@onebun/core 0.2.5 → 0.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onebun/core",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Core package for OneBun framework - decorators, DI, modules, controllers",
   "license": "LGPL-3.0",
   "author": "RemRyahirev",

package/src/application/application.test.ts

@@ -11,6 +11,12 @@ import {
 import { register } from 'prom-client';
 
 import type { ApplicationOptions } from '../types';
+import type {
+  MiddlewareClass,
+  OneBunRequest,
+  OneBunResponse,
+} from '../types';
+import type { OnModuleConfigure } from '../types';
 
 import {
   Module,
@@ -23,8 +29,12 @@ import {
   Header,
   Cookie,
   Req,
+  UseMiddleware,
+  Middleware,
 } from '../decorators/decorators';
 import { Controller as BaseController } from '../module/controller';
+import { BaseMiddleware } from '../module/middleware';
+import { Service } from '../module/service';
 import { makeMockLoggerLayer } from '../testing/test-utils';
 
 import { OneBunApplication } from './application';
@@ -2562,6 +2572,517 @@ describe('OneBunApplication', () => {
       // Verify they are the same (no duplication due to trailing slash)
       expect(recordedMetrics[0].route).toBe(recordedMetrics[1].route);
     });
+
+    describe('Middleware composition (docs: controllers.md#middleware-execution-order)', () => {
+      test('should run route-level middlewares left-to-right then handler', async () => {
+        const order: string[] = [];
+
+        class MwA extends BaseMiddleware {
+          async use(req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('MwA');
+            const res = await next();
+            order.push('MwA-after');
+
+            return res;
+          }
+        }
+
+        class MwB extends BaseMiddleware {
+          async use(req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('MwB');
+            const res = await next();
+            order.push('MwB-after');
+
+            return res;
+          }
+        }
+
+        @Controller('/api')
+        class ApiController extends BaseController {
+          @Get('/chain')
+          @UseMiddleware(MwA, MwB)
+          getChain() {
+            order.push('handler');
+
+            return this.success({ ok: true });
+          }
+        }
+
+        @Module({ controllers: [ApiController] })
+        class TestModule {}
+
+        const app = createTestApp(TestModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/api/chain', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        const body = await response.json();
+
+        expect(response.status).toBe(200);
+        expect(body.result).toEqual({ ok: true });
+        expect(order).toEqual(['MwA', 'MwB', 'handler', 'MwB-after', 'MwA-after']);
+      });
+
+      test('should run controller-level then route-level middleware', async () => {
+        const order: string[] = [];
+
+        class CtrlMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('CtrlMw');
+
+            return await next();
+          }
+        }
+
+        class RouteMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('RouteMw');
+
+            return await next();
+          }
+        }
+
+        @Controller('/api')
+        @UseMiddleware(CtrlMw)
+        class ApiController extends BaseController {
+          @Get('/dashboard')
+          getDashboard() {
+            order.push('handler');
+
+            return this.success({ stats: {} });
+          }
+
+          @Get('/settings')
+          @UseMiddleware(RouteMw)
+          getSettings() {
+            order.push('handler-settings');
+
+            return this.success({ updated: false });
+          }
+        }
+
+        @Module({ controllers: [ApiController] })
+        class TestModule {}
+
+        const app = createTestApp(TestModule);
+        await app.start();
+
+        order.length = 0;
+        const req1 = new Request('http://localhost:3000/api/dashboard', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const res1 = await (mockServer as any).fetchHandler(req1);
+        expect(res1.status).toBe(200);
+        expect(order).toEqual(['CtrlMw', 'handler']);
+
+        order.length = 0;
+        const req2 = new Request('http://localhost:3000/api/settings', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const res2 = await (mockServer as any).fetchHandler(req2);
+        expect(res2.status).toBe(200);
+        expect(order).toEqual(['CtrlMw', 'RouteMw', 'handler-settings']);
+      });
+
+      test('should run module-level then controller-level then route-level middleware', async () => {
+        const order: string[] = [];
+
+        class ModuleMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('ModuleMw');
+
+            return await next();
+          }
+        }
+
+        class CtrlMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('CtrlMw');
+
+            return await next();
+          }
+        }
+
+        class RouteMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('RouteMw');
+
+            return await next();
+          }
+        }
+
+        @Controller('/admin')
+        @UseMiddleware(CtrlMw)
+        class AdminController extends BaseController {
+          @Get('/users')
+          @UseMiddleware(RouteMw)
+          getUsers() {
+            order.push('handler');
+
+            return this.success({ users: [] });
+          }
+        }
+
+        @Module({ controllers: [AdminController] })
