parse-community / parse-community/parse-server
LiveQuery Redis does not match ACL users properly
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest version of Parse Server.
Issue Description
I am using parse-server@6.4.0, I am running two Parse instances, one configured as LiveQueryParseServer, the other as regular Parse Server. I use Redis to implement cross instance pubsub of the Live Queries.
I have successfully configured it to publish and subscribe, however, when the messages should be sent to the client (FE app), the LiveQuery server cannot match the user and does not send the message.
In the FE app, I am subscribing sending the session token, I've verified the token in the subscription request being correct.
If I remove the ACL from the obejct, the FE app receives the message.
By using the default pubsub provider (EventEmitter) in a single instance, the same ACL and FE code to subscribe, works perfectly. This indicates a high proability of a bug in the Redis PubSub logic to match users based on their session tokens.
Steps to reproduce
- Using ParseServer and LiveQueryParseServer
- Using Redis as PubSub
- Have a client subscribe to LiveQueryParseServer using the sessionToken
- Create an object with ACL pointing to a specific user id
- Observe how the message does not reach the FE app.
- Now remove the ACL, and try creating a new object
- Observe how the message now reaches successfully the FE app
Actual Outcome
No messages received.
Expected Outcome
All messages using the right ACL should be received
Environment
Server
- Parse Server version:
6.4.0 - Operating system:
Linux - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc):
AWS
Database
- System (MongoDB or Postgres):
MongoDB - Database version:
6 - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc):
MongoDB Atlas
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc):
JavaScript - SDK version:
4.3.1
Logs
Even using the VERBOSE level, LiveQueryParseServer logs very little, almost nothing.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the LiveQueryParseServer Redis PubSub path described in the issue, tracing how session tokens and ACL users are matched across the two Parse instances. Reproduce the listed Redis, MongoDB, and ACL steps, then confirm that messages for the authorized user arrive while preserving the working single-instance behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, mongodb, redis
- Domain
- authorization, backend, distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100