Adds class level permission requiring authenticated user - #893

@flovilmart updated the pull request.

Current coverage is 91.76%

Merging #893 into master will increase coverage by +0.06% as of 7f0fd88

@@            master    #893   diff @@
======================================
  Files           71      71       
  Stmts         4110    4117     +7
  Branches       849     853     +4
  Methods          0       0       
======================================
+ Hit           3769    3778     +9
  Partial         10      10       
+ Missed         331     329     -2

Review entire Coverage Diff as of 7f0fd88

Powered by Codecov. Updated on successful CI builds.

I'm guessing the use case for this is when the app developer is issuing accounts only to trusted people? If anyone can sign up for an account, then this feature doesn't really seem to add any security.

we discussed it with @gfosco this morning, and some users want to restrict globally access to the content. It really doesn't add any security, but if s/o wants to implement it, it's still faster than having so add users to a role etc...

I'm not sure we want to add features that just create a false sense of security. I can see how it's useful in the case of e.g. internal apps though.

Either way, this will need documentation.

:) I'm a fan of this.

@flovilmart updated the pull request.

@drew-gross you're right, we need to carefully document it, as well as implement on parse-dashboard.

@gfosco what do you think? merge now, and document later in the wiki?

The dashboard implementation can probably wait, as long as you can modify the setting without having to dig around in the source. The documentation is more important, I'd say. So far we've been adding stuff without documentation only if it's hidden behind an experimental flag but I don't want to get too much into that habit and have tons of stuff languishing in experimental for ages.

@flovilmart updated the pull request.

Awaiting docs and rebase.

@drew-gross yeah... I need to take some time on that :)

No worries. I think this is a rarely requested feature anyway.

@flovilmart @drew-gross
if it is not too much to ask can one of you please explain this "creates a false sense of security"?
Is there a way to bypass requiresAuthentication to get access to the content?

If anyone can signup, and create an account, then this protection dont really protect anything

@flovilmart updated the pull request.

@flovilmart updated the pull request.

It's been a while since the last commit was reviewed and the labels show this pull request needs review. Based on the blame information for the files in this pull request we identified @drew-gross as a potential reviewer. Could you take a look please or cc someone with more context?

The main benefit (for me at least) is the minimizes the potential for someone coming along and scraping your data. At least they'd have to put some effort into it with this feature.

@flovilmart updated the pull request - view changes

See: https://github.com/ParsePlatform/parse-server/wiki/NEW:-Class-Level-Permission:-requireAuthentication

@flovilmart updated the pull request - view changes

@flovilmart updated the pull request - view changes

@flovilmart updated the pull request - view changes

@steven-supersolid merging as it's been approved, thoroughly tested. We'll add the docs before 2.3.0