Commit Graph

204 Commits

Author SHA1 Message Date
Antonio Davi Macedo Coelho de Castro
90c81c1750 Validates permission before calling beforeSave trigger (#5546)
* Test to reproduce the problem

* Validating update before calling beforeSave trigger

* Fixing lint

* Commenting code

* Improving the code
2019-05-11 10:37:27 -07:00
CoderickLamar
c7eb7daeae Fix for count being very slow on large Parse Classes' collections (Postgres) (#5330)
* Changed count to be approximate. Should help with postgres slowness

* refactored last commit to only fall back to estimate if no complex query

* handlign variables correctly

* Trying again because it was casting to lowercase table names which doesnt work for us/

* syntax error

* Adding quotations to pg query

* hopefully final pg fix

* Postgres will now use an approximate count unless there is a more complex query specified

* handling edge case

* Fix for count being very slow on large Parse Classes' collections in Postgres. Replicating fix for Mongo in issue 5264

* Fixed silly spelling error resulting from copying over notes

* Lint fixes

* limiting results to 1 on approximation

* suppress test that we can no longer run for postgres

* removed tests from Postgres that no longer apply

* made changes requested by dplewis

* fixed count errors

* updated package.json

* removed test exclude for pg

* removed object types from method

* test disabled for postgres

* returned type

* add estimate count test

* fix mongo test
2019-04-08 17:59:15 -05:00
awgeorge
86e9351cd0 Reverse update. 2019-02-23 07:28:39 -08:00
awgeorge
c5a5f57451 Updates based on review 2019-02-23 07:28:39 -08:00
awgeorge
ff33c9939c Use ES6 code 2019-02-23 07:28:39 -08:00
awgeorge
1420df7d7a Update based on @milesrichardson comment https://github.com/parse-community/parse-server/pull/5334#discussion_r252693409 2019-02-23 07:28:39 -08:00
awgeorge
0dec4931a0 Add filter sensitive fields logic that apply CLPs\nAdd protectedFields CLP\nAdd defaults for protectedFields CLP\nFix tests 2019-02-23 07:28:39 -08:00
Florent Vilmart
46ac7e7f11 Adds fix for issue affecting update with CLP (#5269)
* Adds fix for issue affecting update with CLP

* Disable single instance
2019-01-04 14:23:27 -05:00
Florent Vilmart
7c81290252 Live query CLP (#4387)
* Auth module refactoring in order to be reusable

* Ensure cache controller is properly forwarded from helpers

* Nits

* Adds support for static validation

* Adds support for CLP in Live query (no support for roles yet)

* Adds e2e test to validate liveQuery hooks is properly called

* Adds tests over LiveQueryController to ensure data is correctly transmitted

* nits

* Fixes for flow types

* Removes usage of Parse.Promise

* Use the Auth module for authentication and caches

* Cleaner implementation of getting auth

* Adds authCache that stores auth promises

* Proper testing of the caching

* nits
2018-10-17 17:53:49 -04:00
Florent Vilmart
f1bc55bf89 Reduces number of calls to injectDefaultSchema (#5107) 2018-10-08 14:16:29 -04:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
efb6c63a95 Ensure legacy users with authData are not locked out (#4898)
* Adds fix for issue, ensuring legacy users with no ACL are properly handled

* Runs tests only on mongo
2018-07-18 14:42:50 +00:00
Florent Vilmart
960431b92d Even faster tests (#4868)
* Various improvements in test name / de-duplications

* Reverts to class by class deletion, introduced fast mode that just delete data for mongo

- Speeds up are incredible Executed 1695 of 1713 specs INCOMPLETE (18 PENDING) in 4 mins 19 secs.

