CLP assertion fails when class is included in a query

[tzabian]

Describe your issue in as much detail as possible.

_User class has public read/write CLP; UserProfile class has read/write CLP

As a user, when running a GET on a _User object which contains a pointer to a UserProfile object, the result returns a non-existent value for UserProfile.

When running the same using MasterKey, result comes back as expected. When changing CLPs on UserProfile to public read/write, things work as expected.

This scenario works in our current implementation on Parse.com.

Steps to reproduce

Please include a detailed list of steps that reproduce the issue. Include curl commands when applicable.

1. Create a UserProfile class that has a field which is a pointer to _User
2. Add a CLP on this class with only read/write permissions (no Public permissions)
3. Create a pointer field in _User called which which points to UserProfile (hence creating a two-way relationship)
4. Create an object in both _User and UserProfile which point to each other via the and fields respectively.
5. Query the _User object as the user themself and include=userProfile

Expected Results

You would expect something like the following

{
    "createdAt": "2015-10-05T07:55:55.124Z",
    "email": "xxx@yyy.com",
    "name": "Users Name ",
    "objectId": "ungxXVTqP4",
    "sessionToken": "r:xxxxxxxxxxxx",
    "updatedAt": "2015-10-05T07:55:56.791Z",
    "userProfile": {
        "__type": "Object",
        "className": "UserProfile",
        "createdAt": "2015-10-05T07:55:55.679Z",
        "objectId": "DbGP97sT7j",
        "updatedAt": "2015-10-05T07:55:55.679Z",
        "user": {
            "__type": "Pointer",
            "className": "_User",
            "objectId": "ungxXVTqP4"
        }
    },
    "username": "user@name.com"
}

Actual Outcome

{
    "createdAt": "2015-10-05T07:55:55.124Z",
    "email": "xxx@yyy.com",
    "name": "Users Name ",
    "objectId": "ungxXVTqP4",
    "sessionToken": "r:xxxxxxxxxxxx",
    "updatedAt": "2015-10-05T07:55:56.791Z",
    "username": "user@name.com"
}

Environment Setup

• Server
  • parse-server version: 2.2.15
  • Operating System: Mac OSX 10.11.5 (local NodeJS)
  • Hardware: MacBook Pro (Retina, 13-inch, Late 2013)
  • Localhost or remote server? Localhost
• Database
  • MongoDB version: 3.2.1
  • Storage engine: wiredTiger
  • Hardware: Local - same as above
  • Localhost or remote server? Local

Logs/Trace

You can turn on additional logging by configuring VERBOSE=1 in your environment.

The trace is the Actual Outcome section above with some obfuscation.

[flovilmart]

@tzabian thanks for reporting that issue! Would you be able to work on a fix yourself? The issue seems pretty well characterized, and even if the fix may not be trivial, I'm pretty sure you can get through it!

[tzabian]

Has anyone had time to address this? @flovilmart I'd love to step in and look into this but still busy working around other bugs in order to get our env live. This migration has taken much longer than we anticipated 😨

[flovilmart]

I haven't had the time to look at. But I'll try before Tuesday

[flovilmart]

Managed to write a repro test, and isolated the root cause. Bad interpolation to an ACL based query of the pointer perm when it's specified as a user pointer field. Working on a fix

[tzabian]

Awesome! After I wrote my last comment, began looking into it and found the same. I had used

_this3.findOptions.acl = Array.from(new Set(roles))

Thanks for doing this 👍

[flovilmart]

I could also use a Set, seems smart :) I'll update the PR

[flovilmart]

Thanks for the tip!