Can not set ACL in cloud code for new User

[sanergulec]

Hello, I try to set the ACL of a new created user that has the read and write permission only by the user. For objects in the other tables I do not have any problem setting the ACL as I am using "beforeSave". But for the user I can not use the "beforeSave" as the user is not created yet. I tried lots of different combinations, but couldn't make it work. The last that I tried is the code below. But it didn't worked either.
Maybe when the "afterSave" function starts in the cloud, the user is not created yet and for this reason the ID can not be set as permission, I don't know. Is there anyone who knows how the set the ACL for a new user only permission to that user?

Parse.Cloud.afterSave(Parse.User, function(req) {

    if (!req.user.existed()) {

    var acl = new Parse.ACL();
    acl.setReadAccess(req.user, true);
    acl.setWriteAccess(req.user, true);
    req.user.setACL(acl);
    req.user.save();

    }

});

[Kira2]

Hi,

You are right, you have to use afterSave to set the permission of the user. But I think the problem is that you try to use req.user instead of req.object. Indeed, when you use afterSave on Parse.User class, your user is stored into req.object.

Try this, it might work:

Parse.Cloud.afterSave(Parse.User, function(req) {

  if (!req.object.existed()) {
    var user = req.object;
    var acl = new Parse.ACL(user);
    user.setACL(acl);
    user.save();
  }
});

Hope it helps.

[stalehard]

Hi,
I have similar problem with ACL in self-hosted Parse-server:
After save new Parse.User object I set ACL for this user:

1 variant

newUser.signUp(null, { useMasterKey: true })
    .then(
        (user) => {
            let acl = new Parse.ACL(user);                      
            user.setACL(acl);
            user.save();
        },
        (error) => {

        }
    );

2 variant

newUser.signUp(null, { useMasterKey: true })
    .then(
        (user) => {
            let acl = new Parse.ACL();
            acl.setReadAccess(user.id, true);
            acl.setWriteAccess(user.id, true);
            acl.setPublicReadAccess(false);
            user.setACL(acl);
            user.save();
        },
        (error) => {

        }
    );

But in both case in mongoDB i see for this record:
"_id" : "mwlCdr4GtU", "_rperm" : [ "mwlCdr4GtU", "*" ], "_wperm" : [ "mwlCdr4GtU" ]

Why in read permission "*"?

[flovilmart]

@stalehard do you still have the issue? (we just released 2.1.6). Also, can you get the result of user.save(), wether it succeeds or fails? Thanks!

[jsoendermann]

I have the same problem, my new (anonymous) users are created with an ACL that enables public reads.

I'm using version 2.1.6 and have this function in my cloud code:

Parse.Cloud.afterSave(Parse.User, function(req) {
  console.log('[afterSave called]: ' + JSON.stringify(req.object));
  if (!req.object.existed()) {
    var user = req.object;
    var acl = new Parse.ACL(user);
    user.setACL(acl);
    user.save(null, {useMasterKey: true}).then(function (s) {
      console.log('[afterSave succeeded]: ' + JSON.stringify(s));
    }, function(e) {
      console.log('[afterSave failed]: '+ JSON.stringify(e));
    })
  }
});

which produces the following log when I call saveInBackgroundWithBlock on an anonymous user with the iOS SDK (slightly formatted for readability:

[afterSave called]: {
   "authData": {"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
   "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
   "ACL":{"eFlLthZdrT":{"read":true,"write":true},"*":{"read":true,"write":false}},
   "createdAt":"2016-03-14T09:00:33.208Z",
   "sessionToken":"r:b93374f192fc1686bf4a1ee908a616b2",
   "updatedAt":"2016-03-14T09:00:33.208Z",
   "objectId":"eFlLthZdrT"}

[afterSave called]: {
   "ACL":{"eFlLthZdrT":{"read":true,"write":true}},
   "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
   "updatedAt":"2016-03-14T09:00:34.392Z",
   "createdAt":"2016-03-14T09:00:33.208Z",
   "authData":{"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
   "objectId":"eFlLthZdrT"}

[afterSave succeeded]: {
   "authData":{"anonymous":{"id":"ca77f3fa-089f-459f-88e2-eb369d6168f5"}},
   "username":"4f2c3b160fdfe9f985401dc4173f5a7e",
   "ACL":{"eFlLthZdrT":{"read":true,"write":true}},
   "createdAt":"2016-03-14T09:00:33.208Z",
   "sessionToken":"r:b93374f192fc1686bf4a1ee908a616b2",
   "updatedAt":"2016-03-14T09:00:34.392Z",
   "objectId":"eFlLthZdrT"}

This looks correct but when I check on the dashboard, the user object still has public read enabled in its ACL.

[drew-gross]

@jsoendermann I've attempted to reproduce this issue in #1281, but I wasn't able to reproduce. Can you look at that PR and tell me if you are doing anything differently from how that test works? If not, try updating your server version, your dashboard version, and refreshing the dashboard page. If you still have problems, please open a new issue with the repro steps.

[haroot]

Here is what worked for me for the latest parse. Apparently, by default User rows are open to Public Read...

async function CreateParseUser(username, password, email, phone, isPro) {
var user = new Parse.User();
user.set("username", username);
user.set("password", password);
user.set("email", email)
user.set("phone", phone);
user.set("isPro", isPro);
await user.signUp(null, {
success: function(user) {
// Hooray! Let them use the app now.
console.log("User created! ", user.id, user);
let acl = new Parse.ACL();
acl.setReadAccess(user.id, true);
acl.setWriteAccess(user.id, true);
acl.setPublicReadAccess(false);
user.setACL(acl);
user.save(null, {useMasterKey: true});
},
error: function(user, error) {
// Show the error message somewhere and let the user try again.
console.log("Error: " + error.code + " " + error.message);
}
});
}