Role.getUsers.query not showing user with private read permission

[steven274]

even if I logged in that user and executed the query

[drew-gross]

Can you please post some code that demonstrates what you are doing, what you expected to happen, and what actually happened?

[steven274]

I have an role Amin with public read and private write permission

{
    "_id": "OXdOGy6CZ6",
    "_rperm": [
        "*"
    ],
    "_wperm": [],
    "name": "Admin",
    "_updated_at": {
        "$date": "2016-05-16T08:15:53.096Z"
    },
    "_created_at": {
        "$date": "2016-05-14T11:45:30.129Z"
    }
}

and a root User with private read and write permission

{
    "_id": "VApFxEerw6",
    "_rperm": [
        "VApFxEerw6"
    ],
    "_wperm": [
        "VApFxEerw6"
    ],
    "username": "root",
    "_updated_at": {
        "$date": "2016-05-17T12:31:53.456Z"
    },
    "_created_at": {
        "$date": "2016-05-14T12:04:52.467Z"
    }
}

root User belongs to role Amin

{
    "_id": {
        "$oid": "5739655045a35949e4d0f73c"
    },
    "relatedId": "VApFxEerw6",
    "owningId": "OXdOGy6CZ6"
}

When I logged in root User and executed this code, it doesn't list the user

        var queryRole = new Parse.Query(Parse.Role);
        queryRole.equalTo('name', 'Admin');
        return queryRole.first().then(
            function(role) {
                if (role) {
                    var relation = role.getUsers();
                    var queryUser = relation.query();
                    queryUser.equalTo('objectId', request.user.id);
                    return queryUser.first();
                } else {
                    return Parse.Promise.error('role not found');
                }
            });

[araskin]

I apologize if my issue is not the same but I think I am having a similar problem.

I have written the following code to assign 'standardUser' role to all of the users in the Users collection.

    Parse.Promise.as()
    .then(function(){
      query = new Parse.Query(Parse.Role);
      query.equalTo("name", "standardUser");
      return query.first({useMasterKey:true});
    }).then(function(standardUserRole){
        // console.log('Role is ' + standardUserRole.id);

        var userQuery = new Parse.Query(Parse.User);
        var aPromise = Parse.Promise.as();

        userQuery.each(function(aUser){
            aPromise = aPromise.then(function(){
                standardUserRole.getUsers().add(aUser);
                console.log('Adding User: ' + aUser.get("username") + ' to role ' + standardUserRole.get("name"));
                return standardUserRole.save(null, {useMasterKey:true});                
            }, function(error){
                console.log('rejecting promise' + JSON.stringify(error));
                aPromise.reject(error);
            });
        }, {useMasterKey:true});
        return aPromise;
    }).then(function(){
        response.success();
    },function(error){
        response.error(error);
    });

The code runs and the logging indicates that ALL users were updated. However, when I go to the Data browser. click on the ROLE and then click on View Relations under on the users field. I only see 2 users listed.

[flovilmart]

@araskin Can you provide the logs when running with VERBOSE=1

[araskin]

Hi @flovilmart I am not sure I am doing this right.

1. On my mac I did the following
   export VERBOSE=1

then I ran the following command

parse-dashboard

Then I click on ROLE collection, and clicked on the View Relations button on the appropriate record.

Problem is I am not sure where the logs are. I checked where parse-dashboard module is installed but don't see anything there. Any ideas where I can see these logs?

[flovilmart]

@araskin can you update parse-server to it's latest version 2.2.23 and comment back?

[araskin]

Unfortunately no change after the update. I don't see any difference when I click on View Relations

I made some small code changes but nothing seriously changed:

Parse.Cloud.define("migrateAllUsersToStandardUsers", function(request, response) {

    // Parse.Cloud.useMasterKey();  

    Parse.Promise.as()
    .then(function(){
      query = new Parse.Query(Parse.Role);
      query.equalTo("name", "standardUser");
      return query.first({useMasterKey:true});
    }).then(function(standardUserRole){
        // console.log('Role is ' + standardUserRole.id);

        var userQuery = new Parse.Query(Parse.User);
        // var aPromise = new Parse.Promise(); 

        return userQuery.each(function(aUser){
            standardUserRole.getUsers().add(aUser);
            console.log('Adding User: ' + aUser.get("username") + ' to role ' + standardUserRole.get("name"));
            return standardUserRole.save({}, {useMasterKey:true});              
        }, {useMasterKey:true});
        // return aPromise;
    }).then(function(){
        response.success();
    },function(error){
        response.error(error);
    });

});

Whats interesting is that after every call to standardUserRole.save() I can see a PUT to class _ROLE in the output with a status of 200. However, when I go to the parse-dashboard and click on that role and click on View Relations (under User) I can not see any of the records that were supposedly assigned.

[corbanb]

This is still a major issue. Our app is unable to share permissions with other users do to this bug. Same code from api.parse.com but when using parse-server 2.2.25 its still not working as expected.

Does anyone have a work around?

This in my mind would be a MAJOR bug for apps sharing permissions across user accounts.

Any help would be great.

[flovilmart]

@corbanb contributions are welcome, not sure as you're not the one reporting the issue if the STR is accurate.

A pull request with a failing test would be helpful to get us started.

[corbanb]

I added a test #3198 and it was merged in. Digging into the test helped me understand the way this had to happen for me. Hope it helps others.

[flovilmart]

Did you need any major code change to make it work?

[montymxb]

This seems rather unclear and was never accurately identified with any reproducible code. Closing this out for now. If anyone is having issues with this let us know and we'll reopen to take a look.