feat: Deprecation DEPPS12: Database option allowPublicExplain defaults to false
#9975
+17
−22
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
🚀 Thanks for opening this pull request! |
mtrezza
added
the
state:breaking
📝 WalkthroughWalkthroughThis PR removes the deprecation entry for Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (4)
💤 Files with no reviewable changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
🧰 Additional context used🧠 Learnings (9)📓 Common learnings📚 Learning: 2025-12-02T06:55:53.808ZApplied to files:
📚 Learning: 2025-11-08T13:46:04.940ZApplied to files:
📚 Learning: 2025-11-08T13:46:04.940ZApplied to files:
📚 Learning: 2025-11-17T15:02:48.786ZApplied to files:
📚 Learning: 2025-11-17T15:02:24.824ZApplied to files:
📚 Learning: 2025-08-27T09:08:34.252ZApplied to files:
📚 Learning: 2025-12-02T08:00:20.138ZApplied to files:
📚 Learning: 2025-12-02T08:00:08.440ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Member
Author
|
BREAKING CHANGE: This release changes the MongoDB database option |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/Options/Definitions.js (1)
1149-1155: Default value direction likely incorrect vs PR objective/title (false vs “defaults to true”).Line 1154 sets
default: false, which contradicts the PR objective/title (“defaults totrue”) and theDEPRECATIONS.mdDEPPS12 row text.If the intent is “default to true”, change to:
allowPublicExplain: { env: 'PARSE_SERVER_DATABASE_ALLOW_PUBLIC_EXPLAIN', help: 'Set to `true` to allow `Parse.Query.explain` without master key.<br><br>\u26A0\uFE0F Enabling this option may expose sensitive query performance data to unauthorized users and could potentially be exploited for malicious purposes.', action: parsers.booleanParser, - default: false, + default: true, },If the intent is “default to false” (more secure), then the PR title/objectives +
DEPRECATIONS.mdneed to be updated accordingly.src/rest.js (1)
39-48: Security-sensitive behavior vs PR objective mismatch: this makes public explain opt-in by default.Line 40 hard-defaults
allowPublicExplaintofalse, and Lines 42-47 rejectexplainwithout master key unless explicitly enabled. That contradicts the PR objective/title (“defaults totrue”).If the intent is actually to default to
true, update:- const allowPublicExplain = config.databaseOptions?.allowPublicExplain ?? false; + const allowPublicExplain = config.databaseOptions?.allowPublicExplain ?? true;Otherwise (if the intent is to default to
false), please update the PR title/objectives andDEPRECATIONS.mdDEPPS12 row to match this behavior.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
DEPRECATIONS.md(1 hunks)spec/Deprecator.spec.js(2 hunks)spec/ParseQuery.spec.js(3 hunks)src/Deprecator/Deprecations.js(0 hunks)src/Options/Definitions.js(1 hunks)src/Options/index.js(1 hunks)src/rest.js(1 hunks)
💤 Files with no reviewable changes (1)
- src/Deprecator/Deprecations.js
🧰 Additional context used
🧠 Learnings (13)
📓 Common learnings
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-11-08T13:46:04.940Z
Learning: When reviewing Parse Server PRs that add new features, always check whether the feature is documented in the README.md file, though for new Parse Server options this is optional rather than required.
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-11-17T15:02:48.786Z
Learning: For Parse Server PRs, always suggest an Angular commit convention PR title that would make a meaningful changelog entry for developers. Update the PR title suggestion on every commit. The format should be: type(scope): description. Common types include feat, fix, perf, refactor, docs, test, chore. The scope should identify the subsystem (e.g., graphql, rest, push, security). The description should be action-oriented and clearly convey the change's impact to developers.
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-11-17T15:02:24.824Z
Learning: For Parse Server PRs, always suggest an Angular-style PR title that would make a meaningful changelog entry for developers. Update the PR title suggestion with every new commit to the PR.
📚 Learning: 2025-11-08T13:46:04.940Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-11-08T13:46:04.940Z
Learning: For new Parse Server options, verify that the option is documented in src/Options/index.js and that npm run definitions has been executed to reflect changes in src/Options/docs.js and src/Options/Definitions.js. README.md documentation is a bonus but not required for new options.
