70 Commits

Author SHA1 Message Date
Manuel
5ef0440c8e fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv) (#9667) 2025-03-21 10:49:09 +01:00
Manuel
9552a4cbee ci: Fix test exclusion list in combination with other exclusions (#9277) 2024-08-13 22:13:19 +02:00
Manuel
901cff5edd test: Add test IDs (#9205) 2024-07-18 15:41:04 +02:00
Diamond Lewis
e355f36ed4 ci: Find duplicate and slow tests (#9188) 2024-07-16 10:34:10 +02:00
Chris
9d0bd2badd fix: Facebook Limited Login not working due to incorrect domain in JWT validation (#9122) 2024-05-16 13:54:41 +02:00
Onur
0cf58eb8d6 feat: Deprecation DEPPS6: Authentication adapters disabled by default (#8858)
BREAKING CHANGE: Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option `auth.<provider>.enabled: true`
2024-02-15 01:28:09 +01:00
Lucas Coratger
3de8494a22 feat: Add support for MongoDB 7 (#8761)
BREAKING CHANGE: `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use.
2023-12-10 02:42:40 +01:00
Daniel
c9b59719ec refactor: Change response types of TOTP adapter to match existing adapters (#8661) 2023-07-06 17:22:18 +02:00
Daniel
cc079a40f6 feat: Add TOTP authentication adapter (#8457) 2023-06-23 17:57:57 +02:00
Daniel
f5bfe4571e fix: Security upgrade jsonwebtoken to 9.0.0 (#8420) 2023-02-07 12:45:30 +01:00
Manuel
b48c27049a refactor: Improve incorrect deprecation log message for auth adapter (#8347) 2022-12-06 23:04:37 +01:00
dblythy
5bbf9cade9 feat: Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters (#8156) 2022-11-10 17:35:39 +01:00
Manuel
5e9d494979 Merge branch 'beta' into build-beta 2022-10-29 21:31:22 +02:00
dblythy
eb649f226f test: fix flaky Apple Game Center tests (#8204) 2022-10-01 12:14:59 +02:00
Manuel
8c8ec71573 fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) [skip release] (#8187) 2022-09-20 23:05:44 +02:00
Manuel
1a2b1b9bc1 fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) [skip release] (#8188) 2022-09-20 23:03:21 +02:00
dblythy
c85bc016e2 ci: fix flaky Apple Game Center tests (#8163) 2022-09-14 16:33:55 +02:00
Manuel
75af9a26cc fix: certificate in Apple Game Center auth adapter not validated [skip release] (#8058) 2022-06-17 20:22:35 +02:00
Manuel
4c2aa63fd2 fix: certificate in Apple Game Center auth adapter not validated [skip release] (#8055) 2022-06-17 19:32:30 +02:00
Antoine Cormouls
0cd902b8c2 refactor: upgrade GraphQL dependencies (#7970) 2022-06-10 14:01:45 +02:00
dblythy
c1e808f9e8 feat: selectively enable / disable default authentication adapters (#7953) 2022-05-29 01:50:43 +02:00
dblythy
3fb6b2b4ab ci: fix flaky tests for Apple Game Center authentication (#7958) 2022-05-01 04:26:08 +02:00
Manuel
af4a0417a9 fix: authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) (#7962) 2022-05-01 02:28:16 +02:00
Manuel Trezza
1593575a87 build: release 2022-03-18 15:17:12 +01:00
Corey
a5ffb95022 refactor: remove deprecated url.parse() method (#7751) 2022-01-06 15:26:00 +01:00
dblythy
12eb6c823b refactor: replace hardcoded error codes with references (#7546) 2021-10-18 20:19:47 +02:00
Miguel Serrano
92f50f6808 Add support for Facebook Limited Login (#7219)
* Add support for Facebook Limited auth

* Add tests

* Fix tests

* Fix tests

* Add entry to changelog

* Cleanup
2021-02-24 07:36:24 -06:00
OverDrive
a1cd631425 Fix for authenticating with instagram (#7173)
* Fix for authenticating with instagram

* Change tests for instagram authentication

* Instagram authentication for the case when data child object is presented in the response
2021-02-19 13:19:13 -06:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
Antonio Davi Macedo Coelho de Castro
755c612fd8 Update vkontakte API to the latest version (#6944)
* Update vkontakte API to the latest version

