Skip to content

test: LiveQuery disconnect does not clear subscription info#10414

Merged
mtrezza merged 2 commits intoparse-community:alphafrom
mtrezza:tests/GHSA-3rpv-5775-m86r-v9
Apr 7, 2026
Merged

test: LiveQuery disconnect does not clear subscription info#10414
mtrezza merged 2 commits intoparse-community:alphafrom
mtrezza:tests/GHSA-3rpv-5775-m86r-v9

Conversation

@mtrezza
Copy link
Copy Markdown
Member

@mtrezza mtrezza commented Apr 7, 2026

Issue

LiveQuery disconnect does not clear subscription info

Tasks

  • Add new tests
  • Add changes to documentation (guides, repository pages, in-code descriptions)

Add test proving that client disconnect does not call
deleteSubscriptionInfo, disproving the claim in advisory
GHSA-3rpv-5775-m86r that subscriptionInfo becomes undefined
on disconnect causing protectedFields to fail open.
@parse-github-assistant
Copy link
Copy Markdown

parse-github-assistant bot commented Apr 7, 2026

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

  • Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
  • Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
  • Group code into logical blocks. Add a short comment before each block to explain its purpose.
  • We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
  • Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
  • Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 7, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d59f06b5-815d-4044-af22-00c5fe729219

📥 Commits

Reviewing files that changed from the base of the PR and between 4c6a59a and 1d44066.

📒 Files selected for processing (1)
  • spec/ParseLiveQueryServer.spec.js
✅ Files skipped from review due to trivial changes (1)
  • spec/ParseLiveQueryServer.spec.js

📝 Walkthrough

Walkthrough

Added a Jasmine test that exercises the server's registered disconnect behavior: it simulates a client websocket disconnect and asserts the client is removed from parseLiveQueryServer.clients and that client.deleteSubscriptionInfo() is not called.

Changes

Cohort / File(s) Summary
Disconnect Handler Test
spec/ParseLiveQueryServer.spec.js
Replaced a TODO with a concrete test: constructs a ParseLiveQueryServer, attaches a mock EventEmitter websocket (with clientId), registers handlers via _onConnect(...), adds a mock subscription, emits disconnect, asserts the client is removed from parseLiveQueryServer.clients and that client.deleteSubscriptionInfo(...) is not invoked.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning No pull request description was provided by the author, but one is expected according to the repository template. Add a description following the template, including sections for Issue, Approach, and Tasks checklist to document the purpose and scope of this test addition.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title begins with 'test:' prefix as required and clearly describes the test addition for LiveQuery disconnect behavior.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Security Check ✅ Passed The pull request introduces a security verification test that correctly confirms a vulnerability does not exist by verifying the disconnect handler does not incorrectly call deleteSubscriptionInfo().
Engage In Review Feedback ✅ Passed The PR is open with no reviewers assigned, so review feedback has not yet been provided. The commit is focused with clear intent for testing disconnect handler behavior.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@spec/ParseLiveQueryServer.spec.js`:
- Around line 660-673: The test currently only asserts that
client.deleteSubscriptionInfo was not called after emitting 'disconnect', which
can pass if the disconnect listener never ran; modify the spec to also assert a
positive side-effect of the disconnect handler so the handler actually executed:
after calling addMockSubscription(parseLiveQueryServer, clientId, requestId,
parseWebSocket) and parseLiveQueryServer._onConnect(parseWebSocket) then emit
'disconnect' and add a positive expectation such as verifying
parseLiveQueryServer._connectedClients no longer contains clientId (or that
parseWebSocket.connected flag changed, or that a mock disconnect handler spy was
called) to prove the disconnect listener ran while keeping the existing assert
that client.deleteSubscriptionInfo was not called; reference symbols:
addMockSubscription, parseLiveQueryServer._onConnect,
parseWebSocket.emit('disconnect'), client.deleteSubscriptionInfo.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 86f2d7a1-cd50-421c-9549-3116715eefc3

📥 Commits

Reviewing files that changed from the base of the PR and between f184f76 and 4c6a59a.

📒 Files selected for processing (1)
  • spec/ParseLiveQueryServer.spec.js

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.98%. Comparing base (c0889c8) to head (1d44066).
⚠️ Report is 6 commits behind head on alpha.

Additional details and impacted files
@@            Coverage Diff             @@
##            alpha   #10414      +/-   ##
==========================================
- Coverage   83.98%   83.98%   -0.01%     
==========================================
  Files         192      192              
  Lines       16749    16749              
  Branches      229      229              
==========================================
- Hits        14067    14066       -1     
- Misses       2656     2657       +1     
  Partials       26       26              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mtrezza mtrezza merged commit 7d4a460 into parse-community:alpha Apr 7, 2026
26 of 41 checks passed
@mtrezza mtrezza deleted the tests/GHSA-3rpv-5775-m86r-v9 branch April 7, 2026 23:12
@parseplatformorg
Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 9.8.0-alpha.11

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

state:released-alpha Released as alpha version

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants