Node.js Cloud Function Guide

Cloud function is a sub-module of LeanEngine that allows you to run functions on the cloud in response to the requests made by clients. Before you continue, make sure you have read LeanEngine Overview.

When developing your application, you may need to write logic that:

• Are shared by multiple platforms (like iOS, Android, and web) and you wish to write them only once.
• Need to be modified frequently (like the sorting rules of a list) but you don't want to release a new version of client each time you make a change.
• Demand high network traffic or computing power (like producing statistics on a huge table) which you don't want to run on clients.
• Need to be triggered when certain events happen (hooking). For example, when a user deletes an account, you may wish to delete the entries in other tables that are related to this account as well.
• Need to bypass certain restrictions set by ACL.
• Need to be performed routinely. For example, you may wish to clean up inactive accounts every month.

With cloud function, you can deploy these logic written in any language (JavaScript, Python, PHP, or Java) on the cloud and have LeanEngine run them for you.

If you have no idea how to deploy you project to LeanEngine, take a look at LeanEngine Quick Start.

Other Languages

This guide uses Node.js as an example, but LeanEngine supports many other languages as well. You can choose the one you are familiar with for development:

• Node.js (current)
• Python
• PHP
• Java

Switching Environments

LeanEngine offers two environments for each app: production environment and staging environment. When calling cloud functions within LeanEngine instances using SDK, no matter explicitly or implicitly (by triggering hooks), the SDK uses the function defined in the same environment as the instance. For example, if beforeDelete hook is defined and an object is deleted with SDK in the staging environment, the beforeDelete hook in the staging environment will be triggered.

When calling cloud functions outside of LeanEngine instances using SDK, no matter explicitly or implicitly, X-LC-Prod is set to be 1 by default, which means that the production environment will be used. For historical reasons, there are some differences between each SDK:

• For Node.js, PHP, and Java SDKs, the production environment will always be used by default.
• For Python SDK, when debugging locally with lean-cli, the staging environment will be used if it exists, otherwise the production environment will be used.
• For Java example projects java-war-getting-started and spring-boot-getting-started, when debugging locally with lean-cli, the staging environment will be used if it exists, otherwise the production environment will be used (same as Python SDK).

You can specify the environment being used with SDK:

[AVCloud setProductionMode:NO]; // Staging environment

AV.setProduction(false); // Staging environment

leancloud.use_production(False) # Staging environment
# Call it before `leancloud.init`

LeanClient::useProduction(false); // Staging environment

AVCloud.setProductionMode(false); // Staging environment

Apps with only trial instances would only have production environments. Please do not attempt to switch to staging environments.

Cloud Functions

In this example, a simple cloud function named hello is defined in cloud.js. By doing so, clients running on all platforms will be able to call it and get the return value of it. The computing process of the function is done on the cloud side rather than on the client side, so there will be less burden on the clients.

Now let's look into a more complex example.

Imagine that you have an app that lets users review the movies they have watched. An object containing a single review of a movie may look like this:

{
  "movie": "Despicable Me",
  "stars": 5,
  "comment": "These minions are so cute. I wish they are real and I can have them in my home!"
}

stars is the score given by the user, ranging from 1 to 5. If you want to obtain the average score of Despicable Me, one thing you can do is to have the client search for all the reviews of this movie and calculate the average score on the device. However, this requires all the reviews of this movie to be fetched to the client, which leads to unnecessary network traffic. With cloud function, you can simply have the client pass the name of the movie to the cloud and receive the calculated score only.

Cloud functions accept parameters in JSON objects which we can include the name of the movie in. All the methods defined in LeanStorage JavaScript SDK can be used on LeanEngine, so we can write the cloud function averageStars like this:

AV.Cloud.define('averageStars', function (request) {
  var query = new AV.Query('Review');
  query.equalTo('movie', request.params.movie);
  return query.find().then(function (results) {
    var sum = 0;
    for (var i = 0; i < results.length; i++) {
      sum += results[i].get('stars');
    }
    return sum / results.length;
  });
});

Parameters and Return Values

A Request will be passed into a cloud function as a parameter. Each Request contains the following properties:

• params: object: The parameters sent from the client; might be an AV.Object when the function is called with rpc.
• currentUser?: AV.User: The user logged in at the client side (according to the header X-LC-Session).
• sessionToken?: string: The sessionToken sent from the client (according to the header X-LC-Session).
• meta: object: Other information about the client, including remoteAddress which is the IP address of the client.

