CVE-2020-15126: Incorrect Authorization (CWE-863)
value: In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2020-07-22T23:15Z
Repository: https://github.com/parse-community/parse-server
Language: JavaScript
Files changed: spec/ParseGraphQLServer.spec.js, src/GraphQL/loaders/usersMutations.js, src/GraphQL/loaders/usersQueries.js
Commit date: 2020-07-17 09:50:41 -0700
Commit message: Merge pull request from GHSA-236h-rqv8-8q73

* Fix graphql viewer breach

* fix

* remove comment
Diff: diff --git a/spec/ParseGraphQLServer.spec.js b/spec/ParseGraphQLServer.spec.js
index b805cabe..c1f23bc7 100644
--- a/spec/ParseGraphQLServer.spec.js
+++ b/spec/ParseGraphQLServer.spec.js
@@ -168,11 +168,11 @@ describe('ParseGraphQLServer', () => {
       let useCount = 0;
       expect(() =>
         new ParseGraphQLServer(parseServer, {
           graphQLPath: 'somepath',
         }).applyGraphQL({
-          use: (path) => {
+          use: path => {
             useCount++;
             expect(path).toEqual('somepath');
           },
         })
       ).not.toThrow();
@@ -206,11 +206,11 @@ describe('ParseGraphQLServer', () => {
       expect(() =>
         new ParseGraphQLServer(parseServer, {
           graphQLPath: 'graphQL',
           playgroundPath: 'somepath',
         }).applyPlayground({
-          get: (path) => {
+          get: path => {
             useCount++;
             expect(path).toEqual('somepath');
           },
         })
       ).not.toThrow();
@@ -434,13 +434,11 @@ describe('ParseGraphQLServer', () => {
         port: 1338,
       });
       parseGraphQLServer.applyGraphQL(expressApp);
       parseGraphQLServer.applyPlayground(expressApp);
       parseGraphQLServer.createSubscriptions(httpServer);
-      await new Promise((resolve) =>
-        httpServer.listen({ port: 13377 }, resolve)
-      );
+      await new Promise(resolve => httpServer.listen({ port: 13377 }, resolve));
 
       const subscriptionClient = new SubscriptionClient(
         'ws://localhost:13377/subscriptions',
         {
           reconnect: true,
@@ -504,11 +502,11 @@ describe('ParseGraphQLServer', () => {
 
       it('should be cors enabled', async () => {
         let checked = false;
         const apolloClient = new ApolloClient({
           link: new ApolloLink((operation, forward) => {
-            return forward(operation).map((response) => {
+            return forward(operation).map(response => {
               const context = operation.getContext();
               const {
                 response: { headers },
               } = context;
               expect(headers.get('access-control-allow-origin')).toEqual('*');
@@ -539,11 +537,11 @@ describe('ParseGraphQLServer', () => {
       });
 
       it('should handle Parse headers', async () => {
         let checked = false;
         const originalGetGraphQLOptions = parseGraphQLServer._getGraphQLOptions;
-        parseGraphQLServer._getGraphQLOptions = async (req) => {
+        parseGraphQLServer._getGraphQLOptions = async req => {
           expect(req.info).toBeDefined();
           expect(req.config).toBeDefined();
           expect(req.auth).toBeDefined();
           checked = true;
           return await originalGetGraphQLOptions.bind(parseGraphQLServer)(req);
@@ -641,11 +639,11 @@ describe('ParseGraphQLServer', () => {
                 }
               `,
             })
           ).data['__type'];
           expect(fileType.kind).toEqual('OBJECT');
-          expect(fileType.fields.map((field) => field.name).sort()).toEqual([
+          expect(fileType.fields.map(field => field.name).sort()).toEqual([
             'name',
             'url',
           ]);
         });
 
@@ -663,11 +661,11 @@ describe('ParseGraphQLServer', () => {
                 }
               `,
             })
           ).data['__type'];
           expect(classType.kind).toEqual('INTERFACE');
-          expect(classType.fields.map((field) => field.name).sort()).toEqual([
+          expect(classType.fields.map(field => field.name).sort()).toEqual([
             'ACL',
             'createdAt',
             'objectId',
             'updatedAt',
           ]);
@@ -688,11 +686,11 @@ describe('ParseGraphQLServer', () => {
               `,
             })
           ).data['__type'];
           expect(readPreferenceType.kind).toEqual('ENUM');
           expect(
-            readPreferenceType.enumValues.map((value) => value.name).sort()
+            readPreferenceType.enumValues.map(value => value.name).sort()
           ).toEqual([
             'NEAREST',
             'PRIMARY',
             'PRIMARY_PREFERRED',
             'SECONDARY',
@@ -729,21 +727,21 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__schema'].types.map((type) => type.name);
+          ).data['__schema'].types.map(type => type.name);
 
           const expectedTypes = [
             'ParseObject',
             'Date',
             'FileInfo',
             'ReadPreference',
             'Upload',
           ];
           expect(
-            expectedTypes.every((type) => schemaTypes.indexOf(type) !== -1)
+            expectedTypes.every(type => schemaTypes.indexOf(type) !== -1)
           ).toBeTruthy(JSON.stringify(schemaTypes.types));
         });
       });
 
       describe('Relay Specific Types', () => {
@@ -766,11 +764,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__schema'].types.map((type) => type.name);
+          ).data['__schema'].types.map(type => type.name);
 
           expect(schemaTypes).toContain('Node');
         });
 
         it('should have node query', async () => {
@@ -784,11 +782,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__type'].fields.map((field) => field.name);
+          ).data['__type'].fields.map(field => field.name);
 
           expect(queryFields).toContain('node');
         });
 
         it('should return global id', async () => {
@@ -802,11 +800,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__type'].fields.map((field) => field.name);
+          ).data['__type'].fields.map(field => field.name);
 
           expect(userFields).toContain('id');
           expect(userFields).toContain('objectId');
         });
 
@@ -822,11 +820,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createFileInputFields).toEqual(['clientMutationId', 'upload']);
         });
 
@@ -842,11 +840,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createFilePayloadFields).toEqual([
             'clientMutationId',
             'fileInfo',
@@ -867,11 +865,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(callFunctionInputFields).toEqual([
             'clientMutationId',
             'functionName',
@@ -893,11 +891,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(callFunctionPayloadFields).toEqual([
             'clientMutationId',
             'result',
@@ -916,11 +914,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual(['clientMutationId', 'fields']);
         });
 
@@ -936,11 +934,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['clientMutationId', 'viewer']);
         });
 
@@ -956,11 +954,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual([
             'clientMutationId',
             'password',
@@ -980,11 +978,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['clientMutationId', 'viewer']);
         });
 
@@ -1000,11 +998,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual(['clientMutationId']);
         });
 
@@ -1020,11 +1018,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['clientMutationId', 'viewer']);
         });
 
@@ -1040,11 +1038,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual([
             'clientMutationId',
             'name',
@@ -1064,11 +1062,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['class', 'clientMutationId']);
         });
 
@@ -1084,11 +1082,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual([
             'clientMutationId',
             'name',
@@ -1108,11 +1106,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['class', 'clientMutationId']);
         });
 
@@ -1128,11 +1126,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(inputFields).toEqual(['clientMutationId', 'name']);
         });
 
@@ -1148,11 +1146,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(payloadFields).toEqual(['class', 'clientMutationId']);
         });
 
@@ -1173,11 +1171,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectInputFields).toEqual([
             'clientMutationId',
             'fields',
@@ -1201,11 +1199,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectPayloadFields).toEqual([
             'clientMutationId',
             'someClass',
@@ -1229,11 +1227,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectInputFields).toEqual([
             'clientMutationId',
             'fields',
@@ -1258,11 +1256,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectPayloadFields).toEqual([
             'clientMutationId',
             'someClass',
@@ -1286,11 +1284,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].inputFields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectInputFields).toEqual(['clientMutationId', 'id']);
         });
 