+        class TestModule implements OnModuleConfigure {
+          configureMiddleware(): MiddlewareClass[] {
+            return [ModuleMw];
+          }
+        }
+
+        const app = createTestApp(TestModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/admin/users', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        const body = await response.json();
+
+        expect(response.status).toBe(200);
+        expect(body.result).toEqual({ users: [] });
+        expect(order).toEqual(['ModuleMw', 'CtrlMw', 'RouteMw', 'handler']);
+      });
+
+      test('should run application-wide then module then controller then route middleware', async () => {
+        const order: string[] = [];
+
+        class GlobalMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('GlobalMw');
+
+            return await next();
+          }
+        }
+
+        class ModuleMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('ModuleMw');
+
+            return await next();
+          }
+        }
+
+        class CtrlMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('CtrlMw');
+
+            return await next();
+          }
+        }
+
+        class RouteMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('RouteMw');
+
+            return await next();
+          }
+        }
+
+        @Controller('/admin')
+        @UseMiddleware(CtrlMw)
+        class AdminController extends BaseController {
+          @Get('/stats')
+          @UseMiddleware(RouteMw)
+          getStats() {
+            order.push('handler');
+
+            return this.success({ stats: {} });
+          }
+        }
+
+        @Module({ controllers: [AdminController] })
+        class TestModule implements OnModuleConfigure {
+          configureMiddleware(): MiddlewareClass[] {
+            return [ModuleMw];
+          }
+        }
+
+        const app = createTestApp(TestModule, { middleware: [GlobalMw] });
+        await app.start();
+
+        const request = new Request('http://localhost:3000/admin/stats', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        const body = await response.json();
+
+        expect(response.status).toBe(200);
+        expect(body.result).toEqual({ stats: {} });
+        expect(order).toEqual(['GlobalMw', 'ModuleMw', 'CtrlMw', 'RouteMw', 'handler']);
+      });
+
+      test('should short-circuit when middleware returns without calling next()', async () => {
+        const order: string[] = [];
+
+        class AuthMw extends BaseMiddleware {
+          async use(req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            order.push('AuthMw');
+            const token = req.headers.get('X-Test-Token');
+            if (token !== 'secret') {
+              return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+                status: 403,
+                // eslint-disable-next-line @typescript-eslint/naming-convention
+                headers: { 'Content-Type': 'application/json' },
+              });
+            }
+
+            return await next();
+          }
+        }
+
+        @Controller('/api')
+        class ApiController extends BaseController {
+          @Get('/protected')
+          @UseMiddleware(AuthMw)
+          getProtected() {
+            order.push('handler');
+
+            return { data: 'secret' };
+          }
+        }
+
+        @Module({ controllers: [ApiController] })
+        class TestModule {}
+
+        const app = createTestApp(TestModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/api/protected', {
+          method: 'GET',
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          headers: { 'X-Test-Token': 'wrong' },
+        });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        const body = await response.json();
+
+        expect(response.status).toBe(403);
+        expect(body.error).toBe('Unauthorized');
+        expect(order).toEqual(['AuthMw']);
+      });
+
+      test('should allow middleware to modify response after next() (onion model)', async () => {
+        class AddHeaderAfterNextMw extends BaseMiddleware {
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            const res = await next();
+            res.headers.set('X-After-Next', 'true');
+
+            return res;
+          }
+        }
+
+        @Controller('/api')
+        class ApiController extends BaseController {
+          @Get('/onion')
+          @UseMiddleware(AddHeaderAfterNextMw)
+          getOnion() {
+            return this.success({ value: 1 });
+          }
+        }
+
+        @Module({ controllers: [ApiController] })
+        class TestModule {}
+
+        const app = createTestApp(TestModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/api/onion', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        const body = await response.json();
+
+        expect(response.status).toBe(200);
+        expect(body.result).toEqual({ value: 1 });
+        expect(response.headers.get('X-After-Next')).toBe('true');
+      });
+    });
+
+    describe('Middleware DI (service injection)', () => {
+      test('should inject service into application-wide middleware', async () => {
+        @Service()
+        class RootService {
+          getValue(): string {
+            return 'global';
+          }
+        }
+
+        @Middleware()
+        class GlobalMw extends BaseMiddleware {
