From 88f16ddfe1e3e491731c757ed002943123c8b234 Mon Sep 17 00:00:00 2001
From: Florent Vilmart <florentvilmart@me.com>
Date: Thu, 8 Sep 2016 21:17:19 -0400
Subject: [PATCH 1/4] Adds test to repro #2672

---
 spec/ParseAPI.spec.js | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/spec/ParseAPI.spec.js b/spec/ParseAPI.spec.js
index eebb940916..37655b2800 100644
--- a/spec/ParseAPI.spec.js
+++ b/spec/ParseAPI.spec.js
@@ -1494,6 +1494,42 @@ it('ensure that if you try to sign up a user with a unique username and email, b
       done();
     });
   });
+
+  it('should not update schema beforeSave #2672', (done) => {
+    Parse.Cloud.beforeSave('MyObject', (request, response) => {
+      if (request.object.get('secret')) {
+         response.error('cannot set secret here');
+         return;
+      }
+      response.success();
+    });
+
+    let object = new Parse.Object('MyObject');
+    object.set('key', 'value');
+    object.save().then(() => {
+      return object.save({'secret': 'should not update schema'});
+    }).then(() => {
+      fail();
+      done();
+    }, () => {
+      return rp({
+        method: 'GET',
+        headers: {
+          'X-Parse-Application-Id': 'test',
+          'X-Parse-Master-Key': 'test'
+        },
+        uri: 'http://localhost:8378/1/schemas/MyObject',
+        json: true
+      });
+    }).then((res) => {
+      let fields = res.fields;
+      expect(fields.secret).toBeUndefined();
+      done();
+    }, (err) => {
+      jfail(err);
+      done();
+    });
+  });
 });
 
 describe_only_db('mongo')('legacy _acl', () => {

From 0ee29c3f171bee6aa8f416f49e1754226a004ede Mon Sep 17 00:00:00 2001
From: Florent Vilmart <florentvilmart@me.com>
Date: Thu, 8 Sep 2016 21:17:56 -0400
Subject: [PATCH 2/4] Run schema validation after beforeSave is run

---
 src/RestWrite.js | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/RestWrite.js b/src/RestWrite.js
index ababdf025a..93de9ba668 100644
--- a/src/RestWrite.js
+++ b/src/RestWrite.js
@@ -62,8 +62,6 @@ RestWrite.prototype.execute = function() {
     return this.getUserAndRoleACL();
   }).then(() => {
     return this.validateClientClassCreation();
-  }).then(() => {
-    return this.validateSchema();
   }).then(() => {
     return this.handleInstallation();
   }).then(() => {
@@ -72,6 +70,8 @@ RestWrite.prototype.execute = function() {
     return this.validateAuthData();
   }).then(() => {
     return this.runBeforeTrigger();
+  }).then(() => {
+    return this.validateSchema();
   }).then(() => {
     return this.setRequiredFieldsIfNeeded();
   }).then(() => {
@@ -176,7 +176,6 @@ RestWrite.prototype.runBeforeTrigger = function() {
       if (this.query && this.query.objectId) {
         delete this.data.objectId
       }
-      return this.validateSchema();
     }
   });
 };

From b963b72cb9a8a72ed61edfb23b37b77ffe754b3c Mon Sep 17 00:00:00 2001
From: Florent Vilmart <florentvilmart@me.com>
Date: Thu, 8 Sep 2016 22:33:56 -0400
Subject: [PATCH 3/4] Makes authData part of base _User object

---
 spec/schemas.spec.js                | 5 ++++-
 src/Controllers/SchemaController.js | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/spec/schemas.spec.js b/spec/schemas.spec.js
index 83f7aa45b0..9c2aff1856 100644
--- a/spec/schemas.spec.js
+++ b/spec/schemas.spec.js
@@ -96,7 +96,8 @@ const userSchema = {
     "username": {"type": "String"},
     "password": {"type": "String"},
     "email": {"type": "String"},
-    "emailVerified": {"type": "Boolean"}
+    "emailVerified": {"type": "Boolean"},
+    "authData": {"type": "Object"}
   },
   "classLevelPermissions": defaultClassLevelPermissions,
 }
@@ -676,6 +677,7 @@ describe('schemas', () => {
             password: {type: 'String'},
             email: {type: 'String'},
             emailVerified: {type: 'Boolean'},
+            authData: {type: 'Object'},
             newField: {type: 'String'},
             ACL: {type: 'ACL'}
           },
@@ -696,6 +698,7 @@ describe('schemas', () => {
               password: {type: 'String'},
               email: {type: 'String'},
               emailVerified: {type: 'Boolean'},
+              authData: {type: 'Object'},
               newField: {type: 'String'},
               ACL: {type: 'ACL'}
             },
diff --git a/src/Controllers/SchemaController.js b/src/Controllers/SchemaController.js
index 6c0c0462bb..cd81531dff 100644
--- a/src/Controllers/SchemaController.js
+++ b/src/Controllers/SchemaController.js
@@ -31,6 +31,7 @@ const defaultColumns = Object.freeze({
     "password":      {type:'String'},
     "email":         {type:'String'},
     "emailVerified": {type:'Boolean'},
+    "authData":      {type:'Object'}
   },
   // The additional default columns for the _Installation collection (in addition to DefaultCols)
   _Installation: {

From 2ff4e25b050aacbc554e1401a658350778ef0f74 Mon Sep 17 00:00:00 2001
From: Florent Vilmart <florentvilmart@me.com>
Date: Thu, 8 Sep 2016 22:43:46 -0400
Subject: [PATCH 4/4] exclude flaky pg test

---
 spec/CloudCode.spec.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/spec/CloudCode.spec.js b/spec/CloudCode.spec.js
index 336e6c01b7..b5624cd5d5 100644
--- a/spec/CloudCode.spec.js
+++ b/spec/CloudCode.spec.js
@@ -954,7 +954,11 @@ it('beforeSave should not affect fetched pointers', done => {
     });
   });
 
-  it('should fully delete objects when using `unset` with beforeSave (regression test for #1840)', done => {
+  /*
+    TODO: fix for Postgres
+    trying to delete a field that doesn't exists doesn't play nice
+   */
+  it_exclude_dbs(['postgres'])('should fully delete objects when using `unset` with beforeSave (regression test for #1840)', done => {
     var TestObject = Parse.Object.extend('TestObject');
     var BeforeSaveObject = Parse.Object.extend('BeforeSaveChanged');