Parse LiveQuery updates only firing subscribed events on Public ACL

New Issue Checklist

• [x ] I am not disclosing a vulnerability.
• [x ] I am not just asking a question.
• [x ] I have searched through existing issues.
• [x ] I can reproduce the issue with the latest version of Parse Server.

Issue Description

LiveQuery Subscription is only working only when the subscribed object is public ACL.

Steps to reproduce

Front End user logs in and then subscribes to live query class updates.
update object content w/ public ACL, front end receives an update
update object content w/ only userId ACL, front end does not receive the update

Actual Outcome

I have subscribed to the class
the object in the class has ACL = userId. When the object is updated no update is sent to the front end.
the object in the class has ACL = Public Read and userID. When the object is updated, update IS sent to the front end.

Expected Outcome

Subscribed events to fire only when the ACL = userId, so that only the user can see the content/updates/etc.

Environment

Dashboard

Parse Dashboard version: 4.2.0
Browser (Safari, Chrome, Firefox, Edge, etc.): Chrome
Browser version: 106.0.5249.119 (arm64)

Server

Parse Server version: 5.2.8
Parse LiveQuery Server version: 5.2.8
Operating system: n/a
Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): AWS

Database

System (MongoDB or Postgres): MongoDB
Database version: 5.0.13
Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): AWS

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): JavaScript
• SDK version: 3.4.3

Logs

My code

Main Server:
Code/Set up:

var api = new ParseServer({
  appName: "App-Name",
  databaseURI: databaseUri,
  cloud: process.env.CLOUD_CODE_MAIN,
  appId: process.env.APP_ID,
  masterKey: process.env.MASTER_KEY,
  fileKey: process.env.FILE_KEY,
  serverURL: process.env.SERVER_URL,
  publicServerURL: process.env.SERVER_URL,
  clientKey: process.env.CLIENT_KEY,
  restAPIKey: process.env.RESTAPI_KEY,
  javascriptKey: process.env.JAVASCRIPT_KEY,
  liveQuery: {
    classNames: ["Room", "Messages"],
    redisURL: process.env.redisURL
  },
  maxUploadSize: "5mb",
  logLevel: "VERBOSE=1",
  verbose: true
});

var port = process.env.PORT || 1337;
var httpServer = require('http').createServer(app);
httpServer.listen(port, function() {
    console.log('[Parse Server] Running  on ' + port + '.');
});

LiveQuery Server:

Code/Setup:

var express = require('express');
var cors = require('cors')
var ParseServer = require('parse-server').ParseServer;

var app = express();
app.use(cors());

app.get('/', function(req, res) {
  res.status(200).send('Make sure to star the parse-server repo on GitHub!');
});

var port = process.env.PORT || 1338;
var httpServer = require('http').createServer(app);
httpServer.listen(port, function() {
    console.log('parse-server-example running on port ' + port + '.');
});

ParseServer.createLiveQueryServer(httpServer, {
  appId: process.env.APP_ID, //same as main server
  masterKey: process.env.MASTER_KEY, //same as main server
  serverURL: process.env.SERVER_URL, //same as main server
  javascriptKey: process.env.JAVASCRIPT_KEY, //same as main server
  redisURL: process.env.redisURL, //same as main server
  websocketTimeout: 10 * 1000,
  cacheTimeout: 60 * 600 * 1000,
  logLevel: "VERBOSE",
  verbose: true
});

Redis Security Group

Name | Security group rule ID | IP version | Type | Protocol | Port range | Source
  | – | sgr-1| IPv6 | Custom TCP | TCP | 80 - 8080 | ::/0
  | – | sgr-2| IPv4 | Custom TCP | TCP | 80 - 8080 | 0.0.0.0/0
-- | --

Front End
Version: parse@3.4.3

Code/Setup:

//Set up Parse
Parse.initialize("app-name", "js-key");
Parse.serverURL = 'https://parse-server.mydomain.com/parse'

