Commit Graph

930 Commits

Author SHA1 Message Date
Florent Vilmart
691cf5988a Adds count class level permission (#3814)
* Adds count class level permission

* fixup! Adds count class level permission

* Adds missing count property on beforeFind request object

* nits
2017-05-14 21:47:30 -04:00
Florent Vilmart
d71683a7e2 Code maintenance, small refactors (#3811)
* Removes promise wrapping in AccountLockoutPolicy

* Use bcrypt promises as globally available
2017-05-14 19:37:42 -04:00
Florent Vilmart
88de01f3d8 Fix issue _PushStatus stuck sending (#3808)
* Adds test for not set device tokens

* Properly filter the installations without a deviceToken

* nit for slower PG test

* nit
2017-05-12 14:24:37 -04:00
Florent Vilmart
10c7cb0bfa requiresAuthentication is self-sufficient for ACL's (#3784)
* Adds test to reproduce issue #3753

* Consider requiresAuthentication as the same level as other CLP

* Better testing
2017-05-11 11:09:06 -04:00
Anthony Mosca
877ef78b5e Improve email verification (#3681)
* Removed hidden keys from users/me.

* Ensured that general users cannot update email verified flag.

* Updated tests to reflect email verification changes.
2017-05-11 09:44:58 -04:00
youngerong
e0be653f4c Properly obfuscate query parameters in logs (#3793)
* fix-3789

* fix3789 add unit test
2017-05-11 07:17:20 -04:00
cmmills91
22ba39812b Add support for resending verification email in case of expired token (#3617)
* -Defines new public API route /apps/:appId/resend_verification_email that will generate a new email verification link and email for a user identified by username in POST body
-Add template and url support for invalidVerificationLink, linkSendSuccess, and linkSendFail pages. The invalidVerificationLink pages includes a button that allows the user to generate a new verification email if their current token has expired, using the new public API route
-All three pages have default html that will be functional out of the box, but they can be customized in the customPages object. The custom page for invalidVerificationLink needs to handle the extraction of the username and appId from the url and the POST to generate the new link (this requires javascript)
-Clicking a link for an email that has already been verified now routes to the emailVerifySuccess page instead of the invalidLink page

* Fix package.json repo url to be parse-server againwq

* Fix js lint issues

* Update unit tests

* Use arrow functions, change html page comments, use qs and a string template to construct location for invalidVerificationLink page, syntax fixes

* Remember to pass result when using arrow function
2017-05-10 09:02:16 -04:00
Jack Wearden
7b9ebc4e8e Avoid multiple $nears in one query (#3798)
Mongo has a hard limit on 1 $near operation per query. Restructuring to
avoid SERVER-13732 should not invalidate a query by creating multiple
$near operations.

Additionally, queries with multiple $ors are now recursively handled,
whereas before, ops at the top level would only have been pushed one
level deeper.

https://github.com/parse-community/parse-server/issues/3767
2017-05-10 08:32:08 -04:00
kahoona77
64e6f40779 catch unhandled rejection with installation-handling (#3795) 2017-05-09 08:10:38 -04:00
Florent Vilmart
8d67776c2e Removes un-necessary shutdown handler (#3786)
* Removes un-necessary shutdown handler

- When registering a shutdown hander, the node process has to be exited manually which causes issues for many users

* Proper graceful shutdown from CLI
2017-05-08 10:06:01 -07:00
Florent Vilmart
45a9d50110 Skip authData validation if it hasn't changed. (#3783)
* Adds test for the new feature

* Re-validate authData only if mutated

- In case of short-lived tokens (like facebook) this will allow clients to be lax with asking users to re-login
2017-05-07 12:55:30 -04:00
Florent Vilmart
f7af48db89 Fix/3678 overloaded query constraints (#3723)
* Added failing test