* Adds documentation about the deleteEverything
2018-07-03 11:13:08 -04:00
Florent Vilmart
585938ca2c improves test performance on mongodb (#4862)
* improves test performance on mongodb

* Removes unused methdos
2018-06-29 17:09:51 -04:00
Florent Vilmart
3bcb5a0997 Ensure User ACL's are more flexible and secure #3588 (#4860)
* Fixes an issue that would let the beforeDelete be called when user has no access to the object

* Ensure we properly lock user

- Improves find method so we can attempt to read for a write poking the right ACL instead of using masterKey
- This ensure we do not run beforeDelete/beforeFind/beforeSave in the wrong scenarios

* nits

* Caps insufficient
2018-06-28 16:31:22 -04:00
Arthur Cinader
260c466dcb Change name of function and variable from baseFieldName to rootFieldName (#4817) 2018-06-07 19:27:11 -04:00
Arthur Cinader
e06471603f Don't error when attempting to sort on an object field (#4806)
* add failing test to demonstrate that you can't sort on a
field in an object.

* Only validate the base of the field name.

* fix test name

* Only test sort for mongo.

* pg order by nested object

* level 2 test

* Factor out operation to get a field's base name.  Add comment.

* tweak comment wording so it wont make my grammar teacher angry.
2018-06-07 18:47:18 -04:00
Jérémy Piednoel
77ed10f57b Adding $nor operator support (#4768)
* adding nor to specialQuerykeys

* adding nor suport

* adding test

* CRLF

* adding postgres NOR

* adding nor validation

* adding NOR test

* adding test amd fixing NOR cases

* revert the nor logic
2018-05-18 14:26:33 -05:00
Jong Eun Lee
b0bcbd8731 add _password_history to default sensitive data (#4699) 2018-04-10 13:54:35 -04:00
Diamond Lewis
f0674df424 Fixes Issue unsetting in beforeSave doesn't allow object creation (#4610)
* skip unset fields on canAddField

* removed fit

* add null check
2018-03-08 10:31:53 -06:00
Florent Vilmart
11c40dce97 Adds session creation code in Auth.js (#4574) 2018-02-19 11:15:54 -05:00
Florent Vilmart
10631371e6 Introduces flow types for storage (#4349)
* Introduces flow types for storage

* Better typing of QueryOptions

* Adds flow types to SchemaCOntroller,

- runs flow on pre tests
- fixes flow

* Adds ClassLevelPermissions type

* Moves Controller types into a single file

* Changes import styles

* Changes import styles

* fixing method setIndexesWithSchemaFormat (#4454)

Fixing invalid database code in method `setIndexesWithSchemaFormat`:

* It must be a transaction, not a task, as it executes multiple database changes
* It should contain the initial queries inside the transaction, providing the context, not outside it;
* Replaced the code with the ES6 Generator notation
* Removing the use of batch, as the value of the result promise is irrelevant, only success/failure that matters

* nits

* Fixes tests, improves flow typing
2017-12-30 20:44:18 -05:00
Diamond Lewis
4bccf96ae7 Add Indexes to Schema API (#4240)
* Add Indexes to Schema API

* error handling

* ci errors

* postgres support

* full text compound indexes

* pg clean up

* get indexes on startup

* test compound index on startup

* add default _id to index, full Text index on startup

* lint

* fix test
2017-11-25 15:39:31 -05:00
Benjamin Wilson Friedman
7944e2bd2d Remove hidden properties from aggregate responses (#4351)
* Remove hidden properties from aggregrate responses

* transform results from mongo & postgres

* Adjust ordering to comply with tests
2017-11-22 23:07:45 -08:00
Florent Vilmart
09fee7d12b Adds optimization for related relations (#4345)
* Adds optimization for related relations

* Makes MongoStorageAdapter only able to sort on Join tables
2017-11-14 14:46:51 -05:00
Diamond Lewis
7223add446 Support for Aggregate Queries (#4207)
* Support for Aggregate Queries

* improve pg and coverage

* Mongo 3.4 aggregates and tests

* replace _id with objectId

* improve tests for objectId

* project with group query

* typo
2017-11-12 14:00:22 -05:00
Florent Vilmart
a5ce9fc175 Refactor pushStatusHandler to use Parse instead of direct access (#4173)
* Refactors pushStatusHandler to use HTTP interface so we can bind CloudCode hooks

* Handle correctly nested dot atomic operations

* Better handling of restricted class names, add support for afterSave _PushStatus

