Commit Graph

66 Commits

Author SHA1 Message Date
dblythy
97c3046f3f FileUpload options for Server Config (#7071)
* New: fileUpload options to restrict file uploads

* review changes

* update review

* Update helper.js

* added complete fileUpload values for tests

* fixed config validation

* allow file upload only for authenicated user by default

* fixed inconsistent error messages

* consolidated and extended tests

* minor compacting

* removed irregular whitespace

* added changelog entry

* always allow file upload with master key

* fix lint

* removed fit

Co-authored-by: Manuel Trezza <trezza.m@gmail.com>
2020-12-17 10:16:37 +01:00
dblythy
e88f2e38f9 Feature: Reuse tokens if they haven't expired (#7017)
* Reuse tokens if they haven't expired

* Fix failing tests

* Update UserController.js

* Update tests

* Tests for invalid config

* restart tests
2020-11-25 09:30:52 -08:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
Manuel
3bd5684f67 Add idempotency (#6748)
* added idempotency router and middleware

* added idempotency rules for routes classes, functions, jobs, installaions, users

* fixed typo

* ignore requests without header

* removed unused var

* enabled feature only for MongoDB

* changed code comment

* fixed inconsistend storage adapter specification

* Trigger notification

* Travis CI trigger

* Travis CI trigger

* Travis CI trigger

* rebuilt option definitions

* fixed incorrect import path

* added new request ID header to allowed headers

* fixed typescript typos

* add new system class to spec helper

* fixed typescript typos

* re-added postgres conn parameter

* removed postgres conn parameter

* fixed incorrect schema for index creation

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* trying to fix postgres issue

* fixed incorrect auth when writing to _Idempotency

* trying to fix postgres issue

* Travis CI trigger

* added test cases

* removed number grouping

* fixed test description

* trying to fix postgres issue

* added Github readme docs

* added change log

* refactored tests; fixed some typos

* fixed test case

* fixed default TTL value

* Travis CI Trigger

* Travis CI Trigger

* Travis CI Trigger

* added test case to increase coverage

* Trigger Travis CI

* changed configuration syntax to use regex; added test cases

* removed unused vars

* removed IdempotencyRouter

* Trigger Travis CI

* updated docs

* updated docs

* updated docs

* updated docs

* update docs

* Trigger Travis CI

* fixed coverage

* removed code comments
2020-07-15 13:10:33 -05:00
Arthur Cinader
5c7918980c Set min mongodb to 3.6 in prep for parse-server 4.0 (#6445)
* Set min mongodb to 3.6 in prep for parse-server 4.0

fixes: 6444

* don't use anonymous functions when we can just
pass the function.

Also remove the boolean argument in tests that no longer exists.

* generate the correct lock file.  ooops.
2020-02-27 10:56:14 -08:00
Omair Vaiyani
eef530b1e3 feat: add allowHeaders to Options (#6044)
* feat: add allowHeaders to Options

This allows developers to use custom headers in their API requests, and they will be accepted by their mounted app.

* refactor: convert allowCrossDomain to generator to add appId in scope

This is necessary as the middleware may run in OPTIONS request that do not contain the appId within the header.

* chore: update Definitions and docs

* fix: update test to use new allowCrossDomain params

* chore: add tests for allowCustomDomain middleware re: allowHeadrs
2019-09-12 14:03:57 -07:00
Jack Wearden
559096f1c2 Allow disabling workaround for since-fixed MongoDB bug (#5617)
* Allow disabling workaround for fixed MongoDB bug

* skipMongoDBServer13732Workaround description fix

* flip test boolean

* Remove CLI flag, use databaseVersion & engine

* Revert "Remove CLI flag, use databaseVersion & engine"

This reverts commit 042d1ba19f636fe0da06074168c6fd5db37ea048.