Applied to files:
src/Options/Definitions.jssrc/rest.jsspec/Deprecator.spec.jssrc/Options/index.js
📚 Learning: 2025-12-02T06:55:53.808Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T06:55:53.808Z
Learning: When reviewing Parse Server PRs that add or modify Parse Server options, always verify that changes are properly reflected in three files: src/Options/index.js (where changes originate), src/Options/Definitions.js, and src/Options/docs.js. The correct workflow is: make changes in index.js first, then run `npm run definitions` to automatically replicate the changes to Definitions.js and docs.js.
Applied to files:
src/Options/Definitions.jsspec/Deprecator.spec.jssrc/Options/index.js
📚 Learning: 2025-09-21T15:43:32.265Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 9858
File: src/GraphQL/ParseGraphQLServer.js:176-178
Timestamp: 2025-09-21T15:43:32.265Z
Learning: The GraphQL playground feature in ParseGraphQLServer.js (applyPlayground method) is intended for development environments only, which is why it includes the master key in client-side headers.
Applied to files:
src/Options/Definitions.jsspec/ParseQuery.spec.js
📚 Learning: 2025-05-04T20:41:05.147Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 9445
File: spec/ParseLiveQuery.spec.js:1312-1338
Timestamp: 2025-05-04T20:41:05.147Z
Learning: New tests in the parse-server repository should use async/await with promise-based patterns rather than callback patterns with `done()`.
Applied to files:
spec/Deprecator.spec.jsspec/ParseQuery.spec.js
📚 Learning: 2025-08-27T09:08:34.252Z
Learnt from: EmpiDev
Repo: parse-community/parse-server PR: 9770
File: src/triggers.js:446-454
Timestamp: 2025-08-27T09:08:34.252Z
Learning: When analyzing function signature changes in Parse Server codebase, verify that call sites are actually incorrect before flagging them. Passing tests are a strong indicator that function calls are already properly aligned with new signatures.
Applied to files:
spec/Deprecator.spec.js
📚 Learning: 2025-10-16T19:27:05.311Z
Learnt from: Moumouls
Repo: parse-community/parse-server PR: 9883
File: spec/CloudCodeLogger.spec.js:410-412
Timestamp: 2025-10-16T19:27:05.311Z
Learning: In spec/CloudCodeLogger.spec.js, the test "should log cloud function triggers using the silent log level" (around lines 383-420) is known to be flaky and requires the extra `await new Promise(resolve => setTimeout(resolve, 100))` timeout after awaiting `afterSavePromise` for reliability, even though it may appear redundant.
Applied to files:
spec/Deprecator.spec.jsspec/ParseQuery.spec.js
📚 Learning: 2025-05-09T09:59:06.289Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 9445
File: spec/ParseLiveQuery.spec.js:1340-1375
Timestamp: 2025-05-09T09:59:06.289Z
Learning: Tests in the parse-server repository should use promise-based approaches rather than callback patterns with `done()`. Use a pattern where a Promise is created that resolves when the event occurs, then await that promise.
Applied to files:
spec/Deprecator.spec.jsspec/ParseQuery.spec.js
📚 Learning: 2025-04-30T19:31:35.344Z
Learnt from: RahulLanjewar93
Repo: parse-community/parse-server PR: 9744
File: spec/ParseLiveQuery.spec.js:0-0
Timestamp: 2025-04-30T19:31:35.344Z
Learning: In the Parse Server codebase, the functions in QueryTools.js are typically tested through end-to-end behavior tests rather than direct unit tests, even though the functions are exported from the module.
Applied to files:
spec/ParseQuery.spec.js
📚 Learning: 2025-05-09T09:59:06.289Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 9445
File: spec/ParseLiveQuery.spec.js:1340-1375
Timestamp: 2025-05-09T09:59:06.289Z
Learning: New tests in the parse-server repository should use async/await with promise-based patterns rather than callback patterns with `done()`. The preferred pattern is to create a Promise that resolves when an expected event occurs, then await that Promise.
Applied to files:
spec/ParseQuery.spec.js
📚 Learning: 2025-08-27T12:33:06.237Z
Learnt from: EmpiDev
Repo: parse-community/parse-server PR: 9770
File: src/triggers.js:467-477
Timestamp: 2025-08-27T12:33:06.237Z
Learning: In the Parse Server codebase, maybeRunAfterFindTrigger is called in production with Parse.Query objects constructed via withJSON(), so the plain object query handling bug only affects tests, not production code paths.
