Commit Graph

166 Commits

Author SHA1 Message Date
Old Grandpa
292bdb713a Allow protectedFields for Authenticated users and Public. Fix userField with keys/excludedKeys (#6415)
* fix error message and test it

* protected fields fixes

* clean

* remove duplicate test, add some comments

* no need for 'requiresAuthentication'
2020-02-19 01:34:08 -08:00
Arthur Cinader
fd0b535159 Case insensitive signup (#5634)
* Always delete data after each, even for mongo.

* Add failing simple case test

* run all tests

* 1. when validating username be case insensitive

2. add _auth_data_anonymous to specialQueryKeys...whatever that is!

* More case sensitivity

1. also make email validation case insensitive
2. update comments to reflect what this change does

* wordsmithery and grammar

* first pass at a preformant case insensitive query.  mongo only so far.

* change name of parameter from insensitive to
caseInsensitive

* Postgres support

* properly handle auth data null

* wip

* use 'caseInsensitive' instead of 'insensitive' in all places.

* update commenet to reclect current plan

* skip the mystery test for now

* create case insensitive indecies for
mongo to support case insensitive
checks for email and username

* remove unneeded specialKey

* pull collation out to a function.

* not sure what i planned
to do with this test.
removing.

* remove typo

* remove another unused flag

* maintain order

* maintain order of params

* boil the ocean on param sequence
i like having explain last cause it seems
like something you would
change/remove after getting what you want
from the explain?

* add test to verify creation
and use of caseInsensitive index

* add no op func to prostgress

* get collation object from mongocollection
make flow lint happy by declaring things Object.

* fix typo

* add changelog

* kick travis

* properly reference static method

* add a test to confirm that anonymous users with
unique username that do collide when compared
insensitively can still be created.

* minot doc nits

* add a few tests to make sure our spy is working as expected
wordsmith the changelog

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-02-14 09:44:51 -08:00
Old Grandpa
3c46117d9b Granular CLP pointer permissions (#6352)
* set pointer permissions per operatioon; tests

* more tests

* fixes addField permission; tests
2020-01-27 22:21:30 -08:00
stevestencil
9842c6ee42 adds ability to set hint on Parse.Query #6288 (#6322)
* added hint to aggregate

* added support for hint in query

* added else clause to aggregate

* fixed tests

* updated tests

* Add tests and clean up

* Add support for explain

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-01-14 02:14:43 -06:00
Dobbias Nan
2b1c591cb7 Protected fields pointer-permissions support (#5951)
* moved whitelisting of own user to remove conflict with custom classes and * permission

* added new pointer-perm regex to permissions

* added pointer-permissions support

* added tests

* fixed typo

* fixed typo 2

* added tests using find operation

* renamed protectedFields pointerPerm to userField

* decoupled readUserFields from CLP and removed readUser from protectedFields before querying

* updated tests
2019-08-22 12:01:50 -07:00
Dobbias Nan
0fa315fc5b Added array support for pointer-permissions (#5921)
* added array support for pointer permissions

* added tests for array support for pointer permissions

* Postgres fix

* simplify PG, no idea why this works
2019-08-15 23:55:12 -05:00
Diamond Lewis
cf6e79ee75 Fix: Lint no-prototype-builtins (#5920)
* Fix: Lint no-prototype-builtins

Closes: https://github.com/parse-community/parse-server/issues/5842

Reference: https://eslint.org/docs/rules/no-prototype-builtins

* replace Object.hasOwnProperty.call
2019-08-14 14:57:00 -07:00
Antonio Davi Macedo Coelho de Castro
8b97c1380b Batch transaction (#5849)
* Batch transaction boilerplate

* Refactoring transaction boilerplate

* Independent sessions test

* Transactions - partial

* Missing only one test

* All tests passing for mongo db

* Tests on Travis

* Transactions on postgres

* Fix travis to restart mongodb

* Remove mongodb service and keep only mongodb runner

* MongoDB service back

* Initialize replicaset

* Remove mongodb runner again

* Again only with mongodb-runner and removing cache

* Trying with pretest and posttest

* WiredTiger

* Pretest and posttest again

* Removing inexistent scripts

* wiredTiger

* One more attempt

* Trying another way to run mongodb-runner

* Fixing tests

* Include batch transaction on direct access

* Add tests to direct access
2019-07-31 02:41:07 -07:00
Antonio Davi Macedo Coelho de Castro
b605638415 Fix: GraphQL _or operator not working (#5840) 2019-07-23 10:29:38 -03:00
Jack Wearden
559096f1c2 Allow disabling workaround for since-fixed MongoDB bug (#5617)
* Allow disabling workaround for fixed MongoDB bug

* skipMongoDBServer13732Workaround description fix

* flip test boolean

* Remove CLI flag, use databaseVersion & engine

* Revert "Remove CLI flag, use databaseVersion & engine"

This reverts commit 042d1ba19f636fe0da06074168c6fd5db37ea048.