@@ -1311,11 +1309,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'].fields
-            .map((field) => field.name)
+            .map(field => field.name)
             .sort();
 
           expect(createObjectPayloadFields).toEqual([
             'clientMutationId',
             'someClass',
@@ -1337,11 +1335,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__schema'].types.map((type) => type.name);
+          ).data['__schema'].types.map(type => type.name);
 
           const expectedTypes = [
             'Role',
             'RoleWhereInput',
             'CreateRoleFieldsInput',
@@ -1352,11 +1350,11 @@ describe('ParseGraphQLServer', () => {
             'UserConnection',
             'CreateUserFieldsInput',
             'UpdateUserFieldsInput',
           ];
           expect(
-            expectedTypes.every((type) => schemaTypes.indexOf(type) !== -1)
+            expectedTypes.every(type => schemaTypes.indexOf(type) !== -1)
           ).toBeTruthy(JSON.stringify(schemaTypes));
         });
 
         it('should ArrayResult contains all types', async () => {
           const objectType = (
@@ -1371,11 +1369,11 @@ describe('ParseGraphQLServer', () => {
                   }
                 }
               `,
             })
           ).data['__type'];
-          const possibleTypes = objectType.possibleTypes.map((o) => o.name);
+          const possibleTypes = objectType.possibleTypes.map(o => o.name);
           expect(possibleTypes).toContain('User');
           expect(possibleTypes).toContain('Role');
           expect(possibleTypes).toContain('Element');
         });
 
@@ -1395,11 +1393,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__type'].fields.map((field) => field.name);
+          ).data['__type'].fields.map(field => field.name);
           expect(userFields.indexOf('foo') !== -1).toBeTruthy();
         });
 
         it('should not contain password field from _User class', async () => {
           const userFields = (
@@ -1412,11 +1410,11 @@ describe('ParseGraphQLServer', () => {
                     }
                   }
                 }
               `,
             })
-          ).data['__type'].fields.map((field) => field.name);
+          ).data['__type'].fields.map(field => field.name);
           expect(userFields.includes('password')).toBeFalsy();
         });
       });
 
       describe('Configuration', function () {
@@ -1894,17 +1892,17 @@ describe('ParseGraphQLServer', () => {
                 }
               }
             `,
           });
           expect(
-            __type.inputFields.find((o) => o.name === 'price').type.kind
+            __type.inputFields.find(o => o.name === 'price').type.kind
           ).toEqual('SCALAR');
           expect(
-            __type.inputFields.find((o) => o.name === 'engine').type.kind
+            __type.inputFields.find(o => o.name === 'engine').type.kind
           ).toEqual('NON_NULL');
           expect(
-            __type.inputFields.find((o) => o.name === 'doors').type.kind
+            __type.inputFields.find(o => o.name === 'doors').type.kind
           ).toEqual('NON_NULL');
 
           const {
             data: { __type: __type2 },
           } = await apolloClient.query({
@@ -1920,17 +1918,17 @@ describe('ParseGraphQLServer', () => {
                 }
               }
             `,
           });
           expect(
-            __type2.fields.find((o) => o.name === 'price').type.kind
+            __type2.fields.find(o => o.name === 'price').type.kind
           ).toEqual('SCALAR');
           expect(
-            __type2.fields.find((o) => o.name === 'engine').type.kind
+            __type2.fields.find(o => o.name === 'engine').type.kind
           ).toEqual('NON_NULL');
           expect(
-            __type2.fields.find((o) => o.name === 'doors').type.kind
+            __type2.fields.find(o => o.name === 'doors').type.kind
           ).toEqual('NON_NULL');
         });
 
         it('should only allow the supplied output fields for a class', async () => {
           const schemaController = await parseServer.config.databaseController.loadSchema();
@@ -2785,11 +2783,11 @@ describe('ParseGraphQLServer', () => {
                 expect(
                   findSecondaryObjectsResult.data.secondaryObjects.count
                 ).toEqual(2);
                 expect(
                   findSecondaryObjectsResult.data.secondaryObjects.edges
-                    .map((value) => value.node.someField)
+                    .map(value => value.node.someField)
                     .sort()
                 ).toEqual(['some value 22', 'some value 44']);
                 expect(
                   findSecondaryObjectsResult.data.secondaryObjects.edges[0].node
                     .id
@@ -2952,11 +2950,11 @@ describe('ParseGraphQLServer', () => {
                   createPrimaryObjectResult.data.createPrimaryObject
                     .primaryObject.pointerField.someField
                 ).toEqual('some value 22');
                 expect(
                   createPrimaryObjectResult.data.createPrimaryObject.primaryObject.relationField.edges
-                    .map((value) => value.node.someField)
+                    .map(value => value.node.someField)
                     .sort()
                 ).toEqual(['some value 22', 'some value 44']);
                 expect(
                   updatePrimaryObjectResult.data.updatePrimaryObject
                     .primaryObject.stringField
@@ -3191,11 +3189,11 @@ describe('ParseGraphQLServer', () => {
                 headers: {
                   'X-Parse-Master-Key': 'test',
                 },
               },
             });
-            const classes = Object.keys(result.data).map((fieldName) => ({
+            const classes = Object.keys(result.data).map(fieldName => ({
               clientMutationId: result.data[fieldName].clientMutationId,
               class: {
                 name: result.data[fieldName].class.name,
                 schemaFields: result.data[
                   fieldName
@@ -3356,13 +3354,13 @@ describe('ParseGraphQLServer', () => {
                   'X-Parse-Master-Key': 'test',
                 },
               },
             });
             findResult.data.classes = findResult.data.classes
-              .filter((schemaClass) => !schemaClass.name.startsWith('_'))
+              .filter(schemaClass => !schemaClass.name.startsWith('_'))
               .sort((a, b) => (a.name > b.name ? 1 : -1));
-            findResult.data.classes.forEach((schemaClass) => {
+            findResult.data.classes.forEach(schemaClass => {
               schemaClass.schemaFields = schemaClass.schemaFields.sort((a, b) =>
                 a.name > b.name ? 1 : -1
               );
             });
             expect(findResult.data.classes).toEqual([
@@ -4275,23 +4273,23 @@ describe('ParseGraphQLServer', () => {
 
               expect(result.objectId).toEqual(obj3.id);
               expect(result.manyRelations.length).toEqual(2);
 
               const customerSubObject = result.manyRelations.find(
-                (o) => o.objectId === obj1.id
+                o => o.objectId === obj1.id
               );
               const someClassSubObject = result.manyRelations.find(
-                (o) => o.objectId === obj2.id
+                o => o.objectId === obj2.id
               );
 
               expect(customerSubObject).toBeDefined();
               expect(someClassSubObject).toBeDefined();
               expect(customerSubObject.someCustomerField).toEqual(
                 'imCustomerOne'
               );
               const formatedArrayField = customerSubObject.arrayField.map(
-                (elem) => elem.value
+                elem => elem.value
               );
               expect(formatedArrayField).toEqual(arrayField);
               expect(someClassSubObject.someClassField).toEqual(
                 'imSomeClassTwo'
               );
@@ -4443,44 +4441,44 @@ describe('ParseGraphQLServer', () => {
             }
 
