fix: allow LiveQuery on Parse.Session (#7554)

CHANGELOG.md

@@ -157,6 +157,7 @@ ___
 - Allow setting descending sort to full text queries (dblythy) [#7496](https://github.com/parse-community/parse-server/pull/7496)
 - Allow cloud string for ES modules (Daniel Blyth) [#7560](https://github.com/parse-community/parse-server/pull/7560)
 - docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) [#7562](https://github.com/parse-community/parse-server/pull/7562)
+- Allow liveQuery on Session class (Daniel Blyth) [#7554](https://github.com/parse-community/parse-server/pull/7554)
 
 ## 4.10.4
 [Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...4.10.4)

spec/ParseLiveQuery.spec.js

@@ -708,6 +708,58 @@ describe('ParseLiveQuery', function () {
     }
   });
 
+  it('liveQuery on Session class', async done => {
+    await reconfigureServer({
+      liveQuery: { classNames: [Parse.Session] },
+      startLiveQueryServer: true,
+      verbose: false,
+      silent: true,
+    });
+
+    const user = new Parse.User();
+    user.setUsername('username');
+    user.setPassword('password');
+    await user.signUp();
+
+    const query = new Parse.Query(Parse.Session);
+    const subscription = await query.subscribe();
+
+    subscription.on('create', async obj => {
+      await new Promise(resolve => setTimeout(resolve, 200));
+      expect(obj.get('user').id).toBe(user.id);
+      expect(obj.get('createdWith')).toEqual({ action: 'login', authProvider: 'password' });
+      expect(obj.get('expiresAt')).toBeInstanceOf(Date);
+      expect(obj.get('installationId')).toBeDefined();
+      expect(obj.get('createdAt')).toBeInstanceOf(Date);
+      expect(obj.get('updatedAt')).toBeInstanceOf(Date);
+      done();
+    });
+
+    await Parse.User.logIn('username', 'password');
+  });
+
+  it('prevent liveQuery on Session class when not logged in', async done => {
+    await reconfigureServer({
+      liveQuery: {
+        classNames: [Parse.Session],
+      },
+      startLiveQueryServer: true,
+      verbose: false,
+      silent: true,
+    });
+
+    Parse.LiveQuery.on('error', error => {
+      expect(error).toBe('Invalid session token');
+    });
+    const query = new Parse.Query(Parse.Session);
+    const subscription = await query.subscribe();
+    subscription.on('error', error => {
+      Parse.LiveQuery.removeAllListeners('error');
+      expect(error).toBe('Invalid session token');
+      done();
+    });
+  });
+
   it('handle invalid websocket payload length', async done => {
     await reconfigureServer({
       liveQuery: {
@@ -754,7 +806,7 @@ describe('ParseLiveQuery', function () {
 
     await reconfigureServer({
       liveQuery: {
-        classNames: ['_User'],
+        classNames: [Parse.User],
       },
       startLiveQueryServer: true,
       verbose: false,

src/Controllers/LiveQueryController.js

 import { ParseCloudCodePublisher } from '../LiveQuery/ParseCloudCodePublisher';
 import { LiveQueryOptions } from '../Options';
+import { getClassName } from './../triggers';
 export class LiveQueryController {
   classNames: any;
   liveQueryPublisher: any;
@@ -9,7 +10,10 @@ export class LiveQueryController {
     if (!config || !config.classNames) {
       this.classNames = new Set();
     } else if (config.classNames instanceof Array) {
-      const classNames = config.classNames.map(name => new RegExp('^' + name + '$'));
+      const classNames = config.classNames.map(name => {
+        const _name = getClassName(name);
+        return new RegExp(`^${_name}$`);
+      });
       this.classNames = new Set(classNames);
     } else {
       throw 'liveQuery.classes should be an array of string';

src/LiveQuery/ParseLiveQueryServer.js

@@ -729,10 +729,12 @@ class ParseLiveQueryServer {
     }
     const client = this.clients.get(parseWebsocket.clientId);
     const className = request.query.className;
+    let authCalled = false;
     try {
       const trigger = getTrigger(className, 'beforeSubscribe', Parse.applicationId);
       if (trigger) {
         const auth = await this.getAuthFromClient(client, request.requestId, request.sessionToken);
+        authCalled = true;
         if (auth && auth.user) {
           request.user = auth.user;
         }
@@ -749,6 +751,30 @@ class ParseLiveQueryServer {
         request.query = query;
       }
 
+      if (className === '_Session') {
+        if (!authCalled) {
+          const auth = await this.getAuthFromClient(
+            client,
+            request.requestId,
+            request.sessionToken
+          );
+          if (auth && auth.user) {
+            request.user = auth.user;
+          }
+        }
+        if (request.user) {
+          request.query.where.user = request.user.toPointer();
+        } else if (!request.master) {
+          Client.pushError(
+            parseWebsocket,
+            Parse.Error.INVALID_SESSION_TOKEN,
+            'Invalid session token',
+            false,
+            request.requestId
+          );
+          return;
+        }
+      }
       // Get subscription from subscriptions, create one if necessary
       const subscriptionHash = queryHash(request.query);
       // Add className to subscriptions if necessary

src/RestWrite.js

@@ -1591,11 +1591,22 @@ RestWrite.prototype.sanitizedData = function () {
 
 // Returns an updated copy of the object
 RestWrite.prototype.buildUpdatedObject = function (extraData) {
+  const className = Parse.Object.fromJSON(extraData);
+  const readOnlyAttributes = className.constructor.readOnlyAttributes
+    ? className.constructor.readOnlyAttributes()
+    : [];
+  if (!this.originalData) {
+    for (const attribute of readOnlyAttributes) {
+      extraData[attribute] = this.data[attribute];
+    }
+  }
   const updatedObject = triggers.inflate(extraData, this.originalData);
   Object.keys(this.data).reduce(function (data, key) {
     if (key.indexOf('.') > 0) {
       if (typeof data[key].__op === 'string') {
-        updatedObject.set(key, data[key]);
+        if (!readOnlyAttributes.includes(key)) {
+          updatedObject.set(key, data[key]);
+        }
       } else {
         // subdocument key with dot notation { 'x.y': v } => { 'x': { 'y' : v } })
         const splittedKey = key.split('.');
@@ -1612,7 +1623,11 @@ RestWrite.prototype.buildUpdatedObject = function (extraData) {
     return data;
   }, deepcopy(this.data));
 
