Commit Graph

349 Commits

Author SHA1 Message Date
Diamond Lewis
cf4c8807b9 feat: Add support for dot notation on array fields of Parse Object (#9115) 2024-07-08 23:29:58 +02:00
Manuel
2edf1e4c03 fix: SQL injection when using Parse Server with PostgreSQL; fixes security vulnerability [GHSA-c2hr-cqg6-8j6r](https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r) (#9167) 2024-06-30 03:34:08 +02:00
Oussama Meglali
2170962a50 feat: Add support for MongoDB query comment (#8928) 2024-03-03 02:27:57 +01:00
Manuel
cbefe770a7 fix: Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database (#8961) 2024-03-01 16:52:05 +01:00
Lucas Coratger
3de8494a22 feat: Add support for MongoDB 7 (#8761)
BREAKING CHANGE: `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use.
2023-12-10 02:42:40 +01:00
Manuel
f630a45aa5 feat: Add $setOnInsert operator to Parse.Server.database.update (#8791) 2023-10-25 19:13:27 +02:00
Manuel
e212eb5195 refactor: Add option to convert Parse.Object to instance in Cloud Function payload (#8656) 2023-06-23 16:29:32 +02:00
Daniel
967700bdbc fix: LiveQuery server is not shut down properly when handleShutdown is called (#8491) 2023-06-08 11:04:49 +02:00
Manuel
6722110f20 revert: fix: Inaccurate table total row count for PostgreSQL
This reverts commit 0823a02fbf.
2023-05-28 21:44:42 +02:00
patelmilanun
0823a02fbf fix: Inaccurate table total row count for PostgreSQL (#8511) 2023-05-28 13:32:02 +02:00
Corey
87cab09b6a refactor: Upgrade pg-promise to 11.3.0 and pg-monitor to 2.0.0 (#8453) 2023-03-06 00:16:04 +01:00
Daniel
22d2446dfe fix: Nested date is incorrectly decoded as empty object {} when fetching a Parse Object (#8446) 2023-03-05 01:22:19 +01:00
Daniel
b3b76de71b feat: Add option schemaCacheTtl for schema cache pulling as alternative to enableSchemaHooks (#8436) 2023-02-27 01:55:47 +01:00
Daniel
d0d30c4f13 feat: Remove deprecation DEPPS1: Native MongoDB syntax in aggregation pipeline (#8362)
BREAKING CHANGE: The MongoDB aggregation pipeline requires native MongoDB syntax instead of the custom Parse Server syntax; for example pipeline stage names require a leading dollar sign like `$match` and the MongoDB document ID is referenced using `_id` instead of `objectId` (#8362)
2023-01-05 15:53:43 +01:00
Daniel
1412666f75 fix: Nested objects are encoded incorrectly for MongoDB (#8209)
BREAKING CHANGE: Nested objects are now properly stored in the database using JSON serialization; previously, due to a bug only top-level objects were serialized, but nested objects were saved as raw JSON; for example, a nested `Date` object was saved as a JSON object like `{ "__type": "Date", "iso": "2020-01-01T00:00:00.000Z" }` instead of its serialized representation `2020-01-01T00:00:00.000Z` (#8209)
2022-12-20 16:57:29 +01:00
dblythy
5bbf9cade9 feat: Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters (#8156) 2022-11-10 17:35:39 +01:00
dblythy
e424137406 fix: query aggregation pipeline cannot handle value of type Date when directAccess: true (#8167) 2022-09-17 16:19:28 +02:00
Jong Eun Lee
7f5a15d5df fix: graphQL query ignores condition equalTo with value false (#8032) 2022-07-03 12:13:10 +02:00
Manuel Trezza
1593575a87 build: release 2022-03-18 15:17:12 +01:00
Antoine Cormouls
f88aa2a62a feat: upgrade to MongoDB Node.js driver 4.x for MongoDB 5.0 support (#7794)
BREAKING CHANGE: The MongoDB GridStore adapter has been removed. By default, Parse Server already uses GridFS, so if you do not manually use the GridStore adapter, you can ignore this change.
2022-02-06 18:30:36 +01:00
Corey
a5ffb95022 refactor: remove deprecated url.parse() method (#7751) 2022-01-06 15:26:00 +01:00
Corey
0c3feaaa17 feat: add Idempotency to Postgres (#7750) 2022-01-02 19:25:53 +01:00
Corey
5e363eae44 refactor: remove unnecessary error checking in PostgresAdapter (#7761) 2022-01-02 18:43:12 +01:00
Corey
16b1b2a197 feat: support relativeTime query constraint on Postgres (#7747) 2022-01-02 01:10:54 +01:00
Manuel
8ee0445c0a fix: unable to use objectId size higher than 19 on GraphQL API (#7722) 2021-11-27 13:36:49 +01:00
Antoine Cormouls
ed86c80772 fix: unable to use objectId size higher than 19 on GraphQL API (#7627) 2021-11-27 12:27:08 +01:00
Samuel Denis-D'Ortun
25d5c30be2 feat: add user-defined schema and migrations (#7418) 2021-11-01 14:28:49 +01:00
Corey
090350a7a0 feat: add support for Postgres 14 (#7644) 2021-10-31 20:49:03 +01:00
Antoine Cormouls
68057c49f3 refactor: minor changes to remove mongo deprecation warnings (#7626) 2021-10-17 21:16:24 +02:00
Antonio Davi Macedo Coelho de Castro
308668c894 Merge pull request from GHSA-xqp8-w826-hh6x
* Added a test case that triggers the query parameter crash

