parse-server: useMasterKey in cloudCode not working as expected

We had some Cloud Code like this in Parse:


Parse.Cloud.define('deleteUser', function (request, response) {`
    var User = Parse.Object.extend('_User');
    var query = new Parse.Query(User);

    query.get(request.params.user).then(function (result) {
        result.destroy();
    }).then(function (results) {
        response.success('User deleted');
    }, function (error) {
        response.error(error);
    })
});

It worked fine in Cloud Code however, it seems to be broken in parse-server, on debugging it looks like Parse.Cloud.useMasterKey(); is not being applied to the options of all ParseObject calls. This is required because the ACL prevents anyone creating additional items in the table.

About this issue

Original URL
State: closed
Created 8 years ago
Comments: 25 (9 by maintainers)

Most upvoted comments

Much like how Parse.User.current() is invalid in a node script, because of the global nature, so is Parse.Cloud.useMasterKey(), because it is global and it would cause other requests to use the master key even if it was not intended.

The correct approach is to always pass a useMasterKey: true option to saves and queries which need to use the master key. We are going to document this as soon as possible, but I wanted to get this out to you and be able to close some issues.

In a save call, the options block is the second param:

obj.save(null, { useMasterKey: true });

In a query, it’s the first.

q.get({ useMasterKey: true }).then(.......)
q.find({ useMasterKey: true}).then(......)

Please update your code to follow this and open a new issue if you have problems. Thank you!

+16

gfosco on Feb 6, 2016

@gfosco you should move this info to the guide imho.

some people like myself with not a lot of node js experience will find it helpful

sivi29y on May 11, 2016

see: http://docs.parseplatform.org/parse-server/guide/#cloud-code

flovilmart on Apr 20, 2017

@gfosco What should be the syntax for setting useMasterKey: true in:

var query = new Parse.Query(Parse.Installation); query.containedIn("user", userList);

because for push notifications, we don’t call find or fetch

khanamir on Jun 14, 2016

@flovilmart thanks for the updated link, but can you answer my question above about the proper use of useMasterKey:true within my example?

EDIT: Fixed with the following code

  query.find({
        success: function(posts) {
            Parse.Object.destroyAll(posts, {useMasterKey: true});
        }
    });

ZacharyKhan on Apr 21, 2017