Hello,
In middleware on parse serve it is possible intercept request if this use master key? i try put middleware,but in req body/headers not have any args(app id or master key).
i suspect what this data is encoded,but not have idea whats the name for get.
Well, you can use express as middleware and verify the req.headers for the master key, using your master key as system ENV, in this way just the server side will have access of your master key. If the key is correct the request can next() to your Parse Server.
My test using my dashboard, and in your reqs not contain this args,and trying search in parse server background code ,how this args is get, but i not have success.
thanks for your time!!!
You can use Parse Dashboard with master key, but not public dashboards.
I think you should have a âRoleâ like âadminâ, that users on this role will be granted to run some âcloud functionsâ (from parse SDK/API), the server check if the user has this role, if has go ahead and run the function, for example:
/// Check if user is on the Role
/// ---------------------------------------------------------------------------------------
async function userInRole({ roleName, user }) {
const query = new Parse.Query(Parse.Role)
query.equalTo('name', roleName)
query.equalTo('users', user)
return await query.first({ useMasterKey: true })
}
/// Cloud code function
/// ---------------------------------------------------------------------------------------
Parse.Cloud.define('runMasterKeyQuery', async (req) => {
// get user from request
const { user } = req
// check if the user are on the admin role
const isAdmin = await userInRole({ roleName: 'admin', user.id })
if (!isAdmin) {
throw `You don't have permission to continue.`
}
// rest of the code that require "useMasterKey" or not, but only run by the server side, by admin users.
...
})
i go to explaim my case using more details, need limited acess for masterkey,but i need garanted acess for SDks,i try use masterKeyIps for limited acess using ip,but when i call clound funciontion in any device, i get error(âno have permissionâ),now my plan is use middleware for check when req use masterkey(for exemplo dashboard) and check if ip is valid, but in req params not have masterkey,i read code in parse serve but not find how masterkey is deconded by request.
Now I understand your point, your question (sorry the delay, hahaha).
But the answer to get if the request are using the master key on login for examples you just use the triggers that Parse has: Cloud Code Guide | Parse