No write permission for user created with PFFacebookUtils.logInInBackgroundWithReadPermissions

[mtrezza]

Issue Description

When a PFUser is created on Parse Server with PFFacebookUtils.logInInBackgroundWithReadPermissions it has no write permission to existing objects with ACL (Public: Read, User: Write). It can however create new objects with that ACL.

The object's ACL is set as:

let acl = PFACL()
acl.setWriteAccess(true, forUser: currentUser)
acl.publicReadAccess = true
aObject.ACL = acl

which results in permissions:

{
    "_id": "Asd1tk4FeW",
    "_rperm": [
        "*"
    ],
    "_wperm": [
        "xdY082YDF0"
    ],
    "_acl": {
        "*": {
            "r": true
        },
        "xdY082YDF0": {
            "w": true
        }
    }
}

Steps to reproduce

1. Create new user with PFFacebookUtils.logInInBackgroundWithReadPermissions
2. Create object with ACL: Public read, user write.
3. Try updating a field of the object, e.g. with PFObject.saveInBackgroundWithBlock.

Expected Results

Updating the object should succeed.

Actual Outcome

Updating the object fails with error, user has no write permissions:

[Error]: Object not found. (Code: 101, Version: 1.13.0)
(Error Domain=Parse Code=101 "Object not found." UserInfo={code=101, temporary=0, error=Object not found., NSLocalizedDescription=Object not found.})

The solution is to log-out and re-log-in the user, then the update and all following updates succeed.
The update also succeeded without re-login when Public: write is enabled in the object's ACL in Parse Dashboard.
This issue does not occur when creating a user with PFUser.signUpInBackgroundWithBlock.

Environment Setup

• Server
  • parse-server version: 2.2.11
  • Operating System: -
  • Hardware: -
  • Localhost or remote server?: Heroku
• Database
  • MongoDB version: 3.0.9.
  • Storage engine: -
  • Hardware: -
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): mLab

Logs/Trace

[bryhaw]

Having the same issue. Figure anything out?

[bryhaw]

Ahhh... Probably not the best practice but I logged in with the access token after calling PFFacebookUtils.logInInBackgroundWithReadPermissions and that seemed to work!

PFFacebookUtils.logInInBackgroundWithAccessToken(FBSDKAccessToken.currentAccessToken())

[flovilmart]

Did you update to the latest parse-server version (2.2.18) and let us know if the issue persist? We have a serverSide mechanism that prevents the user lock himself out.

[mtrezza]

I can confirm that this issue is solved in Parse Server 2.2.18.