Spring, NestJS, Express, and AWS Lambda support

What OpenAPI Guard understands in Spring Boot (Java and Kotlin), NestJS controllers, Express applications, and AWS Lambda route maps.

Spring Boot (Java and Kotlin)

• @RestController and @Controller classes, class-level @RequestMapping, and @GetMapping, @PostMapping, @PutMapping, @PatchMapping, @DeleteMapping, and @RequestMapping(method = …).
• Inheritance: mappings and class-level paths inherited from API interfaces and base classes in other files, as in openapi-generator’s interface-only and delegate output. Generated sources under build/generated, build/generate-resources, and target/generated-sources are read for this, even though build output is otherwise skipped.
• Constants: static final String fields, interface constants, and Kotlin const val, from any file, joined with +.
• Placeholders: ${key} and ${key:default} from application.properties and application.yml (default profile).
• Base paths: server.servlet.context-path and spring.mvc.servlet.path are aligned with the contract’s servers URL.
• A @RequestMapping without method serves every method; it satisfies operations but is never reported as undocumented. Neither are view-rendering @Controller handlers.

NestJS

@Controller, @Get, @Post, @Put, @Patch, and @Delete imported from @nestjs/common, with literal paths, path arrays, and :id parameters. If the contract’s paths include a global prefix such as /api, set stackblender.openApiGuard.implementationPathPrefix to it.

Express

Express applications and routers in TypeScript or JavaScript (ES modules or CommonJS). OpenAPI Guard composes each application with the routers it mounts, across files.

• app.get, post, put, patch, delete, and all (every method, never reported as undocumented), router.route(path) chains, and path arrays.
• :id parameters, parameter patterns (:id(\d+)), optional parameters (:id?), and Express 5 optional groups ({/:id}).
• Mounts with use(path, router), nested routers, routers imported with import or require, and router factories (app.use('/orders', ordersRouter(service))). Middleware such as express.json() or cors() is ignored.
• A route or prefix computed at run time, or a router that no application in the workspace mounts, is an analysis limitation. Wildcard (*) and regular-expression routes are skipped.

JavaScript (.js, .mjs, .cjs) is read for Express, NestJS, and AWS Lambda. Minified files, compiled output, and test files are skipped.

AWS Lambda (API Gateway)

TypeScript handlers behind an API Gateway HTTP API that dispatch on event.routeKey:

const routes = {
  'GET /api/v1/inboxes': listInboxes,
  'POST /api/v1/email/draft': createDraft,
};
const route = routes[canonicalRouteKey(event.routeKey)];

switch (canonicalRouteKey(event.routeKey)) {
  case 'GET /api/v1/inboxes':
    return listInboxes(event);
}

• Route maps: object literals and new Map([...]) keyed by METHOD /path, including spreads and maps imported from other files of the project.
• Dispatch: switch cases and comparisons such as routeKey === 'GET /health'. The route key is followed through variables, { routeKey }, canonicalizer calls, and local dispatcher functions. Keys may be literals, templates, or + of const strings.
• Aliases: a map from route key to route key, such as { 'GET /inboxes': 'GET /api/v1/inboxes' }, or a case that only returns a route key, declares a legacy route. It is implemented when its target is.
• ANY routes satisfy every method on their path and are never undocumented. $default, HEAD, and OPTIONS routes are ignored, as are test files (*.test.ts, *.spec.ts, __tests__/).

For a router OpenAPI Guard cannot read, declare its routes in an openapi-guard.routes.json file anywhere in the workspace:

{
  "routes": [
    "GET /api/v1/inboxes",
    { "route": "POST /api/v1/email/draft", "handler": "createDraft" }
  ],
  "aliases": { "GET /inboxes": "GET /api/v1/inboxes" },
  "complete": true
}

"complete": true states that the file lists every route the router serves, so operations it does not list are reported missing. REST API (v1) payloads that dispatch on httpMethod and resource are not supported.

Not guessed

Paths computed at run time, unknown placeholders, supertypes that are not in the workspace, and Lambda dispatch that cannot be read are skipped rather than guessed; the operations they could serve are shown as Could not verify, not reported missing. An information diagnostic marks each such place (an analysis limitation).

×