fix: Parameters missing in `afterFind` trigger of authentication adapters #8458

dblythy · 2023-03-06T01:52:09Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

Added in #8444, authentication adapters can change the save response, however there is no way to change behavior depending on master, user, ip, etc.

Closes: #8444

Approach

Add request parameter to auth afterFind trigger

Tasks

Add tests

parse-github-assistant · 2023-03-06T01:52:11Z

I will reformat the title to use the proper commit message syntax.

parse-github-assistant · 2023-03-06T01:52:14Z

Thanks for opening this pull request!

dblythy · 2023-03-06T01:52:36Z

@mtrezza this was an oversight by me - should've been added in #8444

mtrezza · 2023-03-06T02:12:57Z

Is this a fix then rather than a feat?

codecov · 2023-03-06T02:13:51Z

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.29 ⚠️

Comparison is base (c793bb8) 94.31% compared to head (f88a718) 94.03%.

❗ Current head f88a718 differs from pull request most recent head dec30ff. Consider uploading reports for the commit dec30ff to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8458      +/-   ##
==========================================
- Coverage   94.31%   94.03%   -0.29%     
==========================================
  Files         183      183              
  Lines       14482    14483       +1     
==========================================
- Hits        13659    13619      -40     
- Misses        823      864      +41

Impacted Files	Coverage Δ
src/Adapters/Auth/index.js	`97.16% <100.00%> (+0.02%)`	⬆️
src/RestQuery.js	`95.84% <100.00%> (ø)`
src/Routers/UsersRouter.js	`97.11% <100.00%> (ø)`
src/Adapters/Cache/RedisCacheAdapter.js	`17.39% <0.00%> (-73.92%)`	⬇️
src/LiveQuery/ParseCloudCodePublisher.js	`84.21% <0.00%> (-15.79%)`	⬇️
src/ParseServer.js	`92.20% <0.00%> (-0.44%)`	⬇️
src/LiveQuery/ParseLiveQueryServer.js	`95.77% <0.00%> (-0.22%)`	⬇️
src/Controllers/SchemaController.js	`97.29% <0.00%> (-0.19%)`	⬇️
src/RestWrite.js	`94.76% <0.00%> (-0.15%)`	⬇️
...dapters/Storage/Postgres/PostgresStorageAdapter.js	`95.66% <0.00%> (-0.08%)`	⬇️
... and 1 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

dblythy · 2023-03-06T02:16:08Z

I think so

mtrezza · 2023-03-06T02:18:48Z

Oops, I've merged this already but you didn't request a review yet. I mixed this up with another PR. Was this ready for merge?

# [6.1.0-alpha.4](6.1.0-alpha.3...6.1.0-alpha.4) (2023-03-06) ### Bug Fixes * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747))

parseplatformorg · 2023-03-06T02:19:18Z

🎉 This change has been released in version 6.1.0-alpha.4

dblythy · 2023-03-06T02:22:37Z

Yep - all good!

# [6.1.0-beta.2](6.1.0-beta.1...6.1.0-beta.2) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747)) * Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d)) ### Features * Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8)) * Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-05-01T21:37:17Z

🎉 This change has been released in version 6.1.0-beta.2

# [6.1.0](6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747)) * Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e)) * Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-05-01T21:52:13Z

🎉 This change has been released in version 6.1.0

commit 1506273 Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Sat May 20 23:24:03 2023 +0000 chore(release): 6.2.0 [skip ci] # [6.2.0](parse-community/parse-server@6.1.0...6.2.0) (2023-05-20) ### Features * Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` ([parse-community#8538](parse-community#8538)) ([a318e7b](parse-community@a318e7b)) commit a318e7b Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Sun May 21 01:23:00 2023 +0200 feat: Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` (parse-community#8538) commit 832702d Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Mon May 1 21:50:23 2023 +0000 chore(release): 6.1.0 [skip ci] # [6.1.0](parse-community/parse-server@6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([parse-community#8456](parse-community#8456)) ([4ce135a](parse-community@4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([parse-community#8446](parse-community#8446)) ([22d2446](parse-community@22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([parse-community#8458](parse-community#8458)) ([ce34747](parse-community@ce34747)) * Rate limiting across multiple servers via Redis not working ([parse-community#8469](parse-community#8469)) ([d9e347d](parse-community@d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([parse-community#8420](parse-community#8420)) ([f5bfe45](parse-community@f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([parse-community#8444](parse-community#8444)) ([c793bb8](parse-community@c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([parse-community#8436](parse-community#8436)) ([b3b76de](parse-community@b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([parse-community#7551](parse-community#7551)) ([e5d610e](parse-community@e5d610e)) * Add rate limiting across multiple servers via Redis ([parse-community#8394](parse-community#8394)) ([34833e4](parse-community@34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([parse-community#8517](parse-community#8517)) ([4f15539](parse-community@4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([parse-community#8388](parse-community#8388)) ([a49e323](parse-community@a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([parse-community#8443](parse-community#8443)) ([40c1961](parse-community@40c1961)) commit 18b63d1 Merge: f7eee19 f59d46c Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Mon May 1 23:49:22 2023 +0200 build: Release (parse-community#8526)

