feat: Add protectedFieldsOwnerExempt option to control _User class owner exemption for protectedFields

[mtrezza]

Issue

The _User class has a special exemption in filterSensitiveData that skips protectedFields filtering when the logged-in user queries their own user object. This exemption does not exist for any other class, creating inconsistent behavior. This adds a new protectedFieldsOwnerExempt option (default: true) to control this exemption, with a deprecation warning that the default will change to false in a future major version.

Tasks

• New Parse Server Tests

Summary by CodeRabbit

• New Features

  • Added protectedFieldsOwnerExempt option to control whether users can see protected fields on their own _User records (default: true).

• Tests

  • Added tests covering owner-exempt vs non-exempt behavior, cross-class cases, and current-user endpoints.

• Documentation

  • Updated docs to describe per-class/per-group protectedFields configuration, selector semantics, defaults, and the new owner-exempt setting.

• Chores

  • Added a deprecation notice for an upcoming default change to the owner-exempt behavior.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new boolean option protectedFieldsOwnerExempt (default true) and makes _User owner exemption from protectedFields conditional on that option; updates DatabaseController and LiveQuery call sites, expands options/docs, adds a deprecation entry, and adds tests covering owner vs non-owner visibility and /users/me behavior.

Changes

Cohort / File(s)	Summary
Tests spec/ProtectedFields.spec.js	New test suite validating protectedFieldsOwnerExempt for _User (owner vs other user, master key) and verifying non-_User classes and GET /1/users/me behavior.
Core Logic src/Controllers/DatabaseController.js, src/LiveQuery/ParseLiveQueryServer.ts	DatabaseController.filterSensitiveData gains an optional protectedFieldsOwnerExempt parameter; _User owner-exemption and addProtectedFields checks are conditional on this option. LiveQuery now passes the option into the filter call.
Options / Docs src/Options/Definitions.js, src/Options/docs.js, src/Options/index.js	Adds protectedFieldsOwnerExempt option (PARSE_SERVER_PROTECTED_FIELDS_OWNER_EXEMPT, default true) and expands protectedFields docstring to describe per-class/per-group configuration, intersection rules, and owner-exemption semantics.
Deprecation src/Deprecator/Deprecations.js	Adds deprecation entry declaring a future default change for protectedFieldsOwnerExempt to false with guidance for migration.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~35 minutes

Possibly related PRs

• fix: Auth data exposed via /users/me endpoint (GHSA-37mj-c2wf-cx96) #10278: Changes around /users/me fetching/filtering; overlaps on how _User protected fields and owner visibility are handled.
• fix: Protected field change detection oracle via LiveQuery watch parameter (GHSA-qpc3-fg4j-8hgm) #10253: LiveQuery protected-field handling adjustments; related to LiveQuery filter behavior updates.
• fix: Protected fields leak via LiveQuery afterEvent trigger (GHSA-5hmj-jcgp-6hff) #10232: LiveQuery sensitive-data propagation changes for afterEvent/save/delete; touches the same LiveQuery filtering surface.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description is incomplete and missing required sections from the template. It addresses Issue and includes an incomplete Tasks section, but lacks documentation and security check items fully documented, and the approach section could be more detailed.	Complete the Tasks section with checkboxes for documentation updates and security checks; provide more detail in the Approach section about changes across multiple files.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: adding a new protectedFieldsOwnerExempt option to control _User class owner exemption behavior for protectedFields.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.53%. Comparing base (875cf10) to head (360d86e).
⚠️ Report is 4 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10280   +/-   ##
=======================================
  Coverage   92.53%   92.53%           
=======================================
  Files         192      192           
  Lines       16481    16482    +1     
  Branches      226      226           
=======================================
+ Hits        15251    15252    +1     
  Misses       1210     1210           
  Partials       20       20           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

spec/ProtectedFields.spec.js (1)

1861-1866: Prefer Parse.serverURL / Parse.applicationId over hardcoded test endpoint values.

Using http://localhost:8378 and 'test' directly makes these specs more brittle than necessary.

♻️ Suggested refactor pattern

+ const baseUrl = Parse.serverURL;
+ const appHeaders = {
+   'X-Parse-Application-Id': Parse.applicationId,
+   'X-Parse-REST-API-Key': 'rest',
+ };

- url: `http://localhost:8378/1/users/${user1.id}`,
+ url: `${baseUrl}/users/${user1.id}`,
  headers: {
-   'X-Parse-Application-Id': 'test',
-   'X-Parse-REST-API-Key': 'rest',
+   ...appHeaders,
    'X-Parse-Session-Token': sessionToken1,
  },

