fix: Login with master key overwrites stored MFA settings of user by mtrezza · Pull Request #10771 · parse-community/parse-server

mtrezza · 2026-10-09T09:01:38Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.

Issue

A login with the master key validates the submitted authData as an update of the user's auth data instead of as a login. The MFA adapter skips the validation of an update made with the master key, so a master-key login with authData.mfa replaces the user's stored MFA settings (TOTP secret and recovery codes, or SMS mobile number) with the submitted value, which disables MFA for the user.

Approach

Auth data validation receives an isLogin option that defaults to login. A login validates the auth data with validateLogin regardless of whether the request uses the master key or a session token; only an update of the user's auth data uses validateUpdate.
An auth data login with the master key also validates auth data that is unchanged from the stored auth data, as auth providers are always validated on login.

Changed behavior:

A login with the master key and authData of a provider configured for the user requires valid auth data; for MFA the token is validated and a used recovery code is consumed.
A login via a request that carries the session token of the same user, for example a GraphQL logIn mutation or a batch request, validates authData as a login.
A custom auth adapter receives validateLogin instead of validateUpdate for these logins.

Tasks

Add tests
Add changes to documentation (guides, repository pages, code comments)

Summary by CodeRabbit

Bug Fixes
- Login requests now validate credentials for providers already configured on an account, including TOTP and SMS verification codes.
- Invalid or missing MFA codes are rejected without changing the account’s MFA settings. Valid codes allow login, and each TOTP recovery code can be used only once.
- Master-key authentication flows now validate existing authentication data without treating login as an account update.

parse-github-assistant · 2026-10-09T09:01:42Z

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
Group code into logical blocks. Add a short comment before each block to explain its purpose.
We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

coderabbitai · 2026-10-09T09:02:04Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 9399fd19-27dc-45bc-bdcd-8d6d04fdc7a6

📥 Commits

Reviewing files that changed from the base of the PR and between f128e3e and 971d129.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: be8ccfe4-3f45-4f8d-9ad2-f5f5f7afcfcb

📥 Commits

Reviewing files that changed from the base of the PR and between 66d33d3 and f128e3e.

📒 Files selected for processing (6)

spec/AuthenticationAdapters.spec.js
spec/AuthenticationAdaptersV2.spec.js
src/Adapters/Auth/AuthAdapter.js
src/Adapters/Auth/index.js
src/Auth.js
src/RestWrite.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

Auth-data handling now distinguishes login requests from updates during provider validation. The change passes login status through the validation path and adds tests for master-key authentication and MFA scenarios.

Changes

Auth-data validation

Layer / File(s)	Summary
Classify and propagate login status `src/RestWrite.js`, `src/Auth.js`	Auth-data handling determines login status before duplicate checks and passes it to validation. Unchanged auth data no longer skips validation for login requests.
Route provider validation `src/Adapters/Auth/index.js`, `src/Adapters/Auth/AuthAdapter.js`	Provider validation uses login status to route configured-provider logins to `validateLogin` and qualifying non-login requests to update validation. Adapter comments describe the login and update cases.
Authentication and MFA coverage `spec/AuthenticationAdapters.spec.js`, `spec/AuthenticationAdaptersV2.spec.js`	Tests cover master-key authentication, TOTP and SMS login, recovery-code use, MFA replacement, batch login, and maintenance or read-only key cases.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RestWrite
  participant Auth
  participant authDataValidator
  participant Provider
  RestWrite->>RestWrite: Determine isLogin
  RestWrite->>Auth: Validate auth data with isLogin
  Auth->>authDataValidator: Pass isLogin to provider validator
  authDataValidator->>Provider: Select validateLogin for configured-provider login

Merge Risk: ⚪ Minimal · up to f128e

Master-key logins now validate submitted auth data as a login, so they can no longer silently overwrite a user's stored MFA settings. Tests cover TOTP, SMS, recovery-code, batch, and restricted-key cases. No concrete merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 6 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check		The title begins with the allowed `fix:` prefix and clearly describes the master-key login issue addressed by the changes.
Description check		The description includes the required Issue, Approach, and Tasks sections. It clearly explains the security issue, implementation approach, changed behavior, and completed tests and documentation upda…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No new security vulnerability is evident. `src/RestWrite.js` now marks requests without a user identity as logins, passes `isLogin` through every validation path, and prevents the unchanged-auth-data …
Engage In Review Feedback		The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, the pull request had no review feedback that required engagement, implementation, or di…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-10-09T09:09:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.98%. Comparing base (2114fca) to head (971d129).
⚠️ Report is 4 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10771   +/-   ##
=======================================
  Coverage   93.98%   93.98%           
=======================================
  Files         193      193           
  Lines       17101    17101           
  Branches      259      259           
=======================================
+ Hits        16072    16073    +1     
+ Misses       1007     1006    -1     
  Partials       22       22

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

## [9.10.5-alpha.1](9.10.4...9.10.5-alpha.1) (2026-10-09) ### Bug Fixes * Login with master key overwrites stored MFA settings of user ([#10771](#10771)) ([28bb53b](28bb53b))

parseplatformorg · 2026-10-09T09:38:02Z

🎉 This change has been released in version 9.10.5-alpha.1

coderabbitai Bot approved these changes Oct 9, 2026

View reviewed changes

fix: Login with master key overwrites stored MFA settings of user

971d129

mtrezza force-pushed the fix/master-key-login-overwrites-mfa branch from f128e3e to 971d129 Compare October 9, 2026 09:18

mtrezza merged commit 28bb53b into parse-community:alpha Oct 9, 2026
25 checks passed

mtrezza deleted the fix/master-key-login-overwrites-mfa branch October 9, 2026 09:37

parseplatformorg added the state:released-alpha Released as alpha version label Oct 9, 2026

Navigation Menu

Repository navigation

fix: Login with master key overwrites stored MFA settings of user - #10771

fix: Login with master key overwrites stored MFA settings of user#10771
mtrezza merged 1 commit into
parse-community:alphafrom
mtrezza:fix/master-key-login-overwrites-mfa

mtrezza commented Oct 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

parse-github-assistant Bot commented Oct 9, 2026

Uh oh!

coderabbitai Bot commented Oct 9, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

parseplatformorg commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mtrezza commented Oct 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Issue

Approach

Tasks

Summary by CodeRabbit

Uh oh!

parse-github-assistant Bot commented Oct 9, 2026

Uh oh!

coderabbitai Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

parseplatformorg commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtrezza commented Oct 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 9, 2026 •

edited

Loading

codecov Bot commented Oct 9, 2026 •

edited

Loading