docs: Document synthetic req contract for requestContextMiddleware

Clarify that directAccess uses a minimal synthetic request and that
Express-only accessors are unavailable, addressing review feedback.

Author: Moumouls

src/Options/Definitions.js

@@ -558,7 +558,7 @@ module.exports.ParseServerOptions = {
   },
   requestContextMiddleware: {
     env: 'PARSE_SERVER_REQUEST_CONTEXT_MIDDLEWARE',
-    help: 'Options to customize the request context using inversion of control/dependency injection.',
+    help: 'Options to customize the request context using inversion of control/dependency injection. Also applied on internal `directAccess` requests via a synthetic `req` that exposes only `config` and empty `headers`. Express-only accessors such as `req.get()`, `req.header()`, `req.ip`, and `req.body` are unavailable on that path.',
   },
   requestKeywordDenylist: {
     env: 'PARSE_SERVER_REQUEST_KEYWORD_DENYLIST',

src/Options/docs.js

@@ -418,7 +418,7 @@ export interface ParseServerOptions {
   /* Options to limit repeated requests to Parse Server APIs. This can be used to protect sensitive endpoints such as `/requestPasswordReset` from brute-force attacks or Parse Server as a whole from denial-of-service (DoS) attacks.<br><br>ℹ️ Mind the following limitations:<br>- rate limits applied per IP address; this limits protection against distributed denial-of-service (DDoS) attacks where many requests are coming from various IP addresses<br>- if multiple Parse Server instances are behind a load balancer or ran in a cluster, each instance will calculate it's own request rates, independent from other instances; this limits the applicability of this feature when using a load balancer and another rate limiting solution that takes requests across all instances into account may be more suitable<br>- this feature provides basic protection against denial-of-service attacks, but a more sophisticated solution works earlier in the request flow and prevents a malicious requests to even reach a server instance; it's therefore recommended to implement a solution according to architecture and use case.<br>- rate limits are matched against the REST API URL path (`requestPath`) and therefore apply to REST API routes only; they do not apply to GraphQL operations, which are all served under the single GraphQL endpoint path (`graphQLPath`, default `/graphql`) and are identified by the request payload rather than the URL. To rate limit GraphQL, either set a `requestPath` for the GraphQL endpoint path to throttle the entire GraphQL API, or use a GraphQL-aware rate limiting solution (for example a schema-directive-based rate limiter) for per-operation limits.
   :DEFAULT: [] */
   rateLimit: ?(RateLimitOptions[]);
-  /* Options to customize the request context using inversion of control/dependency injection.*/
+  /* Options to customize the request context using inversion of control/dependency injection. Also applied on internal `directAccess` requests via a synthetic `req` that exposes only `config` and empty `headers`. Express-only accessors such as `req.get()`, `req.header()`, `req.ip`, and `req.body` are unavailable on that path.*/
   requestContextMiddleware: ?(req: any, res: any, next: any) => void;
   /* If set to `true`, error details are removed from error messages in responses to client requests, and instead a generic error message is sent. Default is `true`.
   :DEFAULT: true */

src/Options/index.js

@@ -32,6 +32,15 @@ function getAuth(options = {}, config) {
 /**
  * Apply requestContextMiddleware on a synthetic request so directAccess ops
  * get the same per-request DI as Express HTTP requests.
+ *
+ * Synthetic request contract (minimal supported fields only):
+ * - `req.config` — Parse Server config (DI target)
+ * - `req.headers` — empty object `{}` (no HTTP headers on this path)
+ *
+ * Express-only request properties and methods such as `req.get()`,
+ * `req.header()`, `req.ip`, and `req.body` are unavailable. Middleware must
+ * use only the supported fields above; this path intentionally does not add
+ * partial Express compatibility.
  */
 function applyRequestContextMiddleware(config) {
   if (typeof config.requestContextMiddleware !== 'function') {
@@ -50,6 +59,7 @@ function applyRequestContextMiddleware(config) {
         resolve();
       }
     };
+    // Minimal synthetic req — see contract in JSDoc above.
     const req = { config, headers: {} };
     try {
       const maybePromise = config.requestContextMiddleware(req, {}, done);