* Allow developers to set the api version (optional)
2020-10-15 15:24:36 -07:00
timination
66f7af90c3 Hotfix instagram api (#6922)
* updated defaultURL to allow new insta API access

* updated defaultURL to allow new insta API access

* updates tests for new instagram API url

Co-authored-by: Tim Talbot <tim@dyingmethod.com>
2020-10-01 18:45:01 +02:00
Rhuan
6e36411ce7 Keycloak auth adapter (#6376)
* Copy auth adapter to create keycloak adapter

* Add keycloak authentication adapter

* Add keycloak to auth adapter tests

* Improve tests

Co-authored-by: Rhuan <rhuan@MacBook-Pro-de-Rhuan.local>
Co-authored-by: Diamond Lewis <findlewis@gmail.com>
Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-08-30 23:11:07 -07:00
Manuel
983121581d changed incorrect key name in apple auth adapter tests (#6861)
* replaced client_id with clientId

* retroactively added breaking change to change log
2020-08-25 17:24:53 +02:00
Diamond Lewis
a0ac8e0686 Remove Facebook AccountKit auth (#6870)
* Remove Facebook AccountKit auth

Account Kit services are no longer available.

https://developers.facebook.com/blog/post/2019/09/09/account-kit-services-no-longer-available-starting-march/

https://www.sinch.com/blog/facebook-account-kit-is-closing-down-are-your-apps-covered/

* remove flaky test
2020-08-20 10:09:54 -07:00
Arjun Vedak
42f75d6d94 fix(auth): Properly handle google token issuer (#6836)
* Updated TOKEN_ISSUER to 'accounts.google.com'

Hi, I was getting this issue from today morning parse-server/Adapters/Auth/google.js was expecting the TOKEN_ISSUER to be prefixed with https:// but on debugging the original value was not having the prefix, removing https:// from TOKEN_ISSUER solved this bug. This issue is introduced in 4.3.0 as in 4.2.0 it is working fine currently I have downgraded the version to 4.2.0 for it to work properly and suggesting the changes please merge this PR.

* Update google.js

* Update AuthenticationAdapters.spec.js

* Update google.js

* Update google.js
2020-07-29 09:55:59 -05:00
SebC
cbf9da517b Add production Google Auth Adapter instead of using the development url (#6734)
* Add the production Google Auth Adapter instead of using the development url

* Update tests to the new google auth

* lint
2020-07-15 09:56:08 -07:00
Maravilho Singa
b60502d8a0 Instagram: Support passing in API url (#6398)
* Update instagram.js

Instagram API was updated.

* Update instagram.js

Instagram API was updated and is not allowing anymore to setup new projects to use the old style but it is still working for the ones that have it already setup.

New docs are listed here: https://developers.facebook.com/docs/instagram-basic-display-api/

I've added support for both old and new API
To use new API just add new field "api_type" = "new_api" in client side.

For old API just no changes needed.

* support api url

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-03-22 11:24:22 -05:00
UnderratedDev
dd2b64ef65 updated 2 files for allowing multiple client ids (#6523)
* updated 2 files for allowing multiple client ids

* updated tests that fail due to user inputting data in code, added todo comment to them stating what we need to do to fix them
2020-03-21 19:04:10 -05:00
Andy
8e0e485de1 use token and algo from jwt header (#6416)
* use token and algo from jwt header

* change node-rsa out for jwks-rsa, reflect change in tests and add one test for coverage

* remove superfluous cache, allow jwks cache parameters to be passed to validateAuthData

* remove package lock

* regenerate package lock

* try fixing package-lock with copy from master

* manual changes for merge conflict

* whitespace

* pass options as object

* fix inconsistent variable name
2020-03-11 15:29:20 -05:00
Antonio Davi Macedo Coelho de Castro
a9066e20dc Relay Spec (#6089)
* Install graphql-relay

