fix: Apply requestContextMiddleware on directAccess requests

spec/rest.spec.js

@@ -1758,4 +1758,36 @@ describe('rest context', () => {
 
     expect(called).toBe(true);
   });
+
+  it('should support dependency injection on nested directAccess ops', async () => {
+    const ParseServerRESTController = require('../lib/ParseServerRESTController')
+      .ParseServerRESTController;
+    const ParseServer = require('../lib/ParseServer').default;
+    const requestContextMiddleware = (req, res, next) => {
+      req.config.aCustomController = 'aCustomController';
+      next();
+    };
+    await reconfigureServer({ requestContextMiddleware, directAccess: true });
+    // reconfigureServer restores the HTTP RESTController; re-enable directAccess
+    // so nested Cloud Code SDK ops go through ParseServerRESTController.
+    Parse.CoreManager.setRESTController(
+      ParseServerRESTController(
+        Parse.applicationId,
+        ParseServer.promiseRouter({ appId: Parse.applicationId })
+      )
+    );
+
+    let nestedCalled = false;
+    Parse.Cloud.beforeSave('Child', request => {
+      expect(request.config.aCustomController).toEqual('aCustomController');
+      nestedCalled = true;
+    });
+    Parse.Cloud.afterSave('Parent', async () => {
+      const child = new Parse.Object('Child');
+      await child.save(null, { useMasterKey: true });
+    });
+
+    await new Parse.Object('Parent').save(null, { useMasterKey: true });
+    expect(nestedCalled).toBe(true);
+  });
 });

src/Options/Definitions.js

@@ -558,7 +558,7 @@ module.exports.ParseServerOptions = {
   },
   requestContextMiddleware: {
     env: 'PARSE_SERVER_REQUEST_CONTEXT_MIDDLEWARE',
-    help: 'Options to customize the request context using inversion of control/dependency injection.',
+    help: 'Options to customize the request context using inversion of control/dependency injection. Also applied on internal `directAccess` requests via a synthetic `req` that exposes only `config` and empty `headers`, with a bare `res` object. On that path the middleware must settle via `next()` or a Promise; do not rely on response termination. Express-only accessors such as `req.get()`, `req.header()`, `req.ip`, and `req.body` are unavailable.',
   },
   requestKeywordDenylist: {
     env: 'PARSE_SERVER_REQUEST_KEYWORD_DENYLIST',

src/Options/index.js

@@ -418,8 +418,8 @@ export interface ParseServerOptions {
   /* Options to limit repeated requests to Parse Server APIs. This can be used to protect sensitive endpoints such as `/requestPasswordReset` from brute-force attacks or Parse Server as a whole from denial-of-service (DoS) attacks.<br><br>ℹ️ Mind the following limitations:<br>- rate limits applied per IP address; this limits protection against distributed denial-of-service (DDoS) attacks where many requests are coming from various IP addresses<br>- if multiple Parse Server instances are behind a load balancer or ran in a cluster, each instance will calculate it's own request rates, independent from other instances; this limits the applicability of this feature when using a load balancer and another rate limiting solution that takes requests across all instances into account may be more suitable<br>- this feature provides basic protection against denial-of-service attacks, but a more sophisticated solution works earlier in the request flow and prevents a malicious requests to even reach a server instance; it's therefore recommended to implement a solution according to architecture and use case.<br>- rate limits are matched against the REST API URL path (`requestPath`) and therefore apply to REST API routes only; they do not apply to GraphQL operations, which are all served under the single GraphQL endpoint path (`graphQLPath`, default `/graphql`) and are identified by the request payload rather than the URL. To rate limit GraphQL, either set a `requestPath` for the GraphQL endpoint path to throttle the entire GraphQL API, or use a GraphQL-aware rate limiting solution (for example a schema-directive-based rate limiter) for per-operation limits.
   :DEFAULT: [] */
   rateLimit: ?(RateLimitOptions[]);
-  /* Options to customize the request context using inversion of control/dependency injection.*/
-  requestContextMiddleware: ?(req: any, res: any, next: any) => void;
+  /* Options to customize the request context using inversion of control/dependency injection. Also applied on internal `directAccess` requests via a synthetic `req` that exposes only `config` and empty `headers`, with a bare `res` object. On that path the middleware must settle via `next()` or a Promise; do not rely on response termination. Express-only accessors such as `req.get()`, `req.header()`, `req.ip`, and `req.body` are unavailable.*/
+  requestContextMiddleware: ?(req: any, res: any, next: any) => void | Promise<void>;
   /* If set to `true`, error details are removed from error messages in responses to client requests, and instead a generic error message is sent. Default is `true`.
   :DEFAULT: true */
   enableSanitizedErrorResponse: ?boolean;