AV.Cloud.define also takes in an optional parameter options (between the function name and the actual function) which has the following properties:

• fetchUser: boolean: Whether to automatically get the user information from the client; defaults to true. When set to false, Request will not have the currentUser property.
• internal: boolean: Whether to only allow the function to be called within LeanEngine (using AV.Cloud.run without enabling remote) or with Master Key (by passing in useMasterKey to AV.Cloud.run) and prevent it from being called directly by the client; defaults to false.

For example, if we don't allow a client to call the function above directly and the function does not need the user information, we can rewrite the function in this way:

AV.Cloud.define('averageStars', { fetchUser: false, internal: true }, function (request) {
  // Same definition as above
});

If the cloud function returns a Promise, the client will receive the response once the Promise is resolved. If an error occurred in the Promise, the client will receive the error as the response. An exception made by AV.Cloud.Error will be considered as a client-side error and will not be output as an error message. The error messages for other exceptions will be printed out accordingly.

We recommend that you chain Promises together to make it easy to process tasks asynchronously and handle errors. Make sure to have the cloud function return the chained Promises. You can read Promises/A+ Proposal to learn more about Promises.

Calling Cloud Functions with SDK

You can call cloud functions with any LeanCloud SDK:

// Construct the dictionary to be passed to the cloud
NSDictionary *dicParameters = [NSDictionary dictionaryWithObject:@"Despicable Me"
                                                          forKey:@"movie"];

// Call averageStars with parameters
[AVCloud callFunctionInBackground:@"averageStars"
                   withParameters:dicParameters
                   block:^(id object, NSError *error) {
                   if(error == nil){
                     // Success; object is the returned value from the cloud function
                   } else {
                     // Error handling
                   }
}];

var paramsJson = {
  movie: "Despicable Me"
};
AV.Cloud.run('averageStars', paramsJson).then(function (data) {
  // Success; data is the returned value from the cloud function
}, function (err) {
  // Error handling
});

from leancloud import cloudfunc

cloudfunc.run('averageStars', movie='Despicable Me')

use \LeanCloud\Engine\Cloud;
$params = array(
    "movie" => "Despicable Me"
);
Cloud::run("averageStars", $params);

// Construct the parameters to be passed to the cloud
Map<String, String> dicParameters = new HashMap<String, String>();
dicParameters.put("movie", "Despicable Me");

// Call averageStars with parameters
AVCloud.callFunctionInBackground("averageStars", dicParameters, new FunctionCallback() {
    public void done(Object object, AVException e) {
        if (e == null) {
            // Success; object is the returned value from the cloud function
        } else {
            // Error handling
        }
    }
});

Calling Cloud Functions with REST API

See LeanEngine REST API Guide.

Calling Cloud Functions on LeanEngine

You can call the cloud functions defined by AV.Cloud.define with AV.Cloud.run:

AV.Cloud.run('averageStars', {
  movie: 'Despicable Me'
}).then(function (data) {
  // Success; data is the returned value from the cloud function
}, function (error) {
  // Error handling
});

By doing so, a local function call will be triggered without initiating an HTTP request. If you want to call the cloud function through an HTTP request, add remote: true as an option. This will be helpful when you use Node.js SDK outside of a LeanEngine environment (including calling cloud functions defined in primary groups from secondary groups):

AV.Cloud.run('averageStars', { movie: 'Despicable Me' }, { remote: true }).then(function (data) {
  // Success; data is the returned value from the cloud function
}, function (error) {
  // Error handling
});

Here remote is passed into AV.Cloud.run as a property of an optional parameter options. options has the following properties:

• remote?: boolean: The same remote as used in the example above; defaults to false.
• user?: AV.User: The user used to run the function (often used when remote is false).
• sessionToken?: string: The sessionToken used to run the function (often used when remote is true).
• req?: http.ClientRequest | express.Request: Used to provide remoteAddress to the function being called.