* Add relayNodeInterface to ParseGraphQLSchema

* Add support to global id

* Add support to global id in other operations

* Fix sort by glboal id

* Fix where by global id

* Introduce IdWhereInput

* Add Relay object identification tests

* Client mutation id on createFile mutation

* Client mutation id on callCloudCode mutation

* Client mutation id on signUp mutation

* Client mutation id on logIn mutation

* Client mutation id on logOut mutation

* Client mutation id on createClass mutation

* Client mutation id on updateClass mutation

* Client mutation id on deleteClass mutation

* Client mutation id on create object mutation

* Improve Viewer type

* Client mutation id on update object mutation

* Client mutation id on delete object mutation

* Introducing connections

* Fix tests

* Add pagination test

* Fix file location

* Fix postgres tests

* Add comments

* Tests to calculateSkipAndLimit
2019-12-01 21:43:08 -08:00
Diamond Lewis
b44726987d Support Google Play Games Service (#6147)
* Support Google Play Games Service

* clean up

* improve coverage

* more tests
2019-10-28 13:16:55 -05:00
Diamond Lewis
c1a217c6b8 Support Apple Game Center Auth (#6143)
Fixes: https://github.com/parse-community/parse-server/issues/5984
2019-10-18 19:04:01 -05:00
Alann Maulana
38e0ff9d76 Microsoft Graph Authentication (#6051)
* add microsoft graph auth

* change mail to id

* add graph user id and email

* add microsoft graph auth test case

* remove validating auth data using mail

* add test case to AuthenticationAdapters

* fix indentation

* fix httpsRequest and fakeClaim not found

* add newline eof last

* fix test in auth adapter

* fix unhandled promise rejection
2019-09-26 13:23:18 -05:00
Saimoom Safayet Akash
723fe3b158 added support for line auth (#6007)
* added support for line auth

* fixed linting issues

* modified auth adapter spec to handle line auth adapter

* revert package.json changes
2019-09-03 08:11:33 -05:00
SebC
b246bad5c7 Fix apple signin authAdapter (#5891)
* Fix apple signin authAdapter to use the user id instead of the user token

* Update spec
2019-08-07 18:08:14 -05:00
Douglas Muraoka
ef14ca530d GraphQL Object constraints (#5715)
* GraphQL Object constraints

Implements the GraphQL Object constraints, which allows us to filter queries results using the `$eq`, `$lt`, `$gt`, `$in`, and other Parse supported constraints.
Example:
```
query objects {
  findMyClass(where: {
    objField: {
      _eq: {
        key: 'foo.bar',
        value: 'hello'
      },
      _gt: {
        key: 'foo.number',
        value: 10
      },
      _lt: {
        key: 'anotherNumber',
        value: 5
      }
    }
  }) {
    results {
      objectId
    }
  }
}
```
In the example above, we have the `findMyClass` query (automatically generated for the `MyClass` class), and a field named `objField` whose type is Object. The object below represents a valid `objField` value and would satisfy all constraints:
```
{
  "foo": {
    "bar": "hello",
    "number": 11
  },
  "anotherNumber": 4
}
```
The Object constraint is applied only when using Parse class object type queries. When using "generic" queries such as `get` and `find`, this type of constraint is not available.

* Objects constraints not working on Postgres

Fixes the $eq, $ne, $gt, and $lt constraints when applied on an Object type field.

* Fix object constraint field name

* Fix Postgres constraints indexes

* fix: Object type composed constraints not working

* fix: Rename key and value fields

* refactor: Object constraints for generic queries

* fix: Object constraints not working on Postgres
2019-08-02 12:18:07 -07:00
Ivan SZKIBA
dfe0ff753c support PhantAuth authentication (#5850)
* support PhantAuth authentication

* fix spelling issues

* Add test case
2019-07-29 00:58:43 -05:00
Diamond Lewis
3a7b0c4c75 Fix: Linking with Apple Auth (#5755)
Rename from apple-signin to apple (key names can't have hyphens
Rename id_token to id (auth adapters require id)
2019-07-03 16:28:29 -05:00
Diamond Lewis
6385deeb6e Add AppSecret to Facebook Auth (#5695)
Closes: https://github.com/parse-community/parse-server/issues/5448
2019-06-20 14:15:57 -05:00
Diamond Lewis
fcdf2d7947 Sign in with Apple Auth Provider (#5694)
* Sign in with Apple Auth Provider

Closes: https://github.com/parse-community/parse-server/issues/5632

Should work out of the box.

* remove required options
2019-06-19 16:05:09 -05:00