// This is a port of the test suite:
// hungry/js/test/parse_acl_test.js
const rest = require('../lib/rest');
const Config = require('../lib/Config');
const auth = require('../lib/Auth');

describe('Parse.ACL', () => {
  it('acl must be valid', done => {
    const user = new Parse.User();
    ok(
      !user.setACL("Ceci n'est pas un ACL.", {
        error: function (user, error) {
          equal(error.code, -1);
          done();
        },
      }),
      'setACL should have returned false.'
    );
  });

  it('refresh object with acl', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp(null);
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    await object.fetch();
    done();
  });

  it('acl an object owned by one user and public get', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));
    await Parse.User.logOut();
    const query = new Parse.Query(TestObject);
    try {
      await query.get(object.id);
      done.fail('Should not have retrieved the object.');
    } catch (error) {
      equal(error.code, Parse.Error.OBJECT_NOT_FOUND);
      done();
    }
  });

  it('acl an object owned by one user and public find', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();

    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Start making requests by the public, which should all fail.
    await Parse.User.logOut();
    // Find
    const query = new Parse.Query(TestObject);
    const results = await query.find();
    equal(results.length, 0);
    done();
  });

  it('acl an object owned by one user and public update', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();

    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Start making requests by the public, which should all fail.
    await Parse.User.logOut();
    // Update
    object.set('foo', 'bar');
    try {
      await object.save();
      done.fail('Should not have been able to update the object.');
    } catch (err) {
      equal(err.code, Parse.Error.OBJECT_NOT_FOUND);
      done();
    }
  });

  it('acl an object owned by one user and public delete', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();

    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();

    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Start making requests by the public, which should all fail.
    await Parse.User.logOut();
    try {
      await object.destroy();
      done.fail('destroy should fail');
    } catch (error) {
      expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
      done();
    }
  });

  it('acl an object owned by one user and logged in get', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    await Parse.User.logIn('alice', 'wonderland');
    // Get
    const query = new Parse.Query(TestObject);
    const result = await query.get(object.id);
    ok(result);
    equal(result.id, object.id);
    equal(result.getACL().getReadAccess(user), true);
    equal(result.getACL().getWriteAccess(user), true);
    equal(result.getACL().getPublicReadAccess(), false);
    equal(result.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));
    done();
  });

  it('acl an object owned by one user and logged in find', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));
    await Parse.User.logOut();
    await Parse.User.logIn('alice', 'wonderland');
    // Find
    const query = new Parse.Query(TestObject);
    const results = await query.find();
    equal(results.length, 1);
    const result = results[0];
    ok(result);
    if (!result) {
      return fail();
    }
    equal(result.id, object.id);
    equal(result.getACL().getReadAccess(user), true);
    equal(result.getACL().getWriteAccess(user), true);
    equal(result.getACL().getPublicReadAccess(), false);
    equal(result.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));
    done();
  });

  it('acl an object owned by one user and logged in update', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    await Parse.User.logIn('alice', 'wonderland');
    // Update
    object.set('foo', 'bar');
    await object.save();
    done();
  });

  it('acl an object owned by one user and logged in delete', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));
    await Parse.User.logOut();
    await Parse.User.logIn('alice', 'wonderland');
    // Delete
    await object.destroy();
    done();
  });

  it('acl making an object publicly readable and public get', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicReadAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), true);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    // Get
    const query = new Parse.Query(TestObject);
    const result = await query.get(object.id);
    ok(result);
    equal(result.id, object.id);
    done();
  });

  it('acl making an object publicly readable and public find', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicReadAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), true);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    // Find
    const query = new Parse.Query(TestObject);
    const results = await query.find();
    equal(results.length, 1);
    const result = results[0];
    ok(result);
    equal(result.id, object.id);
    done();
  });

  it('acl making an object publicly readable and public update', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicReadAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), true);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    object.set('foo', 'bar');
    object.save().then(
      () => {
        fail('the save should fail');
      },
      error => {
        expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
        done();
      }
    );
  });

  it('acl making an object publicly readable and public delete', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicReadAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), true);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    Parse.User.logOut()
      .then(() => object.destroy())
      .then(
        () => {
          fail('expected failure');
        },
        error => {
          expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
          done();
        }
      );
  });

  it('acl making an object publicly writable and public get', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicWriteAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), true);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    // Get
    const query = new Parse.Query(TestObject);
    query
      .get(object.id)
      .then(done.fail)
      .catch(error => {
        equal(error.code, Parse.Error.OBJECT_NOT_FOUND);
        done();
      });
  });

  it('acl making an object publicly writable and public find', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicWriteAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), true);
    ok(object.get('ACL'));

    await Parse.User.logOut();
    // Find
    const query = new Parse.Query(TestObject);
    query.find().then(function (results) {
      equal(results.length, 0);
      done();
    });
  });

  it('acl making an object publicly writable and public update', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicWriteAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), true);
    ok(object.get('ACL'));