* clean up
2019-06-19 17:30:08 -05:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
1dd58b7527 Adds support for read-only masterKey (#4297)
* Adds support for read-only masterKey

* Adds tests to make sure all endpoints are properly protected

* Updates readme

* nits
2017-10-26 15:35:07 -04:00
Florent Vilmart
9de4b8b2a7 Refactors configuration management (#4271)
* Adds flow types / Configuration interfaces

* Lets call it options

* Use a single interface to generate the configurations

* Translates options to definitions only if comments are set

* improves logic

* Moves objects around

* Fixes issue affecting logging of circular objects

* fixes undefined env

* Moves all defaults to defaults

* Adds back CLI defaults

* Restored defaults in commander.js

* Merge provided defaults and platform defaults

* Addresses visual nits

* Improves Config.js code

* Adds ability to pass the default value in trailing comments

* Load platform defaults from the definitions file

* proper default values on various options

* Adds ParseServer.start and server.start(options) as quick startup methods

* Moves creating liveQueryServer http into ParseServer.js

* removes dead code

* Adds tests to guarantee we can start a LQ Server from main module

* Fixes incorrect code regading liveQuery init port

* Start a http server for LQ if port is specified

* ensure we dont fail if config.port is not set

* Specify port

* ignore other path skipped in tests

* Adds test for custom middleware setting

* Refactors new Config into Config.get

- Hides AppCache from ParseServer.js, use Config.put which validates

* Extracts controller creation into Controllers/index.js

- This makes the ParseServer init way simpler

* Move serverURL inference into ParseServer

* review nits
2017-10-23 08:43:05 -04:00
Chris Norris
23bffc8883 Add maxLimit server configuration (#4048)
* Add maxLimit server configuration

* Fix maxlimit validation logic to correctly handle maxLimit:0 case
2017-10-02 09:23:09 -04:00
Worathiti Manosroi
7e54265f6d Security: limit Masterkey remote access (#4017)
* update choose_password to have the confirmation

* add comment mark

* First version, no test

* throw error right away instead of just use masterKey false

* fix the logic

* move it up before the masterKey check

* adding some test

* typo

* remove the choose_password

* newline

* add cli options

* remove trailing space

* handle  in case the server is behind proxy

* add getting the first ip in the ip list of xff

* sanity check the ip in config if it is a valid ip address

* split ip extraction to another function

* trailing spaces
2017-07-23 12:26:30 -04:00
Steven Shipton
51d2dd92cb Add config for objectId size (#3950)
* Add objectId config property, default to 10

* Update Config constructor

* Add test for backwards compatibility when changing objectId size
2017-06-27 13:22:43 +03:00
cmmills91
22ba39812b Add support for resending verification email in case of expired token (#3617)
* -Defines new public API route /apps/:appId/resend_verification_email that will generate a new email verification link and email for a user identified by username in POST body
-Add template and url support for invalidVerificationLink, linkSendSuccess, and linkSendFail pages. The invalidVerificationLink pages includes a button that allows the user to generate a new verification email if their current token has expired, using the new public API route
-All three pages have default html that will be functional out of the box, but they can be customized in the customPages object. The custom page for invalidVerificationLink needs to handle the extraction of the username and appId from the url and the POST to generate the new link (this requires javascript)
-Clicking a link for an email that has already been verified now routes to the emailVerifySuccess page instead of the invalidLink page

* Fix package.json repo url to be parse-server againwq

* Fix js lint issues

* Update unit tests

* Use arrow functions, change html page comments, use qs and a string template to construct location for invalidVerificationLink page, syntax fixes

* Remember to pass result when using arrow function
2017-05-10 09:02:16 -04:00
Florent Vilmart
907b160fc7 Adds support for PushScheduling (#3722)
* Add support for push scheduling

Add a configuration flag on the server to handle the availability of
push scheduling.

* Update push controller to skip sending only if scheduling is configured

Only skip push sending if scheduling is configured

* Update bad conventions

* Add CLI definitions for push scheduling

* Adds tests for pushTime

* Adds test for scheduling

* nits

* Test for not scheduled
2017-04-15 17:20:55 -04:00
Florent Vilmart
deedf7b370 Push scalability (#3080)
* Update status through increment
* adds support for incrementing nested keys
* fix issue when having spaces in keys for ordering
* Refactors PushController to use worker
* Adds tests for custom push queue config
* Makes PushController adapter independant
* Better logging of _PushStatus in VERBOSE
2017-01-13 19:34:04 -05:00
Arthur Cinader
4cb6e7d209 Add lint rule space-infix-ops (#3237)
Disallows: 1+1.  Must be 1 + 1.
2017-01-11 12:31:40 -08:00
Lenart Rudel
5d9dbea07b Add parseFrameURL for masking user-facing pages (#3267)
* Add parseFrameURL for masking user-facing pages.

Allow users to specify a different address which is used to mask parse
requests for verifying email and resetting password. This is how Parse.com
used to allow customers to gain control over page content, styling etc.

