v5.8.1 - Webhook ACLs, Query Authority, Session Revocation, Search Ownership

[AdrianCurtin]

Summary

Release 5.8.1: a correctness release that closes the follow-ups left from 5.8.0. It covers webhook create ACLs and sub-document writes, session revocation and Parse.without_master_key parity, query OR compilation and authority, relation change tracking, search ownership filtering, and sub-agent policy narrowing. There are no new defaults and no API changes; every corrected outcome is listed in the CHANGELOG under Behavior Notes.

Webhooks

• A client create through a before_save handler that returns parse_object gets the ACL its class policy resolves, as an SDK create would. Owner policies take the requesting user as owner when the owner field is empty, so a signed-in client can read its own record (it used to get {} under :owner_else_private). An anonymous create gets the declared fallback, never public write.
• A master-key request gets the policy fallback, and a _User class with owner: :self is owned by the new user, never the requester. A guard :acl, :master_only revert returns the ACL to the class policy.
• An ACL the handler assigns (through acl= or mass assignment) always wins, even when it equals the class default, and whatever the handler returns (parse_object, true, nil, or a Hash without ACL).
• When the handler changes a record, changed sub-documents are written back as one-level dotted paths (Parse Server rebuilds dotted keys only one level for afterSave), so concurrent writes to sibling sub-keys survive. Arrays and typed values (Date, Bytes, Pointer) are written whole. Dotted overrides fold into the write they belong to with operators applied, and unsupported or conflicting overrides fail the save.

Sessions and master-key scope

• Deleting sessions or users, singly or through Array#destroy, drops their cached identities when the delete succeeds or the row is already gone; a denied delete leaves the cache alone. A session missing its token or owner is looked up first (one query per batch, with the delete's own session when the client has no master key). A lookup with no row forgets nothing; only a failed lookup resets the identity cache, at most once every 5 seconds per client. The looked-up token never stays on the object or enters the response cache, and a token resolution in flight across an invalidation does not cache its answer.
• Inside Parse.without_master_key, an explicit master: true to Parse::MongoDB.aggregate, Parse::ACLScope, direct query reads, vector and hybrid search, Atlas Search, and master-key agent tools runs in the public scope (or raises under either strict flag), and the aggregate notification reports master_dropped: true.
• SDK metadata reads (CLP schema, role graph, index stats, Atlas index listing) keep the master key through a private sentinel instead of re-enabling it for the whole call. A schema read refused inside the block is no longer negative-cached; that had denied every scoped mongo-direct read of the class, for all callers, for 5 seconds.
• faceted_search raises inside the block. The metadata marker rides only on the outgoing request copy, never on response.request. A LiveQuery admin client that first connected inside the block keeps withholding its master key on reconnect until allow_master_key_connection!.
• Signup and upgrade_anonymous! store timestamps as Parse::Date, so reading them no longer dirties the user.

Queries, LiveQuery, and push

• An OR with an unconstrained branch matches every row (an empty receiver of | still starts the OR, so reduce(Model.query, :|) works), and :or => [...] builds a real $or.
• Pipeline-only constraints (readable_by, array_size, set_equals, mongo-direct geo operators) raise inside any OR, in subqueries, in LiveQuery subscriptions, and in push targeting, instead of being dropped and widening the result to every row.
• clone, |, or_where, Parse::Query.or, :or branches (Hash or query), and $inQuery/$select subqueries keep the query's authority and application: session token, become client, scoped user or role, master flag, read preference, and the target app. Different authorities or applications raise, the authority is pinned whichever operand carries it, a rejected change leaves the query untouched, and a combined query re-checks its authority (including explicit auth passed to direct or Atlas reads) before it runs. Subscriptions run under the query's own session.
• A bare objectId compared to a declared pointer field matches on REST, LiveQuery subscriptions, and push targeting (new Query#compile_rest_where).
• A repeated order field is sent once, and "-field" strings parse as descending.

Associations

• Fetches (fetch!, partial fetch, autofetch, with or without preserve_changes:) keep a relation's staged additions and removals and leave it marked changed, including when the response carries the Relation descriptor. reload! and clear_changes! discard them.
• rollback! drops staged relation changes, including after a fetch, and a relation kept across a fetch re-reads its list.
• RelationCollectionProxy#save sends the staged operations (it silently sent nothing) and accepts session:, and atomic relation operations target the remote column.
• Pointer collections adopt the array Parse Server returns only when every entry is a pointer to the declared class.

Search

• Atlas Search, autocomplete, and native hybrid search apply the CLP pointerFields / readUserFields ownership constraint before $limit, so scoped callers no longer get short or empty pages when other users' rows rank first.
• Vector search enforces ownership server-side and pushes it into $vectorSearch.filter when every owner field is a declared scalar pointer that is filter-indexed in a READY index serving its latest definition. A refusal naming an owner path is retried once without the prefilter, a caller's own unindexed filter no longer disables it for everyone, and failed index lookups are negatively cached.

Agent policies

• A sub-agent's tools: and methods: filters only narrow its parent's (they used to replace them), and a sub-agent cannot turn on master_atlas when its parent does not have it. Sub-agents use the parent's approval gate at call time, including through the MCP dispatcher, qualified methods: entries match class aliases and Ruby constant names, and describe and the audit payload report inherited method layers.

Behavior changes for upgrading apps

CHANGELOG.md lists each one. The ones most likely to be noticed:

• An OR with an unconstrained branch returns every row; pipeline-only constraints inside an OR raise.
• Combining queries under different authorities or applications raises ArgumentError, as does changing a combined query's authority.
• LiveQuery subscriptions, push targeting, and subqueries with pipeline-only constraints raise.
• REST, LiveQuery, and push comparisons of a bare objectId to a declared pointer field now match.
• Explicit master: true inside Parse.without_master_key no longer runs as master; wrap such calls in Parse.with_master_key.
• A sub-agent only: list that leaves nothing once the parent's filters apply raises, as does master_atlas: true under a parent without it.
• before_save create replies carry the class-policy ACL.

Testing

• bundle exec rake test:unit passes on the final commit.
• Integration files for every changed area pass against Parse Server 9.10.3 and MongoDB 9.0.2, including new live tests for webhook create ACLs, concurrent sub-key writes, and afterSave shape, pointer-array adoption and relation saves after a fetch, and REST pointer coercion and OR compilation. The transaction batch-limits test hits Parse Server's concurrent-session transaction abort intermittently on both this branch and the previous commit.
• Each review finding was reproduced before its fix, and the regression tests fail on the previous code.