Skip to content

Commit ed499e3

Browse files
dblythydblythy
authored
feat: Remove deprecation DEPPS3: Config option enforcePrivateUsers defaults to true (#8283)
BREAKING CHANGE: The Parse Server option `enforcePrivateUsers` is set to `true` by default; in previous releases this option defaults to `false`; this change improves the default security configuration of Parse Server (#8283)
1 parent 6e66b20 commit ed499e3

12 files changed

+85
-17
lines changed

‎DEPRECATIONS.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ The following is a list of deprecations, according to the [Deprecation Policy](h
66
|--------|-------------------------------------------------|----------------------------------------------------------------------|---------------------------------|---------------------------------|-----------------------|-------|
77
| DEPPS1 | Native MongoDB syntax in aggregation pipeline | [#7338](https://github.com/parse-community/parse-server/issues/7338) | 5.0.0 (2022) | 6.0.0 (2023) | deprecated | - |
88
| DEPPS2 | Config option `directAccess` defaults to `true` | [#6636](https://github.com/parse-community/parse-server/pull/6636) | 5.0.0 (2022) | 6.0.0 (2023) | removed | - |
9-
| DEPPS3 | Config option `enforcePrivateUsers` defaults to `true` | [#7319](https://github.com/parse-community/parse-server/pull/7319) | 5.0.0 (2022) | 6.0.0 (2023) | deprecated | - |
9+
| DEPPS3 | Config option `enforcePrivateUsers` defaults to `true` | [#7319](https://github.com/parse-community/parse-server/pull/7319) | 5.0.0 (2022) | 6.0.0 (2023) | removed | - |
1010
| DEPPS4 | Remove convenience method for http request `Parse.Cloud.httpRequest` | [#7589](https://github.com/parse-community/parse-server/pull/7589) | 5.0.0 (2022) | 6.0.0 (2023) | removed | - |
1111
| DEPPS5 | Config option `allowClientClassCreation` defaults to `false` | [#7925](https://github.com/parse-community/parse-server/pull/7925) | 5.3.0 (2022) | 7.0.0 (2024) | deprecated | - |
1212
| DEPPS6 | Auth providers disabled by default | [#7953](https://github.com/parse-community/parse-server/pull/7953) | 5.3.0 (2022) | 7.0.0 (2024) | deprecated | - |

‎spec/ParseGraphQLServer.spec.js

+22-3
Original file line numberDiff line numberDiff line change
@@ -292,30 +292,37 @@ describe('ParseGraphQLServer', () => {
292292
let objects = [];
293293

294294
async function prepareData() {
295+
const acl = new Parse.ACL();
296+
acl.setPublicReadAccess(true);
295297
user1 = new Parse.User();
296298
user1.setUsername('user1');
297299
user1.setPassword('user1');
298300
user1.setEmail('user1@user1.user1');
301+
user1.setACL(acl);
299302
await user1.signUp();
300303

301304
user2 = new Parse.User();
302305
user2.setUsername('user2');
303306
user2.setPassword('user2');
307+
user2.setACL(acl);
304308
await user2.signUp();
305309

306310
user3 = new Parse.User();
307311
user3.setUsername('user3');
308312
user3.setPassword('user3');
313+
user3.setACL(acl);
309314
await user3.signUp();
310315

311316
user4 = new Parse.User();
312317
user4.setUsername('user4');
313318
user4.setPassword('user4');
319+
user4.setACL(acl);
314320
await user4.signUp();
315321

316322
user5 = new Parse.User();
317323
user5.setUsername('user5');
318324
user5.setPassword('user5');
325+
user5.setACL(acl);
319326
await user5.signUp();
320327

321328
const roleACL = new Parse.ACL();
@@ -7066,6 +7073,11 @@ describe('ParseGraphQLServer', () => {
70667073
},
70677074
},
70687075
},
7076+
context: {
7077+
headers: {
7078+
'X-Parse-Master-Key': 'test',
7079+
},
7080+
},
70697081
});
70707082

