Why can't I use `useMasterKey()` in a `beforeSave` function?

Question

My Parse app has a GiftCode collection which disallows the find operation at the class-level.

I am writing a beforeSave cloud function that prevents duplicate codes from being entered by our team from Parse's dashboard:

Parse.Cloud.beforeSave('GiftCode', function (req, res) {
  Parse.Cloud.useMasterKey();

  const code = req.object.get('code');

  if (!code) {
    res.success();
  } else {
    const finalCode = code.toUpperCase().trim();

    req.object.set('code', finalCode);

    (new Parse.Query('GiftCode'))
    .equalTo('code', finalCode)
    .first()
    .then((gift) => {
      if (!gift) {
        res.success();
      } else {
        res.error(`GiftCode with code=${finalCode} already exists (objectId=${gift.id})`);
      }
    }, (err) => {
      console.error(err);
      res.error(err);
    });
  }  
});

As you can see, I am calling Parse.Cloud.useMasterKey() (and this is running in the Parse cloud), but I am still getting the following error:

This user is not allowed to perform the find operation on GiftCode.

I use useMasterKey() in other normal cloud functions and am able to perform find operations as needed.

Is useMasterKey() not applicable to beforeSave functions?

score 2 · Accepted Answer · answered Jan 06 '16 at 18:08

I've never tried to use the master key in a beforeSave function but I wouldn't be surprised if there's some extra safeguards in place to prevent it. From a security standpoint, it seems like it could make all write-based CLPs and ACLs worthless for that class.

Try selectively using the master key by passing it as an option to the query like so

(new Parse.Query('GiftCode'))
.equalTo('code', finalCode)
.first({ useMasterKey: true })
.then((gift) => {
    ...

score 1 · Answer 2 · answered Jun 01 '17 at 00:27

Parse.Cloud.useMasterKey(); has been deprecated in Parse Server version 2.3.0 (Dec 7, 2016). From that version on, it is a no-op (it does nothing). You should now insert the {useMasterKey:true} optional parameter to each of the methods that need to override the ACL or CLP in your code.

Why can't I use `useMasterKey()` in a `beforeSave` function?

2 Answers2