JavaScript and TypeScript API Discovery: Express and NestJS Support

The following section covers the components of JavaScript frameworks and their library components that NightVision’s API Discovery capability can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please get in touch with our support team at support@nightviz.ai, and we can add this as a new feature.

JavaScript

@nestjs/common

Library Component	Description
Controller	Decorator to define a controller class in NestJS, which handles incoming HTTP requests.
Module	Decorator to define a module in NestJS, used to organize related components, services, and controllers.
Injectable	Decorator to define a class as a provider that can be injected into other components via dependency injection.

@nestjs/core

Library Component	Description
DynamicModule	Represents a dynamically created module in NestJS.
NestFactory.create	Method to create an application instance using the NestFactory class.
@nestjs/core.Route	Represents a route definition in NestJS, used for setting up routing at the core level.
@nestjs/core.RouterModule.register	Method to register a set of routes in NestJS.
@nestjs/core.nestjs_app.setGlobalPrefix	Method to set a global prefix for all routes in a NestJS application.
@nestjs/core.nestjs_app.listen	Method to start listening for incoming HTTP requests in a NestJS application.

Express

Library Component	Description
express.Router	Method to create a new router object to handle routes in Express.
express()	Method to initialize a new Express application instance.
app.get	Method to handle HTTP GET requests in an Express application.
app.post	Method to handle HTTP POST requests in an Express application.
app.put	Method to handle HTTP PUT requests in an Express application.
app.patch	Method to handle HTTP PATCH requests in an Express application.
app.delete	Method to handle HTTP DELETE requests in an Express application.
app.all	Method to handle all HTTP methods in an Express application.
app.use	Method to mount middleware or sub-applications.
app.router	The application’s in-built instance of router. This is created lazily, on first access.
app.listen	Method to start listening for HTTP requests on a specified port.
app.route	Method to create a route with a specific path in an Express application.
request.params	Represents the parameters sent in the request URL in an Express application.
request.body	Represents the parameters sent in the request body in an Express application.
request.query	Represents the parameters sent in the request query in an Express application.

Fastify

Library Component	Description
@fastify.autoload	Fastify plugin that loads and configure routes matching the folder structure.
fastify.get	Method to handle HTTP GET requests in a Fastify application.
fastify.head	Method to handle HTTP HEAD requests in a Fastify application.
fastify.post	Method to handle HTTP POST requests in a Fastify application.
fastify.put	Method to handle HTTP PUT requests in a Fastify application.
fastify.delete	Method to handle HTTP DELETE requests in a Fastify application.
fastify.options	Method to handle HTTP OPTIONS requests in a Fastify application.
fastify.patch	Method to handle HTTP PATCH requests in a Fastify application.
fastify.route	Method to configure the endpoints in a Fastify application.
fastify.register	Method to configure specific behaviors for a route, e.g. to add prefixes or log levels.
fastify.after	Method that is executed once the previous declared register has finished.
fastify.ready	Method that is executed once all the registers declared have finished their execution.
fastify.listen	Behaves the same way as ready, starting the server for a given port.

Authentication and security schemes

NightVision reads authentication guards on NestJS and Fastify routes and records them as OpenAPI security schemes. See the Framework Support Index for how schemes and the x-unsound marker are represented. Plain Express routes are not scanned for authentication middleware; NestJS applications (which run on Express) are fully supported.

NestJS

Guard / Decorator	Recognized as
@UseGuards(AuthGuard('jwt')) and other Passport strategies	The strategy’s scheme (see the strategy mapping below)
@UseGuards(SomeAuthGuard) (a custom guard class)	Classified from its AuthGuard(...) base, its canActivate credential check, or its name; classifications not proven from a recognized strategy are flagged x-unsound
APP_GUARD provider / app.useGlobalGuards(...)	Applied as a global guard to every route reachable through the module import graph
@Public(), @IsPublic(), @AllowAnonymous(), @SkipAuth()	Exempt a route from a global guard
@ApiBearerAuth(), @ApiBasicAuth(), @ApiCookieAuth(), @ApiOAuth2([...]), @ApiSecurity('name')	Explicit @nestjs/swagger security declarations

Passport strategy mapping:

AuthGuard('...') strategy	OpenAPI Security Scheme
jwt, bearer	HTTP bearer (JWT)
basic	HTTP basic
header API-key strategies	API key (header)
local, and redirect flows (google, github, oauth2, openidconnect, and similar)	None - these guard login and OAuth-redirect endpoints that are reachable anonymously

Fastify

Library / Pattern	Recognized as
@fastify/jwt (request.jwtVerify())	HTTP bearer (JWT)
@fastify/basic-auth (fastify.basicAuth hook)	HTTP basic
@fastify/auth (fastify.auth([...]))	The union of the composed strategies
@fastify/passport (request.authenticate via decorateRequest)	The scheme its verifier reads
A guard hook (onRequest, preHandler, preValidation, preParsing) that reads an auth header and rejects with 401/403	HTTP bearer or API key, flagged x-unsound

Fastify encapsulation is respected: a hook added inside a register(plugin) guards only that plugin’s scope, while a plugin wrapped with fastify-plugin has its hooks hoisted to the parent scope.

NestJS role guards and scopes other than @ApiOAuth2 scopes are not currently extracted, so no x-roles are emitted for JavaScript. Heuristic guard classifications and name-based @Public() exemptions are flagged x-unsound.