On the destination page javascript is used to check the link in the request
and embed the parse server page using IFRAME.

* Fix code indentation

* Rename method for building link and pass config to it.

* Add customPages options to README.md.

* Add tests for parseFrameURL email link building, and parseFrameURL option.

* Add parseFrameURL for masking user-facing pages.

Allow users to specify a different address which is used to mask parse
requests for verifying email and resetting password. This is how Parse.com
used to allow customers to gain control over page content, styling etc.

On the destination page javascript is used to check the link in the request
and embed the parse server page using IFRAME.

* Fix code indentation

* Rename method for building link and pass config to it.

* Add customPages options to README.md.

* Don't Object.assign to defaultConfiguration global
2017-01-08 10:56:57 -08:00
Bhaskar Reddy Yasa
f331f6644c Add support for regex string for password policy validatorPattern setting (#3331) 2017-01-08 07:12:44 -08:00
Arthur Cinader
ca286b7108 Enable prefer-const lint rule (#3202) 2016-12-07 18:17:05 -05:00
Florent Vilmart
c1dcaf1271 Auth Adapters refactoring (#3177)
* Moves all authentication providers to Adapter/Auth

* refactors specs

* Deprecates oauth option in favor of auth option

- Deprecates facebookAppIds option (in favor of auth.facebook.appIds)
- Adds warnings about the deprecated options

* nits
2016-12-06 14:09:43 -08:00
Arthur Cinader
01b05b060f Strip personally identifiable information from user table for unauthorized users.
- add a config option to explicitly enumerate pii fields beyond email
- in query controller, strip pii of user table results before sending out the door.
2016-12-02 19:39:09 -05:00
Arthur Cinader
a270632570 More lint tweaking (#3164)
1. Add no space in paren rule
2. fix spec/eslintrc.json so it allow for inheriting from root rc.

Because the spce rc specified reccomended, it "turned off" all of the
rule tweaks in the root.  This fixes that.
2016-12-02 19:11:54 -05:00
Bhaskar Reddy Yasa
bd1689190f Adds password history support to passwordPolicy (#3102)
* password history support in passwordPolicy

* Refactor RestWrite.transformUser

* fix eslint issues
2016-11-29 09:01:52 -08:00
Bhaskar Reddy Yasa
edb7b70ced Adds password expiry support to password policy (#3068)
* Adding support for password expiry policy

* Renamed daysBeforeExpiry -> maxPasswordAge
2016-11-21 07:46:38 -08:00
Bhaskar Reddy Yasa
cf6ce5b9a3 Adding support for optional Password Policy (#3032)
* adds resetTokenValidityDuration setting

* adds a validator to validate password that can be used to enforce strong
passwords

* adds unit tests for passwordPolicy.validator

* adds unit tests to to fail reset password function if password is not in a valid format

* updates README.md for passwordPolicy

* prevents duplicate check for password validator in updateUserPassword

* adds optional setting to disallow username in password

* updates test cases to use fdescribe instead of describe

* updates test cases to use request-promise instead of request

* adds ability to use a RegExp or Callback function or both for a passwordPolicy.validator

* expect username parameter in redirect to password_reset_success

* adds support for _perishable_token_expires_at in postgres
2016-11-17 08:37:51 -08:00
Steven Shipton
b347bff641 Add option to re-use schema cache between requests (#2979)
* Add option to reuse database controller between requests. Clear schema cache when deleting everything

* Add test

* Rename setting to persistSchemaCache to more accurately reflect effect

* Repurpose option to determine whether to randomize cache prefix. Restore Config.js controller creation. Add tests

* Fix bug with missing parameter passed to to SchemaCache

* Renaming and formatting

* Fix property name typo

* Rename option to avoid double negative and still be falsey by default. Style fix
2016-11-02 19:05:23 -04:00
Diwakar Cherukumilli
28bd37884d Adds ability to set an account lockout policy (#2601)
* Adds ability to set account lockout policy

* change fit to it in tests
2016-09-02 20:00:47 -04:00
Florent Vilmart
09bd9e3b2c Adds schema caching capabilities (5s by default) (#2286)
* Adds schema caching capabilities (off by default)

