chore(release): 5.2.4 [skip ci]

## [5.2.4](https://github.com/parse-community/parse-server/compare/5.2.3...5.2.4) (2022-06-30) ### Bug Fixes * protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) (https://github.com/parse-community/parse-server/pull/8074) ([#8073](https://github.com/parse-community/parse-server/issues/8073)) ([309f64c](https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1))
fix: protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh )) (https://github.com/parse-community/parse-server/pull/8074 ) (#8073 )
2026-08-09 13:03:18 +00:00 · 2022-06-30 10:46:12 +00:00 · 2022-06-30 12:26:39 +02:00 · 2022-06-17 23:40:39 +00:00 · 2022-06-18 01:33:19 +02:00 · 2022-06-17 16:36:47 +00:00
29 changed files with 721 additions and 849 deletions
@@ -6,7 +6,7 @@ on:
    branches:
      - '**'
 env:
-  NODE_VERSION: 16.14.2
+  NODE_VERSION: 16.13.0
  PARSE_SERVER_TEST_TIMEOUT: 20000
 jobs:
  check-ci:
@@ -101,57 +101,47 @@ jobs:
    strategy:
      matrix:
        include:
-          - name: MongoDB 5.2, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 5.2.1
-            MONGODB_TOPOLOGY: replicaset
-            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 14.19.1
-          - name: MongoDB 5.1, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 5.1.1
-            MONGODB_TOPOLOGY: replicaset
-            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 14.19.1
          - name: MongoDB 5.0, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 5.0.6
+            MONGODB_VERSION: 5.0.3
            MONGODB_TOPOLOGY: replicaset
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: MongoDB 4.4, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 4.4.13
+            MONGODB_VERSION: 4.4.10
            MONGODB_TOPOLOGY: replicaset
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: MongoDB 4.2, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 4.2.19
+            MONGODB_VERSION: 4.2.17
            MONGODB_TOPOLOGY: replicaset
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: MongoDB 4.0, ReplicaSet, WiredTiger
-            MONGODB_VERSION: 4.0.28
+            MONGODB_VERSION: 4.0.27
            MONGODB_TOPOLOGY: replicaset
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: MongoDB 4.0, Standalone, MMAPv1
-            MONGODB_VERSION: 4.0.28
+            MONGODB_VERSION: 4.0.27
            MONGODB_TOPOLOGY: standalone
            MONGODB_STORAGE_ENGINE: mmapv1
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: Redis Cache
            PARSE_SERVER_TEST_CACHE: redis
-            MONGODB_VERSION: 4.4.13
+            MONGODB_VERSION: 4.4.10
            MONGODB_TOPOLOGY: standalone
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: Node 12
-            MONGODB_VERSION: 4.4.13
+            MONGODB_VERSION: 4.4.10
            MONGODB_TOPOLOGY: standalone
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 12.22.11
+            NODE_VERSION: 12.22.7
          - name: Node 14
-            MONGODB_VERSION: 4.4.13
+            MONGODB_VERSION: 4.4.10
            MONGODB_TOPOLOGY: standalone
            MONGODB_STORAGE_ENGINE: wiredTiger
-            NODE_VERSION: 14.19.1
+            NODE_VERSION: 14.18.1
      fail-fast: false
    name: ${{ matrix.name }}
    timeout-minutes: 15
@@ -193,22 +183,22 @@ jobs:
        include:
          - name: PostgreSQL 11, PostGIS 3.0
            POSTGRES_IMAGE: postgis/postgis:11-3.0
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: PostgreSQL 11, PostGIS 3.1
            POSTGRES_IMAGE: postgis/postgis:11-3.1
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: PostgreSQL 11, PostGIS 3.2
            POSTGRES_IMAGE: postgis/postgis:11-3.2
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: PostgreSQL 12, PostGIS 3.2
            POSTGRES_IMAGE: postgis/postgis:12-3.2
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: PostgreSQL 13, PostGIS 3.2
            POSTGRES_IMAGE: postgis/postgis:13-3.2
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
          - name: PostgreSQL 14, PostGIS 3.2
            POSTGRES_IMAGE: postgis/postgis:14-3.2
-            NODE_VERSION: 16.14.2
+            NODE_VERSION: 16.13.0
      fail-fast: false
    name: ${{ matrix.name }}
    timeout-minutes: 15
@@ -112,34 +112,32 @@ Before you start make sure you have installed:
 #### Node.js
 Parse Server is continuously tested with the most recent releases of Node.js to ensure compatibility. We follow the [Node.js Long Term Support plan](https://github.com/nodejs/Release) and only test against versions that are officially supported and have not reached their end-of-life date.

-| Version    | Latest Version | End-of-Life | Compatible   |
-|------------|----------------|-------------|--------------|
-| Node.js 12 | 12.22.11        | April 2022  | ✅ Yes        |
-| Node.js 14 | 14.19.1        | April 2023  | ✅ Yes        |
-| Node.js 16 | 16.14.2        | April 2024  | ✅ Yes        |
+| Version    | Latest Version | End-of-Life | Compatible    |
+|------------|----------------|-------------|---------------|
+| Node.js 12 | 12.22.7        | April 2022  | ✅ Yes        |
+| Node.js 14 | 14.18.1        | April 2023  | ✅ Yes        |
+| Node.js 16 | 16.13.0        | April 2024  | ✅ Yes        |
 | Node.js 17 | 17.x           | June 2022   | ❌ Not tested |

 #### MongoDB
 Parse Server is continuously tested with the most recent releases of MongoDB to ensure compatibility. We follow the [MongoDB support schedule](https://www.mongodb.com/support-policy) and only test against versions that are officially supported and have not reached their end-of-life date.

-| Version     | Latest Version | End-of-Life | Compatible |
-|-------------|----------------|-------------|------------|
-| MongoDB 4.0 | 4.0.28         | April 2022  | ✅ Yes      |
-| MongoDB 4.2 | 4.2.19         | TBD         | ✅ Yes      |
-| MongoDB 4.4 | 4.4.13         | TBD         | ✅ Yes      |
-| MongoDB 5.0 | 5.0.6          | TBD         | ✅ Yes      |
-| MongoDB 5.1 | 5.1.1          | TBD         | ✅ Yes      |
-| MongoDB 5.2 | 5.2.1          | TBD         | ✅ Yes      |
-
+| Version     | Latest Version | End-of-Life  | Compatible |
+|-------------|----------------|--------------|------------|
+| MongoDB 4.0 | 4.0.27         | April 2022   | ✅ Yes     |
+| MongoDB 4.2 | 4.2.17         | TBD          | ✅ Yes     |
+| MongoDB 4.4 | 4.4.10         | TBD          | ✅ Yes     |
+| MongoDB 5.0 | 5.0.3          | January 2024 | ✅ Yes     |
+  
 #### PostgreSQL
 Parse Server is continuously tested with the most recent releases of PostgreSQL and PostGIS to ensure compatibility, using [PostGIS docker images](https://registry.hub.docker.com/r/postgis/postgis/tags?page=1&ordering=last_updated). We follow the [PostgreSQL support schedule](https://www.postgresql.org/support/versioning) and [PostGIS support schedule](https://www.postgis.net/eol_policy/) and only test against versions that are officially supported and have not reached their end-of-life date. Due to the extensive PostgreSQL support duration of 5 years, Parse Server drops support if a version is older than 3.5 years and a newer version has been available for at least 2.5 years.

 | Version     | PostGIS Version | End-of-Life   | Parse Server Support End | Compatible |
 |-------------|-----------------|---------------|--------------------------|------------|
-| Postgres 11 | 3.0, 3.1, 3.2   | November 2023 | April 2022               | ✅ Yes      |
-| Postgres 12 | 3.2             | November 2024 | April 2023               | ✅ Yes      |
-| Postgres 13 | 3.2             | November 2025 | April 2024               | ✅ Yes      |
-| Postgres 14 | 3.2             | November 2026 | April 2025               | ✅ Yes      |
+| Postgres 11 | 3.0, 3.1, 3.2   | November 2023 | April 2022               | ✅ Yes     |
+| Postgres 12 | 3.2             | November 2024 | April 2023               | ✅ Yes     |
+| Postgres 13 | 3.2             | November 2025 | April 2024               | ✅ Yes     |
+| Postgres 14 | 3.2             | November 2026 | April 2025               | ✅ Yes     |

 ### Locally
 ```bash
@@ -1,45 +1,3 @@
-# [5.3.0-alpha.4](https://github.com/parse-community/parse-server/compare/5.3.0-alpha.3...5.3.0-alpha.4) (2022-04-04)
-
-
-### Bug Fixes
-
-* custom database options are not passed to MongoDB GridFS ([#7911](https://github.com/parse-community/parse-server/issues/7911)) ([a72b384](https://github.com/parse-community/parse-server/commit/a72b384f76137a3d83ffb69f65cb25aff1bbab4f))
-
-# [5.3.0-alpha.3](https://github.com/parse-community/parse-server/compare/5.3.0-alpha.2...5.3.0-alpha.3) (2022-03-27)
-
-
-### Features
-
-* add MongoDB 5.2 support ([#7894](https://github.com/parse-community/parse-server/issues/7894)) ([6b4b358](https://github.com/parse-community/parse-server/commit/6b4b358f0842ae920e45652f5e8b2afebc6caf3a))
-
-# [5.3.0-alpha.2](https://github.com/parse-community/parse-server/compare/5.3.0-alpha.1...5.3.0-alpha.2) (2022-03-27)
-
-
-### Bug Fixes
-
-* security upgrade parse push adapter from 4.1.0 to 4.1.2 ([#7893](https://github.com/parse-community/parse-server/issues/7893)) ([ef56e98](https://github.com/parse-community/parse-server/commit/ef56e98ef65041b4d3b7b82cce3473269c27f6fd))
-
-# [5.3.0-alpha.1](https://github.com/parse-community/parse-server/compare/5.2.1-alpha.2...5.3.0-alpha.1) (2022-03-27)
-
-
-### Features
-
-* add MongoDB 5.1 compatibility ([#7682](https://github.com/parse-community/parse-server/issues/7682)) ([90155cf](https://github.com/parse-community/parse-server/commit/90155cf1680e5e0499b0000e071c6cb0ce3aef96))
-
-## [5.2.1-alpha.2](https://github.com/parse-community/parse-server/compare/5.2.1-alpha.1...5.2.1-alpha.2) (2022-03-26)
-
-
-### Performance Improvements
-
-* reduce database operations when using the constant parameter in Cloud Function validation ([#7892](https://github.com/parse-community/parse-server/issues/7892)) ([48bd512](https://github.com/parse-community/parse-server/commit/48bd512eeb47666967dff8c5e723ddc5b7801daa))
-
-## [5.2.1-alpha.1](https://github.com/parse-community/parse-server/compare/5.2.0...5.2.1-alpha.1) (2022-03-26)
-
-
-### Bug Fixes
-
-* return correct response when revert is used in beforeSave ([#7839](https://github.com/parse-community/parse-server/issues/7839)) ([f63fb2b](https://github.com/parse-community/parse-server/commit/f63fb2b338c908f0e7a648d338c26b9daa50c8f2))