* Adds simple testing for afterSave(PushStatus)

* Reverts jobStatusHandler

* Addresses fixes

* adds delays to all methods
2017-09-18 15:01:07 -04:00
Florent Vilmart
0f840b6bb8 Fix/issue pointer permissions (#4141)
* Makes sure we don't override roles

* Reduces the query size whith pointer permissions

- Does not return as $and if not needed
- Returns just the query with the additional constraint

* Do not use $in if include is just of length 1
2017-09-09 14:02:07 -04:00
Arthur Cinader
ff4ae55e34 Fix minor comment typo (#4110)
* Fix minor comment typo

* get the rest of the typos.  use US spelling for behavior.
2017-08-23 10:41:27 -07:00
Antonio Davi Macedo Coelho de Castro
b6298feaa7 Read preference option per query (#3865) 2017-06-21 23:18:10 +03:00
Antonio Davi Macedo Coelho de Castro
a0d1a3517f fix(DatabaseController): Do not match any entry when searching for null in relation field (#3924) 2017-06-21 08:23:20 -04:00
Antonio Davi Macedo Coelho de Castro
4509d25471 Endpoints for audiences CRUD (#3861) 2017-06-21 08:54:13 +03:00
greenkeeper[bot]
e94991b368 Update dependencies to enable Greenkeeper 🌴 (#3940)
* chore(package): update dependencies

* docs(readme): add Greenkeeper badge

* Fix indent issues with eslint 4.0

see http://eslint.org/docs/user-guide/migrating-to-4.0.0\#-the-indent-rule-is-more-strict
2017-06-20 09:15:26 -07:00
Diamond Lewis
8b21d5ab80 feat: Full Text Search Support (#3904)
* Full Text Support

* invalid input test

* Support for sort

* index exist test

* clean up

* better error messaging

* postgres support

* error instructions for $diacritic and $case sensitivity

* nit

* nit

* nit

* separate test for full text
2017-06-13 21:42:59 -04:00
Florent Vilmart
b5a2042d12 Fixes issue #3835 affecting relation updates (#3836)
* Adds test for 3835

* Makes sure we run relational updates AFTER validating access to the object

* Always run relation udpates last
2017-05-22 12:34:00 -04:00
Florent Vilmart
691cf5988a Adds count class level permission (#3814)
* Adds count class level permission

* fixup! Adds count class level permission

* Adds missing count property on beforeFind request object

* nits
2017-05-14 21:47:30 -04:00
Jack Wearden
7b9ebc4e8e Avoid multiple $nears in one query (#3798)
Mongo has a hard limit on 1 $near operation per query. Restructuring to
avoid SERVER-13732 should not invalidate a query by creating multiple
$near operations.

Additionally, queries with multiple $ors are now recursively handled,
whereas before, ops at the top level would only have been pushed one
level deeper.

https://github.com/parse-community/parse-server/issues/3767
2017-05-10 08:32:08 -04:00
Natan Rolnik
9bfa0c60c4 Adds index on _Role name property (#3586)
* Adds index on _Role name property

In order to avoid having different _Role objects with the same name, adding an index on the name property of _Role is necessary.

Fixes #3579

* Uses throw instead of Promise.reject when enforcing unique indexes

* Fixes wrong sorting of results in schemas tests
2017-03-04 12:42:19 -08:00
Jack Wearden
73195627c0 Alleviate SERVER-13732 on all top level filters (#3564)
In a prior commit, improvements were made to the addition of `_rperm`
in the case of `$or` queries, to avoid MongoDB bug SERVER-13732.

As the vast majority of $or queries previously hit this bug due to the
presence of `_rperm` on most Parse queries), the present solution
avoids the bug and improves query performance in most cases.

However, it's still possible for clients to supply their own queries
which hit that bug, such as those with `_created_at` or `_updated_at`
filters, or their own properties from their data model.

This commit makes the logic currently present for `_rperm` available
to all top level filters that exist alongside an $or query, meaning
SERVER-13732 should be avoided in all cases where keys at the top and
inner levels do not have name clashes.