* Updated test description

* Properly handle equalities with additional operator constraints

* adds continuation to silence rejected promises

* Wrap json parsing

* nits
2017-04-23 15:10:17 -07:00
Paulo Vítor S Reis
69042fbf50 [postgres] Improve performance when adding many new fields to the Schema (#3740) 2017-04-23 17:25:33 -04:00
Paulo Vítor S Reis
5e14147676 Fixes issue affecting deleting multiple fields of a Schema (#3735) 2017-04-23 17:22:55 -04:00
Florent Vilmart
5813fd0bf8 Fix flaky tests (#3724)
* adds continuation to silence rejected promises

* Wrap json parsing
2017-04-16 16:50:03 -04:00
Florent Vilmart
fd375cb927 Fixes issue affecting queries on Pointer arrays (#3721)
* Transform array atoms on equality

* nits
2017-04-16 11:44:41 -04:00
Florent Vilmart
907b160fc7 Adds support for PushScheduling (#3722)
* Add support for push scheduling

Add a configuration flag on the server to handle the availability of
push scheduling.

* Update push controller to skip sending only if scheduling is configured

Only skip push sending if scheduling is configured

* Update bad conventions

* Add CLI definitions for push scheduling

* Adds tests for pushTime

* Adds test for scheduling

* nits

* Test for not scheduled
2017-04-15 17:20:55 -04:00
Florent Vilmart
e7a45cecb7 Adds graceful shutdown handler for mongodb (#3706) 2017-04-11 09:26:25 -07:00
ren dong
f3f81b692b support pg-promise init options (#3613)
* pg-promise init options

* add database init options

* Create PostgresInitOptions.spec.js

* Update PostgresInitOptions.spec.js

* Update PostgresInitOptions.spec.js

* add PostgresInitOptions test

* Add files via upload

* linebreaks CRLF to LF

* modify postgresURI to test environment

* modify pg error code to 42P01

* fix reconfigureServer callback
2017-04-07 07:50:55 -04:00
zhoul-HS
52828683ba Add __type property to GeoPoint fields in PostgresStorageAdapter (#3695)
* Add __type property to GeoPoint fields in PostgresStorageAdapter

* Add test to check __type on GeoPoint queries
2017-04-07 07:44:12 -04:00
Benjamin Wilson Friedman
e01b417d3f Added exception for Twitter and OAuth missing options (#3676)
* Added exception for Twitter and OAuth missing configuration information

* Updated error codes to INTERNAL_SERVER_ERROR, code 1
2017-03-28 18:16:47 -04:00
Florent Vilmart
1f9a4edacd Ignore duplicate_object error on create _Schema if not exists (#3668) 2017-03-23 22:29:43 -04:00
Wissam Abirached
2533a8cdb3 Do not create user if username or password is empty (#3650) 2017-03-17 18:57:21 -04:00
Florent Vilmart
eb1b84b556 CLI: Do not exit(0) so each module can close its connections (#3634) 2017-03-13 12:13:07 -04:00
Arthur Cinader
1d8edd73c3 default for userSensitiveFields should be an array not a string. (#3599) 2017-03-05 09:06:45 -08:00
Vitaly Tomilov
271608bc82 Update PostgresStorageAdapter.js (#3578)
* Update PostgresStorageAdapter.js

proper database API, via transaction.

* Update PostgresStorageAdapter.js

fixing bracket.

* Update PostgresStorageAdapter.js

adding the same rejection approach as before, the functionality remains identical.

* Update PostgresStorageAdapter.js

* Update PostgresStorageAdapter.js

lint fixing

* Update PostgresStorageAdapter.js

fixing misspelling.
2017-03-04 15:56:53 -08:00
Xy Ziemba
29fec01a42 Resend Verification Email Endpoint (#3543)
* Endpoint to Handle Verification Email Request

* Adds tests for verificationEmailRequest endpoint

* Better error responses for `/verificationEmailRequest`
2017-03-04 13:30:52 -08:00
Natan Rolnik
9bfa0c60c4 Adds index on _Role name property (#3586)
* Adds index on _Role name property

In order to avoid having different _Role objects with the same name, adding an index on the name property of _Role is necessary.