Calling Cloud Functions with RPC

By calling cloud functions with RPC, LeanEngine will automatically serialize the HTTP response body and the SDK will get the response in the format of AV.Object:

NSDictionary *dicParameters = [NSDictionary dictionaryWithObject:@"Despicable Me"
                                                          forKey:@"movie"];

[AVCloud rpcFunctionInBackground:@"averageStars"
                  withParameters:parameters
                  block:^(id object, NSError *error) {
                  if(error == nil){
                    // Success
                  }
                  else {
                    // Error handling
                  }
}];

var paramsJson = {
  movie: "Despicable Me"
};

AV.Cloud.rpc('averageStars', paramsJson).then(function (object) {
  // Success
}, function (error) {
  // Error handling
});

from leancloud import cloudfunc

cloudfunc.rpc('averageStars', movie='Despicable Me')

// Construct parameters
Map<String, String> dicParameters = new HashMap<String, String>();
dicParameters.put("movie", "Despicable Me");

AVCloud.rpcFunctionInBackground("averageStars", dicParameters,
  new FunctionCallback<AVObject>() {
    @Override
    public void done(AVObject object, AVException e) {
      Assert.assertNull(e);
    }
  }
);

Error Codes

You can customize error codes for cloud functions in accordance with HTTP status codes.

AV.Cloud.define('errorCode', function (request) {
  return AV.User.logIn('NotThisUser', 'P@ssword');
});

The client will receive { "code": 211, "error": "Could not find the user." } from the function above.

AV.Cloud.define('customErrorCode', function (request) {
  throw new AV.Cloud.Error('Custom error message.', { code: 123 });
});

The client will receive { "code": 123, "error": "Custom error message." } from the function above.

Timeouts

The time limit for a cloud function to be processed is 15 seconds. If the cloud function does not make a response after this, HTTP error 503 will be triggered with error message The request timed out on the server. An error log like LeanEngine: /1.1/functions/<cloudFunc>: function timeout (15000ms) will be printed on the server side. Keep in mind that even after the client already receives the error message, the function may still be running, but the return value of the function will not be able to be sent to the client and an error log like Can't set headers after they are sent will be printed.

Handling Timeouts

We recommend that you have your application handle tasks asynchronously to avoid timeouts.

You may:

1. Create a new class in LeanStorage with a field named status.
2. For each new task, create an object with this class and mark status to be ongoing. End the request by sending the id of this task back to the client:

   return new Promise((resolve, reject) => {
     resolve(id);
   });
   

3. After the task is completed, change its status to be completed or failed.
4. You can check the status of a task at any time with its id.

However, this usually does not make sense for before hooks. Although asynchronous before hooks will not trigger timeout errors, they also cannot interrupt the operation. If you cannot optimize execuation time for before hooks, you have to use after hooks instead. For example, to filter fake comments, one beforeSave hook needs to call a time-consuming third party NLP API, which may cause timeout. As a workaround, you can use an afterSave hook to call the third party after the comment is saved. If that comment turns out to be a fake one, then delete it afterwards.

Hooking

A hook can be automatically triggered when certain events happen (like before or after saving or updating an object). Keep in mind that:

• Importing data on the dashboard will not trigger any hooks.
• Dead loops may be caused if hooks are not defined properly.
• Hooks cannot be applied to _Installation table.

For hooks starting with before (including onLogin), if an exception occurs inside the function, the data operation will be terminated. Therefore, you can reject certain data operations by having functions throw an error. For hooks starting with after (including onVerified), such exception will not terminate the data operation because the operation is already completed before the function is executed.

graph LR
A((save)) -->D{object}
D-->E(new)
E-->|beforeSave|H{error?}
H-->N(No)
N-->B[create new object on the cloud]
B -->|afterSave|C((done))
H-->Y(Yes)
Y-->Z((interrupted))
D-->F(existing)
F-->|beforeUpdate|I{error?}
I-->Y
I-->V(No)
V-->G[update existing object on the cloud]
G-->|afterUpdate|C

graph LR
A((delete))-->|beforeDelete|H{error?}
H-->Y(Yes)
Y-->Z((interrupted))
H-->N(No)
N-->B[delete object on the cloud]
B -->|afterDelete|C((done))