- https://github.com/ParsePlatform/parse-server/pull/3476
- https://jira.mongodb.org/browse/SERVER-13732
2017-02-26 13:37:33 -05:00
Jack Wearden
96a9588a6e MongoDB $or Queries avoid SERVER-13732 bug (#3476)
MongoDB has an unfixed bug in all supported versions 2.6-3.4 which
results in suboptimal index usage for `$or` queries when the query has
implicit `$and`s at the query root.

When adding `_rperm` to `$or` queries, Parse accidentally creates
queries which hit this bug.

The fix in this commit applies the suggested workaround of putting the
`_rperm` property inside all `$or` subdocuments, moving it from the top
level and leaving `$or` as the only top-level operator.

MongoDB Bug Link: https://jira.mongodb.org/browse/SERVER-13732
2017-02-03 21:34:19 -08:00
Arthur Cinader
ca286b7108 Enable prefer-const lint rule (#3202) 2016-12-07 18:17:05 -05:00
Arthur Cinader
8359284329 Fix some random minor typos. (#3157) 2016-12-01 20:34:39 -05:00
Arthur Cinader
11f7712651 Add no trailing whitespace and force eol at end of file. (#3154) 2016-12-01 13:24:46 -05:00
Bhaskar Reddy Yasa
bd1689190f Adds password history support to passwordPolicy (#3102)
* password history support in passwordPolicy

* Refactor RestWrite.transformUser

* fix eslint issues
2016-11-29 09:01:52 -08:00
Florent Vilmart
8c2c76dd26 Adds liniting into the workflow (#3082)
* initial linting of src

* fix indent to 2 spaces

* Removes unnecessary rules

* ignore spec folder for now

* Spec linting

* Fix spec indent

* nits

* nits

* no no-empty rule
2016-11-24 15:47:41 -05:00
Bhaskar Reddy Yasa
edb7b70ced Adds password expiry support to password policy (#3068)
* Adding support for password expiry policy

* Renamed daysBeforeExpiry -> maxPasswordAge
2016-11-21 07:46:38 -08:00
Bhaskar Reddy Yasa
cf6ce5b9a3 Adding support for optional Password Policy (#3032)
* adds resetTokenValidityDuration setting

* adds a validator to validate password that can be used to enforce strong
passwords

* adds unit tests for passwordPolicy.validator

* adds unit tests to to fail reset password function if password is not in a valid format

* updates README.md for passwordPolicy

* prevents duplicate check for password validator in updateUserPassword

* adds optional setting to disallow username in password

* updates test cases to use fdescribe instead of describe

* updates test cases to use request-promise instead of request

* adds ability to use a RegExp or Callback function or both for a passwordPolicy.validator

* expect username parameter in redirect to password_reset_success

* adds support for _perishable_token_expires_at in postgres
2016-11-17 08:37:51 -08:00
Steven Shipton
b347bff641 Add option to re-use schema cache between requests (#2979)
* Add option to reuse database controller between requests. Clear schema cache when deleting everything

* Add test

* Rename setting to persistSchemaCache to more accurately reflect effect

* Repurpose option to determine whether to randomize cache prefix. Restore Config.js controller creation. Add tests

* Fix bug with missing parameter passed to to SchemaCache

* Renaming and formatting

* Fix property name typo

* Rename option to avoid double negative and still be falsey by default. Style fix
2016-11-02 19:05:23 -04:00
Jeremy Louie
b88b0c578f Fix multiple use of notEqualTo (#2882)
* Add failing test for multiple .notEqualTo on relation with same class

* Fix multiple .notEqualTo on relations with the same class

Multiple  should use the union of all objectIds not the intersect
Fixes ParsePlatform/parse-server#1596
2016-10-18 16:44:47 -04:00
Florent Vilmart
b5af4d017c Makes sure pointer includes are interpolated as get (#2747)
* test for repro #2005

* Adds ability to override CLP op from RestQuery.execute

* nits
2016-09-24 14:54:31 -04:00