* clean up
2019-06-19 17:30:08 -05:00
Diamond Lewis
cc6d474dcb Schema Cache Improvement 2 (#5616)
* schema hasClass improvement

* create object improvement

* destroy object

* update object

* hasClass test rewrite

* more tests

* improve signing up users
2019-05-30 11:14:05 -05:00
Diamond Lewis
f7716f2f87 Schema Cache Improvements (#5612)
* Cache Improvements

* improve tests

* more tests

* clean-up

* test with singlecache

* ensure indexes exists

* remove ALL_KEYS

* Add Insert Test

* enableSingleSchemaCache default true

* Revert "enableSingleSchemaCache default true"

This reverts commit 323e7130fb8f695e3ca44ebf9b3b1d38905353da.

* further optimization

* refactor enforceFieldExists

* coverage improvements

* improve tests

* remove flaky test

* cleanup

* Learned something new
2019-05-24 16:42:27 -05:00
Antonio Davi Macedo Coelho de Castro
90c81c1750 Validates permission before calling beforeSave trigger (#5546)
* Test to reproduce the problem

* Validating update before calling beforeSave trigger

* Fixing lint

* Commenting code

* Improving the code
2019-05-11 10:37:27 -07:00
CoderickLamar
c7eb7daeae Fix for count being very slow on large Parse Classes' collections (Postgres) (#5330)
* Changed count to be approximate. Should help with postgres slowness

* refactored last commit to only fall back to estimate if no complex query

* handlign variables correctly

* Trying again because it was casting to lowercase table names which doesnt work for us/

* syntax error

* Adding quotations to pg query

* hopefully final pg fix

* Postgres will now use an approximate count unless there is a more complex query specified

* handling edge case

* Fix for count being very slow on large Parse Classes' collections in Postgres. Replicating fix for Mongo in issue 5264

* Fixed silly spelling error resulting from copying over notes

* Lint fixes

* limiting results to 1 on approximation

* suppress test that we can no longer run for postgres

* removed tests from Postgres that no longer apply

* made changes requested by dplewis

* fixed count errors

* updated package.json

* removed test exclude for pg

* removed object types from method

* test disabled for postgres

* returned type

* add estimate count test

* fix mongo test
2019-04-08 17:59:15 -05:00
awgeorge
86e9351cd0 Reverse update. 2019-02-23 07:28:39 -08:00
awgeorge
c5a5f57451 Updates based on review 2019-02-23 07:28:39 -08:00
awgeorge
ff33c9939c Use ES6 code 2019-02-23 07:28:39 -08:00
awgeorge
1420df7d7a Update based on @milesrichardson comment https://github.com/parse-community/parse-server/pull/5334#discussion_r252693409 2019-02-23 07:28:39 -08:00
awgeorge
0dec4931a0 Add filter sensitive fields logic that apply CLPs\nAdd protectedFields CLP\nAdd defaults for protectedFields CLP\nFix tests 2019-02-23 07:28:39 -08:00
Florent Vilmart
46ac7e7f11 Adds fix for issue affecting update with CLP (#5269)
* Adds fix for issue affecting update with CLP

* Disable single instance
2019-01-04 14:23:27 -05:00
Florent Vilmart
7c81290252 Live query CLP (#4387)
* Auth module refactoring in order to be reusable

* Ensure cache controller is properly forwarded from helpers

* Nits

* Adds support for static validation

* Adds support for CLP in Live query (no support for roles yet)