+          constructor(private readonly svc: RootService) {
+            super();
+          }
+
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            const res = await next();
+            res.headers.set('X-Injected-Value', this.svc.getValue());
+
+            return res;
+          }
+        }
+
+        @Controller('/api')
+        class ApiController extends BaseController {
+          @Get('/ping')
+          ping() {
+            return this.success({ pong: true });
+          }
+        }
+
+        @Module({ controllers: [ApiController], providers: [RootService] })
+        class TestModule {}
+
+        const app = createTestApp(TestModule, { middleware: [GlobalMw] });
+        await app.start();
+
+        const request = new Request('http://localhost:3000/api/ping', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        expect(response.status).toBe(200);
+        expect(response.headers.get('X-Injected-Value')).toBe('global');
+      });
+
+      test('should inject service into module-level middleware', async () => {
+        @Service()
+        class FeatureService {
+          getValue(): string {
+            return 'module';
+          }
+        }
+
+        @Middleware()
+        class FeatureModuleMw extends BaseMiddleware {
+          constructor(private readonly svc: FeatureService) {
+            super();
+          }
+
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            const res = await next();
+            res.headers.set('X-Injected-Value', this.svc.getValue());
+
+            return res;
+          }
+        }
+
+        @Controller('/feature')
+        class FeatureController extends BaseController {
+          @Get('/data')
+          getData() {
+            return this.success({ data: true });
+          }
+        }
+
+        @Module({ controllers: [FeatureController], providers: [FeatureService] })
+        class FeatureModule implements OnModuleConfigure {
+          configureMiddleware(): MiddlewareClass[] {
+            return [FeatureModuleMw];
+          }
+        }
+
+        @Module({ imports: [FeatureModule], controllers: [] })
+        class RootModule {}
+
+        const app = createTestApp(RootModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/feature/data', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        expect(response.status).toBe(200);
+        expect(response.headers.get('X-Injected-Value')).toBe('module');
+      });
+
+      test('should inject service into controller-level middleware from owner module', async () => {
+        @Service()
+        class FeatureService {
+          getValue(): string {
+            return 'controller';
+          }
+        }
+
+        @Middleware()
+        class FeatureCtrlMw extends BaseMiddleware {
+          constructor(private readonly svc: FeatureService) {
+            super();
+          }
+
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            const res = await next();
+            res.headers.set('X-Injected-Value', this.svc.getValue());
+
+            return res;
+          }
+        }
+
+        @Controller('/feature')
+        @UseMiddleware(FeatureCtrlMw)
+        class FeatureController extends BaseController {
+          @Get('/ctrl')
+          getCtrl() {
+            return this.success({ ok: true });
+          }
+        }
+
+        @Module({ controllers: [FeatureController], providers: [FeatureService] })
+        class FeatureModule {}
+
+        @Module({ imports: [FeatureModule], controllers: [] })
+        class RootModule {}
+
+        const app = createTestApp(RootModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/feature/ctrl', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        expect(response.status).toBe(200);
+        expect(response.headers.get('X-Injected-Value')).toBe('controller');
+      });
+
+      test('should inject service into route-level middleware from owner module', async () => {
+        @Service()
+        class FeatureService {
+          getValue(): string {
+            return 'route';
+          }
+        }
+
+        @Middleware()
+        class FeatureRouteMw extends BaseMiddleware {
+          constructor(private readonly svc: FeatureService) {
+            super();
+          }
+
+          async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+            const res = await next();
+            res.headers.set('X-Injected-Value', this.svc.getValue());
+
+            return res;
+          }
+        }
+
+        @Controller('/feature')
+        class FeatureController extends BaseController {
+          @Get('/route')
+          @UseMiddleware(FeatureRouteMw)
+          getRoute() {
+            return this.success({ ok: true });
+          }
+        }
+
+        @Module({ controllers: [FeatureController], providers: [FeatureService] })
+        class FeatureModule {}
+
+        @Module({ imports: [FeatureModule], controllers: [] })
+        class RootModule {}
+
+        const app = createTestApp(RootModule);
+        await app.start();
+
+        const request = new Request('http://localhost:3000/feature/route', { method: 'GET' });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const response = await (mockServer as any).fetchHandler(request);
+        expect(response.status).toBe(200);
+        expect(response.headers.get('X-Injected-Value')).toBe('route');
+      });
+    });
   });
 