-
 # [5.2.0-alpha.3](https://github.com/parse-community/parse-server/compare/5.2.0-alpha.2...5.2.0-alpha.3) (2022-03-24)


@@ -1,3 +1,31 @@
+## [5.2.4](https://github.com/parse-community/parse-server/compare/5.2.3...5.2.4) (2022-06-30)
+
+
+### Bug Fixes
+
+* protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) (https://github.com/parse-community/parse-server/pull/8074) ([#8073](https://github.com/parse-community/parse-server/issues/8073)) ([309f64c](https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1))
+
+## [5.2.3](https://github.com/parse-community/parse-server/compare/5.2.2...5.2.3) (2022-06-17)
+
+
+### Bug Fixes
+
+* invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) ([#8060](https://github.com/parse-community/parse-server/issues/8060)) ([5be375d](https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92))
+
+## [5.2.2](https://github.com/parse-community/parse-server/compare/5.2.1...5.2.2) (2022-06-17)
+
+
+### Bug Fixes
+
+* certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc)) ([ba2b0a9](https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1))
+
+## [5.2.1](https://github.com/parse-community/parse-server/compare/5.2.0...5.2.1) (2022-05-01)
+
+
+### Bug Fixes
+
+* authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) ([#7962](https://github.com/parse-community/parse-server/issues/7962)) ([af4a041](https://github.com/parse-community/parse-server/commit/af4a0417a9f3c1e99b3793806b4b18e04d9fa999))
+
 # [5.2.0](https://github.com/parse-community/parse-server/compare/5.1.1...5.2.0) (2022-03-24)


@@ -75,21 +75,17 @@ class NodeEngineCheck {

    // For each file
    for (const file of files) {
+
      // Get node version
      const contentString = await fs.readFile(file, 'utf-8');
-      try {
-        const contentJson = JSON.parse(contentString);
-        const version = ((contentJson || {}).engines || {}).node;
+      const contentJson = JSON.parse(contentString);
+      const version = ((contentJson || {}).engines || {}).node;

-        // Add response
-        response.push({
-          file: file,
-          nodeVersion: version
-        });
-      } catch(e) {
-        console.log(`Ignoring file because it is not valid JSON: ${file}`);
-        core.warning(`Ignoring file because it is not valid JSON: ${file}`);
-      }
+      // Add response
+      response.push({
+        file: file,
+        nodeVersion: version
+      });
    }

    // If results should be cleaned by removing undefined node versions
@@ -1,6 +1,6 @@
 {
  "name": "parse-server",
-  "version": "5.3.0-alpha.4",
+  "version": "5.2.4",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {
@@ -1109,11 +1109,11 @@
      }
    },
    "@babel/runtime-corejs3": {
-      "version": "7.14.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.14.7.tgz",
-      "integrity": "sha512-Wvzcw4mBYbTagyBVZpAJWI06auSIj033T/yNE0Zn1xcup83MieCddZA7ls3kme17L4NOGBrQ09Q+nKB41RLWBA==",
+      "version": "7.14.6",
+      "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.14.6.tgz",
+      "integrity": "sha512-Xl8SPYtdjcMoCsIM4teyVRg7jIcgl8F2kRtoCcXuHzXswt9UxZCS6BzRo8fcnCuP6u2XtPgvyonmEPF57Kxo9Q==",
      "requires": {
-        "core-js-pure": "^3.15.0",
+        "core-js-pure": "^3.14.0",
        "regenerator-runtime": "^0.13.4"
      }
    },
@@ -1850,20 +1850,20 @@
      "dev": true
    },
    "@parse/node-apn": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/@parse/node-apn/-/node-apn-5.1.3.tgz",
-      "integrity": "sha512-Bwhmbm895lEIF2772PJ8dSvBjrtOG9/q/TDMxmX40IgZxQFoXS73+JUIKTq3CA7SUB/Szu5roJINQ0L2U/1MJw==",
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@parse/node-apn/-/node-apn-5.1.0.tgz",
+      "integrity": "sha512-WT3iVwr1Y/Jf4nq4RGNwBdLwm3gTodsb+g3IY98MPSJ7LCNf+R81Nj/nQO5r/twJfN1v5B8cAgfvPGs2rPelvg==",
      "requires": {
-        "debug": "4.3.3",
+        "debug": "4.3.2",
        "jsonwebtoken": "8.5.1",
-        "node-forge": "1.3.0",
-        "verror": "1.10.1"
+        "node-forge": "0.10.0",
+        "verror": "1.10.0"
      },
      "dependencies": {
        "debug": {
-          "version": "4.3.3",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
-          "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+          "version": "4.3.2",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.2.tgz",
+          "integrity": "sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==",
          "requires": {
            "ms": "2.1.2"
          }
@@ -1872,16 +1872,6 @@
          "version": "2.1.2",
          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
          "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
-        },
-        "verror": {
-          "version": "1.10.1",
-          "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
-          "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
-          "requires": {
-            "assert-plus": "^1.0.0",
-            "core-util-is": "1.0.2",
-            "extsprintf": "^1.2.0"
-          }
        }
      }
    },
@@ -1896,36 +1886,42 @@
      }
    },
    "@parse/push-adapter": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/@parse/push-adapter/-/push-adapter-4.1.2.tgz",
-      "integrity": "sha512-034vZTlAzgdfefIY4+Q4j8DHS/VwUAIVoh1JeRkHNfyQmUQ++uKbQbUQdJ/nf11HHS69kwLENs13BmhlHMpyHQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@parse/push-adapter/-/push-adapter-4.1.0.tgz",
+      "integrity": "sha512-8SOU4zgIr3+wn6Hbge4X/zAYAcJR7puJ3aY2ri+8fqMARgBria4JkIeAyKaTG/mUMHw6Qy5DpYYRe0LjImjZNw==",
      "requires": {
-        "@parse/node-apn": "5.1.3",
+        "@parse/node-apn": "5.1.0",
        "@parse/node-gcm": "1.0.2",
        "npmlog": "4.1.2",
-        "parse": "3.4.0"
+        "parse": "3.3.0"
      },
      "dependencies": {
        "@babel/runtime": {
-          "version": "7.15.4",
-          "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.15.4.tgz",
-          "integrity": "sha512-99catp6bHCaxr4sJ/DbTGgHS4+Rs2RVd2g7iOap6SLGPDknRK9ztKNsE/Fg6QhSeh1FGE5f6gHGQmvvn3I3xhw==",
+          "version": "7.14.6",
+          "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.14.6.tgz",
+          "integrity": "sha512-/PCB2uJ7oM44tz8YhC4Z/6PeOKXp4K588f+5M3clr1M4zbqztlo0XEfJ2LEzj/FgwfgGcIdl8n7YYjTCI0BYwg==",
          "requires": {
            "regenerator-runtime": "^0.13.4"
          }
        },
+        "crypto-js": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.0.0.tgz",
+          "integrity": "sha512-bzHZN8Pn+gS7DQA6n+iUmBfl0hO5DJq++QP3U6uTucDtk/0iGpXd/Gg7CGR0p8tJhofJyaKoWBuJI4eAO00BBg==",
+          "optional": true
+        },
        "parse": {
-          "version": "3.4.0",
-          "resolved": "https://registry.npmjs.org/parse/-/parse-3.4.0.tgz",
-          "integrity": "sha512-FMZLxPW6PvrBgxkXc9AmnYsFKvPwiS4G2n9OI4mdfiSoNzIVLc+bXzlUdJ+I7hiqHsBTP0BrdQczw2/cnVkJ6w==",
+          "version": "3.3.0",
+          "resolved": "https://registry.npmjs.org/parse/-/parse-3.3.0.tgz",
+          "integrity": "sha512-SQkTDupU7JQBJpYFIpO8TlQjUtjboUdkXaak57pjoC1ZVbhaiNyLsdYbrlM0B+sNYhlvcMh7zwZW48u10+zm0A==",
          "requires": {
-            "@babel/runtime": "7.15.4",
-            "@babel/runtime-corejs3": "7.14.7",
-            "crypto-js": "4.1.1",
+            "@babel/runtime": "7.14.6",
+            "@babel/runtime-corejs3": "7.14.6",
+            "crypto-js": "4.0.0",
            "idb-keyval": "5.0.6",
            "react-native-crypto-js": "1.0.0",
            "uuid": "3.4.0",
-            "ws": "7.5.1",
+            "ws": "7.5.0",
            "xmlhttprequest": "1.8.0"
          }
        },
@@ -1935,9 +1931,9 @@
          "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A=="
        },
        "ws": {
-          "version": "7.5.1",
-          "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.1.tgz",
-          "integrity": "sha512-2c6faOUH/nhoQN6abwMloF7Iyl0ZS2E9HGtsiLrWn0zOOMWlhtDmdf/uihDt6jnuCxgtwGBNy6Onsoy2s2O2Ow=="
+          "version": "7.5.0",
+          "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.0.tgz",
+          "integrity": "sha512-6ezXvzOZupqKj4jUqbQ9tXuJNo+BR2gU8fFRk3XCP3e0G6WT414u5ELe6Y0vtp7kmSJ3F7YWObSNr1ESsgi4vw=="
        }
      }
    },
@@ -10447,21 +10443,21 @@
      "integrity": "sha512-kHmoybcPV8Sqy59DwNDY3Jefr64lK/by/da0ViFcuA4DH0vQg5Q6Ze5VimxkfQNSC+Mls/Kx53s7TjP1RhFEDQ=="
    },
    "mongodb": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-4.4.1.tgz",
-      "integrity": "sha512-IAD3nFtCR4s22vi5qjqkCBnuyDDrOW8WVSSmgHquOvGaP1iTD+XpC5tr8wAUbZ2EeZkaswwBKQFHDvl4qYcKqQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-4.3.1.tgz",
+      "integrity": "sha512-sNa8APSIk+r4x31ZwctKjuPSaeKuvUeNb/fu/3B6dRM02HpEgig7hTHM8A/PJQTlxuC/KFWlDlQjhsk/S43tBg==",
      "requires": {
        "bson": "^4.6.1",
        "denque": "^2.0.1",
-        "mongodb-connection-string-url": "^2.5.2",
+        "mongodb-connection-string-url": "^2.4.1",
        "saslprep": "^1.0.3",
-        "socks": "^2.6.2"
+        "socks": "^2.6.1"
      },
      "dependencies": {
        "bson": {
-          "version": "4.6.2",
-          "resolved": "https://registry.npmjs.org/bson/-/bson-4.6.2.tgz",
-          "integrity": "sha512-VeJKHShcu1b/ugl0QiujlVuBepab714X9nNyBdA1kfekuDGecxgpTA2Z6nYbagrWFeiIyzSWIOzju3lhj+RNyQ==",
+          "version": "4.6.1",
+          "resolved": "https://registry.npmjs.org/bson/-/bson-4.6.1.tgz",
+          "integrity": "sha512-I1LQ7Hz5zgwR4QquilLNZwbhPw0Apx7i7X9kGMBTsqPdml/03Q9NBtD9nt/19ahjlphktQImrnderxqpzeVDjw==",
          "requires": {
            "buffer": "^5.6.0"
          }
@@ -10474,9 +10470,9 @@
      }
    },
    "mongodb-connection-string-url": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/mongodb-connection-string-url/-/mongodb-connection-string-url-2.5.2.tgz",
-      "integrity": "sha512-tWDyIG8cQlI5k3skB6ywaEA5F9f5OntrKKsT/Lteub2zgwSUlhqEN2inGgBTm8bpYJf8QYBdA/5naz65XDpczA==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/mongodb-connection-string-url/-/mongodb-connection-string-url-2.4.1.tgz",
+      "integrity": "sha512-d5Kd2bVsKcSA7YI/yo57fSTtMwRQdFkvc5IZwod1RRxJtECeWPPSo7zqcUGJELifRA//Igs4spVtYAmvFCatug==",
      "requires": {
        "@types/whatwg-url": "^8.2.1",
        "whatwg-url": "^11.0.0"
@@ -10903,9 +10899,9 @@
      }
    },
