fix(Role): use noDefaultACL flag while creating Role interally (#461)

Author: leeyeh

src/av.js

@@ -291,7 +291,7 @@ AV._decode = function(value, key) {
   var className;
   if (value.__type === "Pointer") {
     className = value.className;
-    var pointer = AV.Object._create(className);
+    var pointer = AV.Object._create(className, undefined, undefined, /* noDefaultACL*/ true);
     if(Object.keys(value).length > 3) {
         const v = _.clone(value);
         delete v.__type;
@@ -308,7 +308,7 @@ AV._decode = function(value, key) {
     const v = _.clone(value);
     delete v.__type;
     delete v.className;
-    var object = AV.Object._create(className);
+    var object = AV.Object._create(className, undefined, undefined, /* noDefaultACL*/ true);
     object._finishFetch(v, true);
     return object;
   }

src/object.js

@@ -1239,7 +1239,7 @@ module.exports = function(AV) {
     * @return {AV.Object} A new subclass instance of AV.Object.
     */
    AV.Object.createWithoutData = function(className, id, hasData){
-     var result = new AV.Object(className);
+     var result = AV.Object._create(className, undefined, undefined, /* noDefaultACL*/ true);
      result.id = id;
      result._hasData = hasData;
      return result;
@@ -1293,9 +1293,9 @@ module.exports = function(AV) {
    * Creates an instance of a subclass of AV.Object for the given classname.
    * @private
    */
-  AV.Object._create = function(className, attributes, options) {
+  AV.Object._create = function(className, attributes, options, noDefaultACL) {
     var ObjectClass = AV.Object._getSubclass(className);
-    return new ObjectClass(attributes, options);
+    return new ObjectClass(attributes, options, noDefaultACL);
   };
 
   // Set up a map of className to class so that we can create new instances of

src/role.js

@@ -21,18 +21,21 @@ module.exports = function(AV) {
      * @param {AV.ACL} [acl] The ACL for this role. if absent, the default ACL
      *    `{'*': { read: true }}` will be used.
      */
-    constructor: function(name, acl) {
+    constructor: function(name, acl, noDefaultACL) {
       if (_.isString(name)) {
         AV.Object.prototype.constructor.call(this, null, null);
         this.setName(name);
       } else {
         AV.Object.prototype.constructor.call(this, name, acl);
       }
       if (acl === undefined) {
-        var defaultAcl = new AV.ACL();
-        defaultAcl.setPublicReadAccess(true);
-        if(!this.getACL()) {
-          this.setACL(defaultAcl);
+        if (!noDefaultACL) {
+          if(!this.getACL()) {
+            console.warn('DEPRECATED: To create a Role without ACL(a default ACL will be used) is deprecated. Please specify an ACL.');
+            var defaultAcl = new AV.ACL();
+            defaultAcl.setPublicReadAccess(true);            
+            this.setACL(defaultAcl);
+          }
         }
       } else if (!(acl instanceof AV.ACL)) {
         throw new TypeError('acl must be an instance of AV.ACL');

test/role.js

@@ -17,6 +17,16 @@ describe("Role", function() {
         }
       });
     });
+    it('no default ACL', () => {
+      expect(AV.Object.createWithoutData('_Role').getACL()).to.eql(undefined);
+      expect(AV._decode({
+        __type: 'Pointer',
+        className: '_Role',
+        name: 'Admin',
+        objectId: '577e50c3165abd005549f210',
+      }).getACL()).to.eql(undefined);
+      expect((new AV.Object('_Role')).getACL()).not.to.eql(undefined);
+    });
     it("type check", function() {
       expect(function() {
         new AV.Role('foo', {});