To ensure that hooks are triggered internally by LeanStorage services, our SDK will verify the source of each request. If the verification fails, the error message Hook key check failed will be returned. If you see such error message when debugging locally, make sure you are using our command-line interface for debugging.

beforeSave

You can perform an operation before an object is saved, like data verification and pre-processing. For example, a comment on a movie may be too long to be displayed on the client and needs to be cut off to 140 characters:

AV.Cloud.beforeSave('Review', function (request) {
  var comment = request.object.get('comment');
  if (comment) {
    if (comment.length > 140) {
      // Cut off and add '…' in the end
      request.object.set('comment', comment.substring(0, 140) + '…');
    }
  } else {
    // Return an error without saving the object
    throw new AV.Cloud.Error('No comment provided!');
  }
});

Here request.object is the AV.Object being operated. request has another property beside object:

• currentUser?: AV.User: The user triggering the operation.

object and currentUser can be found in the request of other hooks as well.

afterSave

You can perform an operation after an object is saved. For example, to update the total number of comments after a comment is created:

AV.Cloud.afterSave('Comment', function (request) {
  var query = new AV.Query('Post');
  return query.get(request.object.get('post').id).then(function (post) {
    post.increment('comments');
    return post.save();
  });
});

Or, to add a new field from for each new user:

AV.Cloud.afterSave('_User', function (request) {
  console.log(request.object);
  request.object.set('from', 'LeanCloud');
  return request.object.save().then(function (user) {
    console.log('Success!');
  });
});

Even though the return value of such hook is not important, we still recommend that you have the function return a Promise so that error logs can be printed out when exceptions occur.

beforeUpdate

You can perform an operation before an object is updated. You will be able to know which fields are updated, or reject the data operation:

AV.Cloud.beforeUpdate('Review', function (request) {
  // Check the length of comment if it is updated
  if (request.object.updatedKeys.indexOf('comment') != -1) {
    if (request.object.get('comment').length > 140) {
      // Reject the update if comment is too long
      throw new AV.Cloud.Error('Your comment cannot be longer than 140 characters.');
    }
  }
});

afterUpdate

You can perform an operation after an object is updated. You will be able to know which fields are updated (same as beforeUpdate).

AV.Cloud.afterUpdate('Review', function(request) {
  if (request.object.updatedKeys.indexOf('comment') != -1) {
    if (request.object.get('comment').length < 5) {
      console.log(review.ObjectId + " seems like a spam: " + comment)
    }
  }
});

Preventing Dead Loops

You might be wondering why we can modify and save the post object in the afterUpdate hook without triggering this hook again. This is because LeanEngine automatically identifies and pre-processes all the request.object objects passed in by a hook to prevent the hook to be triggered again.

However, if the following situations happen, you still need to handle them by yourself:

• You called fetch on the request.object objects passed in.
• You constructed the request.object objects passed in by yourself with methods like AV.Object.createWithoutData().

To prevent such objects from triggering certain hooks, you can call object.disableBeforeHook() or object.disableAfterHook() on them:

// Directly modifying and saving the object will not trigger afterUpdate
request.object.set('foo', 'bar');
request.object.save().then(function (obj) {
  // Your logic here
});

// Use disableAfterHook if you called fetch on the object
request.object.fetch().then(function (obj) {
  obj.disableAfterHook();
  obj.set('foo', 'bar');
  return obj.save();
}).then(function (obj) {
  // Your logic here
});

// Use disableAfterHook if you constructed the object by yourself
var obj = AV.Object.createWithoutData('Post', request.object.id);
obj.disableAfterHook();
obj.set('foo', 'bar');
obj.save().then(function (obj) {
  // Your logic here
});

beforeDelete

You can perform an operation before an object is deleted. For example, before an album is deleted, check if there are any photos in it:

AV.Cloud.beforeDelete('Album', function (request) {
  // See if there is a Photo belonging to this Album
  var query = new AV.Query('Photo');
  var album = AV.Object.createWithoutData('Album', request.object.id);
  query.equalTo('album', album);
  return query.count().then(function (count) {
    if (count > 0) {
      // The delete operation will be aborted
      throw new AV.Cloud.Error('Cannot delete an album if it still has photos in it.');
    }
  }, function (error) {
    throw new AV.Cloud.Error('Error ' + error.code + ' occurred when finding photos: ' + error.message);
  });
});

afterDelete

You can perform an operation after an object is deleted. For example, when an album is being deleted, instead of checking if there are any photos left, we directly delete all the photos in it:

AV.Cloud.afterDelete('Album', function (request) {
  var query = new AV.Query('Photo');
  var album = AV.Object.createWithoutData('Album', request.object.id);
  query.equalTo('album', album);
  return query.find().then(function (posts) {
    return AV.Object.destroyAll(posts);
  }).catch(function (error) {
    console.error('Error ' + error.code + ' occurred when finding photos: ' + error.message);
  });
});

onVerified

You can perform an operation after a user's email or phone number is verified:

AV.Cloud.onVerified('sms', function (request) {
  console.log('User ' + request.object + ' is verified by SMS.');
});

Here object can be replaced by currentUser as well since the object being operated is the user itself. Same for onLogin.

The first parameter is the type of verification (sms for phone number and email for email).

Keep in mind that you don't have to update fields like emailVerified with this hook since the system automatically updates them.

onLogin

You can perform an operation before a user tries to log in. For example, to prevent blocked users from logging in:

AV.Cloud.onLogin(function (request) {
  // The user is not logged in yet and their information is in request.object
  console.log('User ' + request.object + ' is trying to log in.');
  if (request.object.get('username') === 'noLogin') {
    // The user cannot log in if an error is thrown (error 401 will be returned)
    throw new AV.Cloud.Error('Forbidden');
  }
});

You can also verify access_token of a third party account using this hook.

Suppose there is a platform called Example with the following authData:

{
    "uid": "42",
    "access_token": "access token string",
}

and the platform name is example_platform. We can verify its access_token using the method below:

AV.Cloud.onLogin(function (request) {
  const authData = request.object.get("authData");
  const userID = authData.example_platform.uid;
  const token = authData.example_platform.access_token;

  https.get(`https://example.com/applications/${userID}/tokens/${token}`, (res) => {
    if (res.statusCode !== 200) {
      throw new AV.Cloud.Error('Example platform token invalid');
    }
  }).on('error', (e) => {
    console.error(e);
    throw new AV.Cloud.Error('Failed to verify Example platform token'); 
  });
});

Be aware that the code above is for demonstration only. We omitted a lot of logic for brevity, such as verifying token's expiration date, handling user login in other ways, and recovering from network errors.

Hooks for LeanMessage

See LeanMessage Overview > LeanEngine Hooks for more instructions on the methods introduced below.

onIMMessageReceived

You can perform an operation after a message is delivered to the cloud but before it is delivered to the receiver. For example, to filter out certain keywords from the message:

AV.Cloud.onIMMessageReceived((request) => {
    // request.params: {
    //     fromPeer: 'Tom',
    //     receipt: false,
    //     groupId: null,
    //     system: null,
    //     content: '{"_lctext":"Hello!","_lctype":-1}',
    //     convId: '5789a33a1b8694ad267d8040',
    //     toPeers: ['Jerry'],
    //     __sign: '1472200796787,a0e99be208c6bce92d516c10ff3f598de8f650b9',
    //     bin: false,
    //     transient: false,
    //     sourceIP: '121.239.62.103',
    //     timestamp: 1472200796764
    // }

    let content = request.params.content;
    console.log('content', content);
    let processedContent = content.replace('selling drugs', '**');
    // Must return the content or an error will be triggered
    return {
        content: processedContent
    };
});

onIMReceiversOffline

You can perform an operation if a message is delivered to the receiver but the receiver is offline. For example, to slice the first 32 characters of the message as the title for the push notification:

AV.Cloud.onIMReceiversOffline((request) => {
    let params = request.params;
    let content = params.content;

    // params.content is the content of the message
    let shortContent = content;

    if (shortContent.length > 32) {
        shortContent = content.slice(0, 32);
    }

    console.log('shortContent', shortContent);

    return {
        pushMessage: JSON.stringify({
            // Self-increase the number of unread messages
            // Can be set to a fixed number
            badge: "Increment",
            sound: "default",
            // Using development certificate
            _profile: "dev",
            alert: shortContent
        })
    }
});

onIMMessageSent

You can perform an operation after a message is delivered to the receiver. For example, to print out a log in LeanEngine:

AV.Cloud.onIMMessageSent((request) => {
  console.log('params:', request.params);

  // params: {
  //   fromPeer: 'Tom',
  //   receipt: false,
  //   onlinePeers: [],
  //   content: '12345678',
  //   convId: '5789a33a1b8694ad267d8040',
  //   msgId: 'fptKnuYYQMGdiSt_Zs7zDA',
  //   __sign: '1472703266575,30e1c9b325410f96c804f737035a0f6a2d86d711',
  //   bin: false,
  //   transient: false,
  //   sourceIP: '114.219.127.186',
  //   offlinePeers: ['Jerry'],
  //   timestamp: 1472703266522
  // }
});

onIMConversationStart

You can perform an operation after the signature verification (if enabled) of creating a conversation is completed but before the conversation is created. For example, to print out a log in LeanEngine:

AV.Cloud.onIMConversationStart((request) => {
  let params = request.params;
  console.log('params:', params);

  // params: {
  //     initBy: 'Tom',
  //     members: ['Tom', 'Jerry'],
  //     attr: {
  //         name: 'Tom & Jerry'
  //     },
  //     __sign: '1472703266397,b57285517a95028f8b7c34c68f419847a049ef26'
  // }
});

onIMConversationStarted

You can perform an operation after a conversation is created. For example, to print out a log in LeanEngine:

AV.Cloud.onIMConversationStarted((request) => {
  let params = request.params;
  console.log('params:', params);

  // params: {
  //     convId: '5789a33a1b8694ad267d8040',
  //     __sign: '1472723167361,f5ceedde159408002fc4edb96b72aafa14bc60bb'
  // }
});

onIMConversationAdd

You can perform an operation after the signature verification (if enabled) of adding a member into a conversation is completed but before the member is added. This will be triggered both when the member proactively joins the conversation or is added by another member. Keep in mind that this hook will not be triggered when creating a conversation with clientIds. For example, to print out a log in LeanEngine:

AV.Cloud.onIMConversationAdd((request) => {
  let params = request.params;
  console.log('params:', params);

  // params: {
  //     initBy: 'Tom',
  //     members: ['Mary'],
  //     convId: '5789a33a1b8694ad267d8040',
  //     __sign: '1472786231813,a262494c252e82cb7a342a3c62c6d15fffbed5a0'
  // }
});

onIMConversationRemove

You can perform an operation after the signature verification (if enabled) of removing a member from a conversation is completed but before the member is removed. This will not be triggered when the member proactively quits the conversation. For example, to print out a log in LeanEngine:

AV.Cloud.onIMConversationRemove((request) => {
  let params = request.params;
  console.log('params:', params);
  console.log('Removed clientId:', params.members[0]);

  // params: {
  //     initBy: 'Tom',
  //     members: ['Jerry'],
  //     convId: '57c8f3ac92509726c3dadaba',
  //     __sign: '1472787372605,abdf92b1c2fc4c9820bc02304f192dab6473cd38'
  // }
  // Removed clientId: Jerry
});

onIMConversationUpdate

You can perform an operation before the name, custom attributes, or mention properties of a conversation (including notifications) are updated. For example, to print out a log in LeanEngine:

AV.Cloud.onIMConversationUpdate((request) => {
  let params = request.params;
  console.log('params:', params);
  console.log('name:', params.attr.name);

  // params: {
  //     convId: '57c9208292509726c3dadb4b',
  //     initBy: 'Tom',
  //     attr: {
  //         name: 'Tom and Jerry',
  //         type: 'public'
  //     }
  // }
  // name: Tom and Jerry
});

Error Codes for Hooks

You can define error codes for hooks like beforeSave:

AV.Cloud.beforeSave('Review', function (request) {
  // Convert the object into a string with JSON.stringify()
  throw new AV.Cloud.Error(JSON.stringify({
    code: 123,
    message: 'An error occurred.'
  }));
});

The client will receive Cloud Code validation failed. Error detail: { "code": 123, "message": "An error occurred." } as the response. You can retrieve the error message by slicing the string.