70717083
expect(result.data.createUser.clientMutationId).toEqual(clientMutationId);
@@ -7123,6 +7135,7 @@ describe('ParseGraphQLServer', () => {
71237135
username: 'user2',
71247136
password: 'user2',
71257137
someField: 'someValue2',
7138+
ACL: { public: { read: true, write: true } },
71267139
},
71277140
},
71287141
someField: 'someValue',
@@ -7195,6 +7208,7 @@ describe('ParseGraphQLServer', () => {
71957208
username: 'user2',
71967209
password: 'user2',
71977210
someField: 'someValue2',
7211+
ACL: { public: { read: true, write: true } },
71987212
},
71997213
},
72007214
},
@@ -8308,19 +8322,21 @@ describe('ParseGraphQLServer', () => {
83088322
const someClass = new Parse.Object('SomeClass');
83098323
await someClass.save();
83108324

8325+
const roleACL = new Parse.ACL();
8326+
roleACL.setPublicReadAccess(true);
8327+
83118328
const user = new Parse.User();
83128329
user.set('username', 'username');
83138330
user.set('password', 'password');
8331+
user.setACL(roleACL);
83148332
await user.signUp();
83158333

83168334
const user2 = new Parse.User();
83178335
user2.set('username', 'username2');
83188336
user2.set('password', 'password2');
8337+
user2.setACL(roleACL);
83198338
await user2.signUp();
83208339

8321-
const roleACL = new Parse.ACL();
8322-
roleACL.setPublicReadAccess(true);
8323-
83248340
const role = new Parse.Role('aRole', roleACL);
83258341
await role.save();
83268342

@@ -10597,6 +10613,9 @@ describe('ParseGraphQLServer', () => {
1059710613
const user = new Parse.User();
1059810614
user.setUsername('user1');
1059910615
user.setPassword('user1');
10616+
const acl = new Parse.ACL();
10617+
acl.setPublicReadAccess(true);
10618+
user.setACL(acl);
1060010619
await user.signUp();
1060110620

1060210621
await parseGraphQLServer.parseGraphQLSchema.schemaCache.clear();

‎spec/ParseLiveQuery.spec.js

+3
Original file line numberDiff line numberDiff line change
@@ -1076,6 +1076,9 @@ describe('ParseLiveQuery', function () {
10761076
user.setUsername('username');
10771077
user.setPassword('password');
10781078
user.set('foo', 'bar');
1079+
const acl = new Parse.ACL();
1080+
acl.setPublicReadAccess(true);
1081+
user.setACL(acl);
10791082

10801083
const query = new Parse.Query(Parse.User);
10811084
query.equalTo('foo', 'bar');

‎spec/ParseSession.spec.js

+6
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
const request = require('../lib/request');
77

88
function setupTestUsers() {
9+
const acl = new Parse.ACL();
10+
acl.setPublicReadAccess(true);
911
const user1 = new Parse.User();
1012
const user2 = new Parse.User();
1113
const user3 = new Parse.User();
@@ -18,6 +20,10 @@ function setupTestUsers() {
1820
user2.set('password', 'password');
1921
user3.set('password', 'password');
2022

23+
user1.setACL(acl);
24+
user2.setACL(acl);
25+
user3.setACL(acl);
26+
2127
return user1
2228
.signUp()
2329
.then(() => {

‎spec/ParseUser.spec.js

+34-8
Original file line numberDiff line numberDiff line change
@@ -196,14 +196,13 @@ describe('Parse.User testing', () => {
196196
const ACL = user.getACL();
197197
expect(ACL.getReadAccess(user)).toBe(true);
198198
expect(ACL.getWriteAccess(user)).toBe(true);
199-
expect(ACL.getPublicReadAccess()).toBe(true);
199+
expect(ACL.getPublicReadAccess()).toBe(false);
200200
expect(ACL.getPublicWriteAccess()).toBe(false);
201201
const perms = ACL.permissionsById;
202-
expect(Object.keys(perms).length).toBe(2);
202+
expect(Object.keys(perms).length).toBe(1);
203203
expect(perms[user.id].read).toBe(true);
204204
expect(perms[user.id].write).toBe(true);
205-
expect(perms['*'].read).toBe(true);
206-
expect(perms['*'].write).not.toBe(true);
205+
expect(perms['*']).toBeUndefined();
207206
done();
208207
});
209208

