Create new Parse.Session programmatically for a user, without their password

Parse Server šŸ“”
#1

Hi everyone!

Iā€™m working on an existing Parse server, and I am currently adding an OAuth system, so that external apps can connect in the name of Parse.User.

I created different classes for codes and tokens, and now my external apps can send requests with an accessToken, corresponding to their application and user (who granted access).

Iā€™m looking for a way to inform the Parse server that the ā€œlogged in userā€ in requests is the end user that authorized the OAuth application. For this, I have created an express middleware handling request before the Parse server middleware, extracting the access token from the request, getting the correct User and Application, and then I wanted to create a Parse.Session programmatically, get the token, and set it in the request as x-parse-session-token. This way, the next handler, Parse, would treat the request as authenticated and performed by the end user.

My problem here is that I cannot find a way to create a session programmatically, Iā€™m aware of the Parse.User.logIn, but that works only with a password.

Iā€™ve tried the following:

const oAuthSession = await new Parse.Session().save({
  user: user // user got from Parse.Query(Parse.User) with masterKey
}, { useMasterKey: true })

But get a Cannot modify readonly attribute user error.

Any hidden method to programmatically create a Parse.Session without a password ?

Thanks

#2

I think you can use the middleware to set req.userFromJWT with the user object. Take a look in here: parse-server/middlewares.js at f6a41729a7a3adc6bd5310cefb3458835b4abb58 Ā· parse-community/parse-server Ā· GitHub

#3

Thanks a lot, it is working great:
const user = await new Parse.Query(Parse.User).get(ā€˜idOfUserā€™);
req.userFromJWT = user;

#4

Cool. Thanks for the feedback.