* Adds e2e test to validate liveQuery hooks is properly called

* Adds tests over LiveQueryController to ensure data is correctly transmitted

* nits

* Fixes for flow types

* Removes usage of Parse.Promise

* Use the Auth module for authentication and caches

* Cleaner implementation of getting auth

* Adds authCache that stores auth promises

* Proper testing of the caching

* nits
2018-10-17 17:53:49 -04:00
Florent Vilmart
f1bc55bf89 Reduces number of calls to injectDefaultSchema (#5107) 2018-10-08 14:16:29 -04:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
efb6c63a95 Ensure legacy users with authData are not locked out (#4898)
* Adds fix for issue, ensuring legacy users with no ACL are properly handled

* Runs tests only on mongo
2018-07-18 14:42:50 +00:00
Florent Vilmart
960431b92d Even faster tests (#4868)
* Various improvements in test name / de-duplications

* Reverts to class by class deletion, introduced fast mode that just delete data for mongo

- Speeds up are incredible Executed 1695 of 1713 specs INCOMPLETE (18 PENDING) in 4 mins 19 secs.

* Adds documentation about the deleteEverything
2018-07-03 11:13:08 -04:00
Florent Vilmart
585938ca2c improves test performance on mongodb (#4862)
* improves test performance on mongodb

* Removes unused methdos
2018-06-29 17:09:51 -04:00
Florent Vilmart
3bcb5a0997 Ensure User ACL's are more flexible and secure #3588 (#4860)
* Fixes an issue that would let the beforeDelete be called when user has no access to the object

* Ensure we properly lock user

- Improves find method so we can attempt to read for a write poking the right ACL instead of using masterKey
- This ensure we do not run beforeDelete/beforeFind/beforeSave in the wrong scenarios

* nits

* Caps insufficient
2018-06-28 16:31:22 -04:00
Arthur Cinader
260c466dcb Change name of function and variable from baseFieldName to rootFieldName (#4817) 2018-06-07 19:27:11 -04:00
Arthur Cinader
e06471603f Don't error when attempting to sort on an object field (#4806)
* add failing test to demonstrate that you can't sort on a
field in an object.

* Only validate the base of the field name.

* fix test name

* Only test sort for mongo.

* pg order by nested object

* level 2 test

* Factor out operation to get a field's base name.  Add comment.

* tweak comment wording so it wont make my grammar teacher angry.
2018-06-07 18:47:18 -04:00
Jérémy Piednoel
77ed10f57b Adding $nor operator support (#4768)
* adding nor to specialQuerykeys

* adding nor suport

* adding test

* CRLF

* adding postgres NOR

* adding nor validation

* adding NOR test

* adding test amd fixing NOR cases

* revert the nor logic
2018-05-18 14:26:33 -05:00
Jong Eun Lee
b0bcbd8731 add _password_history to default sensitive data (#4699) 2018-04-10 13:54:35 -04:00
Diamond Lewis
f0674df424 Fixes Issue unsetting in beforeSave doesn't allow object creation (#4610)
* skip unset fields on canAddField

* removed fit

* add null check
2018-03-08 10:31:53 -06:00
Florent Vilmart
11c40dce97 Adds session creation code in Auth.js (#4574) 2018-02-19 11:15:54 -05:00
Florent Vilmart
10631371e6 Introduces flow types for storage (#4349)
* Introduces flow types for storage

* Better typing of QueryOptions

* Adds flow types to SchemaCOntroller,

- runs flow on pre tests
- fixes flow

* Adds ClassLevelPermissions type

* Moves Controller types into a single file

* Changes import styles

* Changes import styles

* fixing method setIndexesWithSchemaFormat (#4454)

Fixing invalid database code in method `setIndexesWithSchemaFormat`:

* It must be a transaction, not a task, as it executes multiple database changes
* It should contain the initial queries inside the transaction, providing the context, not outside it;
* Replaced the code with the ES6 Generator notation
* Removing the use of batch, as the value of the result promise is irrelevant, only success/failure that matters

* nits

* Fixes tests, improves flow typing
2017-12-30 20:44:18 -05:00
Diamond Lewis
4bccf96ae7 Add Indexes to Schema API (#4240)
* Add Indexes to Schema API

* error handling

* ci errors

* postgres support

* full text compound indexes

* pg clean up

* get indexes on startup

* test compound index on startup

* add default _id to index, full Text index on startup

* lint

* fix test
2017-11-25 15:39:31 -05:00
Benjamin Wilson Friedman
7944e2bd2d Remove hidden properties from aggregate responses (#4351)
* Remove hidden properties from aggregrate responses