* rest.js: validate the explain parameter to keep the nodejs driver from throwing an uncatchable exception and crashing the server (see https://jira.mongodb.org/browse/NODE-3463)
RestQuery.js: Check whether explain mode is enabled not by "!== true", but by the "!" operator. explain can have string values.
Added tests that validate correct behaviour on different explain values

* Refactor the new tests

* Simplify the new tests
Also do a sanity check on the explain results

* Test refactor

* Exclude queryPlannerExtended as it is not supported by the testing environment
  Simplifies the tests

* Restrict the changes to mongodb
  Moved the verification of the explain value from rest.js to MongoStorageAdapter.js
  Also restricted the relevant unit tests to mongodb

* Added changelog entry

* reformat changelog entry

* Update CHANGELOG.md

Co-authored-by: Kartal Kaan Bozdoğan <kartalkaanbozdogan@gmail.com>
Co-authored-by: Manuel <5673677+mtrezza@users.noreply.github.com>
2021-09-02 12:46:48 +02:00
Kartal Kaan Bozdoğan
5e7c9d2e1a Fixed a bug affecting updates to nested pointers (#7392)
* Fixed a bug affecting updates to nested pointers
  Also created unit tests

* Marked the regression test for #7391 as pending for postgre
  The issue is not fixed yet
Use cont instead of var
2021-05-25 15:33:40 -07:00
Snyk bot
755c49404d [Snyk] Upgrade pg-promise from 10.9.2 to 10.10.1 (#7286)
* fix: upgrade pg-promise from 10.9.2 to 10.9.3

Snyk has created this PR to upgrade pg-promise from 10.9.2 to 10.9.3.

See this package in npm:
https://www.npmjs.com/package/pg-promise

See this project in Snyk:
https://app.snyk.io/org/acinader/project/8c1a9edb-c8f5-4dc1-b221-4d6030a323eb?utm_source=github&utm_medium=upgrade-pr

* bump pg-promise to 10.10.1

* fix add field if not exists

* lint

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2021-04-29 12:10:15 -05:00
Vitaly Tomilov
25fb476bf8 Update PostgresClient.js (#7276)
Proper pg-monitor re-attachment logic.
2021-03-18 15:54:17 -05:00
Diamond Lewis
a02014f557 Improve single schema cache (#7214)
* Initial Commit

* fix flaky test

* temporary set ci timeout

* turn off ci check

* fix postgres tests

* fix tests

* node flaky test

* remove improvements

* Update SchemaPerformance.spec.js

* fix tests

* revert ci

* Create Singleton Object

* properly clear cache testing

* Cleanup

* remove fit

* try PushController.spec

* try push test rewrite

* try push enqueue time

* Increase test timeout

* remove pg server creation test

* xit push tests

* more xit

* remove skipped tests

* Fix conflicts

* reduce ci timeout

* fix push tests

* Revert "fix push tests"

This reverts commit 05aba62f1cbbca7d5d3e80b9444529f59407cb56.

