Serialization yana sarrafa yadda al'adu ke canzawa zuwa JSON da aka aika a amsa — muhimmi, tanadeye hadanniyar fields (kamar passwords) da siffanta output. NestJS yana aiki da ClassSerializerInterceptor da class-transformer decorators.
()
() {
..(id);
}
Dawo da database entities kai tsaye na iya fallasa fields da ba su kamata su kai wa client (password hashes, internal flags, tokens) — matsala mai muhimmi ta amniwa/sirri.
import { Exclude } from "class-transformer";
export class User {
id: number;
name: string;
email: string;
@Exclude() // this field is REMOVED from responses
password: string;
}
// enable the serializer interceptor (globally or per-controller)
@UseInterceptors(ClassSerializerInterceptor)
@Controller("users")
export class UsersController {
@Get(":id")
findOne(@Param("id") id): User {
return this.usersService.findOne(id); // password is automatically stripped
}
}
// or globally: app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector)))
ClassSerializerInterceptor yana amfani da class-transformer decorators lokacin serializing responses, don @Exclude() fields an cire su kai tsaye — amma kawai idan kuka dawo da class instances (ba plain objects ba).
export class User {
@Expose() id: number; // explicitly include (with excludeAll strategy)
@Exclude() password: string; // remove from output
@Expose({ name: "full_name" }) // rename in the output
name: string;
@Transform(({ value }) => value.toUpperCase()) // transform the value
code: string;
@Exclude({ toPlainOnly: true }) // exclude only when serializing OUT (not on input)
internalField: string;
}
// ⚠️ the interceptor only transforms CLASS INSTANCES — plain objects pass through unchanged
return new User(data); // ✅ decorators apply
return plainToInstance(User, data); // ✅ convert a plain object to an instance
return { ...data }; // ❌ plain object — @Exclude is IGNORED!
Babbar abin dogara: serialization decorators sai su aiki akan halaye class instances kai tsaye, don haka dole ku dawo da instance (ORM entities yawanci instances; manual-built plain objects suna buƙatar juyawa).
Instead of decorating entities, map to a separate Response DTO containing only the
fields meant for the client — explicit, decoupled from the DB model, and very safe.
Sarrafa response serialization yana da muhimmanci ga duka amniwa da tsaffi API tsari.
Muhimmancin gida shine rigirgi leakage na sensitibil data — dawo da database entities kai tsaye na iya fallasa password hashes, internal fields, tokens, ko wasu data da ba su kamata su kai wa clients, matsala ta gida da mai tsanani.
ClassSerializerInterceptor na NestJS tare da class-transformer decorators (@Exclude, @Expose, @Transform) yana ba da hanya mai tsaffi, mai bayyananniya don siffanta responses — kai tsaye tanadeye excluded fields, sake suna, da canzawa ƙimarori.
Jikillis ita yana muhimmantu gida kowane rana don kowane API da ke dawo da user ko domain data, da sanin mahimmin dogara — cewa serialization kawai yana aiki akan class instances, ba plain objects ba (tushen yau-da-yau "me ya sa password har yanzu yana nuna?" bugs) — yana da muhimmanci ne a zahiri.
Daidai muhimmantu ita ce gane jiya pattern na dedicated response DTOs (zama entities zuwa aiki-sakandare classes da suka ƙunshi server-safe fields kawai), wanda ya keɓe API alkawari daga database tsari kuma shine sallama wannan kusanci don sensitibil data.
Sarrafa serialization da kyau ita ce alamar amniwa mai siri, da kuma tsaffi-tsari NestJS APIs kuma matakin gajeriyar muhimmanci a aiki-real applications da ke aiki da kowane data wanda ba jama'a ba.