Restrict access scope of master key #8218

New Feature / Enhancement Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

The masterKey currently allows to manipulate some Parse Server internal fields. At the same time, the masterKey is intended to be used for normal operations, such as for Parse Dashboard to connect to Parse Server or special Remote Config parameters. The scope of masterKey is unclear because it's not defined anywhere.

Allowing the masterKey to modify internal fields, while distributing it for normal operation is a bad combination. It raises the risk associated with a compromised masterKey, because it significantly increases the integrity impact of the vulnerability's CVSS score.

Feature / Enhancement Description

Define scopes, implement them and add them to docs. This will be a breaking change.

We can assume that there is a difference in scope between:

• accessing all data within the official features and constrains of Parse Server (intended to be used for normal operation)
• manipulating Parse Server internal fields that are usually rather constraint-free (not intended to be used for normal operation)

Suggested scopes:

_{* doesn't exist yet as a feature}

Example Use Case

• give masterKey to a business client to access all data, configure dashboard apps and use Remove Config parameters that are restricted to master key --> this doesn't allow the user to mess up the internals of Parse Server
• give maintenanceKey to a DevOp to be able to manipulate internal Parse Server fields --> these internal fields are not supposed to be manipulated for normal operation, they may need to to be manipulated for one-time migration or data correction tasks

Alternatives / Workarounds

n/a

3rd Party References

n/a