Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest version of Parse Server.
Issue Description
I updated from Parse 6.2.0 to 6.3.0 and it appears to have changed how queries with include(...) are made.
The req.context is empty in Parse.Cloud.beforeFind() when using a query with include().
For a query like:
const posts = await new Parse.Query("Post")
.include("user") <- pointer to a _User
...
.find({ context: {...}, sessionToken: ... });
in the old version the beforeFind was only called once and had the specified context object.
But in the latest (6.3.0) version the beforeFind is called twice, once for the query to Post (with the context object) and another time for the query to _User (with no context object and the query {"where":{"objectId":{"$in":[objectId1, objectId2, ... ]}}}).
I use the beforeFind to only allow queries made from the cloud code for certain classes (by using the find context), but for queries with include it is no longer possible to check if the query was made from cloud code or from a client SDK.
Steps to reproduce
Define beforeFind, like:
Parse.Cloud.beforeFind("Post", async req => {
if (!req.master && !req.isGet) {
if (!req.context) { throw "Empty") }
}
});
Parse.Cloud.beforeFind(Parse.User, async req => {
if (!req.master && !req.isGet) {
if (!req.context) { throw "Empty") }
}
});
and use a query like:
const posts = await new Parse.Query("Post")
.include("user") <- pointer to a _User
...
.find({ context: {...}, sessionToken: ... });
Actual Outcome
The context in beforeFind("Post", ...) is the context object defined in the query.
The context in beforeFind(Parse.User, ...) (or any class that is included in a query) is undefined/empty.
Expected Outcome
The context is defined in both beforeFind functions.
Environment
Server
- Parse Server version:
6.3.0
Database
- System (MongoDB or Postgres):
MongoDB