Using Primary Key

[jaysonng]

So calling functions inside of the .post function of Vapor doesn't have the check for ParseUser who called the request right? So basically calling a query will need .usePrimaryKey option.

Is there a way to pass the calling user so that queries made still checks if the user is authorized to make queries?

thanks,

[cbaker6]

The examples show how to do this. You need to always pass the options to your functions

parse-server-swift/Sources/ParseServerSwift/routes.swift

Lines 25 to 36 in be2c6dd

	var parseRequest = try req.content
	.decode(ParseHookFunctionRequest<User, FooParameters>.self)
	// If a User made the request, fetch the complete user.
	if parseRequest.user != nil {
	parseRequest = try await parseRequest.hydrateUser(request: req)
	}
	// To query using the User's credentials who called this function,
	// use the options() method from the parseRequest
	let options = try parseRequest.options(req)
	let scores = try await GameScore.query.findAll(options: options)

[jaysonng]

hmm. thanks! I missed that.

[jaysonng]

I still have to use .usePrimaryKey with parseRequest.hydrateUser() to get my queries to work. I still keep getting unauthorized user as an error without it.

 if parseRequest.user != nil {
            parseRequest = try await parseRequest.hydrateUser(options: [.usePrimaryKey], request: req)
        }

Do you have any idea what I should look into to check and see why I'm unauthorized when all I'm doing is a basic findall Query on GameScore which has no CLP aside from the basic Public and default data it has?

[cbaker6]

I believe you are having two separate issues. “hydrateUser” is only related to your _User table. Parse has certain CLP, ACL, and settings there by default to prevent developers from creating insecure apps. hydrateUser() is a fetch under the hood using the sessionToken of the user who made the call: https://github.com/netreconlab/Parse-Swift/blob/5f2c5f4404ddc8cbb27dc95897ecdcc7f528ec1e/Sources/ParseSwift/Protocols/ParseHookRequestable.swift#L75-L97

So if you are unauthorized, you are either:

1. Making the call from a user on the client side who isn’t logged in, so they don’t have a sessionToken and therefore cannot fetch themselves from the server
2. Making the call from a user on the client side who has an expired sessionToken
3. Modified your CLP and/or ACL on to be too restrictive, preventing the logged in user from fetching themselves

Since you are saying fetchAll doesn’t work with GameScore as well, I suspect your problem is number 1 above as you probably never had a sessionToken. You can verify this by logging to your console parseRequest, if the sessionToken is empty you are making calls from a user who isn’t logged in. IMO most cases you should only be using Cloud Code functions for logged in users and rarely using the primaryKey, but that’s up to your discretion as a developer

Your GameSecure CLP is also very insecure and I don’t recommend it. You should be restricting at least write and add field access to “Authorized” users only. You probably have a setting on your server that’s protecting your table even though your CLP is unrestrictive, possibly even an ACL

[cbaker6]

You should also verify the cloud code I linked about with the default parse server image I supply. If you are using your own server, you need to check your settings. The settings for the server I supply is here:

parse-server-swift/docker-compose.yml

Lines 19 to 40 in be2c6dd

	PARSE_SERVER_APPLICATION_ID: ${PARSE_SERVER_APPLICATION_ID}
	PARSE_SERVER_PRIMARY_KEY: ${PARSE_SERVER_PRIMARY_KEY}
	PARSE_SERVER_READ_ONLY_PRIMARY_KEY: 367F7395-2E3A-46B1-ABA3-963A25D533C3
	PARSE_SERVER_WEBHOOK_KEY: ${PARSE_SERVER_WEBHOOK_KEY}
	PARSE_SERVER_ENCRYPTION_KEY: 72F8F23D-FDDB-4792-94AE-72897F0688F9
	PARSE_SERVER_TRUST_PROXY: 'true'
	PARSE_SERVER_OBJECT_ID_SIZE: 32
	PARSE_SERVER_DATABASE_URI: postgres://${PG_PARSE_USER}:${PG_PARSE_PASSWORD}@db:${DB_PORT}/${PG_PARSE_DB}
	PORT: ${PORT}
	PARSE_SERVER_MOUNT_PATH: ${MOUNT_PATH}
	PARSE_SERVER_CLOUD: /parse-server/cloud/main.js
	PARSE_SERVER_MOUNT_GRAPHQL: 'false'
	PARSE_SERVER_ALLOW_CLIENT_CLASS_CREATION: 'true' # Don't allow classes to be created on the client side. You can create classes by using ParseDashboard instead
	PARSE_SERVER_ALLOW_CUSTOM_OBJECTID: 'true' # Required to be true for ParseCareKit
	PARSE_SERVER_ENABLE_SCHEMA_HOOKS: 'true' # When this is true, only need one server for PARSE_SERVER_SWIFT_URLS
	PARSE_SERVER_DIRECT_ACCESS: 'false' # WARNING: Setting to 'true' is known to cause crashes on parse-hipaa running postgres
	PARSE_SERVER_ENABLE_PRIVATE_USERS: 'true'
	PARSE_SERVER_USING_PARSECAREKIT: 'false' # If you are not using ParseCareKit, set this to 'false'
	PARSE_SERVER_RATE_LIMIT: 'true'
	PARSE_SERVER_RATE_LIMIT_REQUEST_COUNT: '100'
	PARSE_SERVER_RATE_LIMIT_INCLUDE_PRIMARY_KEY: 'false'
	PARSE_SERVER_RATE_LIMIT_INCLUDE_INTERNAL_REQUESTS: 'false'

and determined by https://github.com/netreconlab/parse-server-swift/blob/main/parse/index.js

if the server works with the playground code https://github.com/netreconlab/Parse-Swift/blob/main/ParseSwift.playground/Pages/10%20-%20Cloud%20Code.xcplaygroundpage/Contents.swift, then ParseServerSwift is working correctly and something is wrong with your setup.

[jaysonng]

Your GameSecure CLP is also very insecure and I don’t recommend it. You should be restricting at least write and add field access to “Authorized” users only. You probably have a setting on your server that’s protecting your table even though your CLP is unrestrictive, possibly even an ACL

yes, this was for testing purposes only. I have ACL and CLP all over my Classes.

Making the call from a user on the client side who isn’t logged in, so they don’t have a sessionToken and therefore cannot fetch themselves from the server

I tried erasing all my entries in the _SESSION class and tried testing again, this time around, the error I received was "invalid session token". So this confirms I was logged in properly before. I re-logged in to test further.

You can verify this by logging to your console parseRequest, if the sessionToken is empty you are making calls from a user who isn’t logged in.

Checked and verified that sessionToken exists and matches with the current one via ParseDashboard.

as of now, I've boiled it down to somewhere inside .hydrateUser() -- maybe user.fetch() that's giving me the unauthorized error.

I'll have to continue tomorrow.

[jaysonng]

if the server works with the playground code https://github.com/netreconlab/Parse-Swift/blob/main/ParseSwift.playground/Pages/10%20-%20Cloud%20Code.xcplaygroundpage/Contents.swift, then ParseServerSwift is working correctly and something is wrong with your setup.

I'll look into my setup again if I missed any of these, which probably is the problem. My ParseServer setup is super basic and taken from the ReadMe files. I'll go through config soon.

thanks!