Can not set ACL in cloud code for new User #701

Activity

1. Kira2 commented on Feb 27, 2016

   

   Kira2

   on Feb 27, 2016

   Contributor

   More actions

   Hi,

   You are right, you have to use afterSave to set the permission of the user. But I think the problem is that you try to use req.user instead of req.object. Indeed, when you use afterSave on Parse.User class, your user is stored into req.object.

   Try this, it might work:

   Parse.Cloud.afterSave(Parse.User, function(req) {
   
     if (!req.object.existed()) {
       var user = req.object;
       var acl = new Parse.ACL(user);
       user.setACL(acl);
       user.save();
     }
   });

   Hope it helps.
2. stalehard commented on Mar 1, 2016

   

   stalehard

   on Mar 1, 2016

   More actions

   Hi,
   I have similar problem with ACL in self-hosted Parse-server:
   After save new Parse.User object I set ACL for this user:

   1 variant

   newUser.signUp(null, { useMasterKey: true })
       .then(
           (user) => {
               let acl = new Parse.ACL(user);                      
               user.setACL(acl);
               user.save();
           },
           (error) => {
   
           }
       );

   2 variant

   newUser.signUp(null, { useMasterKey: true })
       .then(
           (user) => {
               let acl = new Parse.ACL();
               acl.setReadAccess(user.id, true);
               acl.setWriteAccess(user.id, true);
               acl.setPublicReadAccess(false);
               user.setACL(acl);
               user.save();
           },
           (error) => {
   
           }
       );

   But in both case in mongoDB i see for this record:
   "_id" : "mwlCdr4GtU", "_rperm" : [ "mwlCdr4GtU", "*" ], "_wperm" : [ "mwlCdr4GtU" ]

   Why in read permission "*"?
3. flovilmart commented on Mar 12, 2016

   

   flovilmart

   on Mar 12, 2016

   Contributor

   More actions

   @stalehard do you still have the issue? (we just released 2.1.6). Also, can you get the result of user.save(), wether it succeeds or fails? Thanks!
4. jsoendermann commented on Mar 13, 2016

   

   jsoendermann

   on Mar 13, 2016

   More actions

   I have the same problem, my new (anonymous) users are created with an ACL that enables public reads.

   I'm using version 2.1.6 and have this function in my cloud code:

   Parse.Cloud.afterSave(Parse.User, function(req) {
     console.log('[afterSave called]: ' + JSON.stringify(req.object));
     if (!req.object.existed()) {
       var user = req.object;
       var acl = new Parse.ACL(user);
       user.setACL(acl);
       user.save(null, {useMasterKey: true}).then(function (s) {
         console.log('[afterSave succeeded]: ' + JSON.stringify(s));
       }, function(e) {
         console.log('[afterSave failed]: '+ JSON.stringify(e));
       })
     }
   });

   which produces the following log when I call saveInBackgroundWithBlock on an anonymous user with the iOS SDK (slightly formatted for readability:

   [afterSave called]: {
      "authData": {"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
      "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
      "ACL":{"eFlLthZdrT":{"read":true,"write":true},"*":{"read":true,"write":false}},
      "createdAt":"2016-03-14T09:00:33.208Z",
      "sessionToken":"r:b93374f192fc1686bf4a1ee908a616b2",
      "updatedAt":"2016-03-14T09:00:33.208Z",
      "objectId":"eFlLthZdrT"}
   
   [afterSave called]: {
      "ACL":{"eFlLthZdrT":{"read":true,"write":true}},
      "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
      "updatedAt":"2016-03-14T09:00:34.392Z",
      "createdAt":"2016-03-14T09:00:33.208Z",
      "authData":{"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
      "objectId":"eFlLthZdrT"}
   
   [afterSave succeeded]: {
      "authData":{"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
      "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
      "ACL":{"eFlLthZdrT":{"read":true,"write":true}},
      "createdAt":"2016-03-14T09:00:33.208Z",
      "sessionToken":"r:b93374f192fc1686bf4a1ee908a616b2",
      "updatedAt":"2016-03-14T09:00:34.392Z",
      "objectId":"eFlLthZdrT"}
   

   This looks correct but when I check on the dashboard, the user object still has public read enabled in its ACL.
5. drew-gross

   added 2 commits that reference this issue on Mar 30, 2016

   Add a test to repro parse-community#701

   6afb9d5

   Add a test to repro parse-community#701

   a0e7739
6. drew-gross commented on Mar 30, 2016

   

   drew-gross

   on Mar 30, 2016

   Contributor

   More actions

   @jsoendermann I've attempted to reproduce this issue in #1281, but I wasn't able to reproduce. Can you look at that PR and tell me if you are doing anything differently from how that test works? If not, try updating your server version, your dashboard version, and refreshing the dashboard page. If you still have problems, please open a new issue with the repro steps.
7. drew-gross

   closed this as completedon Mar 30, 2016
8. flovilmart

   added a commit that references this issue on Mar 30, 2016

   Merge pull request #1281 from drew-gross/test-701

   ...

   33c9730
9. haroot commented on Aug 14, 2018

   

   haroot

   on Aug 14, 2018

   Last edited by haroot

   More actions

   Here is what worked for me for the latest parse. Apparently, by default User rows are open to Public Read...

   async function CreateParseUser(username, password, email, phone, isPro) {
   var user = new Parse.User();
   user.set("username", username);
   user.set("password", password);
   user.set("email", email)
   user.set("phone", phone);
   user.set("isPro", isPro);
   await user.signUp(null, {
   success: function(user) {
   // Hooray! Let them use the app now.
   console.log("User created! ", user.id, user);
   let acl = new Parse.ACL();
   acl.setReadAccess(user.id, true);
   acl.setWriteAccess(user.id, true);
   acl.setPublicReadAccess(false);
   user.setACL(acl);
   user.save(null, {useMasterKey: true});
   },
   error: function(user, error) {
   // Show the error message somewhere and let the user try again.
   console.log("Error: " + error.code + " " + error.message);
   }
   });
   }