[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.
• Link this pull request to an issue.

Issue

Add request header X-Parse-Upload-Mode to identify file upload as binary data via Buffer, Readable, ReadableStream.

This new header is needed to distinguish between the new streaming and traditional non-streaming file upload on the Parse Server side. Other ways to distinguish have drawbacks and introduce breaking changes in edge cases. For example, using Content-Type: application/octet-stream to infer streaming would be a misuse as it should describe the data, not delivery mode.

Summary by CodeRabbit

• New Features

  • Enhanced stream-based file upload handling with explicit upload mode indication.

• Tests

  • Added comprehensive test coverage for stream and base64 upload modes to ensure proper header configuration across upload scenarios.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added the header X-Parse-Upload-Mode: 'stream' to stream-based uploads in DefaultController.saveBinary and added/updated tests to verify the header is present for stream uploads and absent for base64 uploads.

Changes

Cohort / File(s)	Summary
Stream Upload Header src/ParseFile.ts	Added X-Parse-Upload-Mode: 'stream' to request headers in DefaultController.saveBinary for stream-backed uploads.
Upload Mode Header Tests src/__tests__/ParseFile-test.js	Added and updated tests to assert X-Parse-Upload-Mode: 'stream' is included for stream/binary stream uploads and excluded for base64 uploads; ensured stream body is forwarded for stream-backed binary uploads.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat: Add support for file upload as binary data via Buffer, Readable, ReadableStream #2925: Modifies DefaultController.saveBinary and stream upload handling; directly related to this PR's header addition.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is incomplete. The required 'Closes' field for linking to an issue is not filled out, and the 'Approach' and 'Tasks' sections are missing or incomplete.	Fill in the 'Closes: FILL_THIS_OUT' field with the linked issue number, add an 'Approach' section describing changes, and complete the 'Tasks' checklist by checking off completed items (tests and documentation updates).

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding the X-Parse-Upload-Mode header to identify binary file uploads via Buffer, Readable, or ReadableStream.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/ParseFile.ts (1)

593-596: 'stream' header value also applies to Buffer uploads — consider a dedicated value or documenting the intent.

saveBinary handles both buffer and stream format sources, yet X-Parse-Upload-Mode is always 'stream'. For a Buffer upload the body is a raw in-memory blob, not a streamed entity. If the Parse Server (or any proxy) ever needs to distinguish the two, it will have no way to do so from this header.

If the intent is purely to signal "binary (not base64)", a value like 'binary' would be more accurate for both cases; if the server genuinely needs to distinguish, separate values ('buffer' / 'stream') would be cleaner.

💡 Option A — single generic value

-      'X-Parse-Upload-Mode': 'stream',
+      'X-Parse-Upload-Mode': 'binary',

💡 Option B — differentiated values

-      'X-Parse-Upload-Mode': 'stream',
+      'X-Parse-Upload-Mode': source.format === 'buffer' ? 'buffer' : 'stream',

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/ParseFile.ts` around lines 593 - 596, The X-Parse-Upload-Mode header is
always set to 'stream' even though saveBinary handles both Buffer and stream
sources; update the header logic in the saveBinary flow (where headers are
built, referencing X-Parse-Upload-Mode and CoreManager.get('APPLICATION_ID')) to
use a meaningful value: either a generic 'binary' for all non-base64 uploads or
choose differentiated values like 'buffer' vs 'stream' based on the actual input
type detected before setting headers. Ensure the chosen value is documented in
comments and consistently used wherever saveBinary constructs headers.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/__tests__/ParseFile-test.js`:
- Around line 976-996: The test incorrectly checks the JSON request body for the
header; instead mock the binary path and assert it was never used: replace the
inline ajax: () => {} with a jest.fn() mock (e.g., ajaxMock) when calling
CoreManager.setRESTController, call file.save() as before, assert request was
called with the base64 payload, and then assert ajaxMock was not called to
guarantee the binary/upload-mode path was not taken (reference the request mock,
ajax mock, and the ParseFile.save invocation).

---

Nitpick comments:
In `@src/ParseFile.ts`:
- Around line 593-596: The X-Parse-Upload-Mode header is always set to 'stream'
even though saveBinary handles both Buffer and stream sources; update the header
logic in the saveBinary flow (where headers are built, referencing
X-Parse-Upload-Mode and CoreManager.get('APPLICATION_ID')) to use a meaningful
value: either a generic 'binary' for all non-base64 uploads or choose
differentiated values like 'buffer' vs 'stream' based on the actual input type
detected before setting headers. Ensure the chosen value is documented in
comments and consistently used wherever saveBinary constructs headers.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e42caf6) to head (13d85d8).
⚠️ Report is 6 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff            @@
##             alpha     #2927   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           64        64           
  Lines         6318      6318           
  Branches      1517      1513    -4     
=========================================
  Hits          6318      6318           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/__tests__/ParseFile-test.js`:
- Around line 976-996: The test "base64 uploads do not include
X-Parse-Upload-Mode header" is correct as written and requires no code change;
keep the jest mocks and assertions (the ParseFile instantiation and save call,
mocking CoreManager RESTController via request and ajax, and the
expect(request).toHaveBeenCalledWith(...) plus
expect(ajax).not.toHaveBeenCalled()) because using ajax = jest.fn() with
expect(ajax).not.toHaveBeenCalled() is the intended stronger guard proving the
binary/streaming code path (which sets X-Parse-Upload-Mode) was never entered.

[parseplatformorg]

🎉 This change has been released in version 8.2.0-alpha.2

[parseplatformorg]

🎉 This change has been released in version 8.2.0