feat: add dashboard option `allowAnonymousUser` #2066

dblythy · 2022-03-23T03:04:49Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

Parse Dashboard assumes security if it detects a remote server, which is unreliable. This adds the option allowAnonymousUser which defaults to false.

Related issue: #2065

Approach

Adds a Parse Dashboard option allowAnonymousUser that defaults to false. Setting this to true allows Dashboard to run with no users.
Adds ability to specify options via command line or via config file
Adds console.error to frontend so solutions to errors can be identified by developers

This also add additional security for when dashboard is run on localhost with no options. Previously Dashboard was effectively assuming the dev parameter if localhost. This PR will only run Dashboard in dev mode if it's implicitly set. To get previous localhost behaviour, the dev parameter is required to be set.

TODOs before merging

Add changes to documentation (guides, repository pages, in-code descriptions)
A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

parse-github-assistant · 2022-03-23T03:04:51Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

Parse-Dashboard/app.js

mtrezza · 2022-03-26T20:16:04Z

Still some checks failing. Please request another review once this is ready.

mtrezza · 2022-03-28T02:55:34Z

Is this a breaking change? Does an existing deployment need a reconfiguration to maintain the same security?

dblythy · 2022-03-28T03:10:13Z

I would say so, an existing localhost configuration would need to be changed but remote servers should function the same as before

mtrezza · 2022-03-28T13:00:02Z

I guess our deprecation policy should be (or is in practice already) extending to Parse Dashboard. So breaking changes should probably happen accumulated once a year only as well. Otherwise we may have a breaking change every other month.

Is there a way to make this non-breaking? For example, if the new option is not set, fall back to the old behavior.

dblythy · 2022-03-31T02:02:54Z

The only way I think is if we set dev to true by default, but that brings security implications

mtrezza · 2022-04-04T00:09:37Z

Yes, I think we should avoid that

mtrezza · 2022-04-04T00:10:10Z

Could you rebase this on alpha?

## [4.1.1-alpha.1](parse-community/parse-dashboard@4.1.0...4.1.1-alpha.1) (2022-04-04) ### Bug Fixes * security upgrade js-beautify from 1.14.0 to 1.14.1 ([parse-community#2077](parse-community#2077)) ([e4ea787](parse-community@e4ea787)) * security vulnerability bump minimist from 1.2.5 to 1.2.6 ([parse-community#2070](parse-community#2070)) ([3d0407e](parse-community@3d0407e))

* adding internal class (e.g. `_User`) fails due to prefixed underscore ([parse-community#2036](parse-community#2036)) ([f80bd07](parse-community@f80bd07))

# [4.0.0-alpha.17](parse-community/parse-dashboard@4.0.0-alpha.16...4.0.0-alpha.17) (2022-02-23) ### Bug Fixes * security upgrade prismjs from 1.26.0 to 1.27.0 ([parse-community#2047](parse-community#2047)) ([3afb24e](parse-community@3afb24e))

…ty#2048)

Snyk has created this PR to upgrade @babel/runtime from 7.17.0 to 7.17.2. See this package in npm: https://www.npmjs.com/package/@babel/runtime See this project in Snyk: https://app.snyk.io/org/acinader/project/3e039b91-2450-4b56-8420-baf56cab388e?utm_source=github&utm_medium=referral&page=upgrade-pr

# [4.0.0-alpha.18](parse-community/parse-dashboard@4.0.0-alpha.17...4.0.0-alpha.18) (2022-03-02) ### Bug Fixes * upgrade @babel/runtime from 7.17.0 to 7.17.2 ([parse-community#2055](parse-community#2055)) ([93335e9](parse-community@93335e9))

…2057)

Snyk has created this PR to upgrade express from 4.17.2 to 4.17.3. See this package in npm: https://www.npmjs.com/package/express See this project in Snyk: https://app.snyk.io/org/acinader/project/3e039b91-2450-4b56-8420-baf56cab388e?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: Manuel <5673677+mtrezza@users.noreply.github.com>

# [4.0.0-alpha.19](parse-community/parse-dashboard@4.0.0-alpha.18...4.0.0-alpha.19) (2022-03-10) ### Bug Fixes * upgrade express from 4.17.2 to 4.17.3 ([parse-community#2058](parse-community#2058)) ([f8dc602](parse-community@f8dc602))

# [4.0.0-alpha.20](parse-community/parse-dashboard@4.0.0-alpha.19...4.0.0-alpha.20) (2022-03-16) ### Features * change string filter description ([parse-community#2059](parse-community#2059)) ([bb1e184](parse-community@bb1e184))

Snyk has created this PR to upgrade otpauth from 7.0.10 to 7.0.11. See this package in npm: https://www.npmjs.com/package/otpauth See this project in Snyk: https://app.snyk.io/org/acinader/project/3e039b91-2450-4b56-8420-baf56cab388e?utm_source=github&utm_medium=referral&page=upgrade-pr

# [4.0.0-alpha.21](parse-community/parse-dashboard@4.0.0-alpha.20...4.0.0-alpha.21) (2022-03-18) ### Bug Fixes * upgrade otpauth from 7.0.10 to 7.0.11 ([parse-community#2061](parse-community#2061)) ([c379306](parse-community@c379306))

…ty#2084)

…ty#2090)

mtrezza

It seems the discussion got stuck at how to avoid making this a breaking change. Once this has been figured out please request another review.

