bump mongodb version

* improved wording in changelog

* another mongodb bump

* rewording changelog

* added info to option docs
2021-03-17 01:57:10 +01:00
Diamond Lewis
a02014f557 Improve single schema cache (#7214)
* Initial Commit

* fix flaky test

* temporary set ci timeout

* turn off ci check

* fix postgres tests

* fix tests

* node flaky test

* remove improvements

* Update SchemaPerformance.spec.js

* fix tests

* revert ci

* Create Singleton Object

* properly clear cache testing

* Cleanup

* remove fit

* try PushController.spec

* try push test rewrite

* try push enqueue time

* Increase test timeout

* remove pg server creation test

* xit push tests

* more xit

* remove skipped tests

* Fix conflicts

* reduce ci timeout

* fix push tests

* Revert "fix push tests"

This reverts commit 05aba62f1cbbca7d5d3e80b9444529f59407cb56.

* improve initialization

* fix flaky tests

* xit flaky test

* Update CHANGELOG.md

* enable debug logs

* Update LogsRouter.spec.js

* create initial indexes in series

* lint

* horizontal scaling documentation

* Update Changelog

* change horizontalScaling db option

* Add enableSchemaHooks option

* move enableSchemaHooks to databaseOptions
2021-03-16 16:05:36 -05:00
Manuel
bee889a329 Add security check (#7247)
* added Parse Server security option

* added SecurityRouter

* added Check class

* added CheckGroup class

* moved parameter validation to Utils

* added CheckRunner class

* added auto-run on server start

* added custom security checks as Parse Server option

* renamed script to check

* reformat log output

* added server config check

* improved contributing guideline

* improved contribution guide

* added check security log

* improved log format

* added checks

* fixed log fomat typo

* added database checks

* fixed database check

* removed database auth check in initial version

* improved contribution guide

* added security check tests

* fixed typo

* improved wording guidelines

* improved wording guidelines
2021-03-10 13:19:28 -06:00
Manuel
de50b7b23d Add custom routes to pages router (#7231)
* added custom routes

* fixed docs typos

* added page.customRoutes config validation

* added 404 response if missing custom route response

* added docs

* minor README formatting

* added CHANGELOG entry

* fixed bug in definitions builder that did not recognize array of custom type

* added missing route handler definition

* fixed custom routes definition
2021-03-07 13:51:35 +01:00
Manuel
7f47b0427e Add page localization (#7128)
* added localized pages; added refactored page templates; adapted test cases; introduced localization test cases

* added changelog entry

* fixed test description typo

* fixed bug in PromiseRouter where headers are not added for text reponse

* added page parameters in page headers for programmatic use

* refactored tests for PublicAPIRouter

* added mustache lib for template rendering

* fixed fs.promises module reference

* fixed template placeholder typo

* changed redirect response to provide headers instead of query parameters

* fix lint

* fixed syntax errors and typos in html templates

* removed obsolete URI encoding

* added locale inferring from request body and header

* added end-to-end localizaton test

* added server option validation; refactored pages server option

* fixed invalid redirect URL for no locale matching file

* added end-to-end localizaton tests

* adapted tests to new response content

* re-added PublicAPIRouter; added PagesRouter as experimental feature

* refactored PagesRouter test structure

* added configuration option for custom path to pages

* added configuration option for custom endpoint to pages

* fixed lint

* added tests

* added a distinct page for invalid password reset link

* renamed generic page invalidLink to expiredVerificationLink

* improved HTML files documentation

* improved HTML files documentation

* changed changelog entry for experimental feature

* improved file naming to make it more descriptive

* fixed file naming and env parameter naming

* added readme entry

* fixed readme TOC - hasn't been updated in a while

* added localization with JSON resource

* added JSON localization to feature pages (password reset, email verification)

* updated readme

* updated readme

* optimized JSON localization for feature pages; added e2e test case

* fixed readme typo

* minor refactoring of existing tests

* fixed bug where Object type was not recognized as config key type

* added feature config placeholders

* prettier

* added passing locale to page config placeholder callback

* refactored passing locale to placeholder to pass test

* added config placeholder feature to README

* fixed typo in README
2021-02-09 14:03:57 +01:00
Manuel
08b2ea45b0 Add account unlock on password reset (#7146)
* added account unlock on password reset