* improve initialization

* fix flaky tests

* xit flaky test

* Update CHANGELOG.md

* enable debug logs

* Update LogsRouter.spec.js

* create initial indexes in series

* lint

* horizontal scaling documentation

* Update Changelog

* change horizontalScaling db option

* Add enableSchemaHooks option

* move enableSchemaHooks to databaseOptions
2021-03-16 16:05:36 -05:00
Diamond Lewis
9563793303 Allow single server instance in test suite (#7262)
* initial pass

* reconfigureServer when needed

* finish postgres tests

* mongo tests

* more tests

* clean up

* re-add skipped test

* Fix transaction tests

* handle batch

* AuthenticationAdapter fix

* More reconfiguration

* clean up

* properly terminate cli servers

* handle Parse.Push

* Flaky PushController

* ensure reconfigureServer when changed

* fix postgres tests

* remove console.log

* LiveQuery spec remove duplicates and listeners
2021-03-13 09:05:22 -06:00
Diamond Lewis
39fa17f914 Postgres: Properly initialize database on startup and debugger (#7255)
* PG: Properly initialize database

* fix flaky tests

* flaky test

* correct test

* no idea

* clean up debugger
2021-03-10 11:31:35 -08:00
Antonio Davi Macedo Coelho de Castro
a430d6f7b7 Fix flaky test with transactions (#7187)
* Fix flaky test with transactions

* Add CHANGELOG entry

* Fix the other transactions related tests that became flaky because now Parse Server tries to submit the transaction multilpe times in the case of TransientError

* Remove fit from tests
2021-02-18 10:18:54 -08:00
Diamond Lewis
033a0bd443 Fix Prettier (#7066) 2020-12-13 11:19:04 -06:00
Vitaly Tomilov
bbae55d518 Update PostgresStorageAdapter.js (#6989)
* Update PostgresStorageAdapter.js

Improve `createClass` transaction:

* `await` makes it a more consistent sequence of queries
* `batch` is not needed there
* No need for an extra `.then` section

* Update PostgresStorageAdapter.js

Remove batch-dependent error code check, as it should happen automatically without batch result.

* Update PostgresStorageAdapter.js

Removing unused variable.
2020-11-03 08:01:04 -08:00
Vitaly Tomilov
82cd27520b Update PostgresStorageAdapter.js (#6981)
* Update PostgresStorageAdapter.js

Start moving toward better, ES7 syntax.

* Update PostgresStorageAdapter.js

Fixing spaces 🤦‍♂️
2020-10-30 08:58:53 -07:00
Corey
de7ec58de3 Postgres: prepend className to unique indexes (#6741)
* prepend className to unique index to allow multiple unique indexes for different classes

* add testcase

* switched test so it can be tested on older versions of parse-server and show failure

* get rid of console log messages on restart by checking if the index exists before creating it

* add IF NOT EXISTS and IF EXISTS to ALTER TABLE

* revert some of code

* ensureIndex use IF NOT EXISTS

* ALTER TABLE CONSTRAINT can't use IF, ADD/DROP COLUMN can

* retesting

* update

* switchted to CREATE UNIQUE INDEX instrad of ALTER TABLE... ALTER TABLE doesn't seem to be needed
2020-10-11 22:47:45 -07:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
Antoine Cormouls
929c4e1b0d Do not throw error if user provide a pointer like index onMongo (#6923)
* Do not throw error if user provide a pointer like index on mongo

* Add test
2020-10-01 14:58:23 -07:00
Manuel
5fd73a72fd fix potential issue with setting geoNear.query to undefined (#6696)
* add test cases for geoNear aggregation

Test cases do not have the `query` parameter set in $geoNear aggregation stage. this is to test for a reported potential issue when the parameter is not set.