Also applies to: 1876-1881, 1902-1907, 1913-1917, 1939-1944, 1965-1970

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ProtectedFields.spec.js` around lines 1861 - 1866, Replace hardcoded
endpoint and app id in the test request construction with the Parse SDK config:
build the request URL using Parse.serverURL instead of "http://localhost:8378"
and set the 'X-Parse-Application-Id' header to Parse.applicationId instead of
the literal 'test'; update every occurrence shown (the request block that uses
url: `http://localhost:8378/1/users/${user1.id}` and headers with 'test') as
well as the other occurrences mentioned (around the blocks using sessionToken1
and user1.id) so tests reference Parse.serverURL and Parse.applicationId,
leaving sessionToken1 and user1.id unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/Controllers/DatabaseController.js`:
- Line 1673: The fast-path that returns null when a caller's id matches
query.objectId should be limited to _User class queries: update the condition in
DatabaseController (the if using this.options.protectedFieldsOwnerExempt,
aclGroup, and query.objectId) to also require the query's class is "_User"
(e.g., check query.className or the appropriate class identifier used in this
code) so non-_User classes with the same objectId do not bypass protectedFields;
leave the existing protectedFieldsOwnerExempt flag and aclGroup logic intact.

In `@src/Options/docs.js`:
- Around line 91-92: Update the docs to list the full selector set accepted by
protectedFields (including per-user entries keyed by user objectId and
selectors: '*', 'authenticated', 'role:RoleName', 'userField:FieldName') and add
a migration note describing the default behavior and planned flip for
protectedFieldsOwnerExempt (current default true and planned change), and ensure
addProtectedFields() behavior is mentioned; make the change by updating the
source option in Options.index (the canonical definition for protectedFields and
protectedFieldsOwnerExempt) and then regenerate Definitions and docs via the
definitions build step (npm run definitions) so src/Options/Definitions.js and
src/Options/docs.js reflect the complete selector set and migration path.

---

Nitpick comments:
In `@spec/ProtectedFields.spec.js`:
- Around line 1861-1866: Replace hardcoded endpoint and app id in the test
request construction with the Parse SDK config: build the request URL using
Parse.serverURL instead of "http://localhost:8378" and set the
'X-Parse-Application-Id' header to Parse.applicationId instead of the literal
'test'; update every occurrence shown (the request block that uses url:
`http://localhost:8378/1/users/${user1.id}` and headers with 'test') as well as
the other occurrences mentioned (around the blocks using sessionToken1 and
user1.id) so tests reference Parse.serverURL and Parse.applicationId, leaving
sessionToken1 and user1.id unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0914b3e0-3d09-4b6d-ad96-02e4ddf1b61a

📥 Commits

Reviewing files that changed from the base of the PR and between 564c845 and 8e90dfa.

📒 Files selected for processing (6)

• spec/ProtectedFields.spec.js
• src/Controllers/DatabaseController.js
• src/Deprecator/Deprecations.js
• src/Options/Definitions.js
• src/Options/docs.js
• src/Options/index.js

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/Controllers/DatabaseController.js`:
- Around line 198-199: The call in ParseLiveQueryServer that invokes
DatabaseController.filterSensitiveData mistakenly passes query as the 10th
argument instead of the protectedFieldsOwnerExempt flag, causing
protectedFieldsOwnerExempt to be undefined; update the
ParseLiveQueryServer.filterSensitiveData invocation to pass
this.options.protectedFieldsOwnerExempt (or the local protectedFieldsOwnerExempt
variable) as the 10th parameter so the DatabaseController.filterSensitiveData
call receives the same protectedFieldsOwnerExempt value propagated by
DatabaseController.js and respects a false setting.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee2c2e4b-7d73-4c68-a909-94295ae4a832

📥 Commits

Reviewing files that changed from the base of the PR and between 8e90dfa and 41d6a17.

📒 Files selected for processing (1)

• src/Controllers/DatabaseController.js

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/Options/index.js`:
- Around line 171-177: Update the help text for the option
protectedFieldsOwnerExempt in src/Options/index.js to include a deprecation
notice that the default will change from true to false in a future major release
(mention which future major version if known), then run npm run definitions so
the change is propagated into the generated Definitions and docs (References:
protectedFieldsOwnerExempt, protectedFields); ensure the new deprecation
sentence is appended to the existing help paragraph and preserves the ENV and
DEFAULT annotations so definitions generation succeeds.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 16e05a55-ade4-4e5e-a426-e9222155cec7

📥 Commits

Reviewing files that changed from the base of the PR and between 41d6a17 and 360d86e.

📒 Files selected for processing (4)

• src/LiveQuery/ParseLiveQueryServer.ts
• src/Options/Definitions.js
• src/Options/docs.js
• src/Options/index.js

🚧 Files skipped from review as they are similar to previous changes (2)

• src/Options/docs.js
• src/Options/Definitions.js

[parseplatformorg]

🎉 This change has been released in version 9.6.0-alpha.56

[parseplatformorg]

🎉 This change has been released in version 9.6.0