Method handleMe

src/Routers/UsersRouter.js:191–235

(req)

  }

  async handleMe(req) {
    if (!req.info || !req.info.sessionToken) {
      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
    }
    const sessionToken = req.info.sessionToken;
    // Query the session with master key to validate the session token,
    // but do NOT include 'user' to avoid leaking user data via master context
    const sessionResponse = await rest.find(
      req.config,
      Auth.master(req.config),
      '_Session',
      { sessionToken },
      {},
      req.info.clientSDK,
      req.info.context
    );
    if (
      !sessionResponse.results ||
      sessionResponse.results.length == 0 ||
      !sessionResponse.results[0].user
    ) {
      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
    }
    const userId = sessionResponse.results[0].user.objectId;
    // Re-fetch the user with the caller's auth context so that
    // protectedFields, CLP, and auth adapter afterFind apply correctly
    const userResponse = await rest.get(
      req.config,
      req.auth,
      '_User',
      userId,
      {},
      req.info.clientSDK,
      req.info.context
    );
    if (!userResponse.results || userResponse.results.length == 0) {
      throw createSanitizedError(Parse.Error.INVALID_SESSION_TOKEN, 'Invalid session token', req.config);
    }
    const user = userResponse.results[0];
    // Send token back on the login, because SDKs expect that.
    user.sessionToken = sessionToken;
    // Remove hidden properties.
    UsersRouter.removeHiddenProperties(user);
    return { response: user };
  }

  async handleLogIn(req) {
    const user = await this._authenticateUserFromRequest(req);