Fixes #3579

* Uses throw instead of Promise.reject when enforcing unique indexes

* Fixes wrong sorting of results in schemas tests
2017-03-04 12:42:19 -08:00
Ryan Foster
e6006e800e adding TTL option for redis cache adapter (#3397)
* adding TTL option for redis cache adapter

* adding test for RedisCacheAdapter

* Fixing adapater var name

* changing timeout

* updating default time

* Fix the redis cache spec to construct the cache with the anticipated ttl

make timeout values really really small so our test run fast :).
2017-02-27 12:29:15 -08:00
Jack Wearden
73195627c0 Alleviate SERVER-13732 on all top level filters (#3564)
In a prior commit, improvements were made to the addition of `_rperm`
in the case of `$or` queries, to avoid MongoDB bug SERVER-13732.

As the vast majority of $or queries previously hit this bug due to the
presence of `_rperm` on most Parse queries), the present solution
avoids the bug and improves query performance in most cases.

However, it's still possible for clients to supply their own queries
which hit that bug, such as those with `_created_at` or `_updated_at`
filters, or their own properties from their data model.

This commit makes the logic currently present for `_rperm` available
to all top level filters that exist alongside an $or query, meaning
SERVER-13732 should be avoided in all cases where keys at the top and
inner levels do not have name clashes.

- https://github.com/ParsePlatform/parse-server/pull/3476
- https://jira.mongodb.org/browse/SERVER-13732
2017-02-26 13:37:33 -05:00
Paulo Vítor S Reis
032d5e55ca Logger MaskSentive just for strings and array string items (#3571) 2017-02-26 13:34:03 -05:00
Bhaskar Reddy Yasa
0e900cbefd allow flow through to passwordPolicy in case of empty ('') password (#3560) 2017-02-24 07:21:50 -05:00
Florent Vilmart
41358d2226 Adds ability to pass a middleware to CLI for instrumentation (#3554)
* Adds ability to pass a middleware to CLI for instrumentation

* Adds readme
2017-02-22 23:42:21 +02:00
Tyler Brock
67260b5fe0 Factor out checking for triggers/liveQuery in rest.js (#3539) 2017-02-20 12:25:25 -08:00
Florent Vilmart
193e5a4278 Make sure we don't treat dot notation keys as topLevel atoms (#3531)
Fixing GeoPoints and Files in _GlobalConfig
2017-02-19 12:07:54 +02:00
Jeremy Louie
6ae0675010 Use flushdb instead of flushall in RedisCacheAdapter (#3523) 2017-02-18 19:36:43 -05:00
David Starke
a520ea0243 Fix LiveQuery unsafe user (#3525)
* LiveQuery should not use unsafe user setting

* server should issue queries with the master key
2017-02-18 19:36:20 -05:00
Vitaly Tomilov
fc7f9f76f5 removing inline sql. (#3529)
* removing inline sql.

* Update index.js

trying to fix indentation.

* Update index.js

commenting out console output for errors.

* Rename json-object-set-key.sql to json-object-set-keys.sql

* Update index.js

* Update add-unique.sql

correcting sql.

* Update add.sql

correcting sql.

* Update contains-all.sql

correcting sql.

* Update contains.sql

correcting sql.

* Update remove.sql

correcting sql.

* Update json-object-set-keys.sql

fixing sql reserved words.
2017-02-18 14:26:25 -05:00
Arthur Cinader
5861996cb0 explicitly check if auth keys are undefined
Simply checking if they are truthy causes a false negative
if the value is ''.
2017-02-09 15:20:10 -08:00
nodechefMatt
ecf422b2d9 Mongo object to Parse object date serialization - avoid re-serialization of iso of type Date (#3389)
* Mongo object to Parse object date serialization - avoid nested ios

* Mongo object to Parse object date serialization

* Remove file from previous commit
2017-02-04 08:32:35 -08:00
Jack Wearden
96a9588a6e MongoDB $or Queries avoid SERVER-13732 bug (#3476)
MongoDB has an unfixed bug in all supported versions 2.6-3.4 which
results in suboptimal index usage for `$or` queries when the query has
implicit `$and`s at the query root.