feat: add parameters to afterFind trigger for authentication adapters

5c7909f

parse-github-assistant bot changed the title ~~feat: add parameters to afterFind trigger for authentication adapters~~ feat: Add parameters to afterFind trigger for authentication adapters Mar 6, 2023

dblythy added 2 commits March 6, 2023 12:54

Update AuthenticationAdaptersV2.spec.js

cfee0ff

Update AuthenticationAdaptersV2.spec.js

dec30ff

mtrezza changed the title ~~feat: Add parameters to afterFind trigger for authentication adapters~~ feat: Add parameters to afterFind trigger of authentication adapters Mar 6, 2023

dblythy changed the title ~~feat: Add parameters to afterFind trigger of authentication adapters~~ fix: Add parameters to afterFind trigger of authentication adapters Mar 6, 2023

mtrezza changed the title ~~fix: Add parameters to afterFind trigger of authentication adapters~~ fix: Parameters missing in afterFind trigger of authentication adapters Mar 6, 2023

mtrezza changed the title ~~fix: Parameters missing in afterFind trigger of authentication adapters~~ fix: Parameters missing in afterFind trigger of authentication adapters Mar 6, 2023

mtrezza merged commit ce34747 into parse-community:alpha Mar 6, 2023

parseplatformorg added the state:released-alpha Released as alpha version label Mar 6, 2023

dblythy deleted the add-master branch March 6, 2023 02:22

parseplatformorg added the state:released-beta Released as beta version label May 1, 2023

parseplatformorg added the state:released Released as stable version label May 1, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: Parameters missing in `afterFind` trigger of authentication adapters #8458

fix: Parameters missing in `afterFind` trigger of authentication adapters #8458

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

parse-github-assistant bot commented Mar 6, 2023

Uh oh!

parse-github-assistant bot commented Mar 6, 2023

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

mtrezza commented Mar 6, 2023

Uh oh!

codecov bot commented Mar 6, 2023 •

edited

Loading

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

mtrezza commented Mar 6, 2023

Uh oh!

parseplatformorg commented Mar 6, 2023

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

parseplatformorg commented May 1, 2023

Uh oh!

parseplatformorg commented May 1, 2023

Uh oh!

Uh oh!

Uh oh!

fix: Parameters missing in afterFind trigger of authentication adapters #8458

fix: Parameters missing in afterFind trigger of authentication adapters #8458

Uh oh!

Conversation

dblythy commented Mar 6, 2023

Pull Request

Issue

Approach

Tasks

Uh oh!

parse-github-assistant bot commented Mar 6, 2023

Uh oh!

parse-github-assistant bot commented Mar 6, 2023

Thanks for opening this pull request!

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

mtrezza commented Mar 6, 2023

Uh oh!

codecov bot commented Mar 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

mtrezza commented Mar 6, 2023

Uh oh!

parseplatformorg commented Mar 6, 2023

Uh oh!

dblythy commented Mar 6, 2023

Uh oh!

parseplatformorg commented May 1, 2023

Uh oh!

parseplatformorg commented May 1, 2023

Uh oh!

Uh oh!

fix: Parameters missing in `afterFind` trigger of authentication adapters #8458

fix: Parameters missing in `afterFind` trigger of authentication adapters #8458

codecov bot commented Mar 6, 2023 •

edited

Loading