Undocumented behavior change for `request.user` in cloud code

[JacobJT]

Issue Description

Undocumented behavior change for request.user in cloud code - used to be a User shell, seems to be a populated object now

Steps to reproduce

• Call a cloud code function
• in the cloud code function print out any field from req.user that should be set and isn't part of the shell object

Expected Results

• The field will be undefined

Actual Outcome

• The field's data exists

Environment Setup

• Server
  • parse-server version (Be specific! Don't say 'latest'.) : 2.7.4
  • Operating System: OSX 10.12.6
  • Hardware: MacBook Pro 2015
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): AWS / Local

Logs/Trace

When calling console.log("user.get('firstName' == " + user.get('firstName'));
user.get('firstName') == Jake

Expected this to print user.get('firstName') == (undefined).

I know in the past I had to fetch the user before being able to access its data. I couldn't find any PR's or release notes relating to this, and the issues I found seemed to revolve around request.user being undefined entirely. I came across this update on accident, and am trying to figure out if it is safe to assume that request.user will be populated if a valid session token is when I call cloud functions. As I'm performing some unnecessary fetches if I no longer need them, I'd love to clean up some of my code, but can't find hard info on this change.

[steven-supersolid]

As I recall, on parse.com request.user was fetched with any authenticated request, then when parse-server was launched this was accidentally omitted but later fixed.
I can't find the commit for this but you can see the current behaviour in Auth.getAuthForSessionToken()

[cjosepha]

@JacobJT I'm currently using 2.6.3 and when I make a REST api call to launch a cloud function, the resquest.user is undefined even if a valid session token is provided in the request.

[flovilmart]

@dangtz can you provide the logs when running with VERBOSE=1 and req.user isn’t set?

[cjosepha]

Sorry, it seems that this is due to the use of the master-key, after removed it, request.user is well defined :
verbose: REQUEST for [POST] /parse/functions/deleteUser: { "userId": "64ld1aOQdr" } method=POST, url=/parse/functions/deleteUser, x-parse-application-id=****, x-parse-master-key=****, content-type=application/json, x-parse-session-token=r:****, user-agent=Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 4 Build/LMY48T), host=192.168.1.45:1337, connection=Keep-Alive, accept-encoding=gzip, content-length=23, userId=64ld1aOQdr
{ params: { userId: '64ld1aOQdr' }, master: true, user: undefined, installationId: undefined, log: LoggerController { options: { jsonLogs: false, logsFolder: './logs/', verbose: true, logLevel: 'verbose', silent: false }, appId: '0k43fV3LPXC1Q2di0RqSJ2Pyr2iDgaIF4wZbrdie', silly: [Function] }, headers: { 'x-parse-application-id': '****', 'x-parse-master-key': '****', 'content-type': 'application/json', 'x-parse-session-token': 'r:****', 'user-agent': 'Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 4 Build/LMY48T)', host: '192.168.1.45:1337', connection: 'Keep-Alive', 'accept-encoding': 'gzip', 'content-length': '23' }, functionName: 'deleteUser' }

[flovilmart]

So everything is according to spec. Glad to hear!