Method handleLogInAs

src/Routers/UsersRouter.js:405–448

* This allows master-key clients to create user sessions without access to * user credentials. This enables systems that can authenticate access another * way (API key, app administrators) to act on a user's behalf. * * We create a new session rather than looking for an existing session;

(req)

   * different reasons from /login
   */
  async handleLogInAs(req) {
    if (!req.auth.isMaster) {
      throw createSanitizedError(
        Parse.Error.OPERATION_FORBIDDEN,
        'master key is required',
        req.config
      );
    }
    if (req.auth.isReadOnly) {
      throw createSanitizedError(
        Parse.Error.OPERATION_FORBIDDEN,
        "read-only masterKey isn't allowed to login as another user.",
        req.config
      );
    }

    const userId = req.body?.userId || req.query.userId;
    if (!userId) {
      throw new Parse.Error(
        Parse.Error.INVALID_VALUE,
        'userId must not be empty, null, or undefined'
      );
    }

    const queryResults = await req.config.database.find('_User', { objectId: userId });
    const user = queryResults[0];
    if (!user) {
      throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'user not found');
    }

    this._sanitizeAuthData(user);

    const { sessionData, createSession } = RestWrite.createSession(req.config, {
      userId,
      createdWith: RestWrite.buildCreatedWith('login', 'masterkey'),
      installationId: req.info.installationId,
    });

    user.sessionToken = sessionData.sessionToken;

    await createSession();

    return { response: user };
  }

  handleVerifyPassword(req) {
    return this._authenticateUserFromRequest(req)