Timeouts for Hooks

The time limit for a hook to be processed is 3 seconds. If a hook is triggered by another cloud function (like a beforeSave or afterSave triggered by saving an object), the time limit of this hook will be further limited by the time remaining.

For example, if a beforeSave is triggered by a cloud function that has already taken 13 seconds, there will be only 2 seconds left for this hook. See Timeouts.

Editing Cloud Functions Online

If you just want to use cloud functions without setting up a complete Node.js project, you can edit cloud functions on the web console. Keep in mind that:

• Setting up cloud functions on the web console will override the project you deployed with Git or command-line interface.
• You can only set up cloud functions (including hooks) on the web console. You cannot use other functions of an ordinary Node.js project (like web hosting or routers).
• You can only use SDK and some built-in modules (see below for details). You cannot import other modules as dependencies.

Online editing only supports LeanCloud JavaScript SDK (3.x), Node.js SDK (3.x), and the following modules:

• async, bluebird, crypto, debug, ejs
• jade, lodash, moment, nodemailer
• qiniu, redis, request, request-promise, superagent
• underscore, uuid, wechat-api, xml2js

In your app's Dashboard > LeanEngine > Deploy > Edit online, you can:

• Create functions by specifying function types, function names, code in the functions, and comments. Click on Save to finish creating a function.
• Deploy functions by specifying the environment and clicking on Deploy.
• Preview functions by viewing all the functions in a single code snippet. You can save the snippet as cloud.js and put it in a Node.js project so you can deploy the project with the cloud functions you created.
• Maintain functions by editing them, viewing version histories, and deleting them.

Scheduled Tasks

You can set up timers to schedule your cloud functions. For example, to clean up temporary data every night, to send push notifications to users every Monday, etc. The timer can be accurate to a second.

The time restrictions applied to ordinary cloud functions also apply to scheduled functions. See Timeouts.

After deploying your program to LeanEngine, go to your app's Dashboard > LeanEngine > Scheduled tasks and click on Create a timer to create a timer for a cloud function. For example, if we have a function named logTimer:

AV.Cloud.define('logTimer', function (request) {
  console.log('This log is printed by logTimer.');
});

After a timer is created, the default status of it will be Disabled. You need to click on Enable to activate the timer. You can see the logs of the timer in Dashboard > LeanEngine > App logs.

You can set up timers with either cron expressions or intervals with seconds as the unit. For example, to run a function on 8:00 every Monday, use 0 0 8 ? * MON as the cron expression.

You can create up to 6 timers for each of the staging environment and the production environment, which means that you can create 12 timers in total.

Error Messages for Scheduled Tasks

The error messages of timers will be output to Dashboard > LeanEngine > App logs. Below are some common errors and the reasons causing them:

• timerAction timed-out and no fallback available
  A function triggered by a timer reached its 15-second time limit for processing. See Handling Timeouts.
• timerAction short-circuited and no fallback available
  A timer is disabled due to frequent timeouts happening to the function it is triggering.

Using Master Key

Since cloud functions are running on the server side, we can assume that requests made by these functions are trustable. Therefore, you can enable global Master Key for all these requests, which will have your program ignore permission settings of classes and those done by ACL so it can access data in the cloud without any restrictions. The code below enables Master Key for your program:

// Often in server.js
AV.Cloud.useMasterKey();

If the code above is not added into your program, your program will not be able to access the data protected by ACL. You will have to specify a sessionToken to have your program perform an operation with the permission of a user:

var post = new Post();
post.save(
  { author: user },
  {
    // You can also use request.sessionToken (need to enable Cloud.CookieSession when using web hosting)
    sessionToken: user.getSessionToken()
  }
);

Or, you can enable Master Key for a single operation to ignore permission settings:

post.destroy({ useMasterKey: true });

You can also disable Master Key for a single operation with useMasterKey: false.

So when should global Master Key be enabled?

• If your cloud functions mainly perform operations for global data, enabling Master Key will make these operations easier to be completed. Make sure to implement permission verification in your program carefully.
• If your cloud functions mainly perform operations that are related to each single user, disabling Master Key would make your application more secure. Your program can still take in the sessionToken from each request for certain operations (like saving objects).

See ACL Guide and Using ACL in LeanEngine for more information regarding permission settings with LeanEngine.