Login with authData fails when public create CLP on _User is disabled #10724

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

Since Parse Server 9, logging in with authData fails with Permission denied when public create is disabled on the _User class.

Login with authData uses the same POST /users request as sign-up. The create permission check added in #10268 now runs for this request even when it logs in an existing user and creates nothing. This worked in 8.x, and the REST guide describes this request as returning the existing user with a session token.

Steps to reproduce

1. Log in with an auth provider to create a linked user, e.g. await Parse.User.logInWith('myoauth', { authData }).
2. Log out.
3. Disable public create on _User (classLevelPermissions.create: {}).
4. Log in again with the same authData.

Actual Outcome

The login fails with Permission denied (code 119).

Expected Outcome

The existing user is logged in and receives a session token, as in 8.x. Signing up a new user with authData should still be denied.

Environment

Server

• Parse Server version: 9.10.0, also reproduced on alpha (c3b46940)
• Operating system: Linux (Docker)
• Local or remote host: Google Cloud

Database

• System (MongoDB or Postgres): MongoDB
• Database version: 8.0.4 (test suite)
• Local or remote host: local (test suite)

Client

• SDK: JavaScript
• SDK version: 8.6.2

Logs

With enableSanitizedErrorResponse: false:

Permission denied for action create on class _User.
    at SchemaController.validatePermission
    at RestWrite.validateCreatePermission

I have a fix with tests and will open a pull request.