fix: Deny request if master key is not set in Parse Server option masterKeyIps regardless of ACL and CLP

spec/Middlewares.spec.js

@@ -33,6 +33,9 @@ describe('middlewares', () => {
   });
 
   it('should use _ContentType if provided', done => {
+    AppCachePut(fakeReq.body._ApplicationId, {
+      masterKeyIps: ['127.0.0.1'],
+    });
     expect(fakeReq.headers['content-type']).toEqual(undefined);
     const contentType = 'image/jpeg';
     fakeReq.body._ContentType = contentType;
@@ -144,31 +147,20 @@ describe('middlewares', () => {
     });
   });
 
-  it('should not succeed and log if the ip does not belong to masterKeyIps list', async () => {
-    const logger = require('../lib/logger').logger;
-    spyOn(logger, 'error').and.callFake(() => {});
-    AppCachePut(fakeReq.body._ApplicationId, {
-      masterKey: 'masterKey',
-      masterKeyIps: ['10.0.0.1'],
-    });
-    fakeReq.ip = '127.0.0.1';
-    fakeReq.headers['x-parse-master-key'] = 'masterKey';
-    await new Promise(resolve => middlewares.handleParseHeaders(fakeReq, fakeRes, resolve));
-    expect(fakeReq.auth.isMaster).toBe(false);
-    expect(logger.error).toHaveBeenCalledWith(
-      `Request using master key rejected as the request IP address '127.0.0.1' is not set in Parse Server option 'masterKeyIps'.`
-    );
-  });
-
   it('should not succeed if the ip does not belong to masterKeyIps list', async () => {
     AppCachePut(fakeReq.body._ApplicationId, {
       masterKey: 'masterKey',
       masterKeyIps: ['10.0.0.1'],
     });
     fakeReq.ip = '127.0.0.1';
     fakeReq.headers['x-parse-master-key'] = 'masterKey';
-    await new Promise(resolve => middlewares.handleParseHeaders(fakeReq, fakeRes, resolve));
-    expect(fakeReq.auth.isMaster).toBe(false);
+    try {
+      await new Promise(resolve => middlewares.handleParseHeaders(fakeReq, fakeRes, resolve));
+    } catch (error) {
+      expect(error.message).toEqual(
+        `Access denied: IP address '127.0.0.1' is not authorized to use the master key.`
+      );
+    }
   });
 
   it('should not succeed if the ip does not belong to maintenanceKeyIps list', async () => {
@@ -180,11 +172,13 @@ describe('middlewares', () => {
     });
     fakeReq.ip = '10.0.0.2';
     fakeReq.headers['x-parse-maintenance-key'] = 'masterKey';
-    await new Promise(resolve => middlewares.handleParseHeaders(fakeReq, fakeRes, resolve));
-    expect(fakeReq.auth.isMaintenance).toBe(false);
-    expect(logger.error).toHaveBeenCalledWith(
-      `Request using maintenance key rejected as the request IP address '10.0.0.2' is not set in Parse Server option 'maintenanceKeyIps'.`
-    );
+    try {
+      await new Promise(resolve => middlewares.handleParseHeaders(fakeReq, fakeRes, resolve));
+    } catch (error) {
+      expect(error.message).toEqual(
+        `Access denied: IP address '10.0.0.2' is not authorized to use the master key.`
+      );
+    }
   });
 
   it('should succeed if the ip does belong to masterKeyIps list', async () => {

src/middlewares.js

@@ -246,6 +246,11 @@ export function handleParseHeaders(req, res, next) {
       `Request using master key rejected as the request IP address '${clientIp}' is not set in Parse Server option 'masterKeyIps'.`
     );
     isMaster = false;
+    // Create a custom error with a 403 status and a specific message #BreakingChange
+    const error = new Error();
+    error.status = 403; // Forbidden status code
+    error.message = `Access denied: IP address '${clientIp}' is not authorized to use the master key.`;
+    throw error;
   }
 
   if (isMaster) {