    "node-forge": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.0.tgz",
-      "integrity": "sha512-08ARB91bUi6zNKzVmaj3QO7cr397uiDT2nJ63cHjyNtCTWIgvS47j3eT0WfzUwS9+6Z5YshRaoasFkXCKrIYbA=="
+      "version": "0.10.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz",
+      "integrity": "sha512-PPmu8eEeG9saEUvI97fm4OYxXVB6bFvyNTyiUOBichBpFG8A1Ljw3bY62+5oOjDEMHRnd0Y7HQ+x7uzxOzC6JA=="
    },
    "node-netstat": {
      "version": "1.8.0",
@@ -15536,12 +15532,12 @@
      }
    },
    "socks": {
-      "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.6.2.tgz",
-      "integrity": "sha512-zDZhHhZRY9PxRruRMR7kMhnf3I8hDs4S3f9RecfnGxvcBHQcKcIH/oUcEWffsfl1XxdYlA7nnlGbbTvPz9D8gA==",
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.6.1.tgz",
+      "integrity": "sha512-kLQ9N5ucj8uIcxrDwjm0Jsqk06xdpBjGNQtpXy4Q8/QY2k+fY7nZH8CARy+hkbG+SGAovmzzuauCpBlb8FrnBA==",
      "requires": {
        "ip": "^1.1.5",
-        "smart-buffer": "^4.2.0"
+        "smart-buffer": "^4.1.0"
      }
    },
    "sort-keys": {
@@ -1,6 +1,6 @@
 {
  "name": "parse-server",
-  "version": "5.3.0-alpha.4",
+  "version": "5.2.4",
  "description": "An express module providing a Parse-compatible API server",
  "main": "lib/index.js",
  "repository": {
@@ -19,13 +19,13 @@
  ],
  "license": "BSD-3-Clause",
  "dependencies": {
-    "@apollo/client": "3.5.8",
    "@apollographql/graphql-playground-html": "1.6.29",
    "@graphql-tools/links": "8.2.2",
+    "@apollo/client": "3.5.8",
    "@graphql-tools/stitch": "6.2.4",
    "@graphql-tools/utils": "6.2.4",
    "@parse/fs-files-adapter": "1.2.1",
-    "@parse/push-adapter": "4.1.2",
+    "@parse/push-adapter": "4.1.0",
    "apollo-server-express": "2.25.2",
    "bcryptjs": "2.4.3",
    "body-parser": "1.19.1",
@@ -46,7 +46,7 @@
    "lodash": "4.17.21",
    "lru-cache": "6.0.0",
    "mime": "3.0.0",
-    "mongodb": "4.4.1",
+    "mongodb": "4.3.1",
    "mustache": "4.2.0",
    "parse": "3.4.1",
    "pg-monitor": "1.4.1",
@@ -116,18 +116,16 @@
    "test:mongodb:runnerstart": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=$npm_config_dbversion} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
    "test:mongodb:testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=$npm_config_dbversion} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
    "test:mongodb": "npm run test:mongodb:runnerstart --dbversion=$npm_config_dbversion && npm run test:mongodb:testonly --dbversion=$npm_config_dbversion",
-    "test:mongodb:4.0.28": "npm run test:mongodb --dbversion=4.0.28",
-    "test:mongodb:4.2.19": "npm run test:mongodb --dbversion=4.2.19",
-    "test:mongodb:4.4.13": "npm run test:mongodb --dbversion=4.4.13",
-    "test:mongodb:5.0.6": "npm run test:mongodb --dbversion=5.0.6",
-    "test:mongodb:5.1.1": "npm run test:mongodb --dbversion=5.1.1",
-    "test:mongodb:5.2.1": "npm run test:mongodb --dbversion=5.2.1",
+    "test:mongodb:4.0.27": "npm run test:mongodb --dbversion=4.0.27",
+    "test:mongodb:4.2.17": "npm run test:mongodb --dbversion=4.2.17",
+    "test:mongodb:4.4.10": "npm run test:mongodb --dbversion=4.4.10",
+    "test:mongodb:5.0.5": "npm run test:mongodb --dbversion=5.0.5",
    "posttest:mongodb": "mongodb-runner stop",
-    "pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.2.1} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
-    "testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.2.1} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
+    "pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.0.5} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
+    "testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.0.5} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
    "test": "npm run testonly",
-    "posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.2.1} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
-    "coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.2.1} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
+    "posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.0.5} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
+    "coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=5.0.5} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
    "start": "node ./bin/parse-server",
    "prettier": "prettier --write {src,spec}/{**/*,*}.js",
    "prepare": "npm run build",
@@ -83,21 +83,20 @@ async function config() {
      ['@semantic-release/git', {
        assets: [changelogFile, 'package.json', 'package-lock.json', 'npm-shrinkwrap.json'],
      }],
+      ['@semantic-release/github', {
+        successComment: getReleaseComment(),
+        labels: ['type:ci'],
+        releasedLabels: ['state:released<%= nextRelease.channel ? `-\${nextRelease.channel}` : "" %>']
+      }],
      [
        "@saithodev/semantic-release-backmerge",
        {
          "branches": [
            { from: "beta", to: "alpha" },
            { from: "release", to: "beta" },
-            { from: "release", to: "alpha" },
          ]
        }
      ],
-      ['@semantic-release/github', {
-        successComment: getReleaseComment(),
-        labels: ['type:ci'],
-        releasedLabels: ['state:released<%= nextRelease.channel ? `-\${nextRelease.channel}` : "" %>']
-      }],
    ],
  };

@@ -23,25 +23,23 @@ const nestedOptionTypes = [
  'PagesRoute',
  'PasswordPolicyOptions',
  'SecurityOptions',
-  'SchemaOptions',
 ];

 /** The prefix of environment variables for nested options. */
 const nestedOptionEnvPrefix = {
-  'AccountLockoutOptions': 'PARSE_SERVER_ACCOUNT_LOCKOUT_',
-  'CustomPagesOptions': 'PARSE_SERVER_CUSTOM_PAGES_',
+  'AccountLockoutOptions' : 'PARSE_SERVER_ACCOUNT_LOCKOUT_',
+  'CustomPagesOptions' : 'PARSE_SERVER_CUSTOM_PAGES_',
  'DatabaseOptions': 'PARSE_SERVER_DATABASE_',
-  'FileUploadOptions': 'PARSE_SERVER_FILE_UPLOAD_',
-  'IdempotencyOptions': 'PARSE_SERVER_EXPERIMENTAL_IDEMPOTENCY_',
-  'LiveQueryOptions': 'PARSE_SERVER_LIVEQUERY_',
-  'LiveQueryServerOptions': 'PARSE_LIVE_QUERY_SERVER_',
-  'PagesCustomUrlsOptions': 'PARSE_SERVER_PAGES_CUSTOM_URL_',
-  'PagesOptions': 'PARSE_SERVER_PAGES_',
+  'FileUploadOptions' : 'PARSE_SERVER_FILE_UPLOAD_',
+  'IdempotencyOptions' : 'PARSE_SERVER_EXPERIMENTAL_IDEMPOTENCY_',
+  'LiveQueryOptions' : 'PARSE_SERVER_LIVEQUERY_',
+  'LiveQueryServerOptions' : 'PARSE_LIVE_QUERY_SERVER_',
+  'PagesCustomUrlsOptions' : 'PARSE_SERVER_PAGES_CUSTOM_URL_',
+  'PagesOptions' : 'PARSE_SERVER_PAGES_',
  'PagesRoute': 'PARSE_SERVER_PAGES_ROUTE_',
-  'ParseServerOptions': 'PARSE_SERVER_',
-  'PasswordPolicyOptions': 'PARSE_SERVER_PASSWORD_POLICY_',
+  'ParseServerOptions' : 'PARSE_SERVER_',
+  'PasswordPolicyOptions' : 'PARSE_SERVER_PASSWORD_POLICY_',
  'SecurityOptions': 'PARSE_SERVER_SECURITY_',
-  'SchemaOptions': 'PARSE_SERVER_SCHEMA_',
 };

 function last(array) {
@@ -52,7 +50,7 @@ const letters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
 function toENV(key) {
  let str = '';
  let previousIsUpper = false;
-  for (let i = 0; i < key.length; i++) {
+  for(let i = 0; i < key.length; i++) {
    const char = key[i];
    if (letters.indexOf(char) >= 0) {
      if (!previousIsUpper) {
@@ -275,8 +273,8 @@ function inject(t, list) {
  return { results, comments };
 }

-const makeRequire = function (variableName, module, t) {
-  const decl = t.variableDeclarator(t.identifier(variableName), t.callExpression(t.identifier('require'), [t.stringLiteral(module)]));
+const makeRequire = function(variableName, module, t) {
+  const decl = t.variableDeclarator(t.identifier(variableName),  t.callExpression(t.identifier('require'), [t.stringLiteral(module)]));
  return t.variableDeclaration('var', [decl])
 }
 let docs = ``;
@@ -285,14 +283,14 @@ const plugin = function (babel) {
  const moduleExports = t.memberExpression(t.identifier('module'), t.identifier('exports'));
  return {
    visitor: {
-      ImportDeclaration: function (path) {
+      ImportDeclaration: function(path) {
        path.remove();
      },
-      Program: function (path) {
+      Program: function(path) {
        // Inject the parser's loader
        path.unshiftContainer('body', makeRequire('parsers', './parsers', t));
      },
-      ExportDeclaration: function (path) {
+      ExportDeclaration: function(path) {
        // Export declaration on an interface
        if (path.node && path.node.declaration && path.node.declaration.type == 'InterfaceDeclaration') {
          const { results, comments } = inject(t, doInterface(path.node.declaration));
@@ -315,6 +313,6 @@ Do not edit manually, but update Options/index.js
 `

 const babel = require("@babel/core");
-const res = babel.transformFileSync('./src/Options/index.js', { plugins: [plugin, '@babel/transform-flow-strip-types'], babelrc: false, auxiliaryCommentBefore, sourceMaps: false });
+const res = babel.transformFileSync('./src/Options/index.js', { plugins: [ plugin, '@babel/transform-flow-strip-types' ], babelrc: false, auxiliaryCommentBefore, sourceMaps: false });
 require('fs').writeFileSync('./src/Options/Definitions.js', res.code + '\n');
 require('fs').writeFileSync('./src/Options/docs.js', docs);
@@ -1652,8 +1652,41 @@ describe('apple signin auth adapter', () => {

 describe('Apple Game Center Auth adapter', () => {
  const gcenter = require('../lib/Adapters/Auth/gcenter');
-
+  const fs = require('fs');
+  const testCert = fs.readFileSync(__dirname + '/support/cert/game_center.pem');
+  it('can load adapter', async () => {
+    const options = {
+      gcenter: {
+        rootCertificateUrl:
+          'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
+      },
+    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
+  });
  it('validateAuthData should validate', async () => {
+    const options = {
+      gcenter: {
+        rootCertificateUrl:
+          'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
+      },
+    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
    // real token is used
    const authData = {
      id: 'G:1965586982',
@@ -1664,68 +1697,147 @@ describe('Apple Game Center Auth adapter', () => {
      salt: 'DzqqrQ==',
      bundleId: 'cloud.xtralife.gamecenterauth',
    };
-
-    try {
-      await gcenter.validateAuthData(authData);
-    } catch (e) {
-      fail();
-    }
+    gcenter.cache['https://static.gc.apple.com/public-key/gc-prod-4.cer'] = testCert;
+    await gcenter.validateAuthData(authData);
