You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
const body = `## Outdated CI environment\n\nThis pull request was created because the CI environment uses frameworks that are not up-to-date.\nYou can see which frameworks need to be upgraded in the [logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).\n\n*⚠️ Use \`Squash and merge\` to merge this pull request.*`;
52
54
53
-
This pull request was created because the CI environment uses frameworks that are not up-to-date.
54
-
You can see which frameworks need to be upgraded in the [logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
55
+
// Check for existing open PR
56
+
const pulls = await github.rest.pulls.list({
57
+
owner,
58
+
repo,
59
+
head: `${owner}:${head}`,
60
+
state: 'open',
61
+
});
55
62
56
-
*⚠️ Use `Squash and merge` to merge this pull request.*
const body = `## Release\n\nThis pull request was created automatically according to the release cycle.\n\n> [!WARNING]\n> Only use \`Merge Commit\` to merge this pull request. Do not use \`Rebase and Merge\` or \`Squash and Merge\`.`;
39
41
40
-
This pull request was created automatically according to the release cycle.
41
-
42
-
> [!WARNING]
43
-
> Only use `Merge Commit` to merge this pull request. Do not use `Rebase and Merge` or `Squash and Merge`.
Copy file name to clipboardExpand all lines: README.md
+90Lines changed: 90 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -58,6 +58,8 @@ A big _thank you_ 🙏 to our [sponsors](#sponsors) and [backers](#backers) who
58
58
-[Basic Options](#basic-options)
59
59
-[Client Key Options](#client-key-options)
60
60
-[Access Scopes](#access-scopes)
61
+
-[Route Allow List](#route-allow-list)
62
+
-[Covered Routes](#covered-routes)
61
63
-[Email Verification and Password Reset](#email-verification-and-password-reset)
62
64
-[Password and Account Policy](#password-and-account-policy)
63
65
-[Custom Routes](#custom-routes)
@@ -77,6 +79,7 @@ A big _thank you_ 🙏 to our [sponsors](#sponsors) and [backers](#backers) who
77
79
-[Dynamic placeholders](#dynamic-placeholders)
78
80
-[Reserved Keys](#reserved-keys)
79
81
-[Parameters](#parameters-1)
82
+
-[Multi-Tenancy](#multi-tenancy)
80
83
-[Logging](#logging)
81
84
-[Deprecations](#deprecations)
82
85
-[Live Query](#live-query)
@@ -308,6 +311,89 @@ The client keys used with Parse are no longer necessary with Parse Server. If yo
308
311
> [!NOTE]
309
312
> In Cloud Code, both `masterKey` and `readOnlyMasterKey` set `request.master` to `true`. To distinguish between them, check `request.isReadOnly`. For example, use `request.master && !request.isReadOnly` to ensure full master key access.
310
313
314
+
## Route Allow List
315
+
316
+
The `routeAllowList` option restricts which API routes are accessible to external clients. When set, all external requests are denied by default unless the route matches one of the configured regex patterns. This is useful for apps where all logic runs in Cloud Code and clients should not access the API directly.
317
+
318
+
Internal calls from Cloud Code, Cloud Jobs, and triggers are not affected. Master key and maintenance key requests bypass the restriction.
319
+
320
+
```js
321
+
constserver=ParseServer({
322
+
...otherOptions,
323
+
routeAllowList: [
324
+
'classes/ChatMessage',
325
+
'classes/Public.*',
326
+
'users',
327
+
'login',
328
+
'functions/getMenu',
329
+
'health',
330
+
],
331
+
});
332
+
```
333
+
334
+
Each entry is a regex pattern matched against the normalized route identifier. Patterns are auto-anchored with `^` and `$` for full-match semantics. For example, `classes/Chat` matches only `classes/Chat`, not `classes/ChatRoom`. Use `classes/Chat.*` to match both.
335
+
336
+
Setting an empty array `[]` blocks all external non-master-key requests (full lockdown). Not setting the option preserves current behavior (all routes accessible).
337
+
338
+
### Covered Routes
339
+
340
+
The following table lists all route groups covered by `routeAllowList` with examples of how to allow them.
341
+
342
+
| Route group | Example route identifiers | Allow pattern |
> File routes are not covered by `routeAllowList`. File upload access is controlled via the `fileUpload` option. File download and metadata access is controlled via the `fileDownload` option.
396
+
311
397
## Email Verification and Password Reset
312
398
313
399
Verifying user email addresses and enabling password reset via email requires an email adapter. There are many email adapters provided and maintained by the community. The following is an example configuration with an example email adapter. See the [Parse Server Options][server-options] for more details and a full list of available options.
@@ -777,6 +863,10 @@ The following parameter and placeholder keys are reserved because they are used
777
863
778
864
- In combination with the [Parse Server API Mail Adapter](https://www.npmjs.com/package/parse-server-api-mail-adapter) Parse Server provides a fully localized flow (emails -> pages) for the user. The email adapter sends a localized email and adds a locale parameter to the password reset or email verification link, which is then used to respond with localized pages.
779
865
866
+
## Multi-Tenancy
867
+
868
+
Parse Server does not support multi-tenancy. Only one Parse Server instance may be mounted per Express app. Among other considerations, there is no isolation between apps in the same process. For example, Cloud Code runs in the same Node.js process as Parse Server and has full access to the server environment, such as server configuration, modules, and environment variables.
0 commit comments