             await Promise.all(
               objects
                 .slice(0, 3)
-                .map((obj) =>
+                .map(obj =>
                   expectAsync(
                     getObject(obj.className, obj.id)
                   ).toBeRejectedWith(jasmine.stringMatching('Object not found'))
                 )
             );
             expect(
               (await getObject(object4.className, object4.id)).data.get
                 .someField
             ).toEqual('someValue4');
             await Promise.all(
-              objects.map(async (obj) =>
+              objects.map(async obj =>
                 expect(
                   (
                     await getObject(obj.className, obj.id, {
                       'X-Parse-Master-Key': 'test',
                     })
                   ).data.get.someField
                 ).toEqual(obj.get('someField'))
               )
             );
             await Promise.all(
-              objects.map(async (obj) =>
+              objects.map(async obj =>
                 expect(
                   (
                     await getObject(obj.className, obj.id, {
                       'X-Parse-Session-Token': user1.getSessionToken(),
                     })
                   ).data.get.someField
                 ).toEqual(obj.get('someField'))
               )
             );
             await Promise.all(
-              objects.map(async (obj) =>
+              objects.map(async obj =>
                 expect(
                   (
                     await getObject(obj.className, obj.id, {
                       'X-Parse-Session-Token': user2.getSessionToken(),
                     })
@@ -4492,22 +4490,22 @@ describe('ParseGraphQLServer', () => {
               getObject(object2.className, object2.id, {
                 'X-Parse-Session-Token': user3.getSessionToken(),
               })
             ).toBeRejectedWith(jasmine.stringMatching('Object not found'));
             await Promise.all(
-              [object1, object3, object4].map(async (obj) =>
+              [object1, object3, object4].map(async obj =>
                 expect(
                   (
                     await getObject(obj.className, obj.id, {
                       'X-Parse-Session-Token': user3.getSessionToken(),
                     })
                   ).data.get.someField
                 ).toEqual(obj.get('someField'))
               )
             );
             await Promise.all(
-              objects.slice(0, 3).map((obj) =>
+              objects.slice(0, 3).map(obj =>
                 expectAsync(
                   getObject(obj.className, obj.id, {
                     'X-Parse-Session-Token': user4.getSessionToken(),
                   })
                 ).toBeRejectedWith(jasmine.stringMatching('Object not found'))
@@ -4519,11 +4517,11 @@ describe('ParseGraphQLServer', () => {
                   'X-Parse-Session-Token': user4.getSessionToken(),
                 })
               ).data.get.someField
             ).toEqual('someValue4');
             await Promise.all(
-              objects.slice(0, 2).map((obj) =>
+              objects.slice(0, 2).map(obj =>
                 expectAsync(
                   getObject(obj.className, obj.id, {
                     'X-Parse-Session-Token': user5.getSessionToken(),
                   })
                 ).toBeRejectedWith(jasmine.stringMatching('Object not found'))
@@ -4644,11 +4642,11 @@ describe('ParseGraphQLServer', () => {
             expect(
               result2.data.graphQLClass.pointerToUser.username
             ).toBeDefined();
           });
 
-          it('should respect protectedFields', async (done) => {
+          it('should respect protectedFields', async done => {
             await prepareData();
             await parseGraphQLServer.parseGraphQLSchema.databaseController.schemaCache.clear();
 
             const className = 'GraphQLClass';
 
@@ -4760,11 +4758,11 @@ describe('ParseGraphQLServer', () => {
 
                 let foundGraphQLClassReadPreference = false;
                 let foundUserClassReadPreference = false;
                 databaseAdapter.database.serverConfig.cursor.calls
                   .all()
-                  .forEach((call) => {
+                  .forEach(call => {
                     if (
                       call.args[0].ns.collection.indexOf('GraphQLClass') >= 0
                     ) {
                       foundGraphQLClassReadPreference = true;
                       expect(call.args[0].options.readPreference.mode).toBe(
@@ -4824,11 +4822,11 @@ describe('ParseGraphQLServer', () => {
 
               let foundGraphQLClassReadPreference = false;
               let foundUserClassReadPreference = false;
               databaseAdapter.database.serverConfig.cursor.calls
                 .all()
-                .forEach((call) => {
+                .forEach(call => {
                   if (call.args[0].ns.collection.indexOf('GraphQLClass') >= 0) {
                     foundGraphQLClassReadPreference = true;
                     expect(call.args[0].options.readPreference.mode).toBe(
                       ReadPreference.SECONDARY
                     );
@@ -4884,11 +4882,11 @@ describe('ParseGraphQLServer', () => {
 
               let foundGraphQLClassReadPreference = false;
               let foundUserClassReadPreference = false;
               databaseAdapter.database.serverConfig.cursor.calls
                 .all()
-                .forEach((call) => {
+                .forEach(call => {
                   if (call.args[0].ns.collection.indexOf('GraphQLClass') >= 0) {
                     foundGraphQLClassReadPreference = true;
                     expect(call.args[0].options.readPreference.mode).toBe(
                       ReadPreference.SECONDARY
                     );
@@ -4934,11 +4932,11 @@ describe('ParseGraphQLServer', () => {
               `,
             });
 
             expect(result.data.customers.edges.length).toEqual(2);
 
-            result.data.customers.edges.forEach((resultObj) => {
+            result.data.customers.edges.forEach(resultObj => {
               const obj = resultObj.node.objectId === obj1.id ? obj1 : obj2;
               expect(resultObj.node.objectId).toEqual(obj.id);
               expect(resultObj.node.someField).toEqual(obj.get('someField'));
               expect(new Date(resultObj.node.createdAt)).toEqual(obj.createdAt);
               expect(new Date(resultObj.node.updatedAt)).toEqual(obj.updatedAt);
@@ -4975,81 +4973,81 @@ describe('ParseGraphQLServer', () => {
               return result;
             }
 
             expect(
               (await findObjects('GraphQLClass')).data.find.edges.map(
-                (object) => object.node.someField
+                object => object.node.someField
               )
             ).toEqual([]);
             expect(
               (await findObjects('PublicClass')).data.find.edges.map(
-                (object) => object.node.someField
+                object => object.node.someField
               )
             ).toEqual(['someValue4']);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Master-Key': 'test',
                 })
               ).data.find.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue2', 'someValue3']);
             expect(
               (
                 await findObjects('PublicClass', {
                   'X-Parse-Master-Key': 'test',
                 })
-              ).data.find.edges.map((object) => object.node.someField)
+              ).data.find.edges.map(object => object.node.someField)
             ).toEqual(['someValue4']);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Session-Token': user1.getSessionToken(),
                 })
               ).data.find.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue2', 'someValue3']);
             expect(
               (
                 await findObjects('PublicClass', {
                   'X-Parse-Session-Token': user1.getSessionToken(),
                 })
-              ).data.find.edges.map((object) => object.node.someField)
+              ).data.find.edges.map(object => object.node.someField)
             ).toEqual(['someValue4']);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Session-Token': user2.getSessionToken(),
                 })
               ).data.find.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue2', 'someValue3']);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Session-Token': user3.getSessionToken(),
                 })
               ).data.find.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue3']);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Session-Token': user4.getSessionToken(),
                 })
-              ).data.find.edges.map((object) => object.node.someField)
+              ).data.find.edges.map(object => object.node.someField)
             ).toEqual([]);
             expect(
               (
                 await findObjects('GraphQLClass', {
                   'X-Parse-Session-Token': user5.getSessionToken(),
                 })
-              ).data.find.edges.map((object) => object.node.someField)
+              ).data.find.edges.map(object => object.node.someField)
             ).toEqual(['someValue3']);
           });
 
           it('should support where argument using class specific query', async () => {
             await prepareData();
@@ -5098,11 +5096,11 @@ describe('ParseGraphQLServer', () => {
               },
             });
 
             expect(
               result.data.graphQLClasses.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue3']);
           });
 
           it('should support in pointer operator using class specific query', async () => {
@@ -5176,11 +5174,11 @@ describe('ParseGraphQLServer', () => {
               },
             });
 
             expect(
               result.data.graphQLClasses.edges
-                .map((object) => object.node.someField)
+                .map(object => object.node.someField)
                 .sort()
             ).toEqual(['someValue1', 'someValue2']);
           });
 
           it('should support full text search', async () => {
@@ -5343,11 +5341,11 @@ describe('ParseGraphQLServer', () => {
                 first: 2,
               },
             });
 
             expect(
-              result.data.find.edges.map((obj) => obj.node.someField)
+              result.data.find.edges.map(obj => obj.node.someField)
             ).toEqual(['someValue14', 'someValue17']);
           });
 
           it('should support pagination', async () => {
             const numberArray = (first, last) => {
@@ -5414,11 +5412,11 @@ describe('ParseGraphQLServer', () => {
               });
             };
 
             let result = await find();
             expect(
-              result.data.someClasses.edges.map((edge) => edge.node.numberField)
+              result.data.someClasses.edges.map(edge => edge.node.numberField)
             ).toEqual(numberArray(0, 99));
             expect(result.data.someClasses.count).toEqual(100);
             expect(result.data.someClasses.pageInfo.hasPreviousPage).toEqual(
               false
             );
@@ -5430,11 +5428,11 @@ describe('ParseGraphQLServer', () => {
             );
             expect(result.data.someClasses.pageInfo.hasNextPage).toEqual(false);
 