//Live Query Setup
Parse.liveQueryServerURL = 'wss://live-query.mydomain.com/'


const MyClass = Parse.Object.extend("Messages");
const messageQuery = new Parse.Query(MyClass);

	messageQuery.subscribe().then(subscription=>{
               
		subscription.on('open', e => {
                        //Connection works. I see a clientId and installationId
                         console.log("connected :: ", e)
                });

		subscription.on('create', (object) => {
                  // Only works if ACL contains Public read. I need this to work for only userId for privacy
		  console.log('object', object);
		});

		subscription.on('update', (object) => {
                  // Only works if ACL contains Public read. I need this to work for only userId for privacy
		  console.log('object updated', object);
		});
	})

I can't imagine this being an issue with nginx. but including the file I am using for the Parse Server & Live Query Server for completeness. Its taken straight from This Helpful Guide

###################################################################################################
#### Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
####
#### Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file
#### except in compliance with the License. A copy of the License is located at
####
####     http://aws.amazon.com/apache2.0/
####
#### or in the "license" file accompanying this file. This file is distributed on an "AS IS"
#### BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#### License for the specific language governing permissions and limitations under the License.
###################################################################################################

###################################################################################################
#### To enable WebSockets on the Node.js platform, this configuration file
#### configures the Nginx proxy server.
#### It replaces the Nginx configuration file with a version that includes the
#### "Upgrade" and "Connection" headers: https://www.nginx.com/blog/websocket-nginx/
####
#### This Elastic Beanstalk configuration file replaces the entire Nginx configuration file.
#### As a result, you won't get our managed updates to the Nginx configuration file, if we make
#### updates in future platform updates. Be sure to test this configuration with new platform versions.
####
#### This configuration file works with single-instance and load-balanced environments.
####
#### If you're using a Classic Load Balancer, you need to enable TCP listeners. See:
#### http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.elb.html

#### This file from: https://github.com/awsdocs/elastic-beanstalk-samples/blob/master/configuration-files/aws-provided/instance-configuration/websockets/nodejs/websockets-nodejs.config
###################################################################################################

files:
   /etc/nginx/conf.d/proxy.conf:
     owner: root
     group: root
     mode: "000644"
     content: |
       # Elastic Beanstalk Managed

       # Elastic Beanstalk managed configuration file
       # Some configuration of nginx can be by placing files in /etc/nginx/conf.d
       # using Configuration Files.
       # http://docs.amazonwebservices.com/elasticbeanstalk/latest/dg/customize-containers.html

       client_max_body_size 5M;

       upstream nodejs {
           server 127.0.0.1:8081;
           keepalive 256;
       }

       server {
           listen 8080;

           if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {
               set $year $1;
               set $month $2;
               set $day $3;
               set $hour $4;
           }
           access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;
           access_log  /var/log/nginx/access.log  main;

           location / {
               proxy_pass  http://nodejs;
               proxy_http_version 1.1;
               proxy_set_header        Upgrade $http_upgrade;
               proxy_set_header        Connection "upgrade";
               proxy_set_header        Host            $host;
               proxy_set_header        X-Real-IP       $remote_addr;
               proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
           }

       gzip on;
       gzip_comp_level 4;
       gzip_types text/html text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

       }

   /opt/elasticbeanstalk/hooks/configdeploy/post/99_kill_default_nginx.sh:
     owner: root
     group: root
     mode: "000755"
     content: |
       #!/bin/bash -xe
       rm -f /etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf
       initctl nginx stop
       initctl nginx start

container_commands:
  removeconfig:
    command: "rm -f /tmp/deployment/config/#etc#nginx#conf.d#00_elastic_beanstalk_proxy.conf /etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf"

Start at ParseServer.createLiveQueryServer and the messageQuery.subscribe flow, then reproduce the difference between public and user-only ACL updates. Done means authorized clients receive updates for objects readable through their userId ACL, while unauthorized clients do not and public ACL behavior remains intact.