* Use InMemoryCacheAdapter

* Uses proper adapter to generate a cache

* Fix bugs when running disabled cache

* nits

* nits

* Use options object instead of boolean

* Imrpove concurrency of loadSchema

* Adds testing with SCHEMA_CACHE_ON

* Use CacheController instead of generator

- Makes caching SchemaCache use a generated prefix
- Makes clearing the SchemaCache clear only the cached schema keys
- Enable cache by default (ttl 5s)
2016-07-22 21:23:59 -07:00
Marek Mikołajczyk
d1a6caeee3 Allow usage of analytics adapter (#2327)
* Allow usage of analytics adapter

* Use promises in controller
2016-07-20 09:27:15 -04:00
Diwakar Cherukumilli
6f292059ba Adds ability to expire email verify token (#2216) 2016-07-18 23:10:36 -07:00
Sen Palanisami
7d234e054b Log objects rather than JSON strings and option for single line logs (#2028)
* Log objects rather than JSON strings and option for single line logs

This reverts commit fcd914bdfd.

* Better password stripping tests
2016-07-15 16:18:50 -04:00
Tyler Brock
2f2ff377eb Better e-mail adapter testing (#2208) 2016-07-05 12:08:46 -07:00
Diwakar Cherukumilli
08c63f324a Adds ability to prevent login with unverified emails (#2175) 2016-07-04 13:56:35 -04:00
Tyler Brock
799e59618c Stop requiring verifyUserEmails for password reset functionality (#2166) 2016-06-28 22:25:44 -04:00
Drew
7e868b2dcc Unique indexes (#1971)
* Add unique indexing

* Add unique indexing for username/email

* WIP

* Finish unique indexes

* Notes on how to upgrade to 2.3.0 safely

* index on unique-indexes: c454180 Revert "Log objects rather than JSON stringified objects (#1922)"

* reconfigure username/email tests

* Start dealing with test shittyness

* Remove tests for files that we are removing

* most tests passing

* fix failing test

* Make specific server config for tests async

* Fix more tests

* fix more tests

* Fix another test

* fix more tests

* Fix email validation

* move some stuff around

* Destroy server to ensure all connections are gone

* Fix broken cloud code

* Save callback to variable

* no need to delete non existant cloud

* undo

* Fix all tests where connections are left open after server closes.

* Fix issues caused by missing gridstore adapter

* Update guide for 2.3.0 and fix final tests

* use strict

* don't use features that won't work in node 4

* Fix syntax error

* Fix typos

* Add duplicate finding command

* Update 2.3.0.md
2016-06-10 20:27:21 -07:00
Tyler Brock
17374eff8d Round out webhookKey support in cli, docs, and Config (#1936) 2016-05-28 12:21:55 -04:00
Blayne Chard
8c09c3dae1 Adding Caching Adapter, allows caching of _Role and _User queries (fixes #168) (#1664)
* Adding Caching Adapter, allows caching of _Role and _User queries.
2016-05-18 12:12:30 +12:00
Steven Shipton
37c502bed0 Add config.expireInactiveSession to add support for non-expiring inactive sessions (#1536)
* Create non-expiring session when sessionLength is zero

* Introduce expireInactiveSessions setting
2016-05-06 12:50:45 -07:00
Drew
d33dd68cc5 Add revokeSessionOnPasswordReset option. Closes #1584 (#1597)
* Add revokeSessionOnPasswordReset option

* Fix nits
2016-04-22 18:21:50 -04:00
Jeremy May
f99b5588ab Added session length option for session tokens to server configuration 2016-04-02 11:36:47 -04:00
Florent Vilmart
ab1858616b Adds ability to override mount with publicServerURL for production uses 2016-03-30 20:09:10 -04:00
wangmengyan95
555e25bf33 Add LiveQuery 2016-03-18 12:32:31 -07:00
Florent Vilmart
9c5f14981e Renames oauth to authDataManager in src 2016-03-10 18:14:56 -05:00
Florent Vilmart
54d154f7aa Centralizes AuthData validation 2016-03-10 18:14:56 -05:00
Florent Vilmart
28d1a8afe4 Sends 404 when parseServerURL is not set on public pages
- throws when verifyEmail = true && publicServerURL not set
2016-02-29 20:51:13 -05:00
Florent Vilmart
6aa38ea8ca Improves validation of email parameters in Configuration 2016-02-29 19:26:50 -05:00
Florent Vilmart
3ecaa0aa4b Sends verification email upon set and update email
- nits
2016-02-29 18:58:34 -05:00
Florent Vilmart
91d9724182 Adds reset password logic 2016-02-29 18:55:15 -05:00