             result = await find({ first: 10 });
             expect(
-              result.data.someClasses.edges.map((edge) => edge.node.numberField)
+              result.data.someClasses.edges.map(edge => edge.node.numberField)
             ).toEqual(numberArray(0, 9));
             expect(result.data.someClasses.count).toEqual(100);
             expect(result.data.someClasses.pageInfo.hasPreviousPage).toEqual(
               false
             );
@@ -5449,11 +5447,11 @@ describe('ParseGraphQLServer', () => {
             result = await find({
               first: 10,
               after: result.data.someClasses.pageInfo.endCursor,
             });
             expect(
-              result.data.someClasses.edges.map((edge) => edge.node.numberField)
+              result.data.someClasses.edges.map(edge => edge.node.numberField)
             ).toEqual(numberArray(10, 19));
             expect(result.data.someClasses.count).toEqual(100);
             expect(result.data.someClasses.pageInfo.hasPreviousPage).toEqual(
               true
             );
@@ -5465,11 +5463,11 @@ describe('ParseGraphQLServer', () => {
             );
             expect(result.data.someClasses.pageInfo.hasNextPage).toEqual(true);
 
             result = await find({ last: 10 });
             expect(
-              result.data.someClasses.edges.map((edge) => edge.node.numberField)
+              result.data.someClasses.edges.map(edge => edge.node.numberField)
             ).toEqual(numberArray(90, 99));
             expect(result.data.someClasses.count).toEqual(100);
             expect(result.data.someClasses.pageInfo.hasPreviousPage).toEqual(
               true
             );
@@ -5484,11 +5482,11 @@ describe('ParseGraphQLServer', () => {
             result = await find({
               last: 10,
               before: result.data.someClasses.pageInfo.startCursor,
             });
             expect(
-              result.data.someClasses.edges.map((edge) => edge.node.numberField)
+              result.data.someClasses.edges.map(edge => edge.node.numberField)
             ).toEqual(numberArray(80, 89));
             expect(result.data.someClasses.count).toEqual(100);
             expect(result.data.someClasses.pageInfo.hasPreviousPage).toEqual(
               true
             );
@@ -5818,11 +5816,11 @@ describe('ParseGraphQLServer', () => {
 
               let foundGraphQLClassReadPreference = false;
               let foundUserClassReadPreference = false;
               databaseAdapter.database.serverConfig.cursor.calls
                 .all()
-                .forEach((call) => {
+                .forEach(call => {
                   if (call.args[0].ns.collection.indexOf('GraphQLClass') >= 0) {
                     foundGraphQLClassReadPreference = true;
                     expect(call.args[0].options.readPreference.mode).toBe(
                       ReadPreference.PRIMARY
                     );
@@ -5875,11 +5873,11 @@ describe('ParseGraphQLServer', () => {
 
               let foundGraphQLClassReadPreference = false;
               let foundUserClassReadPreference = false;
               databaseAdapter.database.serverConfig.cursor.calls
                 .all()
-                .forEach((call) => {
+                .forEach(call => {
                   if (call.args[0].ns.collection.indexOf('GraphQLClass') >= 0) {
                     foundGraphQLClassReadPreference = true;
                     expect(call.args[0].options.readPreference.mode).toBe(
                       ReadPreference.SECONDARY
                     );
@@ -5935,11 +5933,11 @@ describe('ParseGraphQLServer', () => {
 
               let foundGraphQLClassReadPreference = false;
               let foundUserClassReadPreference = false;
               databaseAdapter.database.serverConfig.cursor.calls
                 .all()
-                .forEach((call) => {
+                .forEach(call => {
                   if (call.args[0].ns.collection.indexOf('GraphQLClass') >= 0) {
                     foundGraphQLClassReadPreference = true;
                     expect(call.args[0].options.readPreference.mode).toBe(
                       ReadPreference.SECONDARY
                     );
@@ -6006,11 +6004,11 @@ describe('ParseGraphQLServer', () => {
 
                 let foundGraphQLClassReadPreference = false;
                 let foundUserClassReadPreference = false;
                 databaseAdapter.database.serverConfig.cursor.calls
                   .all()
-                  .forEach((call) => {
+                  .forEach(call => {
                     if (
                       call.args[0].ns.collection.indexOf('GraphQLClass') >= 0
                     ) {
                       foundGraphQLClassReadPreference = true;
                       expect(call.args[0].options.readPreference.mode).toBe(
@@ -6065,11 +6063,11 @@ describe('ParseGraphQLServer', () => {
             } catch (e) {
               handleError(e);
             }
 
             expect(
-              result.data.graphQLClasses.edges.map((edge) => edge.node.objectId)
+              result.data.graphQLClasses.edges.map(edge => edge.node.objectId)
             ).toEqual([object3.id, object1.id, object2.id]);
           });
 
           it_only_db('mongo')(
             'should order by multiple fields on a relation field',
@@ -6118,11 +6116,11 @@ describe('ParseGraphQLServer', () => {
                 handleError(e);
               }
 
               expect(
                 result.data.parentClass.graphQLClasses.edges.map(
-                  (edge) => edge.node.objectId
+                  edge => edge.node.objectId
                 )
               ).toEqual([object3.id, object1.id, object2.id]);
             }
           );
         });
@@ -6382,11 +6380,11 @@ describe('ParseGraphQLServer', () => {
                 },
               });
             }
 
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(obj.className, obj.id, {
                     someField: 'changedValue1',
                   })
@@ -6403,11 +6401,11 @@ describe('ParseGraphQLServer', () => {
               ).data.update.clientMutationId
             ).toBeDefined();
             await object4.fetch({ useMasterKey: true });
             expect(object4.get('someField')).toEqual('changedValue1');
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6419,11 +6417,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue2');
               })
             );
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6435,11 +6433,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue3');
               })
             );
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6451,11 +6449,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue4');
               })
             );
             await Promise.all(
-              [object1, object3, object4].map(async (obj) => {
+              [object1, object3, object4].map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6478,11 +6476,11 @@ describe('ParseGraphQLServer', () => {
               )
             ).toBeRejectedWith(jasmine.stringMatching('Object not found'));
             await object2.fetch({ useMasterKey: true });
             expect(object2.get('someField')).toEqual(originalFieldValue);
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(
                     obj.className,
                     obj.id,
@@ -6505,11 +6503,11 @@ describe('ParseGraphQLServer', () => {
               ).data.update.clientMutationId
             ).toBeDefined();
             await object4.fetch({ useMasterKey: true });
             expect(object4.get('someField')).toEqual('changedValue6');
             await Promise.all(
-              objects.slice(0, 2).map(async (obj) => {
+              objects.slice(0, 2).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(
                     obj.className,
                     obj.id,
@@ -6581,11 +6579,11 @@ describe('ParseGraphQLServer', () => {
                 },
               });
             }
 
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(obj.className, obj.id, {
                     someField: 'changedValue1',
                   })
@@ -6605,11 +6603,11 @@ describe('ParseGraphQLServer', () => {
               ].updatedAt
             ).toBeDefined();
             await object4.fetch({ useMasterKey: true });
             expect(object4.get('someField')).toEqual('changedValue1');
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6624,11 +6622,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue2');
               })
             );
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6643,11 +6641,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue3');
               })
             );
             await Promise.all(
-              objects.map(async (obj) => {
+              objects.map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6662,11 +6660,11 @@ describe('ParseGraphQLServer', () => {
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual('changedValue4');
               })
             );
             await Promise.all(
-              [object1, object3, object4].map(async (obj) => {
+              [object1, object3, object4].map(async obj => {
                 expect(
                   (
                     await updateObject(
                       obj.className,
                       obj.id,
@@ -6692,11 +6690,11 @@ describe('ParseGraphQLServer', () => {
               )
             ).toBeRejectedWith(jasmine.stringMatching('Object not found'));
             await object2.fetch({ useMasterKey: true });
             expect(object2.get('someField')).toEqual(originalFieldValue);
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(
                     obj.className,
                     obj.id,
@@ -6722,11 +6720,11 @@ describe('ParseGraphQLServer', () => {
               ].updatedAt
             ).toBeDefined();
             await object4.fetch({ useMasterKey: true });
             expect(object4.get('someField')).toEqual('changedValue6');
             await Promise.all(
-              objects.slice(0, 2).map(async (obj) => {
+              objects.slice(0, 2).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   updateObject(
                     obj.className,
                     obj.id,
@@ -6849,21 +6847,21 @@ describe('ParseGraphQLServer', () => {
                 },
               });
             }
 