@@ -875,8 +874,8 @@ describe('Parse.User testing', () => {
875874
kevin.set('password', 'mypass');
876875
await kevin.signUp();
877876
const query = new Parse.Query(Parse.User);
878-
const count = await query.count();
879-
equal(count, 2);
877+
const count = await query.find({ useMasterKey: true });
878+
equal(count.length, 2);
880879
done();
881880
});
882881

@@ -2153,7 +2152,15 @@ describe('Parse.User testing', () => {
21532152
});
21542153

21552154
it("querying for users doesn't get session tokens", done => {
2156-
Parse.User.signUp('finn', 'human', { foo: 'bar' })
2155+
const user = new Parse.User();
2156+
user.set('username', 'finn');
2157+
user.set('password', 'human');
2158+
user.set('foo', 'bar');
2159+
const acl = new Parse.ACL();
2160+
acl.setPublicReadAccess(true);
2161+
user.setACL(acl);
2162+
user
2163+
.signUp()
21572164
.then(function () {
21582165
return Parse.User.logOut();
21592166
})
@@ -2162,6 +2169,9 @@ describe('Parse.User testing', () => {
21622169
user.set('username', 'jake');
21632170
user.set('password', 'dog');
21642171
user.set('foo', 'baz');
2172+
const acl = new Parse.ACL();
2173+
acl.setPublicReadAccess(true);
2174+
user.setACL(acl);
21652175
return user.signUp();
21662176
})
21672177
.then(function () {
@@ -2188,7 +2198,14 @@ describe('Parse.User testing', () => {
21882198
});
21892199

21902200
it('querying for users only gets the expected fields', done => {
2191-
Parse.User.signUp('finn', 'human', { foo: 'bar' }).then(() => {
2201+
const user = new Parse.User();
2202+
user.setUsername('finn');
2203+
user.setPassword('human');
2204+
user.set('foo', 'bar');
2205+
const acl = new Parse.ACL();
2206+
acl.setPublicReadAccess(true);
2207+
user.setACL(acl);
2208+
user.signUp().then(() => {
21922209
request({
21932210
headers: {
21942211
'X-Parse-Application-Id': 'test',
@@ -3426,6 +3443,9 @@ describe('Parse.User testing', () => {
34263443
password: 'world',
34273444
email: 'test@email.com',
34283445
});
3446+
const acl = new Parse.ACL();
3447+
acl.setPublicReadAccess(true);
3448+
user.setACL(acl);
34293449

34303450
reconfigureServer({
34313451
appName: 'unused',
@@ -4057,6 +4077,12 @@ describe('Parse.User testing', () => {
40574077
silent: true,
40584078
});
40594079

4080+
Parse.Cloud.beforeSave(Parse.User, ({ object }) => {
4081+
const acl = new Parse.ACL();
4082+
acl.setPublicReadAccess(true);
4083+
object.setACL(acl);
4084+
});
4085+
40604086
const query = new Parse.Query(Parse.User);
40614087
query.doesNotExist('foo');
40624088
const subscription = await query.subscribe();

‎spec/ProtectedFields.spec.js

+12
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ describe('ProtectedFields', function () {
1313
user.setPassword('sekrit');
1414
user.set('email', 'alice@aol.com');
1515
user.set('favoriteColor', 'yellow');
16+
const acl = new Parse.ACL();
17+
acl.setPublicReadAccess(true);
18+
user.setACL(acl);
1619
await user.save();
1720

1821
const fetched = await new Parse.Query(Parse.User).get(user.id);
@@ -35,6 +38,9 @@ describe('ProtectedFields', function () {
3538
user.set('timeZone', 'America/Los_Angeles');
3639
user.set('favoriteColor', 'yellow');
3740
user.set('favoriteFood', 'pizza');
41+
const acl = new Parse.ACL();
42+
acl.setPublicReadAccess(true);
43+
user.setACL(acl);
3844
await user.save();
3945

