fix: _Installation update fails when clearing deviceToken#10454
fix: _Installation update fails when clearing deviceToken#10454AdrianCurtin wants to merge 1 commit intoparse-community:alphafrom
Conversation
handleInstallation runs before Parse __op operators are processed, so
when a client cleared deviceToken via { __op: 'Delete' } or null, the
operator object was being pushed into the Mongo $or lookup query and
rejected by transformQueryKeyValue with "You cannot use [object Object]
as a query parameter" (Parse error 107).
Detect the clearing intent and route the identification/lookup paths
through deviceTokenForLookup (undefined when clearing) while leaving
this.data.deviceToken untouched so the field is still cleared on write.
Adds regression specs covering both clearing shapes and the case where
deviceToken is cleared alongside another field update.
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR fixes how Parse Server handles ChangesInstallation DeviceToken Clearing Logic
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~28 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 6 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (6 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 OpenGrep (1.20.0)OpenGrep fatal error (exit code 2): [00.18][ERROR]: Error: exception Unix_error: No such file or directory stat spec/ParseInstallation.spec.js Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates _Installation handling so clearing deviceToken during an update no longer feeds a delete/null payload into the installation lookup path, which was causing Mongo query transformation failures.
Changes:
- Adds a
deviceTokenForLookuppath inRestWrite.handleInstallationto treatnulland{ __op: 'Delete' }as non-identifying values during installation matching. - Updates installation matching, validation, and dedup lookup branches to use the derived lookup token instead of the raw request payload.
- Adds regression tests covering
deviceTokenclearing via delete op, vianull, and while updating another field.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/RestWrite.js |
Adjusts _Installation lookup logic to avoid querying with delete-op/null deviceToken values. |
spec/ParseInstallation.spec.js |
Adds regression tests for clearing deviceToken during installation updates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Treat that as "no deviceToken to identify/match by" so we do not feed the | ||
| // operator object into the lookup query (which would fail Mongo transform). | ||
| const clearingDeviceToken = | ||
| this.data.deviceToken === null || | ||
| (typeof this.data.deviceToken === 'object' && | ||
| this.data.deviceToken !== null && | ||
| this.data.deviceToken.__op === 'Delete'); |
| expect(results[0].deviceToken == null).toBeTrue(); | ||
| expect(results[0].installationId).toEqual(installId); |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Issue
Updating an existing
_Installationto cleardeviceTokenfrom the client (iOS/Android SDKs, Dashboard, anything sending{ deviceToken: { __op: 'Delete' } }or{ deviceToken: null }) fails with:RestWrite.handleInstallationruns at step 109 ofRestWrite.execute, before the field-write loop processes__opoperators. TheDeleteoperator object is truthy, so it was being pushed into the$orlookup query as{ deviceToken: { __op: 'Delete' } }, whichtransformQueryKeyValuecannot transform into a Mongo predicate.Approach
Detect the two clearing shapes (
nulland{ __op: 'Delete' }) at the top ofhandleInstallationand derive adeviceTokenForLookupvalue (undefined when clearing). Identification paths usedeviceTokenForLookup:$orlookuporQueriespushresult.deviceTokenmatch loopdelQueryblocksthis.data.deviceTokenis left untouched, so the actual write step still applies the Delete op and the field is cleared on the row.Tasks
Add changes to documentation (guides, repository pages, code comments)Add security checkAdd new Parse Error codes to Parse JS SDKSummary by CodeRabbit
Bug Fixes
Tests