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   deleteObject(obj.className, obj.id)
                 ).toBeRejectedWith(jasmine.stringMatching('Object not found'));
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual(originalFieldValue);
               })
             );
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   deleteObject(obj.className, obj.id, {
                     'X-Parse-Session-Token': user4.getSessionToken(),
                   })
@@ -6950,21 +6948,21 @@ describe('ParseGraphQLServer', () => {
                 },
               });
             }
 
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   deleteObject(obj.className, obj.id)
                 ).toBeRejectedWith(jasmine.stringMatching('Object not found'));
                 await obj.fetch({ useMasterKey: true });
                 expect(obj.get('someField')).toEqual(originalFieldValue);
               })
             );
             await Promise.all(
-              objects.slice(0, 3).map(async (obj) => {
+              objects.slice(0, 3).map(async obj => {
                 const originalFieldValue = obj.get('someField');
                 await expectAsync(
                   deleteObject(obj.className, obj.id, {
                     'X-Parse-Session-Token': user4.getSessionToken(),
                   })
@@ -7183,10 +7181,60 @@ describe('ParseGraphQLServer', () => {
           expect(objectId).toEqual(user.id);
           expect(sessionToken).toBeDefined();
           expect(resultFoo).toBeDefined();
           expect(resultFoo.bar).toEqual('hello');
         });
+        it('should return logged user and do not by pass pointer security', async () => {
+          const masterKeyOnlyACL = new Parse.ACL();
+          masterKeyOnlyACL.setPublicReadAccess(false);
+          masterKeyOnlyACL.setPublicWriteAccess(false);
+          const foo = new Parse.Object('Foo');
+          foo.setACL(masterKeyOnlyACL);
+          foo.set('bar', 'hello');
+          await foo.save(null, { useMasterKey: true });
+          const userName = 'userx1',
+            password = 'user1',
+            email = 'emailUserx1@parse.com';
+
+          const user = new Parse.User();
+          user.setUsername(userName);
+          user.setPassword(password);
+          user.setEmail(email);
+          user.set('userFoo', foo);
+          await user.signUp();
+
+          await parseGraphQLServer.parseGraphQLSchema.databaseController.schemaCache.clear();
+
+          const session = await Parse.Session.current();
+          const result = await apolloClient.query({
+            query: gql`
+              query GetCurrentUser {
+                viewer {
+                  sessionToken
+                  user {
+                    id
+                    objectId
+                    userFoo {
+                      bar
+                    }
+                  }
+                }
+              }
+            `,
+            context: {
+              headers: {
+                'X-Parse-Session-Token': session.getSessionToken(),
+              },
+            },
+          });
+
+          const sessionToken = result.data.viewer.sessionToken;
+          const { objectId, userFoo: resultFoo } = result.data.viewer.user;
+          expect(objectId).toEqual(user.id);
+          expect(sessionToken).toBeDefined();
+          expect(resultFoo).toEqual(null);
+        });
       });
 
       describe('Users Mutations', () => {
         it('should sign user up', async () => {
           const clientMutationId = uuidv4();
@@ -7633,12 +7681,12 @@ describe('ParseGraphQLServer', () => {
             expect(graphQLErrors.length).toBe(1);
             expect(graphQLErrors[0].message).toBe('Some error message.');
           }
         });
 
-        it('should accept different params', (done) => {
-          Parse.Cloud.define('hello', async (req) => {
+        it('should accept different params', done => {
+          Parse.Cloud.define('hello', async req => {
             expect(req.params.date instanceof Date).toBe(true);
             expect(req.params.date.getTime()).toBe(1463907600000);
             expect(req.params.dateList[0] instanceof Date).toBe(true);
             expect(req.params.dateList[0].getTime()).toBe(1463907600000);
             expect(req.params.complexStructure.date[0] instanceof Date).toBe(
@@ -7770,11 +7818,11 @@ describe('ParseGraphQLServer', () => {
                 `,
               })
             ).data['__type'];
             expect(functionEnum.kind).toEqual('ENUM');
             expect(
-              functionEnum.enumValues.map((value) => value.name).sort()
+              functionEnum.enumValues.map(value => value.name).sort()
             ).toEqual(['_underscored', 'a', 'b', 'contains1Number']);
           } catch (e) {
             handleError(e);
           }
         });
@@ -7812,16 +7860,16 @@ describe('ParseGraphQLServer', () => {
                 `,
               })
             ).data['__type'];
             expect(functionEnum.kind).toEqual('ENUM');
             expect(
-              functionEnum.enumValues.map((value) => value.name).sort()
+              functionEnum.enumValues.map(value => value.name).sort()
             ).toEqual(['a']);
             expect(
               parseGraphQLServer.parseGraphQLSchema.log.warn.calls
                 .all()
-                .map((call) => call.args[0])
+                .map(call => call.args[0])
                 .sort()
             ).toEqual([
               'Function 1NumberInTheBeggning could not be added to the auto schema because GraphQL names must match /^[_a-zA-Z][_a-zA-Z0-9]*$/.',
               'Function double-barrelled could not be added to the auto schema because GraphQL names must match /^[_a-zA-Z][_a-zA-Z0-9]*$/.',
             ]);
@@ -8713,17 +8761,17 @@ describe('ParseGraphQLServer', () => {
 
             expect(result.id).toBeDefined();
             expect(result.name).toEqual('imACountry2');
             expect(result.companies.edges.length).toEqual(3);
             expect(
-              result.companies.edges.some((o) => o.node.objectId === company.id)
+              result.companies.edges.some(o => o.node.objectId === company.id)
             ).toBeTruthy();
             expect(
-              result.companies.edges.some((o) => o.node.name === 'imACompany2')
+              result.companies.edges.some(o => o.node.name === 'imACompany2')
             ).toBeTruthy();
             expect(
-              result.companies.edges.some((o) => o.node.name === 'imACompany3')
+              result.companies.edges.some(o => o.node.name === 'imACompany3')
             ).toBeTruthy();
           }
         );
 
         it_only_db('mongo')('should support deep nested creation', async () => {
@@ -8804,20 +8852,20 @@ describe('ParseGraphQLServer', () => {
           expect(result.id).toBeDefined();
           expect(result.name).toEqual('imACountry2');
           expect(result.companies.edges.length).toEqual(2);
           expect(
             result.companies.edges.some(
-              (c) =>
+              c =>
                 c.node.name === 'imACompany2' &&
-                c.node.teams.edges.some((t) => t.node.name === 'imATeam2')
+                c.node.teams.edges.some(t => t.node.name === 'imATeam2')
             )
           ).toBeTruthy();
           expect(
             result.companies.edges.some(
-              (c) =>
+              c =>
                 c.node.name === 'imACompany3' &&
-                c.node.teams.edges.some((t) => t.node.name === 'imATeam3')
+                c.node.teams.edges.some(t => t.node.name === 'imATeam3')
             )
           ).toBeTruthy();
         });
 
         it_only_db('mongo')(
@@ -8882,21 +8930,17 @@ describe('ParseGraphQLServer', () => {
             });
 
             expect(result.objectId).toEqual(country.id);
             expect(result.companies.edges.length).toEqual(2);
             expect(
-              result.companies.edges.some(
-                (o) => o.node.objectId === company2.id
-              )
+              result.companies.edges.some(o => o.node.objectId === company2.id)
             ).toBeTruthy();
             expect(
-              result.companies.edges.some((o) => o.node.name === 'imACompany3')
+              result.companies.edges.some(o => o.node.name === 'imACompany3')
             ).toBeTruthy();
             expect(
-              result.companies.edges.some(
-                (o) => o.node.objectId === company1.id
-              )
+              result.companies.edges.some(o => o.node.objectId === company1.id)
             ).toBeFalsy();
           }
         );
 
         it_only_db('mongo')(
@@ -8964,11 +9008,11 @@ describe('ParseGraphQLServer', () => {
 
             expect(result.id).toBeDefined();
             expect(result.name).toEqual('imACountry2');
             expect(result.companies.edges.length).toEqual(1);
             expect(
-              result.companies.edges.some((o) => o.node.name === 'imACompany2')
+              result.companies.edges.some(o => o.node.name === 'imACompany2')
             ).toBeTruthy();
           }
         );
 
         it_only_db('mongo')('should support relation on query', async () => {
@@ -9015,14 +9059,14 @@ describe('ParseGraphQLServer', () => {
           });
 
           expect(result1.objectId).toEqual(country.id);
           expect(result1.companies.edges.length).toEqual(2);
           expect(
-            result1.companies.edges.some((o) => o.node.objectId === company1.id)
+            result1.companies.edges.some(o => o.node.objectId === company1.id)
           ).toBeTruthy();
           expect(
-            result1.companies.edges.some((o) => o.node.objectId === company2.id)
+            result1.companies.edges.some(o => o.node.objectId === company2.id)
           ).toBeTruthy();
 
