Session Lookup should use indexes

[dblythy]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

There are no indexes created the _Session class. This means that the default index of _id is used when session tokens are looked up

Steps to reproduce

Create a new user.

Actual Outcome

No indexes are created. An index on _session_token could increase the performance of session lookups

Expected Outcome

Parse Server should use hint / indexes when looking up session tokens

Environment

Server

• Parse Server version: 5.3.0
• Operating system: macos
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): localhost

Database

• System (MongoDB or Postgres): mongo
• Database version: 5.0
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): atlas

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): js
• SDK version: 3.5.0

Logs

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[dblythy]

parse-server/src/Auth.js

Lines 80 to 97 in 81304be

	let results;
	if (config) {
	const restOptions = {
	limit: 1,
	include: 'user',
	};
	const query = new RestQuery(config, master(config), '_Session', { sessionToken }, restOptions);
	results = (await query.execute()).results;
	} else {
	results = (
	await new Parse.Query(Parse.Session)
	.limit(1)
	.include('user')
	.equalTo('sessionToken', sessionToken)
	.find({ useMasterKey: true })
	).map(obj => obj.toJSON());
	}

[mtrezza]

It would be surprising if there was no index on the session token. I looked into the server code and also couldn't find any index creation for _session_token.

[aclec]

I was looking for this too.
I think the best way is to create the _Session collection at the same time that the others (_User, _Role).
I you think it's the good way, i can make a PR.

[mtrezza]

That sounds good