Module users 

Signup, login, /users/me, logout.

Upstream: src/Routers/UsersRouter.js. Three facts shape this module.

• POST /users is not POST /classes/_User. Only the signup route returns a session token. A non-master create or delete through the class route is refused; an update is allowed, because that is what user.save() sends. See classes::enforce_class_security.
• The password hash must never reach a response. Upstream reattaches the hash onto the object as password and strips it in exactly one place, so every response path depends on that one step running. Here the hash is never placed on a response object at all, so there is nothing to strip and no path that can forget to.
• Login reads below the pipeline. filterSensitiveData removes every _-prefixed key, including the hash the password check needs, so a login that went through the read pipeline could never verify anything. Upstream has the same problem and solves it by reading under Auth.maintenance (UsersRouter.js:108-110), whose bypass parse-rust does not model; the equivalent here is one direct adapter read, built from a username and nothing client-shaped.

Constants

USER_CLASS

Functions

login_core

POST /login.

logout_core

POST /logout.

me_core

GET /users/me.

signup_core

POST /users. Signup.