The following section covers the components of JavaScript frameworks and their library components that NightVision’s API Discovery capability can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please get in touch with our support team at support@nightviz.ai, and we can add this as a new feature.
| Library Component | Description |
|---|
| Controller | Decorator to define a controller class in NestJS, which handles incoming HTTP requests. |
| Module | Decorator to define a module in NestJS, used to organize related components, services, and controllers. |
| Injectable | Decorator to define a class as a provider that can be injected into other components via dependency injection. |
| Library Component | Description |
|---|
| DynamicModule | Represents a dynamically created module in NestJS. |
| NestFactory.create | Method to create an application instance using the NestFactory class. |
| @nestjs/core.Route | Represents a route definition in NestJS, used for setting up routing at the core level. |
| @nestjs/core.RouterModule.register | Method to register a set of routes in NestJS. |
| @nestjs/core.nestjs_app.setGlobalPrefix | Method to set a global prefix for all routes in a NestJS application. |
| @nestjs/core.nestjs_app.listen | Method to start listening for incoming HTTP requests in a NestJS application. |
| Library Component | Description |
|---|
| express.Router | Method to create a new router object to handle routes in Express. |
| express() | Method to initialize a new Express application instance. |
| app.get | Method to handle HTTP GET requests in an Express application. |
| app.post | Method to handle HTTP POST requests in an Express application. |
| app.put | Method to handle HTTP PUT requests in an Express application. |
| app.patch | Method to handle HTTP PATCH requests in an Express application. |
| app.delete | Method to handle HTTP DELETE requests in an Express application. |
| app.all | Method to handle all HTTP methods in an Express application. |
| app.use | Method to mount middleware or sub-applications. |
| app.router | The application’s in-built instance of router. This is created lazily, on first access. |
| app.listen | Method to start listening for HTTP requests on a specified port. |
| app.route | Method to create a route with a specific path in an Express application. |
| request.params | Represents the parameters sent in the request URL in an Express application. |
| request.body | Represents the parameters sent in the request body in an Express application. |
| request.query | Represents the parameters sent in the request query in an Express application. |
| Library Component | Description |
|---|
| @fastify.autoload | Fastify plugin that loads and configure routes matching the folder structure. |
| fastify.get | Method to handle HTTP GET requests in a Fastify application. |
| fastify.head | Method to handle HTTP HEAD requests in a Fastify application. |
| fastify.post | Method to handle HTTP POST requests in a Fastify application. |
| fastify.put | Method to handle HTTP PUT requests in a Fastify application. |
| fastify.delete | Method to handle HTTP DELETE requests in a Fastify application. |
| fastify.options | Method to handle HTTP OPTIONS requests in a Fastify application. |
| fastify.patch | Method to handle HTTP PATCH requests in a Fastify application. |
| fastify.route | Method to configure the endpoints in a Fastify application. |
| fastify.register | Method to configure specific behaviors for a route, e.g. to add prefixes or log levels. |
| fastify.after | Method that is executed once the previous declared register has finished. |
| fastify.ready | Method that is executed once all the registers declared have finished their execution. |
| fastify.listen | Behaves the same way as ready, starting the server for a given port. |
NightVision reads authentication guards on NestJS and Fastify routes and records them as OpenAPI security schemes. See the Framework Support Index for how schemes and the x-unsound marker are represented. Plain Express routes are not scanned for authentication middleware; NestJS applications (which run on Express) are fully supported.
| Guard / Decorator | Recognized as |
|---|
@UseGuards(AuthGuard('jwt')) and other Passport strategies | The strategy’s scheme (see the strategy mapping below) |
@UseGuards(SomeAuthGuard) (a custom guard class) | Classified from its AuthGuard(...) base, its canActivate credential check, or its name; classifications not proven from a recognized strategy are flagged x-unsound |
APP_GUARD provider / app.useGlobalGuards(...) | Applied as a global guard to every route reachable through the module import graph |
@Public(), @IsPublic(), @AllowAnonymous(), @SkipAuth() | Exempt a route from a global guard |
@ApiBearerAuth(), @ApiBasicAuth(), @ApiCookieAuth(), @ApiOAuth2([...]), @ApiSecurity('name') | Explicit @nestjs/swagger security declarations |
Passport strategy mapping:
AuthGuard('...') strategy | OpenAPI Security Scheme |
|---|
jwt, bearer | HTTP bearer (JWT) |
basic | HTTP basic |
| header API-key strategies | API key (header) |
local, and redirect flows (google, github, oauth2, openidconnect, and similar) | None - these guard login and OAuth-redirect endpoints that are reachable anonymously |
| Library / Pattern | Recognized as |
|---|
@fastify/jwt (request.jwtVerify()) | HTTP bearer (JWT) |
@fastify/basic-auth (fastify.basicAuth hook) | HTTP basic |
@fastify/auth (fastify.auth([...])) | The union of the composed strategies |
@fastify/passport (request.authenticate via decorateRequest) | The scheme its verifier reads |
A guard hook (onRequest, preHandler, preValidation, preParsing) that reads an auth header and rejects with 401/403 | HTTP bearer or API key, flagged x-unsound |
Fastify encapsulation is respected: a hook added inside a register(plugin) guards only that plugin’s scope, while a plugin wrapped with fastify-plugin has its hooks hoisted to the parent scope.
NestJS role guards and scopes other than @ApiOAuth2 scopes are not currently extracted, so no x-roles are emitted for JavaScript. Heuristic guard classifications and name-based @Public() exemptions are flagged x-unsound.