   describe('Tracing integration', () => {

package/src/application/application.ts

@@ -758,10 +758,14 @@ export class OneBunApplication {
         // Module-level middleware (already resolved bound functions)
         const moduleMiddleware = this.ensureModule().getModuleMiddleware?.(controllerClass) ?? [];
 
-        // Controller-level middleware — resolve class constructors via root module DI
+        // Resolve controller-level and route-level middleware with the owner module's DI
+        const ownerModule =
+          this.ensureModule().getOwnerModuleForController?.(controllerClass) ?? this.ensureModule();
+
+        // Controller-level middleware — resolve via owner module DI
         const ctrlMiddlewareClasses = getControllerMiddleware(controllerClass);
         const ctrlMiddleware: Function[] = ctrlMiddlewareClasses.length > 0
-          ? (this.ensureModule().resolveMiddleware?.(ctrlMiddlewareClasses) ?? [])
+          ? (ownerModule.resolveMiddleware?.(ctrlMiddlewareClasses) ?? [])
           : [];
 
         for (const route of controllerMetadata.routes) {
@@ -773,10 +777,10 @@ export class OneBunApplication {
             controller,
           );
 
-          // Route-level middleware — resolve class constructors via root module DI
+          // Route-level middleware — resolve via owner module DI
           const routeMiddlewareClasses = route.middleware ?? [];
           const routeMiddleware: Function[] = routeMiddlewareClasses.length > 0
-            ? (this.ensureModule().resolveMiddleware?.(routeMiddlewareClasses) ?? [])
+            ? (ownerModule.resolveMiddleware?.(routeMiddlewareClasses) ?? [])
             : [];
 
           // Merge middleware: global → module → controller → route

package/src/decorators/decorators.test.ts

@@ -52,6 +52,7 @@ import {
   Req,
   Res,
   UseMiddleware,
+  Middleware,
   Module,
   getModuleMetadata,
   ApiResponse,
@@ -301,6 +302,33 @@ describe('decorators', () => {
     });
   });
 
+  describe('Middleware decorator', () => {
+    test('should emit design:paramtypes for automatic DI', () => {
+      @Service()
+      class HelperService {
+        getValue() {
+          return 'ok';
+        }
+      }
+
+      @Middleware()
+      class TestMiddleware extends BaseMiddleware {
+        constructor(private readonly helper: HelperService) {
+          super();
+        }
+
+        async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>) {
+          return await next();
+        }
+      }
+
+      const deps = getConstructorParamTypes(TestMiddleware);
+      expect(deps).toBeDefined();
+      expect(deps).toHaveLength(1);
+      expect(deps?.[0]).toBe(HelperService);
+    });
+  });
+
   describe('HTTP method decorators', () => {
     test('should register GET route', () => {
       @Controller('test')

package/src/decorators/decorators.ts

@@ -240,6 +240,32 @@ export function Inject<T>(serviceType: new (...args: any[]) => T) {
   };
 }
 
+/**
+ * Class decorator for middleware. Apply to classes that extend BaseMiddleware so that
+ * TypeScript emits design:paramtypes and constructor dependencies are resolved automatically
+ * by the framework (no need for @Inject on each parameter). You can still use @Inject when needed.
+ *
+ * @example
+ * ```ts
+ * @Middleware()
+ * class AuthMiddleware extends BaseMiddleware {
+ *   constructor(private authService: AuthService) {
+ *     super();
+ *   }
+ *   async use(req, next) { ... }
+ * }
+ * ```
+ */
+// eslint-disable-next-line @typescript-eslint/naming-convention
+export function Middleware(): ClassDecorator {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return (target: any): any => {
+    injectable()(target);
+
+    return target;
+  };
+}
+
 /**
  * Register dependencies manually (fallback method)
  */

package/src/module/module.test.ts

@@ -24,7 +24,11 @@ import type {
 } from '../types';
 
 
-import { Controller as CtrlDeco, Module } from '../decorators/decorators';
+import {
+  Controller as CtrlDeco,
+  Middleware,
+  Module,
+} from '../decorators/decorators';
 import { makeMockLoggerLayer } from '../testing/test-utils';
 import { BaseWebSocketGateway } from '../websocket/ws-base-gateway';
 import { WebSocketGateway } from '../websocket/ws-decorators';
@@ -685,7 +689,7 @@ describe('OneBunModule', () => {
 
   describe('Controller DI with @Inject decorator', () => {
     const {
-      Inject, getConstructorParamTypes, Controller: ControllerDecorator, clearGlobalModules,
+      Inject: InjectDecorator, getConstructorParamTypes, Controller: ControllerDecorator, clearGlobalModules,
     } = require('../decorators/decorators');
     const { Controller: BaseController } = require('./controller');
     const { clearGlobalServicesRegistry: clearRegistry } = require('./module');
@@ -716,7 +720,7 @@ describe('OneBunModule', () => {
 
       // Define controller with @Inject BEFORE @Controller
       class OriginalController extends BaseController {
-        constructor(@Inject(SimpleService) private svc: SimpleService) {
+        constructor(@InjectDecorator(SimpleService) private svc: SimpleService) {
           super();
         }
       }
@@ -1189,6 +1193,55 @@ describe('OneBunModule', () => {
     });
   });
 