  });

  it('validateAuthData invalid signature id', async () => {
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      {}
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
    const authData = {
      id: 'G:1965586982',
-      publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer',
+      publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-6.cer',
      timestamp: 1565257031287,
      signature: '1234',
      salt: 'DzqqrQ==',
-      bundleId: 'cloud.xtralife.gamecenterauth',
+      bundleId: 'com.example.com',
    };
-
-    try {
-      await gcenter.validateAuthData(authData);
-      fail();
-    } catch (e) {
-      expect(e.message).toBe('Apple Game Center - invalid signature');
-    }
-  });
-
-  it('validateAuthData invalid public key url', async () => {
-    const authData = {
-      id: 'G:1965586982',
-      publicKeyUrl: 'invalid.com',
-      timestamp: 1565257031287,
-      signature: '1234',
-      salt: 'DzqqrQ==',
-      bundleId: 'cloud.xtralife.gamecenterauth',
-    };
-
-    try {
-      await gcenter.validateAuthData(authData);
-      fail();
-    } catch (e) {
-      expect(e.message).toBe('Apple Game Center - invalid publicKeyUrl: invalid.com');
-    }
+    await expectAsync(gcenter.validateAuthData(authData)).toBeRejectedWith(
+      new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Apple Game Center - invalid signature')
+    );
  });

  it('validateAuthData invalid public key http url', async () => {
-    const authData = {
-      id: 'G:1965586982',
-      publicKeyUrl: 'http://static.gc.apple.com/public-key/gc-prod-4.cer',
-      timestamp: 1565257031287,
-      signature: '1234',
-      salt: 'DzqqrQ==',
-      bundleId: 'cloud.xtralife.gamecenterauth',
+    const options = {
+      gcenter: {
+        rootCertificateUrl:
+          'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
+      },
    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
+    const publicKeyUrls = [
+      'example.com',
+      'http://static.gc.apple.com/public-key/gc-prod-4.cer',
+      'https://developer.apple.com/assets/elements/badges/download-on-the-app-store.svg',
+      'https://example.com/ \\.apple.com/public_key.cer',
+      'https://example.com/ &.apple.com/public_key.cer',
+    ];
+    await Promise.all(
+      publicKeyUrls.map(publicKeyUrl =>
+        expectAsync(
+          gcenter.validateAuthData({
+            id: 'G:1965586982',
+            timestamp: 1565257031287,
+            publicKeyUrl,
+            signature: '1234',
+            salt: 'DzqqrQ==',
+            bundleId: 'com.example.com',
+          })
+        ).toBeRejectedWith(
+          new Parse.Error(
+            Parse.Error.SCRIPT_FAILED,
+            `Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
+          )
+        )
+      )
+    );
+  });

-    try {
-      await gcenter.validateAuthData(authData);
-      fail();
-    } catch (e) {
-      expect(e.message).toBe(
-        'Apple Game Center - invalid publicKeyUrl: http://static.gc.apple.com/public-key/gc-prod-4.cer'
-      );
-    }
+  it('should not validate Symantec Cert', async () => {
+    const options = {
+      gcenter: {
+        rootCertificateUrl:
+          'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem',
+      },
+    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
+    expect(() =>
+      gcenter.verifyPublicKeyIssuer(
+        testCert,
+        'https://static.gc.apple.com/public-key/gc-prod-4.cer'
+      )
+    );
+  });
+
+  it('adapter should load default cert', async () => {
+    const options = {
+      gcenter: {},
+    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
+    const previous = new Date();
+    await adapter.validateAppId(
+      appIds,
+      { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+      providerOptions
+    );
+
+    const duration = new Date().getTime() - previous.getTime();
+    expect(duration).toEqual(0);
+  });
+
+  it('adapter should throw', async () => {
+    const options = {
+      gcenter: {
+        rootCertificateUrl: 'https://example.com',
+      },
+    };
+    const { adapter, appIds, providerOptions } = authenticationLoader.loadAuthAdapter(
+      'gcenter',
+      options
+    );
+    await expectAsync(
+      adapter.validateAppId(
+        appIds,
+        { publicKeyUrl: 'https://static.gc.apple.com/public-key/gc-prod-4.cer' },
+        providerOptions
+      )
+    ).toBeRejectedWith(
+      new Parse.Error(
+        Parse.Error.OBJECT_NOT_FOUND,
+        'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
+      )
+    );
  });
 });

@@ -1494,110 +1494,6 @@ describe('Cloud Code', () => {
    });
  });

-  it('before save can revert fields', async () => {
-    Parse.Cloud.beforeSave('TestObject', ({ object }) => {
-      object.revert('foo');
-      return object;
-    });
-
-    Parse.Cloud.afterSave('TestObject', ({ object }) => {
-      expect(object.get('foo')).toBeUndefined();
-      return object;
-    });
-
-    const obj = new TestObject();
-    obj.set('foo', 'bar');
-    await obj.save();
-
-    expect(obj.get('foo')).toBeUndefined();
-    await obj.fetch();
-
-    expect(obj.get('foo')).toBeUndefined();
-  });
-
-  it('before save can revert fields with existing object', async () => {
-    Parse.Cloud.beforeSave(
-      'TestObject',
-      ({ object }) => {
-        object.revert('foo');
-        return object;
-      },
-      {
-        skipWithMasterKey: true,
-      }
-    );
-
-    Parse.Cloud.afterSave(
-      'TestObject',
-      ({ object }) => {
-        expect(object.get('foo')).toBe('bar');
-        return object;
-      },
-      {
-        skipWithMasterKey: true,
-      }
-    );
-
-    const obj = new TestObject();
-    obj.set('foo', 'bar');
-    await obj.save(null, { useMasterKey: true });
-
-    expect(obj.get('foo')).toBe('bar');
-    obj.set('foo', 'yolo');
-    await obj.save();
-    expect(obj.get('foo')).toBe('bar');
-  });
-
-  it('can unset in afterSave', async () => {
-    Parse.Cloud.beforeSave('TestObject', ({ object }) => {
-      if (!object.existed()) {
-        object.set('secret', true);
-        return object;
-      }
-      object.revert('secret');
-    });
-
-    Parse.Cloud.afterSave('TestObject', ({ object }) => {
-      object.unset('secret');
-    });
-
-    Parse.Cloud.beforeFind(
-      'TestObject',
-      ({ query }) => {
-        query.exclude('secret');
-      },
-      {
-        skipWithMasterKey: true,
-      }
-    );
-
-    const obj = new TestObject();
-    await obj.save();
-    expect(obj.get('secret')).toBeUndefined();
-    await obj.fetch();
-    expect(obj.get('secret')).toBeUndefined();
-    await obj.fetch({ useMasterKey: true });
-    expect(obj.get('secret')).toBe(true);
-  });
-
-  it('should revert in beforeSave', async () => {
-    Parse.Cloud.beforeSave('MyObject', ({ object }) => {
-      if (!object.existed()) {
-        object.set('count', 0);
-        return object;
-      }
-      object.revert('count');
-      return object;
-    });
-    const obj = await new Parse.Object('MyObject').save();
-    expect(obj.get('count')).toBe(0);
-    obj.set('count', 10);
-    await obj.save();
-    expect(obj.get('count')).toBe(0);
-    await obj.fetch();
-    expect(obj.get('count')).toBe(0);
-  });
-
  it('beforeSave should not sanitize database', async done => {
    const { adapter } = Config.get(Parse.applicationId).database;
    const spy = spyOn(adapter, 'findOneAndUpdate').and.callThrough();
@@ -1964,36 +1860,6 @@ describe('afterSave hooks', () => {
    const myObject = new MyObject();
    myObject.save().then(() => done());
  });
-
-  it('should unset in afterSave', async () => {
-    Parse.Cloud.afterSave(
-      'MyObject',
-      ({ object }) => {
-        object.unset('secret');
-      },
-      {
-        skipWithMasterKey: true,
-      }
-    );
-    const obj = new Parse.Object('MyObject');
-    obj.set('secret', 'bar');
-    await obj.save();
-    expect(obj.get('secret')).toBeUndefined();
-    await obj.fetch();
-    expect(obj.get('secret')).toBe('bar');
-  });
-
-  it('should unset', async () => {
-    Parse.Cloud.beforeSave('MyObject', ({ object }) => {
-      object.set('secret', 'hidden');
-    });
-
-    Parse.Cloud.afterSave('MyObject', ({ object }) => {
-      object.unset('secret');
-    });
-    const obj = await new Parse.Object('MyObject').save();
-    expect(obj.get('secret')).toBeUndefined();
-  });
 });

 describe('beforeDelete hooks', () => {
@@ -43,20 +43,6 @@ describe('FilesController', () => {
    done();
  });

-  it_only_db('mongo')('should pass databaseOptions to GridFSBucketAdapter', async () => {
-    await reconfigureServer({
-      databaseURI: 'mongodb://localhost:27017/parse',
-      filesAdapter: null,
-      databaseAdapter: null,
-      databaseOptions: {
-        retryWrites: true,
-      },
-    });
-    const config = Config.get(Parse.applicationId);
-    expect(config.database.adapter._mongoOptions.retryWrites).toBeTrue();
-    expect(config.filesController.adapter._mongoOptions.retryWrites).toBeTrue();
-  });
-
  it('should create a server log on failure', done => {
    const logController = new LoggerController(new WinstonLoggerAdapter());

@@ -308,7 +308,7 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
    await expectAsync(adapter.getClass('UnknownClass')).toBeRejectedWith(undefined);
  });

-  it_only_mongodb_version('<5.1')('should use index for caseInsensitive query', async () => {
+  it('should use index for caseInsensitive query', async () => {
    const user = new Parse.User();
    user.set('username', 'Bugs');
    user.set('password', 'Bunny');
@@ -342,40 +342,6 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
    expect(postIndexPlan.executionStats.executionStages.stage).toBe('FETCH');
  });

-  it_only_mongodb_version('>=5.1')('should use index for caseInsensitive query', async () => {
-    const user = new Parse.User();
-    user.set('username', 'Bugs');
-    user.set('password', 'Bunny');
-    await user.signUp();
-
-    const database = Config.get(Parse.applicationId).database;
-    await database.adapter.dropAllIndexes('_User');
-
-    const preIndexPlan = await database.find(
-      '_User',
-      { username: 'bugs' },
-      { caseInsensitive: true, explain: true }
-    );
-