Applied to files:
spec/ParseQuery.spec.js
📚 Learning: 2025-12-02T08:00:20.138Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T08:00:20.138Z
Learning: For Parse Server 9 release (PR #9938 and related), the parse/push-adapter dependency must be upgraded to version >= 8.0.0, not 7.0.0. Version 8.x drops support for Node 18.
Applied to files:
DEPRECATIONS.md
📚 Learning: 2025-12-02T08:00:08.440Z
Learnt from: mtrezza
Repo: parse-community/parse-server PR: 0
File: :0-0
Timestamp: 2025-12-02T08:00:08.440Z
Learning: For Parse Server 9 release preparation, the parse/push-adapter dependency should be upgraded to version >= 8.0.0, not 7.x, as version 8.x is required despite dropping Node 18 support (which aligns with Parse Server 9's removal of EOL Node versions).
Applied to files:
DEPRECATIONS.md
🧬 Code graph analysis (1)
spec/ParseQuery.spec.js (2)
spec/PushController.spec.js (1)
result(32-32)spec/Parse.Push.spec.js (1)
result(8-8)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (16)
- GitHub Check: Docker Build
- GitHub Check: Node 18
- GitHub Check: PostgreSQL 17, PostGIS 3.5
- GitHub Check: Redis Cache
- GitHub Check: Node 22
- GitHub Check: Node 20
- GitHub Check: MongoDB 7, ReplicaSet
- GitHub Check: PostgreSQL 15, PostGIS 3.4
- GitHub Check: PostgreSQL 16, PostGIS 3.5
- GitHub Check: MongoDB 6, ReplicaSet
- GitHub Check: PostgreSQL 15, PostGIS 3.3
- GitHub Check: MongoDB 8, ReplicaSet
- GitHub Check: PostgreSQL 18, PostGIS 3.6
- GitHub Check: Code Analysis (javascript)
- GitHub Check: PostgreSQL 15, PostGIS 3.5
- GitHub Check: Benchmarks
🔇 Additional comments (4)
spec/Deprecator.spec.js (1)
49-61: Good test isolation for nested dot-notation deprecation keys.Switching the test from
databaseOptions.allowPublicExplainto a dummydatabaseOptions.testOptionmakes the Deprecator unit test resilient to future behavior/security changes ofallowPublicExplain.Also applies to: 62-72
src/Options/Definitions.js (1)
1-5: Verified:src/Options/docs.jswas properly regenerated with consistent defaults.The
allowPublicExplainoption is consistently defined across all three files:
- src/Options/index.js (line 756-757):
:DEFAULT: false- src/Options/Definitions.js (line 1154):
default: false- src/Options/docs.js (line 261): Help text matches, confirming regeneration occurred
All files reflect the same default value and documentation, including the security warning with proper Unicode formatting.
spec/ParseQuery.spec.js (2)
5362-5375: LGTM! Master key correctly added for default explain behavior.The test now correctly passes
{ useMasterKey: true }when using explain, which aligns with the new default behavior whereallowPublicExplaindefaults tofalse.
5535-5565: LGTM! Test correctly validates new default behavior.The updated test properly validates that:
explain()fails without master key whenallowPublicExplainis undefined (default)explain()succeeds with master keyThe test description "explain requires master key by default" accurately reflects the breaking change.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #9975 +/- ##
=======================================
Coverage 92.53% 92.54%
=======================================
Files 190 190
Lines 15434 15434
Branches 176 176
=======================================
+ Hits 14282 14283 +1
+ Misses 1140 1139 -1
Partials 12 12 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
mtrezza
changed the title
allowPublicExplain defaults to trueallowPublicExplain defaults to false
24 tasks
Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>
parseplatformorg
pushed a commit
that referenced
this pull request
Dec 12, 2025
# [9.0.0-alpha.9](9.0.0-alpha.8...9.0.0-alpha.9) (2025-12-12) ### Features * Deprecation DEPPS12: Database option `allowPublicExplain` defaults to `false` ([#9975](#9975)) ([c1c7e69](c1c7e69)) ### BREAKING CHANGES * This release changes the MongoDB database option `allowPublicExplain` default to `false` (Deprecation DEPPS12). ([c1c7e69](c1c7e69))
Contributor
|
🎉 This change has been released in version 9.0.0-alpha.9 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.