* added account policy option

* added changelog entry

* Added docs entry

* moved changelog entry to correct position

* improved tests to ensure requesting password reset email does not unlock account

* run prettier
2021-02-01 01:07:04 +01:00
dblythy
97c3046f3f FileUpload options for Server Config (#7071)
* New: fileUpload options to restrict file uploads

* review changes

* update review

* Update helper.js

* added complete fileUpload values for tests

* fixed config validation

* allow file upload only for authenicated user by default

* fixed inconsistent error messages

* consolidated and extended tests

* minor compacting

* removed irregular whitespace

* added changelog entry

* always allow file upload with master key

* fix lint

* removed fit

Co-authored-by: Manuel Trezza <trezza.m@gmail.com>
2020-12-17 10:16:37 +01:00
dblythy
e634eba57c fix: definitions for accountLockout and passwordPolicy (#7040)
* fix: definitions for accountLockout and passwordPolicy

* redo env prefix
2020-12-03 15:03:29 -06:00
dblythy
c8ff445c10 Fix typo in server definitions for emailVerifyTokenReuseIfValid (#7037)
* Update index.js

* run docs
2020-12-03 13:40:13 -06:00
dblythy
e88f2e38f9 Feature: Reuse tokens if they haven't expired (#7017)
* Reuse tokens if they haven't expired

* Fix failing tests

* Update UserController.js

* Update tests

* Tests for invalid config

* restart tests
2020-11-25 09:30:52 -08:00
dblythy
b4ec63e8a7 Init (#6999) 2020-11-09 16:36:45 -08:00
Antonio Davi Macedo Coelho de Castro
78b59fb26b Merge pull request from GHSA-2xm2-xj2q-qgpj
* Test case and fixes

* Change requestTimeout default to 5s

* Document new function argument
2020-10-21 16:32:07 -07:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
Manuel
3bd5684f67 Add idempotency (#6748)
* added idempotency router and middleware

* added idempotency rules for routes classes, functions, jobs, installaions, users

* fixed typo

* ignore requests without header

* removed unused var

* enabled feature only for MongoDB

* changed code comment

* fixed inconsistend storage adapter specification

* Trigger notification

* Travis CI trigger

* Travis CI trigger

* Travis CI trigger

* rebuilt option definitions

* fixed incorrect import path

* added new request ID header to allowed headers

* fixed typescript typos

* add new system class to spec helper

* fixed typescript typos

* re-added postgres conn parameter

* removed postgres conn parameter

* fixed incorrect schema for index creation

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* trying to fix postgres issue

* fixed incorrect auth when writing to _Idempotency

* trying to fix postgres issue

* Travis CI trigger

* added test cases

* removed number grouping

* fixed test description

* trying to fix postgres issue

* added Github readme docs

* added change log

* refactored tests; fixed some typos

* fixed test case

* fixed default TTL value

* Travis CI Trigger

* Travis CI Trigger

* Travis CI Trigger

* added test case to increase coverage

* Trigger Travis CI

* changed configuration syntax to use regex; added test cases

* removed unused vars

* removed IdempotencyRouter

* Trigger Travis CI

* updated docs

* updated docs

* updated docs

* updated docs

* update docs

* Trigger Travis CI

* fixed coverage

* removed code comments
2020-07-15 13:10:33 -05:00
Jerome De Leon
0abe9bb42d Make clear description of anonymous user (#6655)
* Make clear description of anonymous user

* Properly generate definitions

Co-authored-by: dplewis <findlewis@gmail.com>
2020-07-13 10:00:55 -05:00
Kevin Yao
d03ec18bcc feat: allow custom cors origin header (#6772) 2020-07-10 13:48:57 -05:00
Arthur Cinader
5c7918980c Set min mongodb to 3.6 in prep for parse-server 4.0 (#6445)
* Set min mongodb to 3.6 in prep for parse-server 4.0

fixes: 6444

* don't use anonymous functions when we can just
pass the function.

Also remove the boolean argument in tests that no longer exists.

