Unable to Save ParseObject with User ACL in Cloud Code

Question

I have an issue saving changes to an object from a Cloud Code function.

I have a collection called Character and one record inside it. This Character record has an ACL with Public Read, and Private Write Access by a specific ParseUser (6MwfSLdAxd).

In Unity, I authenticated the user and I then call the Cloud Code function as follows:

ParseCloud.CallFunctionAsync<Character>("startBattle", null).ContinueWith(t =>
{
    Debug.Log("I got here...");
    Debug.Log(t.Result.ClassName);
});

In my Cloud Code function, I grab the first character in the collection (ignoring checking if it belongs to this user, because at the moment there is only one and it DOES belong to this user - there's only one user too).

var Character = Parse.Object.extend("Character");

Parse.Cloud.define("startBattle", function (request, response) {
    var user = request.user;
    if (user == null)
    {
        return response.error("You must login before you can battle!");
    }

    var characterQuery = new Parse.Query(Character);
    characterQuery.first()
    .then(
        function (character) {
            character.set("name", "Cloud Code sucka");
            character.save().then(function(character) {
                return response.success(character);
            });
        },
        function (error) {
            return response.error("You must create a character before you can battle! " + error);
        }
    )
});

However, I simply cannot save any changes to this character. All the documentation and forum posts I've found suggest that if you call a Cloud Code function when authenticated then that function should have the same level permissions as the user calling it.

The only time this code works is if I set the ACL of the character to Public Write.

Does anyone have any ideas why this wouldn't be working?

Note: Worth noting that I can see in the server logs that the Cloud Code function IS being called by the authenticated user 6MwfSLdAxd as I get this error (if I add a response.error call):

error: Failed running cloud function startBattle for user 6MwfSLdAxd with:
  Input: {}
  Error: {"code":141,"message":"Messed up: [object Object]"} functionName=startBattle, code=141, message=Messed up: [object Object], , user=6MwfSLdAxd
error: Error generating response. ParseError { code: 141, message: 'Messed up: [object Object]' } code=141, message=Messed up: [object Object]
[object Object]
[object Object]

Tom Glenn Tom Glenn · Accepted Answer · 2016-09-16T16:29:45

After some extensive searching I've now found the solution to this. For anyone else encountering the same issues, you should be aware that whilst Parse.com used to run Cloud Code functions in the context of the user that called them (afaik), self-hosted Parse Servers do not.

In order to call queries or saves in the context of a user you must pass their session token as shown below. I hope this saves someone the hours of confusion I went through!

var MyObject = Parse.Object.extend("MyObject");

Parse.Cloud.define("myCloudFunction", function (request, response) {
    var user = request.user;
    var sessionToken = user.getSessionToken();

    var query = new Parse.Query(MyObject)
        .find({ sessionToken: sessionToken })
        .then(
            function (object) {
                object.set("someKey", "someValue");
                return object.save(null, { sessionToken: sessionToken });
            }
        )
        .then(
            function (object) {
                return response.success(object);
            },
            function (error) {
                return response.error(error.message);
            }
        );
});

For further context see:

https://github.com/ParsePlatform/parse-server/wiki/Compatibility-with-Hosted-Parse#cloud-code

Unable to Save ParseObject with User ACL in Cloud Code

1 Answers