mtrezza force-pushed the alpha branch from 12b61b7 to 7a3e8c7 Compare March 23, 2022 03:17

dblythy requested a review from a team March 23, 2022 03:26

mtrezza requested changes Mar 23, 2022

View reviewed changes

Parse-Dashboard/app.js Outdated Show resolved Hide resolved

Parse-Dashboard/app.js Outdated Show resolved Hide resolved

dblythy requested a review from mtrezza March 28, 2022 01:17

mtrezza force-pushed the alpha branch from 8f1dc55 to f14c7d8 Compare April 3, 2022 15:43

refactor: upgrade inquirer from 8.2.0 to 8.2.1 (parse-community#2079)

cbde31a

semantic-release-bot and others added 16 commits April 4, 2022 00:15

ci: bump environment

3fff99c

chore(release): 4.0.0-alpha.16 [skip ci]

394c449

* adding internal class (e.g. `_User`) fails due to prefixed underscore ([parse-community#2036](parse-community#2036)) ([f80bd07](parse-community@f80bd07))

refactor: upgrade typescript from 4.5.4 to 4.5.5 (parse-community#2038)

bf878ef

refactor: upgrade otpauth from 7.0.9 to 7.0.10 (parse-community#2044)

1b1a9db

refactor: upgrade graphql from 16.2.0 to 16.3.0 (parse-community#2043)

1d360ec

refactor: upgrade @babel/runtime from 7.16.7 to 7.17.0 (parse-communi…

d4a8233

…ty#2048)

refactor: upgrade body-parser from 1.19.1 to 1.19.2 (parse-community#…

24f446f

…2057)

chore(release): 4.0.0-alpha.19 [skip ci]

df0567f

# [4.0.0-alpha.19](parse-community/parse-dashboard@4.0.0-alpha.18...4.0.0-alpha.19) (2022-03-10) ### Bug Fixes * upgrade express from 4.17.2 to 4.17.3 ([parse-community#2058](parse-community#2058)) ([f8dc602](parse-community@f8dc602))

chore(release): 4.0.0-alpha.20 [skip ci]

93dc823

# [4.0.0-alpha.20](parse-community/parse-dashboard@4.0.0-alpha.19...4.0.0-alpha.20) (2022-03-16) ### Features * change string filter description ([parse-community#2059](parse-community#2059)) ([bb1e184](parse-community@bb1e184))

chore(release): 4.0.0-alpha.21 [skip ci]

6af3f0d

# [4.0.0-alpha.21](parse-community/parse-dashboard@4.0.0-alpha.20...4.0.0-alpha.21) (2022-03-18) ### Bug Fixes * upgrade otpauth from 7.0.10 to 7.0.11 ([parse-community#2061](parse-community#2061)) ([c379306](parse-community@c379306))

dblythy and others added 7 commits April 4, 2022 10:52

feat: add dashboard option allowAnonymousUser

74e0114

Update app.js

43c236c

Update Dashboard.js

f331d95

review feedback

acffe6a

ci: refactor lint CI task and fix lint issues (parse-community#2004)

da457b6

Update app.js

3913d54

Update dashboard.e2e.test.js

b9cc888

dblythy force-pushed the allowAnonymousUser branch from 6921339 to b9cc888 Compare April 4, 2022 00:52

dblythy and others added 7 commits April 4, 2022 11:04

alpha

357d927

revert changelog

504bb2a

refactor: upgrade commander from 9.0.0 to 9.1.0 (parse-community#2089)

0117a41

refactor: upgrade @babel/runtime from 7.17.2 to 7.17.7 (parse-communi…

1d33c96

…ty#2084)

refactor: upgrade graphiql from 1.6.0 to 1.7.1 (parse-community#2083)

03e66a3

refactor: upgrade @babel/runtime from 7.17.7 to 7.17.8 (parse-communi…

fcd84d8

…ty#2090)

Merge branch 'alpha' into allowAnonymousUser

b7ce426

mtrezza reviewed Apr 14, 2022

View reviewed changes

mtrezza removed the request for review from a team April 14, 2022 09:40

mtrezza force-pushed the alpha branch 2 times, most recently from d32a043 to 0f42a34 Compare May 1, 2022 13:11

bugra9 mentioned this pull request May 7, 2022

fix: config options like --port or --config are ignored #2113

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add dashboard option `allowAnonymousUser` #2066

feat: add dashboard option `allowAnonymousUser` #2066

dblythy commented Mar 23, 2022 •

edited

Loading

parse-github-assistant bot commented Mar 23, 2022 •

edited

Loading

mtrezza commented Mar 26, 2022

mtrezza commented Mar 28, 2022

dblythy commented Mar 28, 2022

mtrezza commented Mar 28, 2022 •

edited

Loading

dblythy commented Mar 31, 2022

mtrezza commented Apr 4, 2022

mtrezza commented Apr 4, 2022

mtrezza left a comment •

edited

Loading

feat: add dashboard option allowAnonymousUser #2066

Are you sure you want to change the base?

feat: add dashboard option allowAnonymousUser #2066

Conversation

dblythy commented Mar 23, 2022 • edited Loading

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Mar 23, 2022 • edited Loading

Thanks for opening this pull request!

mtrezza commented Mar 26, 2022

mtrezza commented Mar 28, 2022

dblythy commented Mar 28, 2022

mtrezza commented Mar 28, 2022 • edited Loading

dblythy commented Mar 31, 2022

mtrezza commented Apr 4, 2022

mtrezza commented Apr 4, 2022

mtrezza left a comment • edited Loading

Choose a reason for hiding this comment

feat: add dashboard option `allowAnonymousUser` #2066

feat: add dashboard option `allowAnonymousUser` #2066

dblythy commented Mar 23, 2022 •

edited

Loading

parse-github-assistant bot commented Mar 23, 2022 •

edited

Loading

mtrezza commented Mar 28, 2022 •

edited

Loading

mtrezza left a comment •

edited

Loading