Allow `Parse.Query.includeAll` when `maxIncludeQueryComplexity` is set

New Feature / Enhancement Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Current Limitation

https://github.com/parse-community/parse-server/pull/9920 was merged with the understanding that its limitation of disabling the feature of Parse.Query.includeAll when maxIncludeQueryComplexity is set is an unnecessary restriction.

Since maxIncludeQueryComplexity is a security feature, which is considered to be enabled by default, it equates to removing the practical usability of the Parse.Query.includeAll feature.

Feature / Enhancement Description

Allow Parse.Query.includeAll when maxIncludeQueryComplexity is set.

The restriction for includeAll should rather be:

• if max depth < 1 AND includeAll is used AND the schema contains a pointer field -> deny with invalid query

Or simpler, because why would someone use includeAll on a schema without pointers:

• if max depth < 1 and includeAll is used -> deny with invalid query

The option also adds a field count limit, so when using includeAll on a class with n pointer fields, and the count limit is < n then there should also be an invalid query response. This may be easy to implement as the schema is known and we can compare the pointer field count early in the process.

See discussion in https://github.com/parse-community/parse-server/pull/9920#discussion_r2540948092.

Alternatives / Workarounds

Refactor developer app code to not use Parse.Query.includeAll.

Start by reading PR #9920 and the linked discussion, then trace how Parse.Query.includeAll is handled with maxIncludeQueryComplexity. Clarify whether the depth rule, pointer-field count rule, or both are required. Done means supported includeAll queries return normally within the limits and invalid queries are rejected when those limits are exceeded.