-    const schema = await new Parse.Schema('_User').get();
-
-    await database.adapter.ensureIndex(
-      '_User',
-      schema,
-      ['username'],
-      'case_insensitive_username',
-      true
-    );
-
-    const postIndexPlan = await database.find(
-      '_User',
-      { username: 'bugs' },
-      { caseInsensitive: true, explain: true }
-    );
-    expect(preIndexPlan.queryPlanner.winningPlan.queryPlan.stage).toBe('COLLSCAN');
-    expect(postIndexPlan.queryPlanner.winningPlan.queryPlan.stage).toBe('FETCH');
-  });
-
  it('should delete field without index', async () => {
    const database = Config.get(Parse.applicationId).database;
    const obj = new Parse.Object('MyObject');
@@ -654,6 +654,44 @@ describe('Parse.File testing', () => {
    });
  });

+  describe('getting files', () => {
+    it('does not crash on file request with invalid app ID', async () => {
+      const res1 = await request({
+        url: 'http://localhost:8378/1/files/invalid-id/invalid-file.txt',
+      }).catch(e => e);
+      expect(res1.status).toBe(403);
+      expect(res1.data).toEqual({ code: 119, error: 'Invalid application ID.' });
+      // Ensure server did not crash
+      const res2 = await request({ url: 'http://localhost:8378/1/health' });
+      expect(res2.status).toEqual(200);
+      expect(res2.data).toEqual({ status: 'ok' });
+    });
+
+    it('does not crash on file request with invalid path', async () => {
+      const res1 = await request({
+        url: 'http://localhost:8378/1/files/invalid-id//invalid-path/%20/invalid-file.txt',
+      }).catch(e => e);
+      expect(res1.status).toBe(403);
+      expect(res1.data).toEqual({ error: 'unauthorized' });
+      // Ensure server did not crash
+      const res2 = await request({ url: 'http://localhost:8378/1/health' });
+      expect(res2.status).toEqual(200);
+      expect(res2.data).toEqual({ status: 'ok' });
+    });
+
+    it('does not crash on file metadata request with invalid app ID', async () => {
+      const res1 = await request({
+        url: `http://localhost:8378/1/files/invalid-id/metadata/invalid-file.txt`,
+      });
+      expect(res1.status).toBe(200);
+      expect(res1.data).toEqual({});
+      // Ensure server did not crash
+      const res2 = await request({ url: 'http://localhost:8378/1/health' });
+      expect(res2.status).toEqual(200);
+      expect(res2.data).toEqual({ status: 'ok' });
+    });
+  });
+
  xdescribe('Gridstore Range tests', () => {
    it('supports range requests', done => {
      const headers = {
@@ -1066,6 +1066,52 @@ describe('ParseLiveQuery', function () {
    }
  });

+  it('should strip out protected fields', async () => {
+    await reconfigureServer({
+      liveQuery: { classNames: ['Test'] },
+      startLiveQueryServer: true,
+    });
+    const obj1 = new Parse.Object('Test');
+    obj1.set('foo', 'foo');
+    obj1.set('bar', 'bar');
+    obj1.set('qux', 'qux');
+    await obj1.save();
+    const config = Config.get(Parse.applicationId);
+    const schemaController = await config.database.loadSchema();
+    await schemaController.updateClass(
+      'Test',
+      {},
+      {
+        get: { '*': true },
+        find: { '*': true },
+        update: { '*': true },
+        protectedFields: {
+          '*': ['foo'],
+        },
+      }
+    );
+    const object = await obj1.fetch();
+    expect(object.get('foo')).toBe(undefined);
+    expect(object.get('bar')).toBeDefined();
+    expect(object.get('qux')).toBeDefined();
+
+    const subscription = await new Parse.Query('Test').subscribe();
+    await Promise.all([
+      new Promise(resolve => {
+        subscription.on('update', (obj, original) => {
+          expect(obj.get('foo')).toBe(undefined);
+          expect(obj.get('bar')).toBeDefined();
+          expect(obj.get('qux')).toBeDefined();
+          expect(original.get('foo')).toBe(undefined);
+          expect(original.get('bar')).toBeDefined();
+          expect(original.get('qux')).toBeDefined();
+          resolve();
+        });
+      }),
+      obj1.save({ foo: 'abc' }),
+    ]);
+  });
+
  afterEach(async function (done) {
    const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
    client.close();
@@ -27,7 +27,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    await TestUtils.destroyAllDataPermanently(false);
  });

-  it_only_mongodb_version('<5.1')('query find with hint string', async () => {
+  it('query find with hint string', async () => {
    const object = new TestObject();
    await object.save();

@@ -39,18 +39,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(explain.queryPlanner.winningPlan.inputStage.indexName).toBe('_id_');
  });

-  it_only_mongodb_version('>=5.1')('query find with hint string', async () => {
-    const object = new TestObject();
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    const explain = await collection._rawFind({ _id: object.id }, { hint: '_id_', explain: true });
-    expect(explain.queryPlanner.winningPlan.queryPlan.stage).toBe('FETCH');
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('IXSCAN');
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.indexName).toBe('_id_');
-  });
-
-  it_only_mongodb_version('<5.1')('query find with hint object', async () => {
+  it('query find with hint object', async () => {
    const object = new TestObject();
    await object.save();

@@ -64,20 +53,6 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    });
  });

-  it_only_mongodb_version('>=5.1')('query find with hint object', async () => {
-    const object = new TestObject();
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    const explain = await collection._rawFind(
-      { _id: object.id },
-      { hint: { _id: 1 }, explain: true }
-    );
-    expect(explain.queryPlanner.winningPlan.queryPlan.stage).toBe('FETCH');
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('IXSCAN');
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.keyPattern).toEqual({ _id: 1 });
-  });
-
  it_only_mongodb_version('<4.4')('query aggregate with hint string', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();
@@ -98,7 +73,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.indexName).toBe('_id_');
  });

-  it_only_mongodb_version('>=4.4<5.1')('query aggregate with hint string', async () => {
+  it_only_mongodb_version('>=4.4')('query aggregate with hint string', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();

@@ -122,54 +97,6 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.inputStage.indexName).toBe('_id_');
  });

-  it_only_mongodb_version('>=5.1<5.2')('query aggregate with hint string', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    let result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      explain: true,
-    });
-    let { queryPlanner } = result[0].stages[0].$cursor;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      hint: '_id_',
-      explain: true,
-    });
-    queryPlanner = result[0].stages[0].$cursor.queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-  });
-
-  it_only_mongodb_version('>=5.2')('query aggregate with hint string', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    let result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      explain: true,
-    });
-    let queryPlanner = result[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      hint: '_id_',
-      explain: true,
-    });
-    queryPlanner = result[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-  });
-
  it_only_mongodb_version('<4.4')('query aggregate with hint object', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();
@@ -190,7 +117,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.keyPattern).toEqual({ _id: 1 });
  });

-  it_only_mongodb_version('>=4.4<5.1')('query aggregate with hint object', async () => {
+  it_only_mongodb_version('>=4.4')('query aggregate with hint object', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();

@@ -215,57 +142,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
  });

-  it_only_mongodb_version('>=5.1<5.2')('query aggregate with hint object', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    let result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      explain: true,
-    });
-    let { queryPlanner } = result[0].stages[0].$cursor;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      hint: { _id: 1 },
-      explain: true,
-    });
-    queryPlanner = result[0].stages[0].$cursor.queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
-  });
-
-  it_only_mongodb_version('>=5.2')('query aggregate with hint object', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-
-    const collection = await config.database.adapter._adaptiveCollection('TestObject');
-    let result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      explain: true,
-    });
-    let queryPlanner = result[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    result = await collection.aggregate([{ $group: { _id: '$foo' } }], {
-      hint: { _id: 1 },
-      explain: true,
-    });
-    queryPlanner = result[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
-  });
-
-  it_only_mongodb_version('<5.1')('query find with hint (rest)', async () => {
+  it('query find with hint (rest)', async () => {
    const object = new TestObject();
    await object.save();
    let options = Object.assign({}, masterKeyOptions, {
@@ -290,31 +167,6 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(explain.queryPlanner.winningPlan.inputStage.inputStage.indexName).toBe('_id_');
  });

-  it_only_mongodb_version('>=5.1')('query find with hint (rest)', async () => {
-    const object = new TestObject();
-    await object.save();
-    let options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/classes/TestObject',
-      qs: {
-        explain: true,
-      },
-    });
-    let response = await request(options);
-    let explain = response.data.results;
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-
-    options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/classes/TestObject',
-      qs: {
-        explain: true,
-        hint: '_id_',
-      },
-    });
-    response = await request(options);
-    explain = response.data.results;
-    expect(explain.queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-  });
-