src/ParseServerRESTController.js

@@ -29,14 +29,76 @@ function getAuth(options = {}, config) {
   });
 }
 
+/**
+ * Apply requestContextMiddleware on a synthetic request so directAccess ops
+ * get the same per-request DI as Express HTTP requests.
+ *
+ * Synthetic request contract (minimal supported fields only):
+ * - `req.config` — Parse Server config (DI target only)
+ * - `req.headers` — empty object `{}` (no HTTP headers on this path; DI support only)
+ * - `res` — bare object `{}` (not a real Express response)
+ *
+ * Express-only request properties and methods such as `req.get()`,
+ * `req.header()`, `req.ip`, and `req.body` are unavailable. Middleware must
+ * use only the supported fields above; this path intentionally does not add
+ * partial Express compatibility.
+ *
+ * Settlement is required: the middleware must call `next()` / `next(err)`, or
+ * return a Promise that resolves or rejects. Do not rely on response
+ * termination (`res.send`, `res.end`, `res.json`, etc.) or other implicit
+ * paths — those will hang nested directAccess ops indefinitely.
+ */
+async function applyRequestContextMiddleware(config) {
+  if (typeof config.requestContextMiddleware !== 'function') {
+    return;
+  }
+
+  // Minimal synthetic req — see contract in JSDoc above.
+  const req = { config, headers: {} };
+
+  // Bridge callback-style Express middleware (`next(err)`) and Promise-returning
+  // middleware into a single awaitable settlement.
+  await new Promise((resolve, reject) => {
+    let settled = false;
+    const done = err => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (err) {
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+
+    let result;
+    try {
+      result = config.requestContextMiddleware(req, {}, done);
+    } catch (err) {
+      done(err);
+      return;
+    }
+
+    if (result != null && typeof result.then === 'function') {
+      result.then(() => done(), done);
+    }
+  });
+}
+
 function ParseServerRESTController(applicationId, router) {
-  function handleRequest(method, path, data = {}, options = {}, config) {
+  async function handleRequest(method, path, data = {}, options = {}, config) {
     // Store the arguments, for later use if internal fails
     const args = arguments;
+    const configWasProvided = !!config;
 
-    if (!config) {
+    if (!configWasProvided) {
       config = Config.get(applicationId);
+      // Fresh config from AppCache has no Express middleware mutations;
+      // re-apply requestContextMiddleware for DI parity with HTTP.
+      await applyRequestContextMiddleware(config);
     }
+
     const serverURL = new URL(config.serverURL);
     if (path.indexOf(serverURL.pathname) === 0) {
       path = path.slice(serverURL.pathname.length, path.length);
@@ -47,14 +109,19 @@ function ParseServerRESTController(applicationId, router) {
     }
 
