Class: Parse::Constraint::NotReadableByConstraint

Inherits:

Parse::Constraint

• Object
• Parse::Constraint
• Parse::Constraint::NotReadableByConstraint

Defined in:

lib/parse/query/constraints.rb

Overview

Note:

"Not readable by X" excludes rows readable by X directly, via any role X inherits, AND publicly — so a User value expands its roles and the public +"*"+ is always added to the exclusion set.

Note:

This constraint uses aggregation pipeline because Parse Server restricts direct queries on the internal _rperm field.

ACL NOT Readable By Constraint Query objects that are NOT readable by the specified users/roles. Useful for finding objects hidden from specific users.

Examples:

Find objects NOT readable by a user (hidden from them)

Song.query.where(:acl.not_readable_by => current_user)

Find objects NOT publicly readable

Song.query.where(:acl.not_readable_by => "*")
Song.query.where(:acl.not_readable_by => :public)

Instance Attribute Summary

Attributes inherited from Parse::Constraint

#operand, #operation, #operator, #value

Instance Method Summary

• #build ⇒ Object

Methods inherited from Parse::Constraint

#as_json, constraint_keyword, create, formatted_value, #formatted_value, #initialize, #key, #precedence, #regex_unicode_option, register, #to_s

Constructor Details

This class inherits a constructor from Parse::Constraint

Instance Method Details

#build ⇒ Object

# File 'lib/parse/query/constraints.rb', line 3232

def build
  keys = ACLPermissions.collect_for_negation(@value)
  return { "__aggregation_pipeline" => [] } if keys.empty?

  # Find objects whose _rperm EXISTS and does NOT contain any of the
  # keys. The `$exists: true` guard is essential: Parse Server treats a
  # missing `_rperm` as publicly readable, and MongoDB's `$nin` matches
  # documents where the field is absent. Without the guard,
  # `not_readable_by("*")` (i.e. #not_publicly_readable) would MATCH the
  # public-by-absence rows it is meant to exclude — inverting the result
  # and giving a security audit a false sense of safety.
  pipeline = [
    {
      "$match" => {
        "_rperm" => { "$exists" => true, "$nin" => keys },
      },
    },
  ]

  { "__aggregation_pipeline" => pipeline }
end