    Parse.User.logOut().then(() => {
      // Update
      object.set('foo', 'bar');
      object.save().then(done);
    });
  });

  it('acl making an object publicly writable and public delete', async done => {
    // Create an object owned by Alice.
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    await user.signUp();
    const object = new TestObject();
    const acl = new Parse.ACL(user);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    ok(object.get('ACL'));

    // Now make it public.
    object.getACL().setPublicWriteAccess(true);
    await object.save();
    equal(object.getACL().getReadAccess(user), true);
    equal(object.getACL().getWriteAccess(user), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), true);
    ok(object.get('ACL'));

    Parse.User.logOut().then(() => {
      // Delete
      object.destroy().then(done);
    });
  });

  it('acl making an object privately writable (#3194)', done => {
    // Create an object owned by Alice.
    let object;
    let user2;
    const user = new Parse.User();
    user.set('username', 'alice');
    user.set('password', 'wonderland');
    user
      .signUp()
      .then(() => {
        object = new TestObject();
        const acl = new Parse.ACL(user);
        acl.setPublicWriteAccess(false);
        acl.setPublicReadAccess(true);
        object.setACL(acl);
        return object.save().then(() => {
          return Parse.User.logOut();
        });
      })
      .then(() => {
        user2 = new Parse.User();
        user2.set('username', 'bob');
        user2.set('password', 'burger');
        return user2.signUp();
      })
      .then(() => {
        return object.destroy({ sessionToken: user2.getSessionToken() });
      })
      .then(
        () => {
          fail('should not be able to destroy the object');
          done();
        },
        err => {
          expect(err).not.toBeUndefined();
          done();
        }
      );
  });

  it('acl sharing with another user and get', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();

    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Sign in as Bob again.
    await Parse.User.logIn('bob', 'pass');
    const query = new Parse.Query(TestObject);
    query.get(object.id).then(result => {
      ok(result);
      equal(result.id, object.id);
      done();
    });
  });

  it('acl sharing with another user and find', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Sign in as Bob again.
    await Parse.User.logIn('bob', 'pass');
    const query = new Parse.Query(TestObject);
    query.find().then(results => {
      equal(results.length, 1);
      const result = results[0];
      ok(result);
      if (!result) {
        fail('should have result');
      } else {
        equal(result.id, object.id);
      }
      done();
    });
  });

  it('acl sharing with another user and update', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Sign in as Bob again.
    await Parse.User.logIn('bob', 'pass');
    object.set('foo', 'bar');
    object.save().then(done);
  });

  it('acl sharing with another user and delete', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Sign in as Bob again.
    await Parse.User.logIn('bob', 'pass');
    object.set('foo', 'bar');
    object.destroy().then(done);
  });

  it('acl sharing with another user and public get', async done => {
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);
    // Start making requests by the public.
    await Parse.User.logOut();
    const query = new Parse.Query(TestObject);
    query.get(object.id).then(
      result => {
        fail(result);
      },
      error => {
        expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
        done();
      }
    );
  });

  it('acl sharing with another user and public find', async done => {
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Start making requests by the public.
    Parse.User.logOut().then(() => {
      const query = new Parse.Query(TestObject);
      query.find().then(function (results) {
        equal(results.length, 0);
        done();
      });
    });
  });

  it('acl sharing with another user and public update', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Start making requests by the public.
    Parse.User.logOut().then(() => {
      object.set('foo', 'bar');
      object.save().then(
        () => {
          fail('expected failure');
        },
        error => {
          expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
          done();
        }
      );
    });
  });