           // With where
           const {
             data: { country: result2 },
@@ -9760,16 +9804,16 @@ describe('ParseGraphQLServer', () => {
 
             // Checks class query results
             const { edges } = someClasses;
             expect(edges.length).toEqual(2);
             expect(
-              edges.find((result) => result.node.id === create1.someClass.id)
-                .node.someField
+              edges.find(result => result.node.id === create1.someClass.id).node
+                .someField
             ).toEqual(someFieldValue);
             expect(
-              edges.find((result) => result.node.id === create2.someClass.id)
-                .node.someField
+              edges.find(result => result.node.id === create2.someClass.id).node
+                .someField
             ).toEqual(someFieldValue2);
           } catch (e) {
             handleError(e);
           }
         });
@@ -9857,11 +9901,11 @@ describe('ParseGraphQLServer', () => {
               },
             });
 
             const { someField } = getResult.data.someClass;
             expect(Array.isArray(someField)).toBeTruthy();
-            expect(someField.map((element) => element.value)).toEqual(
+            expect(someField.map(element => element.value)).toEqual(
               someFieldValue
             );
             expect(getResult.data.someClasses.edges.length).toEqual(1);
           } catch (e) {
             handleError(e);
@@ -10274,11 +10318,11 @@ describe('ParseGraphQLServer', () => {
             const somePolygonFieldValue = [
               [44, 45],
               [46, 47],
               [48, 49],
               [44, 45],
-            ].map((point) => ({
+            ].map(point => ({
               latitude: point[0],
               longitude: point[1],
             }));
 
             await apolloClient.mutate({
@@ -10354,11 +10398,11 @@ describe('ParseGraphQLServer', () => {
 
             expect(typeof getResult.data.someClass.somePolygonField).toEqual(
               'object'
             );
             expect(getResult.data.someClass.somePolygonField).toEqual(
-              somePolygonFieldValue.map((geoPoint) => ({
+              somePolygonFieldValue.map(geoPoint => ({
                 ...geoPoint,
                 __typename: 'GeoPoint',
               }))
             );
             expect(getResult.data.someClasses.edges.length).toEqual(1);
@@ -10670,11 +10714,11 @@ describe('ParseGraphQLServer', () => {
               hello4: User! @mock(with: { username: "somefolk" })
             }
           `,
         });
         parseGraphQLServer.applyGraphQL(expressApp);
-        await new Promise((resolve) =>
+        await new Promise(resolve =>
           httpServer.listen({ port: 13377 }, resolve)
         );
         const httpLink = createUploadLink({
           uri: 'http://localhost:13377/graphql',
           fetch,
@@ -10795,11 +10839,11 @@ describe('ParseGraphQLServer', () => {
         const SomeClassType = new GraphQLObjectType({
             name: 'SomeClass',
             fields: {
               nameUpperCase: {
                 type: new GraphQLNonNull(GraphQLString),
-                resolve: (p) => p.name.toUpperCase(),
+                resolve: p => p.name.toUpperCase(),
               },
               type: { type: TypeEnum },
               language: {
                 type: new GraphQLEnumType({
                   name: 'LanguageEnum',
@@ -10856,11 +10900,11 @@ describe('ParseGraphQLServer', () => {
               ],
             }),
           });
 
         parseGraphQLServer.applyGraphQL(expressApp);
-        await new Promise((resolve) =>
+        await new Promise(resolve =>
           httpServer.listen({ port: 13377 }, resolve)
         );
         const httpLink = createUploadLink({
           uri: 'http://localhost:13377/graphql',
           fetch,
@@ -10990,11 +11034,11 @@ describe('ParseGraphQLServer', () => {
           graphQLCustomTypeDefs: ({ autoSchema, stitchSchemas }) =>
             stitchSchemas({ subschemas: [autoSchema] }),
         });
 
         parseGraphQLServer.applyGraphQL(expressApp);
-        await new Promise((resolve) =>
+        await new Promise(resolve =>
           httpServer.listen({ port: 13377 }, resolve)
         );
         const httpLink = createUploadLink({
           uri: 'http://localhost:13377/graphql',
           fetch,
diff --git a/src/GraphQL/loaders/usersMutations.js b/src/GraphQL/loaders/usersMutations.js
index 70192967..09d66bd9 100644
--- a/src/GraphQL/loaders/usersMutations.js
+++ b/src/GraphQL/loaders/usersMutations.js
@@ -39,27 +39,26 @@ const load = parseGraphQLSchema => {
     mutateAndGetPayload: async (args, context, mutationInfo) => {
       try {
         const { fields } = args;
         const { config, auth, info } = context;
 
-        const { sessionToken } = await objectsMutations.createObject(
+        const { sessionToken, objectId } = await objectsMutations.createObject(
           '_User',
           fields,
           config,
           auth,
           info
         );
 
-        info.sessionToken = sessionToken;
+        context.info.sessionToken = sessionToken;
 
         return {
           viewer: await getUserFromSessionToken(
-            config,
-            info,
+            context,
             mutationInfo,
             'viewer.user.',
-            true
+            objectId
           ),
         };
       } catch (e) {
         parseGraphQLSchema.handleError(e);
       }
@@ -118,27 +117,26 @@ const load = parseGraphQLSchema => {
     mutateAndGetPayload: async (args, context, mutationInfo) => {
       try {
         const { fields, authData } = args;
         const { config, auth, info } = context;
 
-        const { sessionToken } = await objectsMutations.createObject(
+        const { sessionToken, objectId } = await objectsMutations.createObject(
           '_User',
           { ...fields, authData },
           config,
           auth,
           info
         );
 
-        info.sessionToken = sessionToken;
+        context.info.sessionToken = sessionToken;
 
         return {
           viewer: await getUserFromSessionToken(
-            config,
-            info,
+            context,
             mutationInfo,
             'viewer.user.',
-            true
+            objectId
           ),
         };
       } catch (e) {
         parseGraphQLSchema.handleError(e);
       }
@@ -181,11 +179,11 @@ const load = parseGraphQLSchema => {
     mutateAndGetPayload: async (args, context, mutationInfo) => {
       try {
         const { username, password } = args;
         const { config, auth, info } = context;
 
-        const { sessionToken } = (
+        const { sessionToken, objectId } = (
           await usersRouter.handleLogIn({
             body: {
               username,
               password,
             },
@@ -194,19 +192,18 @@ const load = parseGraphQLSchema => {
             auth,
             info,
           })
         ).response;
 
-        info.sessionToken = sessionToken;
+        context.info.sessionToken = sessionToken;
 
         return {
           viewer: await getUserFromSessionToken(
-            config,
-            info,
+            context,
             mutationInfo,
             'viewer.user.',
-            true
+            objectId
           ),
         };
       } catch (e) {
         parseGraphQLSchema.handleError(e);
       }
@@ -234,15 +231,14 @@ const load = parseGraphQLSchema => {
     mutateAndGetPayload: async (_args, context, mutationInfo) => {
       try {
         const { config, auth, info } = context;
 
         const viewer = await getUserFromSessionToken(
-          config,
-          info,
+          context,
           mutationInfo,
           'viewer.user.',
-          true
+          auth.user.id
         );
 
         await usersRouter.handleLogOut({
           config,
           auth,
diff --git a/src/GraphQL/loaders/usersQueries.js b/src/GraphQL/loaders/usersQueries.js
index 6a1d3ea9..976d0b3b 100644
--- a/src/GraphQL/loaders/usersQueries.js
+++ b/src/GraphQL/loaders/usersQueries.js
@@ -1,19 +1,19 @@
 import { GraphQLNonNull } from 'graphql';
 import getFieldNames from 'graphql-list-fields';
 import Parse from 'parse/node';
 import rest from '../../rest';
-import Auth from '../../Auth';
 import { extractKeysAndInclude } from './parseClassTypes';
+import { Auth } from '../../Auth';
 
 const getUserFromSessionToken = async (
-  config,
-  info,
+  context,
   queryInfo,
   keysPrefix,
-  validatedToken
+  userId
 ) => {
+  const { info, config } = context;
   if (!info || !info.sessionToken) {
     throw new Parse.Error(
       Parse.Error.INVALID_SESSION_TOKEN,
       'Invalid session token'
     );
@@ -25,52 +25,59 @@ const getUserFromSessionToken = async (
 
   const keysAndInclude = extractKeysAndInclude(selectedFields);
   const { keys } = keysAndInclude;
   let { include } = keysAndInclude;
 
