[RagedPanda]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #10841

Approach

SchemaController.getObjectType now throws Parse.Error.COMMAND_UNAVAILABLE with the same message the storage adapters use ("The operator is not supported yet.") in place of a plain string. A create or update with SetOnInsert or an unknown __op now returns HTTP 400 that names the operator. SetOnInsert through Parse.Server.database.update is unaffected, because that path doesn't run this schema validation.

Tasks

• Add tests

Tested locally (MongoDB 8.0.4 via mongodb-runner, Node 24): the new spec fails on alpha (HTTP 500) and passes with the fix; spec/ParseAPI.spec.js + spec/Schema.spec.js 157 specs, 0 failures; eslint clean on the changed files.

Summary by CodeRabbit

• Bug Fixes
  • Requests using unsupported operators during object creation or updates now receive an HTTP 400 response with a consistent error code and a message identifying the unsupported operator.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8736e852-e455-473b-8ddf-d1b5399257bc

Commits

Reviewing files that changed from the base of the PR and between 9805d3e and 4e60a79.

Files selected for processing: 2

• spec/ParseAPI.spec.js
• src/Controllers/SchemaController.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

Unsupported __op values now return COMMAND_UNAVAILABLE with an operator-specific message. Tests cover SetOnInsert and Foo in class-object creation and update requests.

Changes: Unsupported operation handling

Layer / File(s)	Summary
Return and verify unsupported-operation errors src/Controllers/SchemaController.js, spec/ParseAPI.spec.js	getObjectType now throws a Parse.Error with code COMMAND_UNAVAILABLE for unsupported operators. Tests check for HTTP 400, the error code, and the operator-specific message on POST and PUT requests.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Suggested reviewers: mtrezza

Merge Risk: Minimal · up to 4e60a

The targeted REST behavior is covered, with no actionable merge-blocking risk identified.

Pre-merge checks: 7

Check name	Status	Explanation
Description check		The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the behavior change, identifies the linked issue, lists tests, and records validation results. Docu…
Title check		The title begins with the required fix: prefix, uses a capitalized first letter after the prefix, and accurately describes the unsupported __op write-request error behavior addressed by the change…
Linked Issues check		Issue #10841 requires that a create or update with an unsupported __op (SetOnInsert or an unknown name) return a client error that names the operator, not HTTP 500. Verified at reviewed head: in `…
Out of Scope Changes check		The source change at reviewed head is one hunk in getObjectType in src/Controllers/SchemaController.js. It replaces the plain-string throw in the unknown-operator branch with a Parse.Error. It dir…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Security Check		No security vulnerability is introduced. The diff changes only unsupported __op handling in SchemaController from a thrown string to Parse.Error.COMMAND_UNAVAILABLE, plus regression tests. The R…
Engage In Review Feedback		No review feedback comments were returned, and the current review produced zero actionable findings. Therefore, there is no feedback that the contributor ignored or resolved without prior engagement.

Full details: Description check

Explanation

The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the behavior change, identifies the linked issue, lists tests, and records validation results. Documentation and security checklist items are not applicable or are not required for this change.

Full details: Title check

Explanation

The title begins with the required fix: prefix, uses a capitalized first letter after the prefix, and accurately describes the unsupported __op write-request error behavior addressed by the changes.

Full details: Linked Issues check

Explanation

Issue #10841 requires that a create or update with an unsupported __op (SetOnInsert or an unknown name) return a client error that names the operator, not HTTP 500. Verified at reviewed head: in src/Controllers/SchemaController.js, getObjectType now throws new Parse.Error(Parse.Error.COMMAND_UNAVAILABLE, "The ${obj.__op} operator is not supported yet.") in its default: branch. Before the change, it threw the plain string 'unexpected op: ' + obj.__op, which the server reported as HTTP 500. The thrown value is now a Parse.Error with code 108, the same type and message the storage adapters use, as the issue requests. Because schema validation runs before the storage adapter, this error is the one the client receives. The PR description states that the new spec fails on alpha with HTTP 500 and passes with the fix. The spec diff itself could not be read in this review, so the test was not independently verified. The issue does not require a specific test, so the code change alone supports the verdict. The PR description states that SetOnInsert through Parse.Server.database.update is unaffected. The issue states that path is server-side only, so no requirement is missed there.

Full details: Out of Scope Changes check

Explanation

The source change at reviewed head is one hunk in getObjectType in src/Controllers/SchemaController.js. It replaces the plain-string throw in the unknown-operator branch with a Parse.Error. It directly implements the issue #10841 requirement. The PR also adds a spec in spec/ParseAPI.spec.js (about +23 lines per the review summary), which covers the POST and PUT cases the issue names. Test coverage supports the fix and is in scope. No unrelated changes were identified from the available evidence. The spec hunk could not be read directly, so its exact contents are taken from the summary only. That limit does not change this verdict, because the source change alone is fully connected to the issue.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.

Full details: Security Check

Explanation

No security vulnerability is introduced. The diff changes only unsupported __op handling in SchemaController from a thrown string to Parse.Error.COMMAND_UNAVAILABLE, plus regression tests. The REST middleware serializes this error through res.json, so the operator name is JSON-escaped. The change does not alter authorization, data access, query execution, deserialization, or credential handling.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

Biome (2.5.15)

src/Controllers/SchemaController.js

File contains syntax errors that prevent linting: Line 24: 'import type' are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 32: type annotation are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 271: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 271: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 271: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 401: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 401: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 422: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the synta

... [truncated 16715 characters] ...

n statement outside of a function; Line 1656: Illegal return statement outside of a function; Line 1664: Illegal return statement outside of a function; Line 1669: Illegal return statement outside of a function; Line 1674: Illegal return statement outside of a function; Line 1679: Illegal return statement outside of a function; Line 1684: Illegal return statement outside of a function; Line 1691: Illegal return statement outside of a function; Line 1696: Illegal return statement outside of a function; Line 1698: Illegal return statement outside of a function; Line 1702: Illegal return statement outside of a function; Line 1705: Illegal return statement outside of a function; Line 1710: Illegal return statement outside of a function; Line 1718: Illegal return statement outside of a function

_{Comment @coderabbitai help to get the list of available commands.}