When adding `_rperm` to `$or` queries, Parse accidentally creates
queries which hit this bug.

The fix in this commit applies the suggested workaround of putting the
`_rperm` property inside all `$or` subdocuments, moving it from the top
level and leaving `$or` as the only top-level operator.

MongoDB Bug Link: https://jira.mongodb.org/browse/SERVER-13732
2017-02-03 21:34:19 -08:00
Arthur Cinader
d5940b17b6 Add logging on failure to create file (#3424) 2017-01-30 12:36:30 -05:00
Arthur Cinader
f864141663 Log Parse Errors so they are intelligible. (#3431)
The problem this pr is trying to solve:

When an error occurs on the server, a message should
be returned to the client, and a message should be logged.

Currently, on the server, the log is just [object, object]

This pr will stop calling the default express error handler
which causes two problems: 1. it writes to console instead of log file
2. the output is completely useless! :)

Instead, we'll log the error ourselves using the ParseServer's logger.

fixes: #661
2017-01-30 12:32:54 -05:00
Greenkeeper
de4c1ee418 Update mongodb to version 2.2.21 🚀 (#3368)
* chore(package): update mongodb to version 2.2.20

https://greenkeeper.io/

* Fix race when fetching schema frequently

* Bumps mongo to 2.2.21
2017-01-16 13:26:14 -08:00
Florent Vilmart
c26db2248f use uWS as optional dependency for ws server (#3231)
* use uWS as optional dependency for ws server

* Update ParseWebSocketServer.js
2017-01-14 07:43:31 -08:00
Florent Vilmart
deedf7b370 Push scalability (#3080)
* Update status through increment
* adds support for incrementing nested keys
* fix issue when having spaces in keys for ordering
* Refactors PushController to use worker
* Adds tests for custom push queue config
* Makes PushController adapter independant
* Better logging of _PushStatus in VERBOSE
2017-01-13 19:34:04 -05:00
Arthur Cinader
4cb6e7d209 Add lint rule space-infix-ops (#3237)
Disallows: 1+1.  Must be 1 + 1.
2017-01-11 12:31:40 -08:00
Lenart Rudel
5d9dbea07b Add parseFrameURL for masking user-facing pages (#3267)
* Add parseFrameURL for masking user-facing pages.

Allow users to specify a different address which is used to mask parse
requests for verifying email and resetting password. This is how Parse.com
used to allow customers to gain control over page content, styling etc.

On the destination page javascript is used to check the link in the request
and embed the parse server page using IFRAME.

* Fix code indentation

* Rename method for building link and pass config to it.

* Add customPages options to README.md.

* Add tests for parseFrameURL email link building, and parseFrameURL option.

* Add parseFrameURL for masking user-facing pages.

Allow users to specify a different address which is used to mask parse
requests for verifying email and resetting password. This is how Parse.com
used to allow customers to gain control over page content, styling etc.

On the destination page javascript is used to check the link in the request
and embed the parse server page using IFRAME.

* Fix code indentation

* Rename method for building link and pass config to it.

* Add customPages options to README.md.

* Don't Object.assign to defaultConfiguration global
2017-01-08 10:56:57 -08:00
Bhaskar Reddy Yasa
f331f6644c Add support for regex string for password policy validatorPattern setting (#3331) 2017-01-08 07:12:44 -08:00
David Starke
df029b82eb LiveQuery should match subobjects with dot notation (#3322)
* LiveQuery should match subobjects with dot notation

* one additional test case
2017-01-06 17:06:25 -08:00