From a6a6f7ff6055f33c4facc5aa14e33489bf36d0fc Mon Sep 17 00:00:00 2001
From: Jeremy Louie <jeremy@jeremylouie.com>
Date: Wed, 19 Oct 2016 15:06:19 -0400
Subject: [PATCH] Fix error when updating installation with useMasterKey
 (#2888)

* Add failing test for updating installations with masterKey

* Prevent auth.installationId from being used when using masterKey

This allows masterKey to update any installation object
Fixes ParsePlatform/parse-server##2887
---
 spec/ParseInstallation.spec.js | 23 +++++++++++++++++++++++
 src/RestWrite.js               |  8 ++++++--
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/spec/ParseInstallation.spec.js b/spec/ParseInstallation.spec.js
index 3796501ea7..6d1a3d7473 100644
--- a/spec/ParseInstallation.spec.js
+++ b/spec/ParseInstallation.spec.js
@@ -906,6 +906,29 @@ describe('Installations', () => {
     });
   });
 
+  it('allows you to update installation with masterKey', done => {
+    let installId = '12345678-abcd-abcd-abcd-123456789abc';
+    let device = 'android';
+    let input = {
+      'installationId': installId,
+      'deviceType': device
+    };
+    rest.create(config, auth.nobody(config), '_Installation', input)
+    .then(createResult => {
+      let installationObj = Parse.Installation.createWithoutData(createResult.response.objectId);
+      installationObj.set('customField', 'custom value');
+      return installationObj.save(null, {useMasterKey: true});
+    }).then(updateResult => {
+      expect(updateResult).not.toBeUndefined();
+      expect(updateResult.get('customField')).toEqual('custom value');
+      done();
+    }).catch(error => {
+      console.log(error);
+      fail('failed');
+      done();
+    });
+  });
+
   // TODO: Look at additional tests from installation_collection_test.go:882
   // TODO: Do we need to support _tombstone disabling of installations?
   // TODO: Test deletion, badge increments
diff --git a/src/RestWrite.js b/src/RestWrite.js
index 1fd291ef01..c7b1a13c46 100644
--- a/src/RestWrite.js
+++ b/src/RestWrite.js
@@ -578,8 +578,12 @@ RestWrite.prototype.handleInstallation = function() {
     this.data.installationId = this.data.installationId.toLowerCase();
   }
 
-  // If data.installationId is not set, we can lookup in the auth
-  let installationId = this.data.installationId || this.auth.installationId;
+  let installationId = this.data.installationId;
+
+  // If data.installationId is not set and we're not master, we can lookup in auth
+  if (!installationId && !this.auth.isMaster) {
+    installationId = this.auth.installationId;
+  }
 
   if (installationId) {
     installationId = installationId.toLowerCase();