Skip to content

fix: Apply requestContextMiddleware on directAccess requests - #10603

Open
Moumouls wants to merge 8 commits into
parse-community:alphafrom
Moumouls:fix/request-context-middleware-direct-access
Open

fix: Apply requestContextMiddleware on directAccess requests#10603
Moumouls wants to merge 8 commits into
parse-community:alphafrom
Moumouls:fix/request-context-middleware-direct-access

Conversation

@Moumouls

@Moumouls Moumouls commented Jul 23, 2026

Copy link
Copy Markdown
Member

Pull Request

Issue

Closes: #10602

Related: #8480 (requestContextMiddleware), orthogonal to #10291 (context clone).

Approach

With directAccess: true, nested SDK ops use ParseServerRESTController and Config.get() without going through Express, so requestContextMiddleware never ran and DI on req.config was lost.

After loading a fresh config via Config.get(), re-apply requestContextMiddleware on a synthetic { config, headers: {} } request (callback + Promise). Skip when a parent config is already passed (batch children).

Tasks

  • Add tests
  • Add changes to documentation (option help text)
  • Add security check
  • Add new Parse Error codes to Parse JS SDK

Test plan

  • rest context → nested directAccess DI (was red before fix)
  • rest context → existing HTTP DI still passes
  • ParseServerRESTController suite (22 specs)

Summary by CodeRabbit

  • Bug Fixes
    • Improved reliability of nested REST and Cloud Code operations by preserving request-scoped context during direct-access requests.
    • Improved REST batch processing with more consistent transaction commit, abort, retry, and error handling.
    • Invalid request contexts now return a clear validation error.
  • Documentation
    • Clarified middleware behavior and limitations for internal direct-access requests.
  • Tests
    • Added coverage for dependency injection in nested direct-access operations.

Nested SDK ops under directAccess bypass Express, so DI injected via
requestContextMiddleware was missing on Cloud hooks. Re-apply the
middleware after Config.get() in ParseServerRESTController.
@parse-github-assistant

Copy link
Copy Markdown

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

  • Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
  • Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
  • Group code into logical blocks. Add a short comment before each block to explain its purpose.
  • We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
  • Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
  • Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9851c945-010e-4997-9e05-ad6456c7bb10

📥 Commits

Reviewing files that changed from the base of the PR and between 09009e5 and 0b8a971.

📒 Files selected for processing (5)
  • spec/rest.spec.js
  • src/Options/Definitions.js
  • src/Options/docs.js
  • src/Options/index.js
  • src/ParseServerRESTController.js

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.


📝 Walkthrough

Walkthrough

ParseServerRESTController now applies requestContextMiddleware during direct-access handling, uses async/await for batch and request routing, preserves transaction and fallback behavior, and adds regression coverage for configuration propagation into nested Cloud Code triggers.

Changes

Direct-access request context

Layer / File(s) Summary
Synthetic request middleware application
src/ParseServerRESTController.js, src/Options/*
Loads configuration when needed and applies callback- or Promise-based requestContextMiddleware. Documentation describes the synthetic request shape and unavailable Express accessors.
Request routing and batch execution
src/ParseServerRESTController.js
Refactors batch and main request handling to async/await while retaining transactions, retries, context cloning, status metadata, authentication, and REST fallback behavior.
Nested-operation regression coverage
spec/rest.spec.js
Tests that middleware-injected configuration is visible in a nested Child beforeSave triggered by saving a Parent with direct access enabled.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Severity of issue fixed: Medium

Suggested reviewers: dblythy

Sequence Diagram(s)

sequenceDiagram
  participant ParentSave
  participant ParseServerRESTController
  participant requestContextMiddleware
  participant ChildBeforeSave
  ParentSave->>ParseServerRESTController: route nested Child.save
  ParseServerRESTController->>requestContextMiddleware: apply request context
  requestContextMiddleware-->>ParseServerRESTController: set req.config.aCustomController
  ParseServerRESTController->>ChildBeforeSave: execute trigger with request config
  ChildBeforeSave-->>ParentSave: observe aCustomController
Loading

Merge Risk: ⚪ Minimal · up to 0b8a9

The direct-access context propagation change is ready to merge; no concrete current-head risk remains.


Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (1 error, 2 warnings)

Check name Status Explanation Resolution
Engage In Review Feedback ❌ Error The PR contains one review thread that the author resolved without reviewer retraction or an implementing commit. Reviewer dblythy proposed replacing the adapter with promisify in comment 3646347875… Reopen the dblythy review thread. Explain the incompatibility with promisify and the Promise-based middleware contract. Obtain dblythy’s agreement and retraction, or implement the proposed change in a commit if the reviewer requires it. H…
Out of Scope Changes check ⚠️ Warning The PR includes behavior changes that are not required for issue #10602. ParseServerRESTController changes non-cloneable context handling to throw Parse.Error.INVALID_VALUE and changes batch trans… Remove the unrelated context-error and batch transaction behavior changes, or move them to a separate pull request. Keep only the async changes required to apply requestContextMiddleware on directAccess requests and preserve existing requ…
Docstring Coverage ⚠️ Warning Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 5 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description check ✅ Passed The description includes the required Pull Request, Issue, Approach, and Tasks sections. It documents the implementation, tests, documentation changes, security check, and linked issues. The additiona…
Title check ✅ Passed The title starts with the allowed prefix "fix:" and uses a capitalized first word after the prefix. It accurately describes applying requestContextMiddleware to directAccess requests.
Linked Issues check ✅ Passed Issue #10602 requires request-scoped dependency injection on nested directAccess operations. ParseServerRESTController now loads the config, applies requestContextMiddleware to a synthetic request…
Security Check ✅ Passed PASS. The pull request does not introduce a demonstrated security vulnerability. The changed controller still constructs authentication with the existing useMasterKey and session-token paths, and it…
Full details: Out of Scope Changes check

Explanation

The PR includes behavior changes that are not required for issue #10602. ParseServerRESTController changes non-cloneable context handling to throw Parse.Error.INVALID_VALUE and changes batch transaction commit, abort, and retry behavior. The middleware application and required async control flow are in scope, but these unrelated behavior changes expand the pull request scope.

Resolution

Remove the unrelated context-error and batch transaction behavior changes, or move them to a separate pull request. Keep only the async changes required to apply requestContextMiddleware on directAccess requests and preserve existing request behavior.

Full details: Engage In Review Feedback

Explanation

The PR contains one review thread that the author resolved without reviewer retraction or an implementing commit. Reviewer dblythy proposed replacing the adapter with promisify in comment 3646347875. CodeRabbit explained that this would not support Promise-returning middleware. The author then wrote, “@dblythy i'll resolve the comment because it will break the contract” (comment 3675660889). The thread is marked resolved, but dblythy did not acknowledge or retract the feedback. Other actionable CodeRabbit comments were engaged and addressed by commits 624f49f, 343023a, and da446a8, but that does not satisfy the requirement for this unresolved disagreement.

Resolution

Reopen the dblythy review thread. Explain the incompatibility with promisify and the Promise-based middleware contract. Obtain dblythy’s agreement and retraction, or implement the proposed change in a commit if the reviewer requires it. Have the reviewer resolve the thread only after that engagement.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.10)
src/Options/index.js

File contains syntax errors that prevent linting: Line 18: Expected a type but instead found '?'.; Line 18: Expected a property, or a signature but instead found ';'.; Line 21: Expected a statement but instead found '?'.; Line 24: Expected a statement but instead found '?'.; Line 27: Expected a statement but instead found '?'.; Line 30: Expected a statement but instead found '?'.; Line 32: Expected a statement but instead found '?'.; Line 34: Expected a statement but instead found '?'.; Line 35: Expected a statement but instead found '}'.; Line 37: type alias are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 38: type alias are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 39: type alias are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 40: type alias are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Li

... [truncated 16757 characters] ...

found '?'.; Line 912: Expected a statement but instead found '?'.; Line 914: Expected a statement but instead found '?'.; Line 915: Expected a statement but instead found '}'.; Line 929: Expected a type but instead found '?'.; Line 929: Expected a property, or a signature but instead found ';'.; Line 930: Expected a statement but instead found '}'.; Line 936: Expected a type but instead found '?'.; Line 936: Expected a property, or a signature but instead found ';'.; Line 940: Expected a statement but instead found '?'.; Line 944: Expected a statement but instead found '?'.; Line 948: Expected a statement but instead found '?'.; Line 952: Expected a statement but instead found '?'.; Line 956: Expected a statement but instead found '?'.; Line 957: Expected a statement but instead found '}'.


