From f3e53e2d9eb054e32a460fcf5022de93ef5a2dfe Mon Sep 17 00:00:00 2001 From: Chetan Date: Tue, 8 Sep 2026 13:36:23 +0530 Subject: [PATCH 1/4] feat: disable Swagger in production environments --- src/helpers/bootstrap.helper.ts | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/helpers/bootstrap.helper.ts b/src/helpers/bootstrap.helper.ts index 5ae0a9e2..88586b5f 100644 --- a/src/helpers/bootstrap.helper.ts +++ b/src/helpers/bootstrap.helper.ts @@ -179,8 +179,18 @@ export async function bootstrapSolidApp( }), ); - // Swagger - if (swagger !== false) { + // Swagger is available in non-production environments only. Treat both the + // Solid ENV value and the standard Node.js NODE_ENV value as production + // markers so deployments cannot expose the docs by omitting one of them. + const isProduction = [process.env.ENV, process.env.NODE_ENV] + .filter(Boolean) + .some( + (value) => + value?.toLowerCase() === "prod" || + value?.toLowerCase() === "production", + ); + + if (swagger !== false && !isProduction) { const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger; const swaggerConfig = new DocumentBuilder() .setTitle(title) From c078190f13f69b8831b62867534774326ca70357 Mon Sep 17 00:00:00 2001 From: Chetan Date: Wed, 9 Sep 2026 11:11:05 +0530 Subject: [PATCH 2/4] feat: restrict Swagger availability to non-production environments --- src/helpers/bootstrap.helper.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/helpers/bootstrap.helper.ts b/src/helpers/bootstrap.helper.ts index 88586b5f..27fe676f 100644 --- a/src/helpers/bootstrap.helper.ts +++ b/src/helpers/bootstrap.helper.ts @@ -20,6 +20,7 @@ import { SolidSecurityOptions, } from './security.helper'; import { parseBooleanEnv } from './environment.helper'; +import { Environment } from 'src/decorators/disallow-in-production.decorator'; // ---- Shared process handlers ---- @@ -182,12 +183,11 @@ export async function bootstrapSolidApp( // Swagger is available in non-production environments only. Treat both the // Solid ENV value and the standard Node.js NODE_ENV value as production // markers so deployments cannot expose the docs by omitting one of them. - const isProduction = [process.env.ENV, process.env.NODE_ENV] + const isProduction = [process.env.ENV] .filter(Boolean) .some( (value) => - value?.toLowerCase() === "prod" || - value?.toLowerCase() === "production", + value?.toLowerCase() === Environment.Production ); if (swagger !== false && !isProduction) { From 781784a386bba0a79929b72a986abaac142a0a98 Mon Sep 17 00:00:00 2001 From: Chetan Date: Wed, 9 Sep 2026 11:30:37 +0530 Subject: [PATCH 3/4] feat: update Swagger configuration to enable in non-production environments only --- src/helpers/bootstrap.helper.ts | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/src/helpers/bootstrap.helper.ts b/src/helpers/bootstrap.helper.ts index 27fe676f..c8432903 100644 --- a/src/helpers/bootstrap.helper.ts +++ b/src/helpers/bootstrap.helper.ts @@ -53,8 +53,8 @@ export interface SolidSwaggerOptions { export interface SolidBootstrapOptions { /** Global API prefix. Defaults to 'api'. Set to '' to disable. */ globalPrefix?: string; - /** Swagger configuration. Set to false to disable Swagger entirely. */ - swagger?: SolidSwaggerOptions | false; + /** Swagger configuration. Set to true to enable everywhere or false to disable entirely. */ + swagger?: SolidSwaggerOptions | boolean; /** Permissions-Policy header overrides (merged with defaults). */ permissionsPolicyOverrides?: Partial; /** Security header overrides, including iframe frame-ancestor allowlists. */ @@ -92,9 +92,13 @@ export async function bootstrapSolidApp( ): Promise { registerGlobalProcessHandlers(); + const isProduction = [process.env.ENV] + .filter(Boolean) + .some((value) => value?.toLowerCase() === Environment.Production); + const { globalPrefix = 'api', - swagger = {}, + swagger = isProduction ? false : true, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, @@ -180,18 +184,9 @@ export async function bootstrapSolidApp( }), ); - // Swagger is available in non-production environments only. Treat both the - // Solid ENV value and the standard Node.js NODE_ENV value as production - // markers so deployments cannot expose the docs by omitting one of them. - const isProduction = [process.env.ENV] - .filter(Boolean) - .some( - (value) => - value?.toLowerCase() === Environment.Production - ); - - if (swagger !== false && !isProduction) { - const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger; + if (swagger !== false) { + const swaggerOptions = typeof swagger === 'object' ? swagger : {}; + const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swaggerOptions; const swaggerConfig = new DocumentBuilder() .setTitle(title) .setDescription(description) From b2c5a222911c75523514a868a6c9a586df203365 Mon Sep 17 00:00:00 2001 From: Chetan Date: Thu, 10 Sep 2026 10:43:16 +0530 Subject: [PATCH 4/4] feat: update Swagger configuration to enable based on environment --- src/helpers/bootstrap.helper.ts | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/helpers/bootstrap.helper.ts b/src/helpers/bootstrap.helper.ts index c8432903..62e9c291 100644 --- a/src/helpers/bootstrap.helper.ts +++ b/src/helpers/bootstrap.helper.ts @@ -92,13 +92,9 @@ export async function bootstrapSolidApp( ): Promise { registerGlobalProcessHandlers(); - const isProduction = [process.env.ENV] - .filter(Boolean) - .some((value) => value?.toLowerCase() === Environment.Production); - const { globalPrefix = 'api', - swagger = isProduction ? false : true, + swagger, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, @@ -184,7 +180,15 @@ export async function bootstrapSolidApp( }), ); - if (swagger !== false) { + const isProduction = [process.env.ENV,] + .filter(Boolean) + .some( + (value) => + value?.toLowerCase() === Environment.Production + ); + + const swaggerEnabled = swagger === undefined ? !isProduction : swagger !== false; + if (swaggerEnabled) { const swaggerOptions = typeof swagger === 'object' ? swagger : {}; const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swaggerOptions; const swaggerConfig = new DocumentBuilder()