@lenne.tech/nest-server 11.42.5 → 11.42.7

package/src/core/common/services/core-body-parser.initializer.ts

@@ -90,11 +90,8 @@ export class CoreBodyParserInitializer implements OnModuleInit {
       const limit = this.resolveLimit(type, config?.[type]?.limit);
       const layers = stack.filter((layer) => this.isGlobalParserLayer(layer, type));
 
-      if (limit !== undefined && !layers.length) {
-        this.logger.warn(
-          `bodyParser.${type}.limit is configured, but no global ${type} body parser is registered ` +
-            '(was the app created with `bodyParser: false`?) — the limit has no effect.',
-        );
+      if (!layers.length) {
+        this.warnMissingGlobalParser(type, stack, limit);
         continue;
       }
 
@@ -147,6 +144,18 @@ export class CoreBodyParserInitializer implements OnModuleInit {
     return layer?.slash === true && typeof layer.handle === 'function' && layer.handle.name === PARSER_NAMES[type];
   }
 
+  /**
+   * Whether the application was created without `bodyParser: false`.
+   *
+   * Read from the same container options as `rawBody`. Under `Test.createTestingModule()` those
+   * options never reach the container, so the answer there is always "enabled".
+   */
+  protected isBodyParserEnabled(): boolean {
+    const container = (this.moduleRef as unknown as { container?: { contextOptions?: { bodyParser?: boolean } } })
+      ?.container;
+    return container?.contextOptions?.bodyParser !== false;
+  }
+
   /**
    * Whether the application was created with `rawBody: true`.
    *
@@ -210,6 +219,39 @@ export class CoreBodyParserInitializer implements OnModuleInit {
     );
   }
 
+  /**
+   * Explain why there is no global parser of this type, when there should be one.
+   *
+   * NestJS registers its own parsers inside `app.init()` only if no layer with the parser's function
+   * name exists yet (`ExpressAdapter.isMiddlewareApplied()` compares the NAME and nothing else). A
+   * path-scoped `server.use('/upload', json({ limit }))` in `main.ts` therefore counts as "applied",
+   * NestJS skips its global parser, and every request outside that path reaches its handler with an
+   * empty body — a sign-in fails with a validation error, and nothing says why. Restoring the parser
+   * from here is not safe: NestJS would have placed it after everything `main.ts` registered, and that
+   * position is no longer knowable during module init (a raw-body webhook or a proxy registered after
+   * the path-scoped parser must keep seeing the unread stream). So this reports, with the remedy.
+   */
+  protected warnMissingGlobalParser(type: CoreBodyParserType, stack: ExpressLayer[], limit: number | undefined): void {
+    const name = PARSER_NAMES[type];
+    const shadowed = stack.some((layer) => layer?.slash !== true && layer?.handle?.name === name);
+    if (shadowed && this.isBodyParserEnabled()) {
+      this.logger.warn(
+        `No global ${type} body parser is registered: NestJS skips its own when a layer named \`${name}\` ` +
+          `already exists, and a path-scoped \`${type}()\` parser registered before \`app.init()\` counts as one. ` +
+          `Every request outside that path reaches its handler with an EMPTY body. Register the global parser ` +
+          `in main.ts as well — \`server.useBodyParser('${type}')\` — a configured \`bodyParser.${type}.limit\` ` +
+          'is applied to it.',
+      );
+      return;
+    }
+    if (limit !== undefined) {
+      this.logger.warn(
+        `bodyParser.${type}.limit is configured, but no global ${type} body parser is registered ` +
+          '(was the app created with `bodyParser: false`?) — the limit has no effect.',
+      );
+    }
+  }
+
   /**
    * Wrap a parser so its 413 is translated, keeping the name NestJS identifies the layer by.
    *

package/src/index.ts

@@ -53,6 +53,7 @@ export * from './core/common/helpers/process-diagnostics.helper';
 export * from './core/common/helpers/register-enum.helper';
 export * from './core/common/helpers/scim.helper';
 export * from './core/common/helpers/service.helper';
+export * from './core/common/helpers/swagger.helper';
 export * from './core/common/helpers/table.helper';
 export * from './core/common/inputs/combined-filter.input';
 export * from './core/common/inputs/core-input.input';
@@ -73,6 +74,7 @@ export * from './core/common/interfaces/prepare-output-options.interface';
 export * from './core/common/interfaces/resolve-selector.interface';
 export * from './core/common/interfaces/server-options.interface';
 export * from './core/common/interfaces/service-options.interface';
+export * from './core/common/interfaces/swagger-setup-options.interface';
 export * from './core/common/middleware/request-context.middleware';
 export * from './core/common/middlewares/to-lower-case.middleware';
 export * from './core/common/middlewares/security-headers.middleware';

package/src/main.ts

@@ -1,6 +1,5 @@
 import { NestFactory } from '@nestjs/core';
 import { NestExpressApplication } from '@nestjs/platform-express';
-import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { exec } from 'child_process';
 import compression = require('compression');
 import cookieParser = require('cookie-parser');
@@ -11,6 +10,7 @@ import { buildCorsConfig, isCookiesEnabled, isCorsDisabled } from './core/common
 import { HttpExceptionLogFilter } from './core/common/filters/http-exception-log.filter';
 import { installGracefulShutdown } from './core/common/helpers/graceful-shutdown.helper';
 import { handleFatalBootstrapError, installProcessDiagnostics } from './core/common/helpers/process-diagnostics.helper';
+import { setupSwagger } from './core/common/helpers/swagger.helper';
 import { CorePersistenceModel } from './core/common/models/core-persistence.model';
 import { CoreAuthModel } from './core/modules/auth/core-auth.model';
 import { CoreUserModel } from './core/modules/user/core-user.model';
@@ -96,21 +96,15 @@ async function bootstrap() {
     // to avoid open CORS with credentials). Callers should configure appUrl/baseUrl/allowedOrigins.
   }
 
-  // Swagger documentation
-  const config = new DocumentBuilder()
-    .setTitle('Nest Server API')
-    .setDescription('API lenne.Tech Nest Server')
-    .setVersion('1.0.0')
-    .addBearerAuth()
-    .build();
-  const documentFactory = () =>
-    SwaggerModule.createDocument(server, config, {
-      autoTagControllers: true,
-      deepScanRoutes: true,
+  // Swagger documentation: security, API-token scopes and the tenant header are read from the same
+  // decorators the guards read (see setupSwagger), so "Authorize" applies to every route.
+  setupSwagger(server, {
+    description: 'API lenne.Tech Nest Server',
+    documentOptions: {
       extraModels: [CoreUserModel, CoreAuthModel, Auth, User, PersistenceModel, CorePersistenceModel, FilterArgs],
-    });
-  SwaggerModule.setup('swagger', server, documentFactory, {
-    jsonDocumentUrl: '/api-docs-json',
+    },
+    title: 'Nest Server API',
+    version: '1.0.0',
   });
 
   // Drain the event loop on SIGTERM/SIGINT so the process actually exits.