  it_only_mongodb_version('<4.4')('query aggregate with hint (rest)', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();
@@ -342,7 +194,7 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.keyPattern).toEqual({ _id: 1 });
  });

-  it_only_mongodb_version('>=4.4<5.1')('query aggregate with hint (rest)', async () => {
+  it_only_mongodb_version('>=4.4')('query aggregate with hint (rest)', async () => {
    const object = new TestObject({ foo: 'bar' });
    await object.save();
    let options = Object.assign({}, masterKeyOptions, {
@@ -374,70 +226,4 @@ describe_only_db('mongo')('Parse.Query hint', () => {
    expect(queryPlanner.winningPlan.inputStage.inputStage.indexName).toBe('_id_');
    expect(queryPlanner.winningPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
  });
-
-  it_only_mongodb_version('>=5.1<5.2')('query aggregate with hint (rest)', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-    let options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/aggregate/TestObject',
-      qs: {
-        explain: true,
-        group: JSON.stringify({ objectId: '$foo' }),
-      },
-    });
-    let response = await request(options);
-    let { queryPlanner } = response.data.results[0].stages[0].$cursor;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/aggregate/TestObject',
-      qs: {
-        explain: true,
-        hint: '_id_',
-        group: JSON.stringify({ objectId: '$foo' }),
-      },
-    });
-    response = await request(options);
-    queryPlanner = response.data.results[0].stages[0].$cursor.queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('PROJECTION_SIMPLE');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
-  });
-
-  it_only_mongodb_version('>=5.2')('query aggregate with hint (rest)', async () => {
-    const object = new TestObject({ foo: 'bar' });
-    await object.save();
-    let options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/aggregate/TestObject',
-      qs: {
-        explain: true,
-        group: JSON.stringify({ objectId: '$foo' }),
-      },
-    });
-    let response = await request(options);
-    let queryPlanner = response.data.results[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('COLLSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage).toBeUndefined();
-
-    options = Object.assign({}, masterKeyOptions, {
-      url: Parse.serverURL + '/aggregate/TestObject',
-      qs: {
-        explain: true,
-        hint: '_id_',
-        group: JSON.stringify({ objectId: '$foo' }),
-      },
-    });
-    response = await request(options);
-    queryPlanner = response.data.results[0].queryPlanner;
-    expect(queryPlanner.winningPlan.queryPlan.stage).toBe('GROUP');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.stage).toBe('FETCH');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.stage).toBe('IXSCAN');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.indexName).toBe('_id_');
-    expect(queryPlanner.winningPlan.queryPlan.inputStage.inputStage.keyPattern).toEqual({ _id: 1 });
-  });
 });
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEvDCCA6SgAwIBAgIQXRHxNXkw1L9z5/3EZ/T/hDANBgkqhkiG9w0BAQsFADB/
+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
+BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxMDAuBgNVBAMTJ1N5bWFudGVj
+IENsYXNzIDMgU0hBMjU2IENvZGUgU2lnbmluZyBDQTAeFw0xODA5MTcwMDAwMDBa
+Fw0xOTA5MTcyMzU5NTlaMHMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9y
+bmlhMRIwEAYDVQQHDAlDdXBlcnRpbm8xFDASBgNVBAoMC0FwcGxlLCBJbmMuMQ8w
+DQYDVQQLDAZHQyBTUkUxFDASBgNVBAMMC0FwcGxlLCBJbmMuMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA06fwIi8fgKrTQu7cBcFkJVF6+Tqvkg7MKJTM
+IOYPPQtPF3AZYPsbUoRKAD7/JXrxxOSVJ7vU1mP77tYG8TcUteZ3sAwvt2dkRbm7
+ZO6DcmSggv1Dg4k3goNw4GYyCY4Z2/8JSmsQ80Iv/UOOwynpBziEeZmJ4uck6zlA
+17cDkH48LBpKylaqthym5bFs9gj11pto7mvyb5BTcVuohwi6qosvbs/4VGbC2Nsz
+ie416nUZfv+xxoXH995gxR2mw5cDdeCew7pSKxEhvYjT2nVdQF0q/hnPMFnOaEyT
+q79n3gwFXyt0dy8eP6KBF7EW9J6b7ubu/j7h+tQfxPM+gTXOBQIDAQABo4IBPjCC
+ATowCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH
+AwMwYQYDVR0gBFowWDBWBgZngQwBBAEwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9k
+LnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGQwXaHR0cHM6Ly9kLnN5bWNiLmNv
+bS9ycGEwHwYDVR0jBBgwFoAUljtT8Hkzl699g+8uK8zKt4YecmYwKwYDVR0fBCQw
+IjAgoB6gHIYaaHR0cDovL3N2LnN5bWNiLmNvbS9zdi5jcmwwVwYIKwYBBQUHAQEE
+SzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Yuc3ltY2QuY29tMCYGCCsGAQUFBzAC
+hhpodHRwOi8vc3Yuc3ltY2IuY29tL3N2LmNydDANBgkqhkiG9w0BAQsFAAOCAQEA
+I/j/PcCNPebSAGrcqSFBSa2mmbusOX01eVBg8X0G/z8Z+ZWUfGFzDG0GQf89MPxV
+woec+nZuqui7o9Bg8s8JbHV0TC52X14CbTj9w/qBF748WbH9gAaTkrJYPm+MlNhu
+tjEuQdNl/YXVMvQW4O8UMHTi09GyJQ0NC4q92Wxvx1m/qzjvTLvrXHGQ9pEHhPyz
+vfBLxQkWpNoCNKU7UeESyH06XOrGc9MsII9deeKsDJp9a0jtx+pP4MFVtFME9SSQ
+tMBs0It7WwEf7qcRLpialxKwY2EzQ9g4WnANHqo18PrDBE10TFpZPzUh7JhMViVr
+EEbl0YdElmF8Hlamah/yNw==
+-----END CERTIFICATE-----
@@ -14,20 +14,14 @@ const authData = {
 const { Parse } = require('parse/node');
 const crypto = require('crypto');
 const https = require('https');
-
+const { pki } = require('node-forge');
+const ca = { cert: null, url: null };
 const cache = {}; // (publicKey -> cert) cache

 function verifyPublicKeyUrl(publicKeyUrl) {
  try {
-    const parsedUrl = new URL(publicKeyUrl);
-    if (parsedUrl.protocol !== 'https:') {
-      return false;
-    }
-    const hostnameParts = parsedUrl.hostname.split('.');
-    const length = hostnameParts.length;
-    const domainParts = hostnameParts.slice(length - 2, length);
-    const domain = domainParts.join('.');
-    return domain === 'apple.com';
+    const regex = /^https:\/\/(?:[-_A-Za-z0-9]+\.){0,}apple\.com\/.*\.cer$/;
+    return regex.test(publicKeyUrl);
  } catch (error) {
    return false;
  }
@@ -43,7 +37,7 @@ function convertX509CertToPEM(X509Cert) {
  return pemPreFix + certBody + pemPostFix;
 }

-function getAppleCertificate(publicKeyUrl) {
+async function getAppleCertificate(publicKeyUrl) {
  if (!verifyPublicKeyUrl(publicKeyUrl)) {
    throw new Parse.Error(
      Parse.Error.OBJECT_NOT_FOUND,
@@ -53,26 +47,59 @@ function getAppleCertificate(publicKeyUrl) {
  if (cache[publicKeyUrl]) {
    return cache[publicKeyUrl];
  }
+  const url = new URL(publicKeyUrl);
+  const headOptions = {
+    hostname: url.hostname,
+    path: url.pathname,
+    method: 'HEAD',
+  };
+  const cert_headers = await new Promise((resolve, reject) =>
+    https.get(headOptions, res => resolve(res.headers)).on('error', reject)
+  );
+  const validContentTypes = ['application/x-x509-ca-cert', 'application/pkix-cert'];
+  if (
+    !validContentTypes.includes(cert_headers['content-type']) ||
+    cert_headers['content-length'] == null ||
+    cert_headers['content-length'] > 10000
+  ) {
+    throw new Parse.Error(
+      Parse.Error.OBJECT_NOT_FOUND,
+      `Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
+    );
+  }
+  const { certificate, headers } = await getCertificate(publicKeyUrl);
+  if (headers['cache-control']) {
+    const expire = headers['cache-control'].match(/max-age=([0-9]+)/);
+    if (expire) {
+      cache[publicKeyUrl] = certificate;
+      // we'll expire the cache entry later, as per max-age
+      setTimeout(() => {
+        delete cache[publicKeyUrl];
+      }, parseInt(expire[1], 10) * 1000);
+    }
+  }
+  return verifyPublicKeyIssuer(certificate, publicKeyUrl);
+}
+
+function getCertificate(url, buffer) {
  return new Promise((resolve, reject) => {
    https
-      .get(publicKeyUrl, res => {
-        let data = '';
+      .get(url, res => {
+        const data = [];
        res.on('data', chunk => {
-          data += chunk.toString('base64');
+          data.push(chunk);
        });
        res.on('end', () => {
-          const cert = convertX509CertToPEM(data);
-          if (res.headers['cache-control']) {
-            var expire = res.headers['cache-control'].match(/max-age=([0-9]+)/);
-            if (expire) {
-              cache[publicKeyUrl] = cert;
-              // we'll expire the cache entry later, as per max-age
-              setTimeout(() => {
-                delete cache[publicKeyUrl];
-              }, parseInt(expire[1], 10) * 1000);
-            }
+          if (buffer) {
+            resolve({ certificate: Buffer.concat(data), headers: res.headers });
+            return;
          }
-          resolve(cert);
+          let cert = '';
+          for (const chunk of data) {
+            cert += chunk.toString('base64');
+          }
+          const certificate = convertX509CertToPEM(cert);
+          resolve({ certificate, headers: res.headers });
        });
      })
      .on('error', reject);
@@ -103,6 +130,30 @@ function verifySignature(publicKey, authData) {
  }
 }

+function verifyPublicKeyIssuer(cert, publicKeyUrl) {
+  const publicKeyCert = pki.certificateFromPem(cert);
+  if (!ca.cert) {
+    throw new Parse.Error(
+      Parse.Error.OBJECT_NOT_FOUND,
+      'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
+    );
+  }
+  try {
+    if (!ca.cert.verify(publicKeyCert)) {
+      throw new Parse.Error(
+        Parse.Error.OBJECT_NOT_FOUND,
+        `Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
+      );
+    }
+  } catch (e) {
+    throw new Parse.Error(
+      Parse.Error.OBJECT_NOT_FOUND,
+      `Apple Game Center - invalid publicKeyUrl: ${publicKeyUrl}`
+    );
+  }
+  return cert;
+}
+
 // Returns a promise that fulfills if this user id is valid.
 async function validateAuthData(authData) {
  if (!authData.id) {
@@ -114,11 +165,31 @@ async function validateAuthData(authData) {
 }

 // Returns a promise that fulfills if this app id is valid.
-function validateAppId() {
-  return Promise.resolve();
+async function validateAppId(appIds, authData, options = {}) {
+  if (!options.rootCertificateUrl) {
+    options.rootCertificateUrl =
+      'https://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt.pem';
+  }
+  if (ca.url === options.rootCertificateUrl) {
+    return;
+  }
+  const { certificate, headers } = await getCertificate(options.rootCertificateUrl, true);
+  if (
+    headers['content-type'] !== 'application/x-pem-file' ||
+    headers['content-length'] == null ||
+    headers['content-length'] > 10000
+  ) {
+    throw new Parse.Error(
+      Parse.Error.OBJECT_NOT_FOUND,
+      'Apple Game Center auth adapter parameter `rootCertificateURL` is invalid.'
