Help with protectedFields on the _User class

Parse Server šŸ“”
#1

Hi everyone,
I have a question about the usage of protectedFields in the _User class.
I want to have some fields that are only available for the User, not for anyone else.
How could this be done without creating an extra class to store those fields?
Kinda like the old sensitiveUserFields.

#3

You need to pass something like this protectedFields: { _User: { '*': ['phone'] } } when initializing Parse Server.

#4

Hi,
Thanks for the answer.
It worked!
Here is my code in case anyone needs something similar.

protectedFields: {
  _User: {
    "*": ["email", "privatePhone", "emailVerified", "birthday"],
    "role:generalAdmins": [],
    "role:generalModerators": [],
    "role:userAdmins": [],
    "role:userModerators": []
  },
  Files: {
    "*": ["metadata"],
    "role:generalAdmins": [],
    "role:generalModerators": [],
    "role:filesAdmins": [],
    "role:filesModerators": []
  }
}
#5

Hi @davimacedo . Whatā€™s protected fields? Ä° recently updated my dashboard to 2.1.0 and protected fields are new. They didnā€™t exist in previous dashboard version. What do they do?

By looking at the name, i think it prevents some field to be fetched.

Like if I add email field to protected fields, does parse server removes email before sending it to client. Iā€™m currently doing it by converting user to json then delete email field.

Can you clarify?

#6

There is still no documentation about it, but here you have an example by @davimacedo on how to use it.

It does what you think, it makes the rows you choose invisible for the general public, you can also specify roles that you want to be able to read it.
You can also give the user set on a pointer specific protectedFields with ā€œuserField:someFieldā€:
More information here:

1 Like
#7

Thank you for the examples. Does protected fields work against masker key? Ä° moved all my logic to cloud code and using master key in every query.

#8

Master key by passes the protected fields rules.

1 Like
#9

Thank youā€¦

#10

Is there any way to make a protectedField on the User class that not even the user is able to see it?
For example a column called is isBanned, only available with the master key, so the user can not change his status or see it.

#11

You can place this field on a separate class with a pointer to the _User class.

#12

Thatā€™s the approach Iā€™m taking right now, but It will be cool to make it directly onto the user class so for example here:


Instead of having to query the second class to verify the user status it will all be made in the first one.
This is not a big problem, but just wanted to give my two cents.