4046
const fetched = await new Parse.Query(Parse.User).get(user.id);
@@ -57,6 +63,9 @@ describe('ProtectedFields', function () {
5763
user.set('timeZone', 'America/Los_Angeles');
5864
user.set('favoriteColor', 'yellow');
5965
user.set('favoriteFood', 'pizza');
66+
const acl = new Parse.ACL();
67+
acl.setPublicReadAccess(true);
68+
user.setACL(acl);
6069
await user.save();
6170

6271
const fetched = await new Parse.Query(Parse.User).get(user.id);
@@ -108,6 +117,9 @@ describe('ProtectedFields', function () {
108117
user.set('timeZone', 'America/Los_Angeles');
109118
user.set('favoriteColor', 'yellow');
110119
user.set('favoriteFood', 'pizza');
120+
const acl = new Parse.ACL();
121+
acl.setPublicReadAccess(true);
122+
user.setACL(acl);
111123
await user.save();
112124

113125
const objA = await new Parse.Object('ClassA').set('foo', 'zzz').set('bar', 'yyy').save();

‎spec/RestQuery.spec.js

+1
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ describe('rest query', () => {
9696
let user = {
9797
username: 'aUsername',
9898
password: 'aPassword',
99+
ACL: { '*': { read: true } },
99100
};
100101
const activity = {
101102
type: 'comment',

‎spec/UserPII.spec.js

+3-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ describe('Personally Identifiable Information', () => {
1616
await reconfigureServer();
1717
user = await Parse.User.signUp('tester', 'abc');
1818
user = await Parse.User.logIn(user.get('username'), 'abc');
19-
await user.set('email', EMAIL).set('zip', ZIP).set('ssn', SSN).save();
19+
const acl = new Parse.ACL();
20+
acl.setPublicReadAccess(true);
21+
await user.set('email', EMAIL).set('zip', ZIP).set('ssn', SSN).setACL(acl).save();
2022
done();
2123
});
2224

‎spec/ValidationAndPasswordsReset.spec.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ describe('Custom Pages, Email Verification, Password Reset', () => {
276276
'Found. Redirecting to http://localhost:8378/1/apps/verify_email_success.html?username=user'
277277
);
278278
user
279-
.fetch()
279+
.fetch({ useMasterKey: true })
280280
.then(
281281
() => {
282282
expect(user.get('emailVerified')).toEqual(true);

‎src/Deprecator/Deprecations.js

-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
* If there are no deprecations, this must return an empty array.
1717
*/
1818
module.exports = [
19-
{ optionKey: 'enforcePrivateUsers', changeNewDefault: 'true' },
2019
{ optionKey: 'allowClientClassCreation', changeNewDefault: 'false' },
2120
{ optionKey: 'allowExpiredAuthDataToken', changeNewDefault: 'false' },
2221
];

‎src/Options/Definitions.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,7 @@ module.exports.ParseServerOptions = {
217217
env: 'PARSE_SERVER_ENFORCE_PRIVATE_USERS',
218218
help: 'Set to true if new users should be created without public read and write access.',
219219
action: parsers.booleanParser,
220-
default: false,
220+
default: true,
221221
},
222222
expireInactiveSessions: {
223223
env: 'PARSE_SERVER_EXPIRE_INACTIVE_SESSIONS',

‎src/Options/index.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ export interface ParseServerOptions {
280280
:DEFAULT: {} */
281281
security: ?SecurityOptions;
282282
/* Set to true if new users should be created without public read and write access.
283-
:DEFAULT: false */
283+
:DEFAULT: true */
284284
enforcePrivateUsers: ?boolean;
285285
/* Allow a user to log in even if the 3rd party authentication token that was used to sign in to their account has expired. If this is set to `false`, then the token will be validated every time the user signs in to their account. This refers to the token that is stored in the `_User.authData` field. Defaults to `true`.
286286
:DEFAULT: true */

0 commit comments

Comments
 (0)