+    );
+  }
+  ca.cert = pki.certificateFromPem(certificate);
+  ca.url = options.rootCertificateUrl;
 }

 module.exports = {
  validateAppId,
  validateAuthData,
+  cache,
 };
@@ -127,7 +127,7 @@ const filterSensitiveData = (
  aclGroup: any[],
  auth: any,
  operation: any,
-  schema: SchemaController.SchemaController,
+  schema: SchemaController.SchemaController | any,
  className: string,
  protectedFields: null | Array<any>,
  object: any
@@ -136,7 +136,8 @@ const filterSensitiveData = (
  if (auth && auth.user) userId = auth.user.id;

  // replace protectedFields when using pointer-permissions
-  const perms = schema.getClassLevelPermissions(className);
+  const perms =
+    schema && schema.getClassLevelPermissions ? schema.getClassLevelPermissions(className) : {};
  if (perms) {
    const isReadOperation = ['get', 'find'].indexOf(operation) > -1;

@@ -1533,14 +1534,17 @@ class DatabaseController {
  }

  addProtectedFields(
-    schema: SchemaController.SchemaController,
+    schema: SchemaController.SchemaController | any,
    className: string,
    query: any = {},
    aclGroup: any[] = [],
    auth: any = {},
    queryOptions: FullQueryOptions = {}
  ): null | string[] {
-    const perms = schema.getClassLevelPermissions(className);
+    const perms =
+      schema && schema.getClassLevelPermissions
+        ? schema.getClassLevelPermissions(className)
+        : schema;
    if (!perms) return null;

    const protectedFields = perms.protectedFields;
@@ -1806,8 +1810,10 @@ class DatabaseController {
  }

  static _validateQuery: any => void;
+  static filterSensitiveData: (boolean, any[], any, any, any, string, any[], any) => void;
 }

 module.exports = DatabaseController;
 // Expose validateQuery for tests
 module.exports._validateQuery = validateQuery;
+module.exports.filterSensitiveData = filterSensitiveData;
@@ -91,20 +91,12 @@ export function getLoggerController(options: ParseServerOptions): LoggerControll
 }

 export function getFilesController(options: ParseServerOptions): FilesController {
-  const {
-    appId,
-    databaseURI,
-    databaseOptions = {},
-    filesAdapter,
-    databaseAdapter,
-    preserveFileName,
-    fileKey,
-  } = options;
+  const { appId, databaseURI, filesAdapter, databaseAdapter, preserveFileName, fileKey } = options;
  if (!filesAdapter && databaseAdapter) {
    throw 'When using an explicit database adapter, you must also use an explicit filesAdapter.';
  }
  const filesControllerAdapter = loadAdapter(filesAdapter, () => {
-    return new GridFSBucketAdapter(databaseURI, databaseOptions, fileKey);
+    return new GridFSBucketAdapter(databaseURI, {}, fileKey);
  });
  return new FilesController(filesControllerAdapter, appId, {
    preserveFileName,
@@ -33,6 +33,9 @@ class ParseCloudCodePublisher {
    if (request.original) {
      message.originalParseObject = request.original._toFullJSON();
    }
+    if (request.classLevelPermissions) {
+      message.classLevelPermissions = request.classLevelPermissions;
+    }
    this.parsePublisher.publish(type, JSON.stringify(message));
  }
 }
@@ -10,11 +10,18 @@ import { ParsePubSub } from './ParsePubSub';
 import SchemaController from '../Controllers/SchemaController';
 import _ from 'lodash';
 import { v4 as uuidv4 } from 'uuid';
-import { runLiveQueryEventHandlers, getTrigger, runTrigger, resolveError, toJSONwithObjects } from '../triggers';
+import {
+  runLiveQueryEventHandlers,
+  getTrigger,
+  runTrigger,
+  resolveError,
+  toJSONwithObjects,
+} from '../triggers';
 import { getAuthForSessionToken, Auth } from '../Auth';
-import { getCacheController } from '../Controllers';
+import { getCacheController, getDatabaseController } from '../Controllers';
 import LRU from 'lru-cache';
 import UserRouter from '../Routers/UsersRouter';
+import DatabaseController from '../Controllers/DatabaseController';

 class ParseLiveQueryServer {
  clients: Map;
@@ -185,14 +192,14 @@ class ParseLiveQueryServer {
            if (res.object && typeof res.object.toJSON === 'function') {
              deletedParseObject = toJSONwithObjects(res.object, res.object.className || className);
            }
-            if (
-              (deletedParseObject.className === '_User' ||
-                deletedParseObject.className === '_Session') &&
-              !client.hasMasterKey
-            ) {
-              delete deletedParseObject.sessionToken;
-              delete deletedParseObject.authData;
-            }
+            await this._filterSensitiveData(
+              classLevelPermissions,
+              res,
+              client,
+              requestId,
+              op,
+              subscription.query
+            );
            client.pushDelete(requestId, deletedParseObject);
          } catch (e) {
            const error = resolveError(e);
@@ -339,16 +346,14 @@ class ParseLiveQueryServer {
                res.original.className || className
              );
            }
-            if (
-              (currentParseObject.className === '_User' ||
-                currentParseObject.className === '_Session') &&
-              !client.hasMasterKey
-            ) {
-              delete currentParseObject.sessionToken;
-              delete originalParseObject?.sessionToken;
-              delete currentParseObject.authData;
-              delete originalParseObject?.authData;
-            }
+            await this._filterSensitiveData(
+              classLevelPermissions,
+              res,
+              client,
+              requestId,
+              op,
+              subscription.query
+            );
            const functionName = 'push' + res.event.charAt(0).toUpperCase() + res.event.slice(1);
            if (client[functionName]) {
              client[functionName](requestId, currentParseObject, originalParseObject);
@@ -540,6 +545,54 @@ class ParseLiveQueryServer {
    // return rolesQuery.find({useMasterKey:true});
  }

+  async _filterSensitiveData(
+    classLevelPermissions: ?any,
+    res: any,
+    client: any,
+    requestId: number,
+    op: string,
+    query: any
+  ) {
+    const subscriptionInfo = client.getSubscriptionInfo(requestId);
+    const aclGroup = ['*'];
+    let clientAuth;
+    if (typeof subscriptionInfo !== 'undefined') {
+      const { userId, auth } = await this.getAuthForSessionToken(subscriptionInfo.sessionToken);
+      if (userId) {
+        aclGroup.push(userId);
+      }
+      clientAuth = auth;
+    }
+    const filter = obj => {
+      if (!obj) {
+        return;
+      }
+      let protectedFields = classLevelPermissions?.protectedFields || [];
+      if (!client.hasMasterKey && !Array.isArray(protectedFields)) {
+        protectedFields = getDatabaseController(this.config).addProtectedFields(
+          classLevelPermissions,
+          res.object.className,
+          query,
+          aclGroup,
+          clientAuth
+        );
+      }
+      return DatabaseController.filterSensitiveData(
+        client.hasMasterKey,
+        aclGroup,
+        clientAuth,
+        op,
+        classLevelPermissions,
+        res.object.className,
+        protectedFields,
+        obj,
+        query
+      );
+    };
+    res.object = filter(res.object);
+    res.original = filter(res.original);
+  }
+
  _getCLPOperation(query: any) {
    return typeof query === 'object' &&
      Object.keys(query).length == 1 &&
@@ -5,51 +5,6 @@ Do not edit manually, but update Options/index.js
 */
 var parsers = require('./parsers');

-module.exports.SchemaOptions = {
-  afterMigration: {
-    env: 'PARSE_SERVER_SCHEMA_AFTER_MIGRATION',
-    help: 'Execute a callback after running schema migrations.',
-  },
-  beforeMigration: {
-    env: 'PARSE_SERVER_SCHEMA_BEFORE_MIGRATION',
-    help: 'Execute a callback before running schema migrations.',
-  },
-  definitions: {
-    env: 'PARSE_SERVER_SCHEMA_DEFINITIONS',
-    help:
-      'Rest representation on Parse.Schema https://docs.parseplatform.org/rest/guide/#adding-a-schema',
-    required: true,
-    action: parsers.objectParser,
-    default: [],
-  },
-  deleteExtraFields: {
-    env: 'PARSE_SERVER_SCHEMA_DELETE_EXTRA_FIELDS',
-    help:
-      'Is true if Parse Server should delete any fields not defined in a schema definition. This should only be used during development.',
-    action: parsers.booleanParser,
-    default: false,
-  },
-  lockSchemas: {
-    env: 'PARSE_SERVER_SCHEMA_LOCK_SCHEMAS',
-    help:
-      'Is true if Parse Server will reject any attempts to modify the schema while the server is running.',
-    action: parsers.booleanParser,
-    default: false,
-  },
-  recreateModifiedFields: {
-    env: 'PARSE_SERVER_SCHEMA_RECREATE_MODIFIED_FIELDS',
-    help:
-      'Is true if Parse Server should recreate any fields that are different between the current database schema and theschema definition. This should only be used during development.',
-    action: parsers.booleanParser,
-    default: false,
-  },
-  strict: {
-    env: 'PARSE_SERVER_SCHEMA_STRICT',
-    help: 'Is true if Parse Server should exit if schema update fail.',
-    action: parsers.booleanParser,
-    default: false,
-  },
-};
 module.exports.ParseServerOptions = {
  accountLockout: {
    env: 'PARSE_SERVER_ACCOUNT_LOCKOUT',
@@ -430,11 +385,6 @@ module.exports.ParseServerOptions = {
    action: parsers.booleanParser,
    default: false,
  },
-  schema: {
-    env: 'PARSE_SERVER_SCHEMA',
-    help: 'Defined schema',
-    action: parsers.objectParser,
-  },
  security: {
    env: 'PARSE_SERVER_SECURITY',
    help: 'The security options to identify and report weak security settings.',
@@ -514,6 +464,45 @@ module.exports.SecurityOptions = {
    default: false,
  },
 };
+module.exports.SchemaOptions = {
+  definitions: {
+    help: 'The schema definitions.',
+    default: [],
+  },
+  strict: {
+    env: 'PARSE_SERVER_SCHEMA_STRICT',
+    help: 'Is true if Parse Server should exit if schema update fail.',
+    action: parsers.booleanParser,
+    default: true,
+  },
+  deleteExtraFields: {
+    env: 'PARSE_SERVER_SCHEMA_DELETE_EXTRA_FIELDS',
+    help:
+      'Is true if Parse Server should delete any fields not defined in a schema definition. This should only be used during development.',
+    action: parsers.booleanParser,
+    default: false,
+  },
+  recreateModifiedFields: {
+    env: 'PARSE_SERVER_SCHEMA_RECREATE_MODIFIED_FIELDS',
+    help:
+      'Is true if Parse Server should recreate any fields that are different between the current database schema and theschema definition. This should only be used during development.',
+    action: parsers.booleanParser,
+    default: false,
+  },
+  lockSchemas: {
+    env: 'PARSE_SERVER_SCHEMA_LOCK',
+    help:
+      'Is true if Parse Server will reject any attempts to modify the schema while the server is running.',
+    action: parsers.booleanParser,
+    default: false,
+  },
+  beforeMigration: {
+    help: 'Execute a callback before running schema migrations.',
+  },
+  afterMigration: {
+    help: 'Execute a callback after running schema migrations.',
+  },
+};
 module.exports.PagesOptions = {
  customRoutes: {
    env: 'PARSE_SERVER_PAGES_CUSTOM_ROUTES',
@@ -1,14 +1,3 @@
-/**
- * @interface SchemaOptions
- * @property {Function} afterMigration Execute a callback after running schema migrations.
- * @property {Function} beforeMigration Execute a callback before running schema migrations.
- * @property {Any} definitions Rest representation on Parse.Schema https://docs.parseplatform.org/rest/guide/#adding-a-schema
- * @property {Boolean} deleteExtraFields Is true if Parse Server should delete any fields not defined in a schema definition. This should only be used during development.
- * @property {Boolean} lockSchemas Is true if Parse Server will reject any attempts to modify the schema while the server is running.
- * @property {Boolean} recreateModifiedFields Is true if Parse Server should recreate any fields that are different between the current database schema and theschema definition. This should only be used during development.
- * @property {Boolean} strict Is true if Parse Server should exit if schema update fail.
- */
-
 /**
 * @interface ParseServerOptions
 * @property {AccountLockoutOptions} accountLockout The account lockout policy for failed login attempts.
@@ -79,7 +68,6 @@
 * @property {String} restAPIKey Key for REST calls
 * @property {Boolean} revokeSessionOnPasswordReset When a user changes their password, either through the reset password email or while logged in, all sessions are revoked if this is true. Set to false if you don't want to revoke sessions.
 * @property {Boolean} scheduledPush Configuration for push scheduling, defaults to false.
- * @property {SchemaOptions} schema Defined schema
 * @property {SecurityOptions} security The security options to identify and report weak security settings.