* generate the correct lock file.  ooops.
2020-02-27 10:56:14 -08:00
Diamond Lewis
1a99cb3f2e Add maxLogFiles option (#6296)
https://community.parseplatform.org/t/server-log-retention/867/2

Maximum number of logs to keep. If not set, no logs will be removed. This can be a number of files or number of days. If using days, add 'd' as the suffix. (default: null).

I'll run this in production for a few days. I assume it works.

Useful for saving disk space.

Update winston-daily-rotate-file package to 4.4.0
2019-12-24 11:35:28 -06:00
Rhuan
8bc201d228 #6101 Let users define objectId (#6177)
* #6101 Let users define objectId

* Add `allowCustomObjectId` to PS Option

* Add checking in objectId creation

* Add test

* Update docs

* Update definition

* Change default to false

* throw on empty, null, undefined

* better tests

* unused async

* removed comment

* retain comment

* Linting fix according to contributing spec.
2019-12-17 12:23:18 -06:00
Omair Vaiyani
eef530b1e3 feat: add allowHeaders to Options (#6044)
* feat: add allowHeaders to Options

This allows developers to use custom headers in their API requests, and they will be accepted by their mounted app.

* refactor: convert allowCrossDomain to generator to add appId in scope

This is necessary as the middleware may run in OPTIONS request that do not contain the appId within the header.

* chore: update Definitions and docs

* fix: update test to use new allowCrossDomain params

* chore: add tests for allowCustomDomain middleware re: allowHeadrs
2019-09-12 14:03:57 -07:00
Diamond Lewis
1064f0c3fb Support: serverCloseComplete option (#5937)
* Support: serverCloseComplete option

Callback when server has fully shutdown.

Please check that all cases are covered.

* handle error on startup

* fix tests

* test workaround

* remove serverCloseComplete chech on startup failure
2019-08-19 00:25:52 -05:00
Douglas Muraoka
ef14ca530d GraphQL Object constraints (#5715)
* GraphQL Object constraints

Implements the GraphQL Object constraints, which allows us to filter queries results using the `$eq`, `$lt`, `$gt`, `$in`, and other Parse supported constraints.
Example:
```
query objects {
  findMyClass(where: {
    objField: {
      _eq: {
        key: 'foo.bar',
        value: 'hello'
      },
      _gt: {
        key: 'foo.number',
        value: 10
      },
      _lt: {
        key: 'anotherNumber',
        value: 5
      }
    }
  }) {
    results {
      objectId
    }
  }
}
```
In the example above, we have the `findMyClass` query (automatically generated for the `MyClass` class), and a field named `objField` whose type is Object. The object below represents a valid `objField` value and would satisfy all constraints:
```
{
  "foo": {
    "bar": "hello",
    "number": 11
  },
  "anotherNumber": 4
}
```
The Object constraint is applied only when using Parse class object type queries. When using "generic" queries such as `get` and `find`, this type of constraint is not available.

* Objects constraints not working on Postgres

Fixes the $eq, $ne, $gt, and $lt constraints when applied on an Object type field.

* Fix object constraint field name

* Fix Postgres constraints indexes

* fix: Object type composed constraints not working

* fix: Rename key and value fields

* refactor: Object constraints for generic queries

* fix: Object constraints not working on Postgres
2019-08-02 12:18:07 -07:00
Diamond Lewis
218c3499f9 Implement WebSocketServer Adapter (#5866)
* Implement WebSocketServerAdapter

* lint

* clean up
2019-07-30 09:05:41 -05:00
Antonio Davi Macedo Coelho de Castro
a6f441248b GraphQL custom schema on CLI (#5828)
* Add --graphQLSchema to CLI

* Add custom graphql schema instructions to readme file

* Update README.md

Co-Authored-By: Tom Fox <tomfox@surprises.io>

* Update src/Options/Definitions.js

Co-Authored-By: Tom Fox <tomfox@surprises.io>

* Update src/Options/docs.js

Co-Authored-By: Tom Fox <tomfox@surprises.io>

* Update src/Options/index.js

Co-Authored-By: Tom Fox <tomfox@surprises.io>
2019-07-19 12:29:45 -07:00