-  if (validatedToken && !keys && !include) {
+  if (userId && !keys && !include) {
     return {
       sessionToken,
     };
   } else if (keys && !include) {
     include = 'user';
   }
 
+  if (userId) {
+    // We need to re create the auth context
+    // to avoid security breach if userId is provided
+    context.auth = new Auth({
+      config,
+      isMaster: context.auth.isMaster,
+      user: { id: userId },
+    });
+  }
+
   const options = {};
   if (keys) {
     options.keys = keys
       .split(',')
-      .map(key => `user.${key}`)
+      .map(key => `${key}`)
       .join(',');
   }
   if (include) {
     options.include = include
       .split(',')
-      .map(included => `user.${included}`)
+      .map(included => `${included}`)
       .join(',');
   }
 
   const response = await rest.find(
     config,
-    Auth.master(config),
-    '_Session',
-    { sessionToken },
+    context.auth,
+    '_User',
+    // Get the user it self from auth object
+    { objectId: context.auth.user.id },
     options,
     info.clientVersion,
-    info.context,
+    info.context
   );
-  if (
-    !response.results ||
-    response.results.length == 0 ||
-    !response.results[0].user
-  ) {
+  if (!response.results || response.results.length == 0) {
     throw new Parse.Error(
       Parse.Error.INVALID_SESSION_TOKEN,
       'Invalid session token'
     );
   } else {
-    const user = response.results[0].user;
+    const user = response.results[0];
     return {
       sessionToken,
       user,
     };
   }
@@ -87,14 +94,12 @@ const load = parseGraphQLSchema => {
       description:
         'The viewer query can be used to return the current user data.',
       type: new GraphQLNonNull(parseGraphQLSchema.viewerType),
       async resolve(_source, _args, context, queryInfo) {
         try {
-          const { config, info } = context;
           return await getUserFromSessionToken(
-            config,
-            info,
+            context,
             queryInfo,
             'user.',
             false
           );
         } catch (e) {

Vulnerable code:           use: (path) => {
          get: (path) => {
      await new Promise((resolve) =>
        httpServer.listen({ port: 13377 }, resolve)
      );
            return forward(operation).map((response) => {
        parseGraphQLServer._getGraphQLOptions = async (req) => {
          expect(fileType.fields.map((field) => field.name).sort()).toEqual([
          expect(classType.fields.map((field) => field.name).sort()).toEqual([
            readPreferenceType.enumValues.map((value) => value.name).sort()
          ).data['__schema'].types.map((type) => type.name);
            expectedTypes.every((type) => schemaTypes.indexOf(type) !== -1)
          ).data['__schema'].types.map((type) => type.name);
          ).data['__type'].fields.map((field) => field.name);
          ).data['__type'].fields.map((field) => field.name);
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
            .map((field) => field.name)
          ).data['__schema'].types.map((type) => type.name);
            expectedTypes.every((type) => schemaTypes.indexOf(type) !== -1)
          const possibleTypes = objectType.possibleTypes.map((o) => o.name);
          ).data['__type'].fields.map((field) => field.name);
          ).data['__type'].fields.map((field) => field.name);
            __type.inputFields.find((o) => o.name === 'price').type.kind
            __type.inputFields.find((o) => o.name === 'engine').type.kind
            __type.inputFields.find((o) => o.name === 'doors').type.kind
            __type2.fields.find((o) => o.name === 'price').type.kind
            __type2.fields.find((o) => o.name === 'engine').type.kind
            __type2.fields.find((o) => o.name === 'doors').type.kind
                    .map((value) => value.node.someField)
                    .map((value) => value.node.someField)
            const classes = Object.keys(result.data).map((fieldName) => ({
              .filter((schemaClass) => !schemaClass.name.startsWith('_'))
            findResult.data.classes.forEach((schemaClass) => {
                (o) => o.objectId === obj1.id
                (o) => o.objectId === obj2.id
                (elem) => elem.value
                .map((obj) =>
              objects.map(async (obj) =>
              objects.map(async (obj) =>
              objects.map(async (obj) =>
              [object1, object3, object4].map(async (obj) =>
              objects.slice(0, 3).map((obj) =>
              objects.slice(0, 2).map((obj) =>
          it('should respect protectedFields', async (done) => {
                  .forEach((call) => {
                .forEach((call) => {
                .forEach((call) => {
            result.data.customers.edges.forEach((resultObj) => {
                (object) => object.node.someField
                (object) => object.node.someField
                .map((object) => object.node.someField)
              ).data.find.edges.map((object) => object.node.someField)
                .map((object) => object.node.someField)
              ).data.find.edges.map((object) => object.node.someField)
                .map((object) => object.node.someField)
                .map((object) => object.node.someField)
              ).data.find.edges.map((object) => object.node.someField)
              ).data.find.edges.map((object) => object.node.someField)
                .map((object) => object.node.someField)
                .map((object) => object.node.someField)
              result.data.find.edges.map((obj) => obj.node.someField)
              result.data.someClasses.edges.map((edge) => edge.node.numberField)
              result.data.someClasses.edges.map((edge) => edge.node.numberField)
              result.data.someClasses.edges.map((edge) => edge.node.numberField)
              result.data.someClasses.edges.map((edge) => edge.node.numberField)
              result.data.someClasses.edges.map((edge) => edge.node.numberField)
                .forEach((call) => {
                .forEach((call) => {
                .forEach((call) => {
                  .forEach((call) => {
              result.data.graphQLClasses.edges.map((edge) => edge.node.objectId)
                  (edge) => edge.node.objectId
              objects.slice(0, 3).map(async (obj) => {
              objects.map(async (obj) => {
              objects.map(async (obj) => {
              objects.map(async (obj) => {
              [object1, object3, object4].map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.slice(0, 2).map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.map(async (obj) => {
              objects.map(async (obj) => {
              objects.map(async (obj) => {
              [object1, object3, object4].map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.slice(0, 2).map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
              objects.slice(0, 3).map(async (obj) => {
        it('should accept different params', (done) => {
          Parse.Cloud.define('hello', async (req) => {
              functionEnum.enumValues.map((value) => value.name).sort()
              functionEnum.enumValues.map((value) => value.name).sort()
                .map((call) => call.args[0])
              result.companies.edges.some((o) => o.node.objectId === company.id)
              result.companies.edges.some((o) => o.node.name === 'imACompany2')
              result.companies.edges.some((o) => o.node.name === 'imACompany3')
              (c) =>
                c.node.teams.edges.some((t) => t.node.name === 'imATeam2')
              (c) =>
                c.node.teams.edges.some((t) => t.node.name === 'imATeam3')
              result.companies.edges.some(
                (o) => o.node.objectId === company2.id
              )
              result.companies.edges.some((o) => o.node.name === 'imACompany3')
              result.companies.edges.some(
                (o) => o.node.objectId === company1.id
              )
              result.companies.edges.some((o) => o.node.name === 'imACompany2')
            result1.companies.edges.some((o) => o.node.objectId === company1.id)
            result1.companies.edges.some((o) => o.node.objectId === company2.id)
              edges.find((result) => result.node.id === create1.someClass.id)
                .node.someField
              edges.find((result) => result.node.id === create2.someClass.id)
                .node.someField
            expect(someField.map((element) => element.value)).toEqual(
            ].map((point) => ({
              somePolygonFieldValue.map((geoPoint) => ({
        await new Promise((resolve) =>
                resolve: (p) => p.name.toUpperCase(),
        await new Promise((resolve) =>
        await new Promise((resolve) =>
        const { sessionToken } = await objectsMutations.createObject(
        info.sessionToken = sessionToken;
            config,
            info,
            true
        const { sessionToken } = await objectsMutations.createObject(
        info.sessionToken = sessionToken;
            config,
            info,
            true
        const { sessionToken } = (
        info.sessionToken = sessionToken;
            config,
            info,
            true
          config,
          info,
          true
import Auth from '../../Auth';
  config,
  info,
  validatedToken
  if (validatedToken && !keys && !include) {
      .map(key => `user.${key}`)
      .map(included => `user.${included}`)
    Auth.master(config),
    '_Session',
    { sessionToken },
    info.context,
  if (
    !response.results ||
    response.results.length == 0 ||
    !response.results[0].user
  ) {
    const user = response.results[0].user;
          const { config, info } = context;
            config,
            info,
Fixed code:           use: path => {
          get: path => {
      await new Promise(resolve => httpServer.listen({ port: 13377 }, resolve));
            return forward(operation).map(response => {
        parseGraphQLServer._getGraphQLOptions = async req => {
          expect(fileType.fields.map(field => field.name).sort()).toEqual([
          expect(classType.fields.map(field => field.name).sort()).toEqual([
            readPreferenceType.enumValues.map(value => value.name).sort()
          ).data['__schema'].types.map(type => type.name);
            expectedTypes.every(type => schemaTypes.indexOf(type) !== -1)
          ).data['__schema'].types.map(type => type.name);
          ).data['__type'].fields.map(field => field.name);
          ).data['__type'].fields.map(field => field.name);
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
            .map(field => field.name)
          ).data['__schema'].types.map(type => type.name);
            expectedTypes.every(type => schemaTypes.indexOf(type) !== -1)
          const possibleTypes = objectType.possibleTypes.map(o => o.name);
          ).data['__type'].fields.map(field => field.name);
          ).data['__type'].fields.map(field => field.name);
            __type.inputFields.find(o => o.name === 'price').type.kind
            __type.inputFields.find(o => o.name === 'engine').type.kind
            __type.inputFields.find(o => o.name === 'doors').type.kind
            __type2.fields.find(o => o.name === 'price').type.kind
            __type2.fields.find(o => o.name === 'engine').type.kind
            __type2.fields.find(o => o.name === 'doors').type.kind
                    .map(value => value.node.someField)
                    .map(value => value.node.someField)
            const classes = Object.keys(result.data).map(fieldName => ({
              .filter(schemaClass => !schemaClass.name.startsWith('_'))
            findResult.data.classes.forEach(schemaClass => {
                o => o.objectId === obj1.id
                o => o.objectId === obj2.id
                elem => elem.value
                .map(obj =>
              objects.map(async obj =>
              objects.map(async obj =>
              objects.map(async obj =>
              [object1, object3, object4].map(async obj =>
              objects.slice(0, 3).map(obj =>
              objects.slice(0, 2).map(obj =>
          it('should respect protectedFields', async done => {
                  .forEach(call => {
                .forEach(call => {
                .forEach(call => {
            result.data.customers.edges.forEach(resultObj => {
                object => object.node.someField
                object => object.node.someField
                .map(object => object.node.someField)
              ).data.find.edges.map(object => object.node.someField)
                .map(object => object.node.someField)
              ).data.find.edges.map(object => object.node.someField)
                .map(object => object.node.someField)
                .map(object => object.node.someField)
              ).data.find.edges.map(object => object.node.someField)
              ).data.find.edges.map(object => object.node.someField)
                .map(object => object.node.someField)
                .map(object => object.node.someField)
              result.data.find.edges.map(obj => obj.node.someField)
              result.data.someClasses.edges.map(edge => edge.node.numberField)
              result.data.someClasses.edges.map(edge => edge.node.numberField)
              result.data.someClasses.edges.map(edge => edge.node.numberField)
              result.data.someClasses.edges.map(edge => edge.node.numberField)
              result.data.someClasses.edges.map(edge => edge.node.numberField)
                .forEach(call => {
                .forEach(call => {
                .forEach(call => {
                  .forEach(call => {
              result.data.graphQLClasses.edges.map(edge => edge.node.objectId)
                  edge => edge.node.objectId
              objects.slice(0, 3).map(async obj => {
              objects.map(async obj => {
              objects.map(async obj => {
              objects.map(async obj => {
              [object1, object3, object4].map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.slice(0, 2).map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.map(async obj => {
              objects.map(async obj => {
              objects.map(async obj => {
              [object1, object3, object4].map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.slice(0, 2).map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.slice(0, 3).map(async obj => {
              objects.slice(0, 3).map(async obj => {
        it('should return logged user and do not by pass pointer security', async () => {
          const masterKeyOnlyACL = new Parse.ACL();
          masterKeyOnlyACL.setPublicReadAccess(false);
          masterKeyOnlyACL.setPublicWriteAccess(false);
          const foo = new Parse.Object('Foo');
          foo.setACL(masterKeyOnlyACL);
          foo.set('bar', 'hello');
          await foo.save(null, { useMasterKey: true });
          const userName = 'userx1',
            password = 'user1',
            email = 'emailUserx1@parse.com';