Comment @coderabbitai help to get the list of available commands.

@Moumouls

This comment has been minimized.

@Moumouls
Moumouls requested a review from mtrezza July 23, 2026 13:17

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/ParseServerRESTController.js`:
- Around line 32-63: Update applyRequestContextMiddleware and its documentation
to define a minimal synthetic-request contract for requestContextMiddleware,
explicitly stating that Express-only request properties and methods such as
req.get(), req.header(), req.ip, and req.body are unavailable. Ensure the
middleware is expected to use only the supported fields on the synthetic req,
rather than adding partial Express compatibility.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 65797509-2cd9-4814-aaf3-ad36e5001eb4

📥 Commits

Reviewing files that changed from the base of the PR and between 5838c07 and cd56c63.

📒 Files selected for processing (4)
  • spec/rest.spec.js
  • src/Options/Definitions.js
  • src/Options/docs.js
  • src/ParseServerRESTController.js

Comment thread src/ParseServerRESTController.js
@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 81.63265% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.80%. Comparing base (09009e5) to head (0b8a971).

Files with missing lines Patch % Lines
src/ParseServerRESTController.js 81.63% 9 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##            alpha   #10603      +/-   ##
==========================================
- Coverage   93.82%   93.80%   -0.02%     
==========================================
  Files         192      192              
  Lines       16863    16877      +14     
  Branches      252      252              
==========================================
+ Hits        15821    15831      +10     
- Misses       1020     1024       +4     
  Partials       22       22              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Clarify that directAccess uses a minimal synthetic request and that
Express-only accessors are unavailable, addressing review feedback.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/Options/index.js`:
- Around line 421-422: Update the requestContextMiddleware type declaration in
the Options definitions to allow both synchronous and Promise-based completion
by using a void-or-Promise<void> return type, while preserving the existing
request, response, and next parameter types.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 53f020c2-d9f8-4ca2-bc23-29f358fdebcb

📥 Commits

Reviewing files that changed from the base of the PR and between e45b7f7 and 624f49f.

📒 Files selected for processing (4)
  • src/Options/Definitions.js
  • src/Options/docs.js
  • src/Options/index.js
  • src/ParseServerRESTController.js
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/ParseServerRESTController.js

Comment thread src/Options/index.js Outdated
Align with handleRequest style while keeping callback and Promise
middleware settlement support.
Comment thread src/ParseServerRESTController.js
Align the Flow type with runtime support for async DI middleware.
@Moumouls

Copy link
Copy Markdown
Member Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown
✅ Action performed

Full review finished.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/ParseServerRESTController.js`:
- Around line 55-80: Update the requestContextMiddleware contract in
applyRequestContextMiddleware to explicitly require settlement via next() or a
resolving/rejecting Promise. Document that the synthetic req.config.req.headers
are only DI support and res is a bare object, so middleware must not rely on
response termination or other implicit paths.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c10f6058-2a17-4445-b362-cc31ea0c2ef6

📥 Commits

Reviewing files that changed from the base of the PR and between 5838c07 and 343023a.

📒 Files selected for processing (5)
  • spec/rest.spec.js
  • src/Options/Definitions.js
  • src/Options/docs.js
  • src/Options/index.js
  • src/ParseServerRESTController.js

Comment thread src/ParseServerRESTController.js
Document that directAccess synthetic res is bare and middleware must
settle via next() or a Promise to avoid hanging nested ops.
Comment thread src/ParseServerRESTController.js

@mtrezza mtrezza left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unresolved conversations

@Moumouls

Copy link
Copy Markdown
Member Author

@mtrezza resolved all comments

@Moumouls

Copy link
Copy Markdown
Member Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
✅ Action performed

Full review finished.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

requestContextMiddleware DI missing on nested directAccess ops

3 participants