* transform results from mongo & postgres

* Adjust ordering to comply with tests
2017-11-22 23:07:45 -08:00
Florent Vilmart
09fee7d12b Adds optimization for related relations (#4345)
* Adds optimization for related relations

* Makes MongoStorageAdapter only able to sort on Join tables
2017-11-14 14:46:51 -05:00
Diamond Lewis
7223add446 Support for Aggregate Queries (#4207)
* Support for Aggregate Queries

* improve pg and coverage

* Mongo 3.4 aggregates and tests

* replace _id with objectId

* improve tests for objectId

* project with group query

* typo
2017-11-12 14:00:22 -05:00
Florent Vilmart
a5ce9fc175 Refactor pushStatusHandler to use Parse instead of direct access (#4173)
* Refactors pushStatusHandler to use HTTP interface so we can bind CloudCode hooks

* Handle correctly nested dot atomic operations

* Better handling of restricted class names, add support for afterSave _PushStatus

* Adds simple testing for afterSave(PushStatus)

* Reverts jobStatusHandler

* Addresses fixes

* adds delays to all methods
2017-09-18 15:01:07 -04:00
Florent Vilmart
0f840b6bb8 Fix/issue pointer permissions (#4141)
* Makes sure we don't override roles

* Reduces the query size whith pointer permissions

- Does not return as $and if not needed
- Returns just the query with the additional constraint

* Do not use $in if include is just of length 1
2017-09-09 14:02:07 -04:00
Arthur Cinader
ff4ae55e34 Fix minor comment typo (#4110)
* Fix minor comment typo

* get the rest of the typos.  use US spelling for behavior.
2017-08-23 10:41:27 -07:00
Antonio Davi Macedo Coelho de Castro
b6298feaa7 Read preference option per query (#3865) 2017-06-21 23:18:10 +03:00
Antonio Davi Macedo Coelho de Castro
a0d1a3517f fix(DatabaseController): Do not match any entry when searching for null in relation field (#3924) 2017-06-21 08:23:20 -04:00
Antonio Davi Macedo Coelho de Castro
4509d25471 Endpoints for audiences CRUD (#3861) 2017-06-21 08:54:13 +03:00
greenkeeper[bot]
e94991b368 Update dependencies to enable Greenkeeper 🌴 (#3940)
* chore(package): update dependencies

* docs(readme): add Greenkeeper badge

* Fix indent issues with eslint 4.0

see http://eslint.org/docs/user-guide/migrating-to-4.0.0\#-the-indent-rule-is-more-strict
2017-06-20 09:15:26 -07:00
Diamond Lewis
8b21d5ab80 feat: Full Text Search Support (#3904)
* Full Text Support

* invalid input test

* Support for sort

* index exist test

* clean up

* better error messaging

* postgres support

* error instructions for $diacritic and $case sensitivity

* nit

* nit

* nit

* separate test for full text
2017-06-13 21:42:59 -04:00
Florent Vilmart
b5a2042d12 Fixes issue #3835 affecting relation updates (#3836)
* Adds test for 3835

* Makes sure we run relational updates AFTER validating access to the object

* Always run relation udpates last
2017-05-22 12:34:00 -04:00
Florent Vilmart
691cf5988a Adds count class level permission (#3814)
* Adds count class level permission

* fixup! Adds count class level permission

* Adds missing count property on beforeFind request object

* nits
2017-05-14 21:47:30 -04:00
Jack Wearden
7b9ebc4e8e Avoid multiple $nears in one query (#3798)
Mongo has a hard limit on 1 $near operation per query. Restructuring to
avoid SERVER-13732 should not invalidate a query by creating multiple
$near operations.

Additionally, queries with multiple $ors are now recursively handled,
whereas before, ops at the top level would only have been pushed one
level deeper.

https://github.com/parse-community/parse-server/issues/3767
2017-05-10 08:32:08 -04:00
Natan Rolnik
9bfa0c60c4 Adds index on _Role name property (#3586)
* Adds index on _Role name property

In order to avoid having different _Role objects with the same name, adding an index on the name property of _Role is necessary.

Fixes #3579

* Uses throw instead of Promise.reject when enforcing unique indexes

* Fixes wrong sorting of results in schemas tests
2017-03-04 12:42:19 -08:00