Skip to content

feat: disable Swagger in production environments #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chetankoli-ll wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

feat: disable Swagger in production environments #168

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f3e53e2
feat: disable Swagger in production environments
chetankoli-ll Sep 8, 2026
c078190
feat: restrict Swagger availability to non-production environments
chetankoli-ll Sep 9, 2026
781784a
feat: update Swagger configuration to enable in non-production enviro…
chetankoli-ll Sep 9, 2026
b2c5a22
feat: update Swagger configuration to enable based on environment
chetankoli-ll Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions src/helpers/bootstrap.helper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import {
SolidSecurityOptions,
} from './security.helper';
import { parseBooleanEnv } from './environment.helper';
import { Environment } from 'src/decorators/disallow-in-production.decorator';

// ---- Shared process handlers ----

Expand Down Expand Up @@ -52,8 +53,8 @@ export interface SolidSwaggerOptions {
export interface SolidBootstrapOptions {
/** Global API prefix. Defaults to 'api'. Set to '' to disable. */
globalPrefix?: string;
/** Swagger configuration. Set to false to disable Swagger entirely. */
swagger?: SolidSwaggerOptions | false;
/** Swagger configuration. Set to true to enable everywhere or false to disable entirely. */
swagger?: SolidSwaggerOptions | boolean;
/** Permissions-Policy header overrides (merged with defaults). */
permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
/** Security header overrides, including iframe frame-ancestor allowlists. */
Expand Down Expand Up @@ -93,7 +94,7 @@ export async function bootstrapSolidApp(

const {
globalPrefix = 'api',
swagger = {},
swagger,
permissionsPolicyOverrides = {},

@oswald-logicLoop oswald-logicLoop Sep 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this seems wrong. if we have passed swagger as true/false, it should always be true/false irrespective of environment. That way someone is consuming project can definitively control his swagger behaivour. only fallback we should default

security = {},
verboseBootstrap = false,
Expand Down Expand Up @@ -179,9 +180,17 @@ export async function bootstrapSolidApp(
}),
);

// Swagger
if (swagger !== false) {
const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger;
const isProduction = [process.env.ENV,]
.filter(Boolean)
.some(
(value) =>
value?.toLowerCase() === Environment.Production
);

const swaggerEnabled = swagger === undefined ? !isProduction : swagger !== false;
if (swaggerEnabled) {
const swaggerOptions = typeof swagger === 'object' ? swagger : {};
const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swaggerOptions;
const swaggerConfig = new DocumentBuilder()
.setTitle(title)
.setDescription(description)
Expand Down