 * @property {Function} serverCloseComplete Callback when server has closed
 * @property {Function} serverStartComplete Callback when server has started
@@ -8,28 +8,7 @@ import { MailAdapter } from '../Adapters/Email/MailAdapter';
 import { PubSubAdapter } from '../Adapters/PubSub/PubSubAdapter';
 import { WSSAdapter } from '../Adapters/WebSocketServer/WSSAdapter';
 import { CheckGroup } from '../Security/CheckGroup';
-
-export interface SchemaOptions {
-  /* Rest representation on Parse.Schema https://docs.parseplatform.org/rest/guide/#adding-a-schema
-  :DEFAULT: [] */
-  definitions: any;
-  /* Is true if Parse Server should exit if schema update fail.
-  :DEFAULT: false */
-  strict: ?boolean;
-  /* Is true if Parse Server should delete any fields not defined in a schema definition. This should only be used during development.
-  :DEFAULT: false */
-  deleteExtraFields: ?boolean;
-  /* Is true if Parse Server should recreate any fields that are different between the current database schema and theschema definition. This should only be used during development.
-  :DEFAULT: false */
-  recreateModifiedFields: ?boolean;
-  /* Is true if Parse Server will reject any attempts to modify the schema while the server is running.
-  :DEFAULT: false */
-  lockSchemas: ?boolean;
-  /* Execute a callback before running schema migrations. */
-  beforeMigration: ?() => void | Promise<void>;
-  /* Execute a callback after running schema migrations. */
-  afterMigration: ?() => void | Promise<void>;
-}
+import type { SchemaOptions } from '../SchemaMigrations/Migrations';

 type Adapter<T> = string | any | T;
 type NumberOrBoolean = number | boolean;
@@ -267,9 +246,7 @@ export interface ParseServerOptions {
  playgroundPath: ?string;
  /* Callback when server has started */
  serverStartComplete: ?(error: ?Error) => void;
-  /* Defined schema
-  :ENV: PARSE_SERVER_SCHEMA
-  */
+  /* Rest representation on Parse.Schema https://docs.parseplatform.org/rest/guide/#adding-a-schema */
  schema: ?SchemaOptions;
  /* Callback when server has closed */
  serverCloseComplete: ?() => void;
@@ -95,7 +95,6 @@ function RestWrite(config, auth, className, query, data, originalData, clientSDK
  // Shared SchemaController to be reused to reduce the number of loadSchema() calls per request
  // Once set the schemaData should be immutable
  this.validSchemaController = null;
-  this.pendingOps = {};
 }

 // A convenient method to perform all the steps of processing the
@@ -226,11 +225,18 @@ RestWrite.prototype.runBeforeSaveTrigger = function () {
    return Promise.resolve();
  }

-  const { originalObject, updatedObject } = this.buildParseObjects();
+  // Cloud code gets a bit of extra data for its objects
+  var extraData = { className: this.className };
+  if (this.query && this.query.objectId) {
+    extraData.objectId = this.query.objectId;
+  }

-  const stateController = Parse.CoreManager.getObjectStateController();
-  const [pending] = stateController.getPendingOps(updatedObject._getStateIdentifier());
-  this.pendingOps = { ...pending };
+  let originalObject = null;
+  const updatedObject = this.buildUpdatedObject(extraData);
+  if (this.query && this.query.objectId) {
+    // This is an update for existing object.
+    originalObject = triggers.inflate(extraData, this.originalData);
+  }

  return Promise.resolve()
    .then(() => {
@@ -1525,7 +1531,20 @@ RestWrite.prototype.runAfterSaveTrigger = function () {
    return Promise.resolve();
  }

-  const { originalObject, updatedObject } = this.buildParseObjects();
+  var extraData = { className: this.className };
+  if (this.query && this.query.objectId) {
+    extraData.objectId = this.query.objectId;
+  }
+
+  // Build the original object, we only do this for a update write.
+  let originalObject;
+  if (this.query && this.query.objectId) {
+    originalObject = triggers.inflate(extraData, this.originalData);
+  }
+
+  // Build the inflated object, different from beforeSave, originalData is not empty
+  // since developers can change data in the beforeSave.
+  const updatedObject = this.buildUpdatedObject(extraData);
  updatedObject._handleSaveResponse(this.response.response, this.response.status || 200);

  this.config.database.loadSchema().then(schemaController => {
@@ -1550,15 +1569,8 @@ RestWrite.prototype.runAfterSaveTrigger = function () {
      this.context
    )
    .then(result => {
-      const jsonReturned = result && !result._toFullJSON;
-      if (jsonReturned) {
-        this.pendingOps = {};
+      if (result && typeof result === 'object') {
        this.response.response = result;
-      } else {
-        this.response.response = this._updateResponseWithData(
-          (result || updatedObject)._toFullJSON(),
-          this.data
-        );
      }
    })
    .catch(function (err) {
@@ -1592,13 +1604,7 @@ RestWrite.prototype.sanitizedData = function () {
 };

 // Returns an updated copy of the object
-RestWrite.prototype.buildParseObjects = function () {
-  const extraData = { className: this.className, objectId: this.query?.objectId };
-  let originalObject;
-  if (this.query && this.query.objectId) {
-    originalObject = triggers.inflate(extraData, this.originalData);
-  }
-
+RestWrite.prototype.buildUpdatedObject = function (extraData) {
  const className = Parse.Object.fromJSON(extraData);
  const readOnlyAttributes = className.constructor.readOnlyAttributes
    ? className.constructor.readOnlyAttributes()
@@ -1636,7 +1642,7 @@ RestWrite.prototype.buildParseObjects = function () {
    delete sanitized[attribute];
  }
  updatedObject.set(sanitized);
-  return { updatedObject, originalObject };
+  return updatedObject;
 };

 RestWrite.prototype.cleanUserAuthData = function () {
@@ -1656,15 +1662,6 @@ RestWrite.prototype.cleanUserAuthData = function () {
 };

 RestWrite.prototype._updateResponseWithData = function (response, data) {
-  const { updatedObject } = this.buildParseObjects();
-  const stateController = Parse.CoreManager.getObjectStateController();
-  const [pending] = stateController.getPendingOps(updatedObject._getStateIdentifier());
-  for (const key in this.pendingOps) {
-    if (!pending[key]) {
-      data[key] = this.originalData ? this.originalData[key] : { __op: 'Delete' };
-      this.storage.fieldsChangedByTrigger.push(key);
-    }
-  }
  if (_.isEmpty(this.storage.fieldsChangedByTrigger)) {
    return response;
  }
@@ -66,6 +66,12 @@ export class FilesRouter {

  getHandler(req, res) {
    const config = Config.get(req.params.appId);
+    if (!config) {
+      res.status(403);
+      const err = new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid application ID.');
+      res.json({ code: err.code, error: err.message });
+      return;
+    }
    const filesController = config.filesController;
    const filename = req.params.filename;
    const contentType = mime.getType(filename);
@@ -250,10 +256,10 @@ export class FilesRouter {
  }

  async metadataHandler(req, res) {
-    const config = Config.get(req.params.appId);
-    const { filesController } = config;
-    const { filename } = req.params;
    try {
+      const config = Config.get(req.params.appId);
+      const { filesController } = config;
+      const { filename } = req.params;
      const data = await filesController.getMetadata(filename);
      res.status(200);
      res.json(data);
@@ -1,15 +1,5 @@
 // @flow

-export interface SchemaOptions {
-  definitions: JSONSchema[];
-  strict: ?boolean;
-  deleteExtraFields: ?boolean;
-  recreateModifiedFields: ?boolean;
-  lockSchemas: ?boolean;
-  beforeMigration: ?() => void | Promise<void>;
-  afterMigration: ?() => void | Promise<void>;
-}
-
 export type FieldValueType =
  | 'String'
  | 'Boolean'
@@ -45,6 +35,17 @@ export interface IndexesInterface {
  [key: string]: IndexInterface;
 }

+export interface SchemaOptions {
+  definitions: JSONSchema[];
+  strict: ?boolean;
+  deleteExtraFields: ?boolean;
+  recreateModifiedFields: ?boolean;
+  lockSchemas: ?boolean;
+  /* Callback when server has started and before running schemas migration operations if schemas key provided */
+  beforeMigration: ?() => void | Promise<void>;
+  afterMigration: ?() => void | Promise<void>;
+}
+
 export type CLPOperation = 'find' | 'count' | 'get' | 'update' | 'create' | 'delete';
 // @Typescript 4.1+ // type CLPPermission = 'requiresAuthentication' | '*' |  `user:${string}` | `role:${string}`

@@ -738,7 +738,7 @@ async function builtInTriggerValidator(options, request, auth) {
        }
        if (opt.constant && request.object) {
          if (request.original) {
-            request.object.revert(key);
+            request.object.set(key, request.original.get(key));
          } else if (opt.default != null) {
            request.object.set(key, opt.default);
          }
Author	SHA1	Message	Date
semantic-release-bot	e42be5c526	chore(release): 5.2.4 [skip ci] ## [5.2.4](https://github.com/parse-community/parse-server/compare/5.2.3...5.2.4) (2022-06-30) ### Bug Fixes * protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh)) (https://github.com/parse-community/parse-server/pull/8074) ([#8073](https://github.com/parse-community/parse-server/issues/8073)) ([`309f64c`](https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1))	2022-06-30 10:46:12 +00:00
Manuel	309f64ced8	fix: protected fields exposed via LiveQuery; this removes protected fields from the client response; this may be a breaking change if your app is currently expecting to receive these protected fields ([GHSA-crrq-vr9j-fxxh](https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh )) (https://github.com/parse-community/parse-server/pull/8074 ) (#8073 )	2022-06-30 12:26:39 +02:00
semantic-release-bot	eb2952fff7	chore(release): 5.2.3 [skip ci] ## [5.2.3](https://github.com/parse-community/parse-server/compare/5.2.2...5.2.3) (2022-06-17) ### Bug Fixes * invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) ([#8060](https://github.com/parse-community/parse-server/issues/8060)) ([`5be375d`](https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92))	2022-06-17 23:40:39 +00:00
Manuel	5be375dec2	fix: invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9 )) (#8060 )	2022-06-18 01:33:19 +02:00
semantic-release-bot	ed0baa87af	chore(release): 5.2.2 [skip ci] ## [5.2.2](https://github.com/parse-community/parse-server/compare/5.2.1...5.2.2) (2022-06-17) ### Bug Fixes * certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc)) ([`ba2b0a9`](https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1))	2022-06-17 16:36:47 +00:00
Manuel	ba2b0a9cb9	fix: certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc ))	2022-06-17 18:29:26 +02:00
semantic-release-bot	a8aef820af	chore(release): 5.2.1 [skip ci] ## [5.2.1](https://github.com/parse-community/parse-server/compare/5.2.0...5.2.1) (2022-05-01) ### Bug Fixes * authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) ([#7962](https://github.com/parse-community/parse-server/issues/7962)) ([`af4a041`](https://github.com/parse-community/parse-server/commit/af4a0417a9f3c1e99b3793806b4b18e04d9fa999))	2022-05-01 00:31:48 +00:00
Manuel	af4a0417a9	fix: authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) (#7962 )	2022-05-01 02:28:16 +02:00