fix: LiveQuery role cache is not invalidated for all users affected by a role write or delete

[AdrianCurtin]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #10628.

LiveQueryController.clearCachedRoles(user) invalidated the LiveQuery server's cached auth for one user, the actor on the request, and only when there was one. Two cases were never invalidated:

• No user on the request. The method returned early when user was falsy, so a master key role write or delete published nothing at all. Managing roles with the master key, from admin tooling or cloud code, is the common case.
• Users other than the actor. The publisher sent a single { userId } and ParseLiveQueryServer#_clearCachedRoles resolved _Session rows for that one user. A role write changes the effective closure of every member of the role and of any role inheriting from it. Adding a member is the clearest example: the actor is the admin doing the write, the affected user is the member being added, and only the actor was invalidated.

Until its authCache entry expired on cacheTimeout, a subscriber kept receiving events decided from a stale role closure.

Approach

clearCache messages now carry clearAll: true, and a LiveQuery server receiving one drops its whole authCache rather than one user's sessions. Entries are repopulated lazily by getAuthForSessionToken, so the cost is a re-resolution per active session after a role write, and role writes are rare relative to events.

Three details worth reviewer attention:

• userId is still published when it is known. A LiveQuery server on an older version ignores clearAll and reads userId, so it keeps doing exactly what it does today rather than silently doing nothing. Mixed-version deployments degrade to current behavior instead of breaking.
• _clearCachedRoles(userId) is kept for the reverse direction, an older Parse Server publishing { userId } to a LiveQuery server on this version.
• A standalone LiveQuery server clears its own role cache. It runs in its own process with its own cache controller, which the publishing Parse Server's cacheController.role.clear() never touched. Failures there are caught and logged rather than propagated, matching _clearCachedRoles.

The whole cache is cleared rather than a computed set of affected sessions because the affected set cannot be reconstructed for a delete: by the time the message is published, the _Role row and its _Join rows are gone. Snapshotting members before the destroy would put the cost on every delete and still miss transitive members.

Tests

spec/ParseLiveQueryServer.spec.js gains a role cache invalidation block:

• A role change with no acting user publishes clearAll, which is the master key case that previously published nothing.
• A role change with an acting user still publishes userId alongside clearAll, pinning the back compat contract.
• A clearAll message routes to the full clear, and a message without it routes to the targeted clear.
• A full clear empties authCache and clears the role cache.
• A full clear resolves rather than rejecting when the role cache is unavailable.

spec/ParseLiveQueryServer.spec.js, spec/ParseLiveQuery.spec.js, spec/ParseRole.spec.js, spec/Auth.spec.js and spec/rest.spec.js all pass against MongoDB 8.

Tasks

• Add tests
• Add changes to documentation (code comments)

Summary by CodeRabbit

• Bug Fixes
  • Improved LiveQuery authorization cache invalidation when roles change.
  • Changes made without an acting user now correctly invalidate cached authorization data.
  • Added safeguards to keep cache cleanup resilient when clearing operations fail.
  • Existing targeted role-cache invalidation behavior remains supported.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 10cc65f9-e5fd-461e-aa84-ce342a48de4b

📥 Commits

Reviewing files that changed from the base of the PR and between 315e157 and 23c8c89.

📒 Files selected for processing (4)

• spec/ParseLiveQueryServer.spec.js
• src/Controllers/LiveQueryController.js
• src/LiveQuery/ParseCloudCodePublisher.js
• src/LiveQuery/ParseLiveQueryServer.ts

---

📝 Walkthrough

Walkthrough

LiveQuery role changes now publish invalidation messages without requiring an acting user. Messages can request full authorization and role-cache clearing, while legacy messages retain targeted invalidation. Tests cover both paths and cache-clear failures.

Changes

LiveQuery role-cache invalidation

Layer / File(s)	Summary
Publish global invalidation messages src/Controllers/LiveQueryController.js, src/LiveQuery/ParseCloudCodePublisher.js	Role changes publish invalidation messages with clearAll: true. The optional user ID remains available for compatibility.
Process and validate cache clearing src/LiveQuery/ParseLiveQueryServer.ts, spec/ParseLiveQueryServer.spec.js	The server clears all authentication and role caches for global messages. Legacy messages clear roles for a specified user. Tests cover userless publication, both invalidation paths, and rejected role-cache clearing.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Mergeability Score: ⚪ Minimal · up to 23c8c

This change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant LiveQueryController
  participant ParseCloudCodePublisher
  participant ParseLiveQueryServer
  participant CacheController
  LiveQueryController->>ParseCloudCodePublisher: publish role-cache invalidation
  ParseCloudCodePublisher->>ParseLiveQueryServer: send clearAll and optional userId
  ParseLiveQueryServer->>CacheController: clear authentication and role caches
  CacheController-->>ParseLiveQueryServer: complete or reject role-cache clearing

Loading

Possibly related issues

• LiveQuery role cache is not invalidated for all users affected by a role write or delete #10628 — Addresses publication and full clearing of LiveQuery authorization caches for role changes without an acting user.

Possibly related PRs

• parse-community/parse-server#10618 — Introduces scoped cache-clearing behavior used by this full invalidation flow.
• parse-community/parse-server#10620 — Also modifies _Role change handling and LiveQuery role-cache invalidation.

Suggested reviewers: mtrezza

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	Placeholder
Engage In Review Feedback	✅ Passed	The PR shows “No reviews”; its only comments are generic guidance and CodeRabbit’s “Currently processing” notice, so no review feedback was available to ignore or resolve.
Title check	✅ Passed	The title begins with the required fix: prefix and clearly describes the LiveQuery role-cache invalidation change.
Description check	✅ Passed	The description includes the required issue, approach, tasks, and test details, with completed tasks clearly marked.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}