From 3b75a14a818169f606fb6fdf7ef8204438891647 Mon Sep 17 00:00:00 2001
From: Manuel Trezza <trezza.m@gmail.com>
Date: Tue, 20 Aug 2019 19:07:39 +0200
Subject: [PATCH 1/4] added saving, retrieving

---
 src/Routers/GlobalConfigRouter.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/Routers/GlobalConfigRouter.js b/src/Routers/GlobalConfigRouter.js
index 2b1d41bd9a..ca189ead68 100644
--- a/src/Routers/GlobalConfigRouter.js
+++ b/src/Routers/GlobalConfigRouter.js
@@ -13,7 +13,20 @@ export class GlobalConfigRouter extends PromiseRouter {
           return { response: { params: {} } };
         }
         const globalConfig = results[0];
-        return { response: { params: globalConfig.params } };
+        if (!req.auth.isMaster && globalConfig.masterKeyOnly !== undefined) {
+          for (const param in globalConfig.params) {
+            if (globalConfig.masterKeyOnly[param]) {
+              delete globalConfig.params[param];
+              delete globalConfig.masterKeyOnly[param];
+            }
+          }
+        }
+        return {
+          response: {
+            params: globalConfig.params,
+            masterKeyOnly: globalConfig.masterKeyOnly,
+          },
+        };
       });
   }
 
@@ -25,9 +38,11 @@ export class GlobalConfigRouter extends PromiseRouter {
       );
     }
     const params = req.body.params;
+    const masterKeyOnly = req.body.masterKeyOnly || {};
     // Transform in dot notation to make sure it works
     const update = Object.keys(params).reduce((acc, key) => {
       acc[`params.${key}`] = params[key];
+      acc[`masterKeyOnly.${key}`] = masterKeyOnly[key] || false;
       return acc;
     }, {});
     return req.config.database

From 8eb3436b58b449bae9899b390906b22228576fcf Mon Sep 17 00:00:00 2001
From: Manuel Trezza <trezza.m@gmail.com>
Date: Tue, 20 Aug 2019 19:34:35 +0200
Subject: [PATCH 2/4] added tests

---
 spec/ParseGlobalConfig.spec.js | 51 ++++++++++++++++++++++++++++++++--
 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/spec/ParseGlobalConfig.spec.js b/spec/ParseGlobalConfig.spec.js
index ff5611ae01..79a028a85e 100644
--- a/spec/ParseGlobalConfig.spec.js
+++ b/spec/ParseGlobalConfig.spec.js
@@ -23,7 +23,10 @@ describe('a GlobalConfig', () => {
           fields: { objectId: { type: 'Number' }, params: { type: 'Object' } },
         },
         query,
-        { params: { companies: ['US', 'DK'] } }
+        {
+          params: { companies: ['US', 'DK'], internalParam: 'internal' },
+          masterKeyOnly: { internalParam: true },
+        }
       )
       .then(done, err => {
         jfail(err);
@@ -54,6 +57,44 @@ describe('a GlobalConfig', () => {
     });
   });
 
+  it('internal parameter can be retrieved with master key', done => {
+    request({
+      url: 'http://localhost:8378/1/config',
+      json: true,
+      headers,
+    }).then(response => {
+      const body = response.data;
+      try {
+        expect(response.status).toEqual(200);
+        expect(body.params.internalParam).toEqual('internal');
+      } catch (e) {
+        jfail(e);
+      }
+      done();
+    });
+  });
+
+  it('internal parameter cannot be retrieved without master key', done => {
+    request({
+      url: 'http://localhost:8378/1/config',
+      json: true,
+      headers: {
+        'X-Parse-Application-Id': 'test',
+        'X-Parse-REST-API-Key': 'rest',
+        'Content-Type': 'application/json',
+      },
+    }).then(response => {
+      const body = response.data;
+      try {
+        expect(response.status).toEqual(200);
+        expect(body.params.internalParam).toBeUndefined();
+      } catch (e) {
+        jfail(e);
+      }
+      done();
+    });
+  });
+
   it('can be updated when a master key exists', done => {
     request({
       method: 'PUT',
@@ -117,7 +158,13 @@ describe('a GlobalConfig', () => {
       method: 'PUT',
       url: 'http://localhost:8378/1/config',
       json: true,
-      body: { params: { companies: { __op: 'Delete' }, foo: 'bar' } },
+      body: {
+        params: {
+          companies: { __op: 'Delete' },
+          internalParam: { __op: 'Delete' },
+          foo: 'bar',
+        },
+      },
       headers,
     }).then(response => {
       const body = response.data;

From 0108bb00ea4b363eee6fd8d62a1f81a8dd457e12 Mon Sep 17 00:00:00 2001
From: Manuel Trezza <trezza.m@gmail.com>
Date: Tue, 20 Aug 2019 20:42:30 +0200
Subject: [PATCH 3/4] fixed typo


From 72dab698c85e800ca1b838dedf6c4eb628224459 Mon Sep 17 00:00:00 2001
From: Manuel Trezza <trezza.m@gmail.com>
Date: Wed, 21 Aug 2019 02:22:36 +0200
Subject: [PATCH 4/4] added masterKeyOnly to schema controller

---
 spec/ParseGlobalConfig.spec.js      | 6 +++++-
 src/Controllers/SchemaController.js | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/spec/ParseGlobalConfig.spec.js b/spec/ParseGlobalConfig.spec.js
index 79a028a85e..9f8b109ed3 100644
--- a/spec/ParseGlobalConfig.spec.js
+++ b/spec/ParseGlobalConfig.spec.js
@@ -20,7 +20,11 @@ describe('a GlobalConfig', () => {
       .upsertOneObject(
         '_GlobalConfig',
         {
-          fields: { objectId: { type: 'Number' }, params: { type: 'Object' } },
+          fields: {
+            objectId: { type: 'Number' },
+            params: { type: 'Object' },
+            masterKeyOnly: { type: 'Object' },
+          },
         },
         query,
         {
diff --git a/src/Controllers/SchemaController.js b/src/Controllers/SchemaController.js
index 23c4013ee5..5d62703be7 100644
--- a/src/Controllers/SchemaController.js
+++ b/src/Controllers/SchemaController.js
@@ -131,6 +131,7 @@ const defaultColumns: { [string]: SchemaFields } = Object.freeze({
   _GlobalConfig: {
     objectId: { type: 'String' },
     params: { type: 'Object' },
+    masterKeyOnly: { type: 'Object' },
   },
   _GraphQLConfig: {
     objectId: { type: 'String' },