Updating a Roles User doesn't fire LQ.

[dblythy]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Possibly related: #5839

Issue Description

If a user is listening to LQ events that they have read access to, and the ACL of an existing Parse.Object (that has the className of the LQ) is updated, an LQ event will fire.

However, this isn't the case with roles.

If a user is listening to LQ events that they have read access to, and the ACL's role of an existing Parse.Object (that has the className of the LQ) add are removes a user, objects that are now available to the user won't come through LQ.

Steps to reproduce

it('expect LQ to work with roles', async done => {
    await reconfigureServer({
      liveQuery: {
        classNames: ['TestObject'],
      },
      startLiveQueryServer: true,
      verbose: false,
      silent: true,
    });

    // setup objects
    const user = new Parse.User();
    user.setUsername('username');
    user.setPassword('password');
    await user.signUp();
    
    const role = new Parse.Role('TestRole', new Parse.ACL(user));
    await role.save();

    const object = new TestObject();
    const acl = new Parse.ACL();
    acl.setRoleReadAccess('TestRole', true);
    object.setACL(acl);
    await object.save(null, {useMasterKey: true});
    
    const query = new Parse.Query(TestObject);
    const subscription = await query.subscribe();

    subscription.on('enter', () => {
      done();
    });
    
    // add user to role
    role.getUsers().add(user);
    await role.save();

    setTimeout(() => {
      fail('LQ should be fired on ACL role update');
    }, 5000);
});

Actual Outcome

No LQ event.

Expected Outcome

When a role user is added or removed, Parse should internally query LQ classes for objects with that role name (possibly limited). If objects are found, they should be passed as LQ events to the client, as an enter or leave request."

This could be problematic and cause bottlenecks with a few LQ classes.

Alternatives:

beforeSave on role and maybe the option to Parse.Cloud.forceLiveQueryFind(Parse.User, 'className'), which could force an LQ to .find all related objects, with a new SDK method:

subscription.on('find', (objects) => {
  for (const obj of objects) {
    if (!allObjects.includes(obj)) {
      allObjects.push(obj);
    }
  }
});

Failing Test Case / Pull Request

• 🤩 I submitted a PR with a fix and a test case.
• 🧐 I submitted a PR with a failing test case.

Also related: Community discussion

[percypyan]

Hi ! The LiveQuery is listening for changes on the User collection, however when the you're adding or removing a user to a role, you are updating a role, not a user. This is why the LiveQuery isn't triggered.
On the other hand when you're update ACLs of an object, you are modify the object itself (ACLs being a field of the collection), so the LiveQuery is triggered as expected.

To be confirmed, but I think that is not a bug :)

[mtrezza]

@percypyan Thanks for the comment, after reading the issue again I agree that this seems more like a proposal for an enhancement than a bug.

Or is this even a non-issue, because the LQ trigger should be on the role class, @dblythy?

[dblythy]

Thank you @percypyan and @mtrezza for the thoughts. I think you both might be right. Let me check and I’ll let you know.