src/rest.js
// Disallowing access to the _Role collection except by master key
Disallowing access to the _Role collection except by master key
Disallowing access to the _Role collection except by master key
function enforceRoleSecurity(method, className, auth) {
  if (className === '_Installation' && !auth.isMaster) {
    if (method === 'delete' || method === 'find' || method === 'get') {
      let error = `Clients aren't allowed to perform the ${method} operation on the installation collection.`
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
    }
  }
  if (className === '_User' && !auth.isMaster) {
    if (method === 'find' || method === 'get') {
      let error = `Clients aren't allowed to perform the ${method} operation on the user collection.`
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
    }
  }
  if (className === 'match' && !auth.isMaster) {
    if (method === 'create' || method === 'delete') {
      let error = `Clients aren't allowed to perform the ${method} operation on the match collection.`
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
    }
  }
  if (className === 'swipe' && !auth.isMaster) {
    if (method === 'delete' || method === 'find' || method === 'get' || method === 'update') {
      let error = `Clients aren't allowed to perform the ${method} operation on the swipe collection.`
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
    }
  }
  if (className === 'banned' && !auth.isMaster) {
    let error = `Clients aren't allowed to perform the ${method} operation on the banned collection.`
    throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
  }
  if (className === 'report' && !auth.isMaster) {
    if (method !== 'create') {
      let error = `Clients aren't allowed to perform the ${method} operation on the swipe collection.`
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
    }
  }
  const volatileClasses = ['_JobStatus', '_PushStatus', '_Hooks', '_GlobalConfig'];
  if(volatileClasses.includes(className) && !auth.isMaster){
    const error = `Clients aren't allowed to perform the ${method} operation on the ${className} collection.`
    throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
  }
}
function enforceRoleSecurity ( method , className , auth ) { if ( className === '_Installation' && ! auth . isMaster ) { if ( method === 'delete' || method === 'find' || method === 'get' ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } } if ( className === '_User' && ! auth . isMaster ) { if ( method === 'find' || method === 'get' ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } } if ( className === 'match' && ! auth . isMaster ) { if ( method === 'create' || method === 'delete' ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } } if ( className === 'swipe' && ! auth . isMaster ) { if ( method === 'delete' || method === 'find' || method === 'get' || method === 'update' ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } } if ( className === 'banned' && ! auth . isMaster ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } if ( className === 'report' && ! auth . isMaster ) { if ( method !== 'create' ) { let error = ` ${ method } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } } const volatileClasses = [ '_JobStatus' , '_PushStatus' , '_Hooks' , '_GlobalConfig' ] ; if ( volatileClasses . includes ( className ) && ! auth . isMaster ) { const error = ` ${ method } ${ className } ` throw new Parse . Error ( Parse . Error . OPERATION_FORBIDDEN , error ) ; } }
Disallowing access to the _Role collection except by master key
Disallowing access to the _Role collection except by master key
//all volatileClasses are masterKey only