  it('acl sharing with another user and public delete', async done => {
    // Sign in as Bob.
    const bob = await Parse.User.signUp('bob', 'pass');
    await Parse.User.logOut();
    // Sign in as Alice.
    const alice = await Parse.User.signUp('alice', 'wonderland');
    // Create an object shared by Bob and Alice.
    const object = new TestObject();
    const acl = new Parse.ACL(alice);
    acl.setWriteAccess(bob, true);
    acl.setReadAccess(bob, true);
    object.setACL(acl);
    await object.save();
    equal(object.getACL().getReadAccess(alice), true);
    equal(object.getACL().getWriteAccess(alice), true);
    equal(object.getACL().getReadAccess(bob), true);
    equal(object.getACL().getWriteAccess(bob), true);
    equal(object.getACL().getPublicReadAccess(), false);
    equal(object.getACL().getPublicWriteAccess(), false);

    // Start making requests by the public.
    Parse.User.logOut()
      .then(() => object.destroy())
      .then(
        () => {
          fail('expected failure');
        },
        error => {
          expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
          done();
        }
      );
  });

  it('acl saveAll with permissions', async done => {
    const alice = await Parse.User.signUp('alice', 'wonderland');
    const acl = new Parse.ACL(alice);
    const object1 = new TestObject();
    const object2 = new TestObject();
    object1.setACL(acl);
    object2.setACL(acl);
    await Parse.Object.saveAll([object1, object2]);
    equal(object1.getACL().getReadAccess(alice), true);
    equal(object1.getACL().getWriteAccess(alice), true);
    equal(object1.getACL().getPublicReadAccess(), false);
    equal(object1.getACL().getPublicWriteAccess(), false);
    equal(object2.getACL().getReadAccess(alice), true);
    equal(object2.getACL().getWriteAccess(alice), true);
    equal(object2.getACL().getPublicReadAccess(), false);
    equal(object2.getACL().getPublicWriteAccess(), false);

    // Save all the objects after updating them.
    object1.set('foo', 'bar');
    object2.set('foo', 'bar');
    await Parse.Object.saveAll([object1, object2]);
    const query = new Parse.Query(TestObject);
    query.equalTo('foo', 'bar');
    query.find().then(function (results) {
      equal(results.length, 2);
      done();
    });
  });

  it('empty acl works', async done => {
    await Parse.User.signUp('tdurden', 'mayhem', {
      ACL: new Parse.ACL(),
      foo: 'bar',
    });

    await Parse.User.logOut();
    const user = await Parse.User.logIn('tdurden', 'mayhem');
    equal(user.get('foo'), 'bar');
    done();
  });

  it('query for included object with ACL works', async done => {
    const obj1 = new Parse.Object('TestClass1');
    const obj2 = new Parse.Object('TestClass2');
    const acl = new Parse.ACL();
    acl.setPublicReadAccess(true);
    obj2.set('ACL', acl);
    obj1.set('other', obj2);
    await obj1.save();
    obj2._clearServerData();
    const query = new Parse.Query('TestClass1');
    const obj1Again = await query.first();
    ok(!obj1Again.get('other').get('ACL'));

    query.include('other');
    const obj1AgainWithInclude = await query.first();
    ok(obj1AgainWithInclude.get('other').get('ACL'));
    done();
  });

  it('restricted ACL does not have public access', done => {
    const obj = new Parse.Object('TestClassMasterACL');
    const acl = new Parse.ACL();
    obj.set('ACL', acl);
    obj
      .save()
      .then(() => {
        const query = new Parse.Query('TestClassMasterACL');
        return query.find();
      })
      .then(results => {
        ok(!results.length, 'Should not have returned object with secure ACL.');
        done();
      });
  });

  it('regression test #701', done => {
    const config = Config.get('test');
    const anonUser = {
      authData: {
        anonymous: {
          id: '00000000-0000-0000-0000-000000000001',
        },
      },
    };

    Parse.Cloud.afterSave(Parse.User, req => {
      if (!req.object.existed()) {
        const user = req.object;
        const acl = new Parse.ACL(user);
        user.setACL(acl);
        user.save(null, { useMasterKey: true }).then(user => {
          new Parse.Query('_User').get(user.objectId).then(
            () => {
              fail('should not have fetched user without public read enabled');
              done();
            },
            error => {
              expect(error.code).toEqual(Parse.Error.OBJECT_NOT_FOUND);
              done();
            }
          );
        }, done.fail);
      }
    });

    rest.create(config, auth.nobody(config), '_User', anonUser);
  });
});