* fixed potential issue when setting the geoNear.query parameter to undefined

see dicussion in https://github.com/parse-community/parse-server/pull/6540

* fixed duplicate index name in test
2020-09-08 22:16:03 +02:00
Manuel
5b71993175 improve field deletion in collection (#6823)
* added filter to updateMany when deleting field

* added test cases

* added changelog entry
2020-07-27 02:22:04 +02:00
Manuel
3bd5684f67 Add idempotency (#6748)
* added idempotency router and middleware

* added idempotency rules for routes classes, functions, jobs, installaions, users

* fixed typo

* ignore requests without header

* removed unused var

* enabled feature only for MongoDB

* changed code comment

* fixed inconsistend storage adapter specification

* Trigger notification

* Travis CI trigger

* Travis CI trigger

* Travis CI trigger

* rebuilt option definitions

* fixed incorrect import path

* added new request ID header to allowed headers

* fixed typescript typos

* add new system class to spec helper

* fixed typescript typos

* re-added postgres conn parameter

* removed postgres conn parameter

* fixed incorrect schema for index creation

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* trying to fix postgres issue

* fixed incorrect auth when writing to _Idempotency

* trying to fix postgres issue

* Travis CI trigger

* added test cases

* removed number grouping

* fixed test description

* trying to fix postgres issue

* added Github readme docs

* added change log

* refactored tests; fixed some typos

* fixed test case

* fixed default TTL value

* Travis CI Trigger

* Travis CI Trigger

* Travis CI Trigger

* added test case to increase coverage

* Trigger Travis CI

* changed configuration syntax to use regex; added test cases

* removed unused vars

* removed IdempotencyRouter

* Trigger Travis CI

* updated docs

* updated docs

* updated docs

* updated docs

* update docs

* Trigger Travis CI

* fixed coverage

* removed code comments
2020-07-15 13:10:33 -05:00
Corey
f43afc5d40 Adding ssl config params to Postgres URI (#6580)
* use pg-promise native pg-connection-string to parse uri instead of ParseConfigParser.js. The allows for a more felxible uri for ssl and other params

* added ssl config params and others to PostgresConfigParser

* forgot to add back the original client file

* need to read in file at path for pfx, ca, key, and key

* convert file buffer to string to be consistant with node-postgres examples
2020-04-23 11:25:16 -05:00
Antonio Davi Macedo Coelho de Castro
0dec1c80e2 Fix #6586 (#6605) 2020-04-22 11:04:07 -05:00
Corey
489aeae784 Fix: objectId size for Pointer in Postgres (#6619)
* Fixing objectId for Pointer in Postgres

* add test case for longer objectId pointer. Note that this test fails on Postgres before the addition of previous commit

* removed comment that wasn't needed
2020-04-22 11:01:11 -05:00
Noah Silas
19086a8112 perf: Allow covering relation queries with minimal index (#6581)
* Apply linter changes on files I'm about to update

My actual changes were quite difficult to find when buried in this sea
of style changes, which were getting automatically applied during a
pre-commit hook. Here I just run the hooks against the files I'm going
to be touching in the following commit, so that a reviewer can ignore
these automatically generated diffs and just view the meaningful commit.

* perf: Allow covering relation queries with minimal index

When finding objects through a relation, we're sending Mongo queries
that look like this:
```
db.getCollection('_Join:foo:bar').find({ relatedId: { $in: [...] } });
```

From the result of that query, we're only reading the `owningId` field,
so we can start by adding it as a projection:
```
db.getCollection('_Join:foo:bar')
  .find({ relatedId: { $in: [...] } })
  .project({ owningId: 1 });
```

This seems like the perfect example of a query that could be satisfied
with an index scan: we are querying on one field, and only need one
field from the matching document.

For example, this can allow users to speed up the fetching of user roles
in authentication, because they query a `roles` relation on the `_Role`
collection. To add a covering index on that, you could now add an index
like the following:
```
db.getCollection('_Join:roles:_Role').createIndex(
  { relatedId: 1, owningId: 1 },
  { background: true }
);
```

One caveat there is that the index I propose above doesn't include the
`_id` column. For the query in question, we don't actually care about
the ID of the row in the join table, just the `owningId` field, so we
can avoid some overhead of putting the `_id` column into the index if we
can also drop it from the projection. This requires adding a small
special case to the MongoStorageAdapter, because the `_id` field is
special: you have to opt-out of using it by projecting `{ _id: 0 }`.
2020-04-08 11:43:45 -07:00