fix: Dashboard config objects stored on server with public read / write access

[mtrezza]

New Pull Request Checklist

• I am not disclosing a vulnerability.
• I am creating this PR in reference to an issue.

Issue Description

The dashboard config objects are stored on server with public read / write access.

Approach

Store with read / write by master key only.

Summary by CodeRabbit

• Bug Fixes
  • Tightened access controls on server configuration data to prevent unintended exposure. Configuration entries now default to restricted access, reducing risk from misconfiguration or unauthorized reads. No changes to how configuration is retrieved or deleted, and no user-facing behavior changes are expected. This hardening improves overall security and integrity of server settings while maintaining existing functionality and performance.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

[parseplatformorg]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

setConfig in src/lib/ServerConfigStorage.js now sets an empty Parse ACL on the config object before saving with the master key. Retrieval and deletion logic remain unchanged.

Changes

Cohort / File(s)	Summary
Server config storage `src/lib/ServerConfigStorage.js`	In setConfig, after updating typed fields and clearing others, assigns `configObject.setACL(new Parse.ACL())` before saving with master key. No changes to get/delete paths.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant C as Caller
  participant S as ServerConfigStorage.setConfig
  participant P as Parse.Object(Config)

  C->>S: setConfig(key, value)
  S->>P: set typed field(s) based on value
  S->>P: clear other value fields
  Note over S,P: New step: set empty ACL
  S->>P: setACL(new Parse.ACL())
  S->>P: save({ useMasterKey: true })
  P-->>S: saved
  S-->>C: resolve

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between dde78a3 and 0f7c618.

📒 Files selected for processing (1)

• src/lib/ServerConfigStorage.js (1 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[parseplatformorg]

🎉 This change has been released in version 7.6.0-alpha.7