requestContextMiddleware DI missing on nested directAccess ops
New Issue Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Issue Description
requestContextMiddleware (added in #8480) is only mounted on the Express stack (REST + GraphQL). With directAccess: true (default), nested Parse SDK save / destroy calls from Cloud Code go through ParseServerRESTController → Config.get(), and never pass through Express.
Anything injected onto req.config by the middleware (custom controllers / DI) is therefore missing on hooks that run for those nested ops, even though the outer HTTP request had the DI applied.
This is separate from #10291 (context object leakage); this is about request-scoped config DI never being applied on the directAccess path.
Steps to reproduce
- Configure Parse Server with
directAccess: trueand:
requestContextMiddleware: (req, res, next) => {
req.config.aCustomController = 'aCustomController';
next();
}- Register:
Parse.Cloud.beforeSave('Child', request => {
// expects request.config.aCustomController
});
Parse.Cloud.afterSave('Parent', async () => {
await new Parse.Object('Child').save(null, { useMasterKey: true });
});- Save a
Parentobject (nestedChild.saveusesParseServerRESTController).
Actual Outcome
request.config.aCustomController is undefined in the nested Child beforeSave.
Expected Outcome
Same DI as HTTP: request.config.aCustomController === 'aCustomController', matching the intent of #8480 (“inject providers available in each hook”).
Environment
Server
- Parse Server version:
9.10.1-alpha.3(also affects prior releases withrequestContextMiddleware+directAccess) - Operating system:
macOS/ Linux - Local or remote host: local
Database
- System: MongoDB
- Database version:
8.0.4 - Local or remote host: local
Client
- SDK: JavaScript (Cloud Code / Node)
- SDK version: bundled with Parse Server
Logs
N/A — assertion failure in Cloud hook when reading injected config property.
Source: parse-community/parse-server