+  describe('Middleware with service injection', () => {
+    test('should resolve middleware with injected service and use it in use()', async () => {
+      @Service()
+      class HelperService {
+        getValue(): string {
+          return 'injected';
+        }
+      }
+
+      @Middleware()
+      class MiddlewareWithService extends BaseMiddleware {
+        constructor(private readonly helper: HelperService) {
+          super();
+        }
+
+        async use(_req: OneBunRequest, next: () => Promise<OneBunResponse>): Promise<OneBunResponse> {
+          const res = await next();
+          res.headers.set('X-Injected-Value', this.helper.getValue());
+
+          return res;
+        }
+      }
+
+      @CtrlDeco('/test')
+      class TestCtrl extends CtrlBase {}
+
+      @Module({
+        controllers: [TestCtrl],
+        providers: [HelperService],
+      })
+      class TestModule {}
+
+      const module = new OneBunModule(TestModule, mockLoggerLayer);
+      await Effect.runPromise(module.setup() as Effect.Effect<unknown, never, never>);
+
+      const resolved = module.resolveMiddleware([MiddlewareWithService]);
+      expect(resolved).toHaveLength(1);
+
+      const mockReq = Object.assign(new Request('http://localhost/'), {
+        params: {},
+        cookies: new Map(),
+      }) as unknown as OneBunRequest;
+      const next = async (): Promise<OneBunResponse> => new Response('ok');
+      const response = await resolved[0](mockReq, next);
+
+      expect(response.headers.get('X-Injected-Value')).toBe('injected');
+    });
+  });
+
   describe('Lifecycle hooks', () => {
     const { clearGlobalModules } = require('../decorators/decorators');
     const { clearGlobalServicesRegistry: clearRegistry, OneBunModule: ModuleClass } = require('./module');
@@ -1375,7 +1428,7 @@ describe('OneBunModule', () => {
     const {
       Controller: ControllerDecorator,
       Get,
-      Inject,
+      Inject: InjectDecorator,
       clearGlobalModules,
     } = require('../decorators/decorators');
     const { Controller: BaseController } = require('./controller');
@@ -1404,7 +1457,7 @@ describe('OneBunModule', () => {
       }
 
       class CounterController extends BaseController {
-        constructor(@Inject(CounterService) private readonly counterService: CounterService) {
+        constructor(@InjectDecorator(CounterService) private readonly counterService: CounterService) {
           super();
         }
         getCount() {
@@ -1439,7 +1492,7 @@ describe('OneBunModule', () => {
       }
 
       class ChildController extends BaseController {
-        constructor(@Inject(ChildService) private readonly childService: ChildService) {
+        constructor(@InjectDecorator(ChildService) private readonly childService: ChildService) {
           super();
         }
         getValue() {
@@ -1486,7 +1539,7 @@ describe('OneBunModule', () => {
       class SharedModule {}
 
       class AppController extends BaseController {
-        constructor(@Inject(SharedService) private readonly sharedService: SharedService) {
+        constructor(@InjectDecorator(SharedService) private readonly sharedService: SharedService) {
           super();
         }
         getLabel() {

package/src/module/module.ts

@@ -974,6 +974,24 @@ export class OneBunModule implements ModuleInstance {
     return [];
   }
 
+  /**
+   * Get the module instance that owns the given controller.
+   * Used to resolve controller-level and route-level middleware with the owner module's DI.
+   */
+  getOwnerModuleForController(controllerClass: Function): ModuleInstance | undefined {
+    if (this.controllers.includes(controllerClass)) {
+      return this;
+    }
+    for (const childModule of this.childModules) {
+      const owner = childModule.getOwnerModuleForController(controllerClass);
+      if (owner) {
+        return owner;
+      }
+    }
+
+    return undefined;
+  }
+
   /**
    * Get all controller instances from this module and child modules (recursive).
    */

package/src/types.ts

@@ -163,6 +163,13 @@ export interface ModuleInstance {
    */
   getModuleMiddleware?(controllerClass: Function): Function[];
 
+  /**
+   * Get the module instance that owns the given controller (the module in whose
+   * `controllers` array the controller is declared). Returns this module or a
+   * child module, or undefined if the controller is not in this module tree.
+   */
+  getOwnerModuleForController?(controllerClass: Function): ModuleInstance | undefined;
+
   /**
    * Resolve middleware class constructors into bound `use()` functions
    * using this module's DI scope (services + logger + config).