          const user = new Parse.User();
          user.setUsername(userName);
          user.setPassword(password);
          user.setEmail(email);
          user.set('userFoo', foo);
          await user.signUp();

          await parseGraphQLServer.parseGraphQLSchema.databaseController.schemaCache.clear();

          const session = await Parse.Session.current();
          const result = await apolloClient.query({
            query: gql`
              query GetCurrentUser {
                viewer {
                  sessionToken
                  user {
                    id
                    objectId
                    userFoo {
                      bar
                    }
                  }
                }
              }
            `,
            context: {
              headers: {
                'X-Parse-Session-Token': session.getSessionToken(),
              },
            },
          });

          const sessionToken = result.data.viewer.sessionToken;
          const { objectId, userFoo: resultFoo } = result.data.viewer.user;
          expect(objectId).toEqual(user.id);
          expect(sessionToken).toBeDefined();
          expect(resultFoo).toEqual(null);
        });
        it('should accept different params', done => {
          Parse.Cloud.define('hello', async req => {
              functionEnum.enumValues.map(value => value.name).sort()
              functionEnum.enumValues.map(value => value.name).sort()
                .map(call => call.args[0])
              result.companies.edges.some(o => o.node.objectId === company.id)
              result.companies.edges.some(o => o.node.name === 'imACompany2')
              result.companies.edges.some(o => o.node.name === 'imACompany3')
              c =>
                c.node.teams.edges.some(t => t.node.name === 'imATeam2')
              c =>
                c.node.teams.edges.some(t => t.node.name === 'imATeam3')
              result.companies.edges.some(o => o.node.objectId === company2.id)
              result.companies.edges.some(o => o.node.name === 'imACompany3')
              result.companies.edges.some(o => o.node.objectId === company1.id)
              result.companies.edges.some(o => o.node.name === 'imACompany2')
            result1.companies.edges.some(o => o.node.objectId === company1.id)
            result1.companies.edges.some(o => o.node.objectId === company2.id)
              edges.find(result => result.node.id === create1.someClass.id).node
                .someField
              edges.find(result => result.node.id === create2.someClass.id).node
                .someField
            expect(someField.map(element => element.value)).toEqual(
            ].map(point => ({
              somePolygonFieldValue.map(geoPoint => ({
        await new Promise(resolve =>
                resolve: p => p.name.toUpperCase(),
        await new Promise(resolve =>
        await new Promise(resolve =>
        const { sessionToken, objectId } = await objectsMutations.createObject(
        context.info.sessionToken = sessionToken;
            context,
            objectId
        const { sessionToken, objectId } = await objectsMutations.createObject(
        context.info.sessionToken = sessionToken;
            context,
            objectId
        const { sessionToken, objectId } = (
        context.info.sessionToken = sessionToken;
            context,
            objectId
          context,
          auth.user.id
import { Auth } from '../../Auth';
  context,
  userId
  const { info, config } = context;
  if (userId && !keys && !include) {
  if (userId) {
    // We need to re create the auth context
    // to avoid security breach if userId is provided
    context.auth = new Auth({
      config,
      isMaster: context.auth.isMaster,
      user: { id: userId },
    });
  }

      .map(key => `${key}`)
      .map(included => `${included}`)
    context.auth,
    '_User',
    // Get the user it self from auth object
    { objectId: context.auth.user.id },
    info.context
  if (!response.results || response.results.length == 0) {
    const user = response.results[0];
            context,