-  updatedObject.set(this.sanitizedData());
+  const sanitized = this.sanitizedData();
+  for (const attribute of readOnlyAttributes) {
+    delete sanitized[attribute];
+  }
+  updatedObject.set(sanitized);
   return updatedObject;
 };
 

src/cloud-code/Parse.Cloud.js

@@ -6,13 +6,6 @@ function isParseObjectConstructor(object) {
   return typeof object === 'function' && Object.prototype.hasOwnProperty.call(object, 'className');
 }
 
-function getClassName(parseClass) {
-  if (parseClass && parseClass.className) {
-    return parseClass.className;
-  }
-  return parseClass;
-}
-
 function validateValidator(validator) {
   if (!validator || typeof validator === 'function') {
     return;
@@ -161,7 +154,7 @@ ParseCloud.job = function (functionName, handler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.TriggerRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.beforeSave = function (parseClass, handler, validationHandler) {
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.beforeSave,
@@ -197,7 +190,7 @@ ParseCloud.beforeSave = function (parseClass, handler, validationHandler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.TriggerRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.beforeDelete = function (parseClass, handler, validationHandler) {
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.beforeDelete,
@@ -236,7 +229,7 @@ ParseCloud.beforeLogin = function (handler) {
   if (typeof handler === 'string' || isParseObjectConstructor(handler)) {
     // validation will occur downstream, this is to maintain internal
     // code consistency with the other hook types.
-    className = getClassName(handler);
+    className = triggers.getClassName(handler);
     handler = arguments[1];
   }
   triggers.addTrigger(triggers.Types.beforeLogin, className, handler, Parse.applicationId);
@@ -266,7 +259,7 @@ ParseCloud.afterLogin = function (handler) {
   if (typeof handler === 'string' || isParseObjectConstructor(handler)) {
     // validation will occur downstream, this is to maintain internal
     // code consistency with the other hook types.
-    className = getClassName(handler);
+    className = triggers.getClassName(handler);
     handler = arguments[1];
   }
   triggers.addTrigger(triggers.Types.afterLogin, className, handler, Parse.applicationId);
@@ -295,7 +288,7 @@ ParseCloud.afterLogout = function (handler) {
   if (typeof handler === 'string' || isParseObjectConstructor(handler)) {
     // validation will occur downstream, this is to maintain internal
     // code consistency with the other hook types.
-    className = getClassName(handler);
+    className = triggers.getClassName(handler);
     handler = arguments[1];
   }
   triggers.addTrigger(triggers.Types.afterLogout, className, handler, Parse.applicationId);
@@ -327,7 +320,7 @@ ParseCloud.afterLogout = function (handler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.TriggerRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.afterSave = function (parseClass, handler, validationHandler) {
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.afterSave,
@@ -363,7 +356,7 @@ ParseCloud.afterSave = function (parseClass, handler, validationHandler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.TriggerRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.afterDelete = function (parseClass, handler, validationHandler) {
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.afterDelete,
@@ -399,7 +392,7 @@ ParseCloud.afterDelete = function (parseClass, handler, validationHandler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.BeforeFindRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.beforeFind = function (parseClass, handler, validationHandler) {
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.beforeFind,
@@ -435,7 +428,7 @@ ParseCloud.beforeFind = function (parseClass, handler, validationHandler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.AfterFindRequest}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.afterFind = function (parseClass, handler, validationHandler) {
-  const className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.afterFind,
@@ -663,7 +656,7 @@ ParseCloud.sendEmail = function (data) {
  */
 ParseCloud.beforeSubscribe = function (parseClass, handler, validationHandler) {
   validateValidator(validationHandler);
-  var className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   triggers.addTrigger(
     triggers.Types.beforeSubscribe,
     className,
@@ -701,7 +694,7 @@ ParseCloud.onLiveQueryEvent = function (handler) {
  * @param {(Object|Function)} validator An optional function to help validating cloud code. This function can be an async function and should take one parameter a {@link Parse.Cloud.LiveQueryEventTrigger}, or a {@link Parse.Cloud.ValidatorObject}.
  */
 ParseCloud.afterLiveQueryEvent = function (parseClass, handler, validationHandler) {
-  const className = getClassName(parseClass);
+  const className = triggers.getClassName(parseClass);
   validateValidator(validationHandler);
   triggers.addTrigger(
     triggers.Types.afterEvent,

src/triggers.js

@@ -46,6 +46,13 @@ const baseStore = function () {
   });
 };
 
+export function getClassName(parseClass) {
+  if (parseClass && parseClass.className) {
+    return parseClass.className;
+  }
+  return parseClass;
+}
+
 function validateClassNameForTriggers(className, type) {
   if (type == Types.beforeSave && className === '_PushStatus') {
     // _PushStatus uses undocumented nested key increment ops