     if (path === '/batch') {
-      const batch = transactionRetries => {
-        let initialPromise = Promise.resolve();
+      const batch = async transactionRetries => {
         if (data.transaction === true) {
-          initialPromise = config.database.createTransactionalSession();
+          await config.database.createTransactionalSession();
         }
-        return initialPromise.then(() => {
-          const promises = data.requests.map(request => {
-            return handleRequest(request.method, request.path, request.body, options, config).then(
+        const result = await Promise.all(
+          data.requests.map(request => {
+            return handleRequest(
+              request.method,
+              request.path,
+              request.body,
+              options,
+              config
+            ).then(
               response => {
                 if (options.returnStatus) {
                   const status = response._status;
@@ -71,36 +138,30 @@ function ParseServerRESTController(applicationId, router) {
                 };
               }
             );
-          });
-          return Promise.all(promises)
-            .then(result => {
-              if (data.transaction === true) {
-                if (result.find(resultItem => typeof resultItem.error === 'object')) {
-                  return config.database.abortTransactionalSession().then(() => {
-                    return Promise.reject(result);
-                  });
-                } else {
-                  return config.database.commitTransactionalSession().then(() => {
-                    return result;
-                  });
-                }
-              } else {
-                return result;
-              }
-            })
-            .catch(error => {
-              if (
-                error &&
-                error.find(
-                  errorItem => typeof errorItem.error === 'object' && errorItem.error.code === 251
-                ) &&
-                transactionRetries > 0
-              ) {
-                return batch(transactionRetries - 1);
-              }
-              throw error;
-            });
-        });
+          })
+        );
+        try {
+          if (data.transaction === true) {
+            if (result.find(resultItem => typeof resultItem.error === 'object')) {
+              await config.database.abortTransactionalSession();
+              throw result;
+            }
+            await config.database.commitTransactionalSession();
+          }
+          return result;
+        } catch (error) {
+          if (
+            error &&
+            error.find &&
+            error.find(
+              errorItem => typeof errorItem.error === 'object' && errorItem.error.code === 251
+            ) &&
+            transactionRetries > 0
+          ) {
+            return batch(transactionRetries - 1);
+          }
+          throw error;
+        }
       };
       return batch(5);
     }
@@ -110,59 +171,50 @@ function ParseServerRESTController(applicationId, router) {
       query = data;
     }
 
-    return new Promise((resolve, reject) => {
-      let requestContext;
-      try {
-        requestContext = structuredClone(options.context || {});
-      } catch (error) {
-        reject(
-          new Parse.Error(
-            Parse.Error.INVALID_VALUE,
-            `Context contains non-cloneable values: ${error.message}`
-          )
-        );
-        return;
+    let requestContext;
+    try {
+      requestContext = structuredClone(options.context || {});
+    } catch (error) {
+      throw new Parse.Error(
+        Parse.Error.INVALID_VALUE,
+        `Context contains non-cloneable values: ${error.message}`
+      );
+    }
+
+    const auth = await getAuth(options, config);
+    const request = {
+      body: data,
+      config,
+      auth,
+      info: {
+        applicationId: applicationId,
+        sessionToken: options.sessionToken,
+        installationId: options.installationId,
+        context: requestContext,
+      },
+      query,
+    };
+
+    try {
+      const { response, status, headers = {} } = await router.tryRouteRequest(
+        method,
+        path,
+        request
+      );
+      if (options.returnStatus) {
+        return { ...response, _status: status, _headers: headers };
       }
-      getAuth(options, config).then(auth => {
-        const request = {
-          body: data,
-          config,
-          auth,
-          info: {
-            applicationId: applicationId,
-            sessionToken: options.sessionToken,
-            installationId: options.installationId,
-            context: requestContext,
-          },
-          query,
-        };
-        return Promise.resolve()
-          .then(() => {
-            return router.tryRouteRequest(method, path, request);
-          })
-          .then(
-            resp => {
-              const { response, status, headers = {} } = resp;
-              if (options.returnStatus) {
-                resolve({ ...response, _status: status, _headers: headers });
-              } else {
-                resolve(response);
-              }
-            },
-            err => {
-              if (
-                err instanceof Parse.Error &&
-                err.code == Parse.Error.INVALID_JSON &&
-                err.message == `cannot route ${method} ${path}`
-              ) {
-                RESTController.request.apply(null, args).then(resolve, reject);
-              } else {
-                reject(err);
-              }
-            }
-          );
-      }, reject);
-    });
+      return response;
+    } catch (err) {
+      if (
+        err instanceof Parse.Error &&
+        err.code == Parse.Error.INVALID_JSON &&
+        err.message == `cannot route ${method} ${path}`
+      ) {
+        return RESTController.request.apply(null, args);
+      }
+      throw err;
+    }
   }
 
   return {