The following section covers the JavaScript and TypeScript framework components that NightVision Source Intelligence can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please get in touch with our support team at support@nightviz.ai, and we can add this as a new feature.
| Library Component | Description |
|---|
| Controller | Decorator to define a controller class in NestJS, which handles incoming HTTP requests. |
| Module | Decorator to define a module in NestJS, used to organize related components, services, and controllers. |
| Injectable | Decorator to define a class as a provider that can be injected into other components via dependency injection. |
| Library Component | Description |
|---|
| DynamicModule | Represents a dynamically created module in NestJS. |
| NestFactory.create | Method to create an application instance using the NestFactory class. |
| @nestjs/core.Route | Represents a route definition in NestJS, used for setting up routing at the core level. |
| @nestjs/core.RouterModule.register | Method to register a set of routes in NestJS. |
| @nestjs/core.nestjs_app.setGlobalPrefix | Method to set a global prefix for all routes in a NestJS application. |
| @nestjs/core.nestjs_app.listen | Method to start listening for incoming HTTP requests in a NestJS application. |
| Library Component | Description |
|---|
| express.Router | Method to create a new router object to handle routes in Express. |
| express() | Method to initialize a new Express application instance. |
| app.get | Method to handle HTTP GET requests in an Express application. |
| app.post | Method to handle HTTP POST requests in an Express application. |
| app.put | Method to handle HTTP PUT requests in an Express application. |
| app.patch | Method to handle HTTP PATCH requests in an Express application. |
| app.delete | Method to handle HTTP DELETE requests in an Express application. |
| app.all | Method to handle all HTTP methods in an Express application. |
| app.use | Method to mount middleware or sub-applications. |
| app.router | The application’s in-built instance of router. This is created lazily, on first access. |
| app.listen | Method to start listening for HTTP requests on a specified port. |
| app.route | Method to create a route with a specific path in an Express application. |
| request.params | Represents the parameters sent in the request URL in an Express application. |
| request.body | Represents the parameters sent in the request body in an Express application. |
| request.query | Represents the parameters sent in the request query in an Express application. |
| Library Component | Description |
|---|
| @fastify.autoload | Fastify plugin that loads and configure routes matching the folder structure. |
| fastify.get | Method to handle HTTP GET requests in a Fastify application. |
| fastify.head | Method to handle HTTP HEAD requests in a Fastify application. |
| fastify.post | Method to handle HTTP POST requests in a Fastify application. |
| fastify.put | Method to handle HTTP PUT requests in a Fastify application. |
| fastify.delete | Method to handle HTTP DELETE requests in a Fastify application. |
| fastify.options | Method to handle HTTP OPTIONS requests in a Fastify application. |
| fastify.patch | Method to handle HTTP PATCH requests in a Fastify application. |
| fastify.route | Method to configure the endpoints in a Fastify application. |
| fastify.register | Method to configure specific behaviors for a route, e.g. to add prefixes or log levels. |
| fastify.after | Method that is executed once the previous declared register has finished. |
| fastify.ready | Method that is executed once all the registers declared have finished their execution. |
| fastify.listen | Behaves the same way as ready, starting the server for a given port. |
NightVision reads authentication guards on NestJS and Fastify routes and records them as OpenAPI security schemes. See the Framework Support Index for how schemes and the x-unsound marker are represented. Plain Express routes are not scanned for authentication middleware; NestJS applications (which run on Express) are fully supported.
| Guard / Decorator | Recognized as |
|---|
@UseGuards(AuthGuard('jwt')) and other Passport strategies | The strategy’s scheme (see the strategy mapping below) |
@UseGuards(SomeAuthGuard) (a custom guard class) | Classified from its AuthGuard(...) base, its canActivate credential check, or its name; classifications not proven from a recognized strategy are flagged x-unsound |
APP_GUARD provider / app.useGlobalGuards(...) | Applied as a global guard to every route reachable through the module import graph |
@Public(), @IsPublic(), @AllowAnonymous(), @SkipAuth() | Exempt a route from a global guard |
@ApiBearerAuth(), @ApiBasicAuth(), @ApiCookieAuth(), @ApiOAuth2([...]), @ApiSecurity('name') | Explicit @nestjs/swagger security declarations |
Passport strategy mapping:
AuthGuard('...') strategy | OpenAPI Security Scheme |
|---|
jwt, bearer | HTTP bearer (JWT) |
basic | HTTP basic |
| header API-key strategies | API key (header) |
local, and redirect flows (google, github, oauth2, openidconnect, and similar) | None - these guard login and OAuth-redirect endpoints that are reachable anonymously |
| Library / Pattern | Recognized as |
|---|
@fastify/jwt (request.jwtVerify()) | HTTP bearer (JWT) |
@fastify/basic-auth (fastify.basicAuth hook) | HTTP basic |
@fastify/auth (fastify.auth([...])) | The union of the composed strategies |
@fastify/passport (request.authenticate via decorateRequest) | The scheme its verifier reads |
A guard hook (onRequest, preHandler, preValidation, preParsing) that reads an auth header and rejects with 401/403 | HTTP bearer or API key, flagged x-unsound |
Fastify encapsulation is respected: a hook added inside a register(plugin) guards only that plugin’s scope, while a plugin wrapped with fastify-plugin has its hooks hoisted to the parent scope.
NestJS role guards and scopes other than @ApiOAuth2 scopes are not currently extracted, so no x-roles are emitted for JavaScript. Heuristic guard classifications and name-based @Public() exemptions are flagged x-unsound.
Operations extracted from Express, Fastify, and NestJS can carry x-nv-dast-sinks for modeled SQL drivers and ORMs, process execution, outbound requests, redirects, dynamic code, template rendering, and file uploads. NestJS provider injection and inherited constructor chains are followed so sinks reached through injected services can be attributed to the route handler. See DAST sink hints for the vocabulary and interpretation.
