Serialisasi ngontrol kepiye obyek diubah dadi JSON sing dikirim ing response — penting banget, ngasingake field sing sensitif (kaya password) lan mbentuk output kasebut. NestJS nangani iki nganggo ClassSerializerInterceptor lan decorator class-transformer.
()
() {
..(id);
}
Mbalekake entitas basis data langsung bisa mbukak field sing kudu ora nganti tekan klien (hash password, flag internal, token) — masalah keamanan/privasi sing serius.
import { Exclude } from "class-transformer";
export class User {
id: number;
name: string;
email: string;
@Exclude() // this field is REMOVED from responses
password: string;
}
// enable the serializer interceptor (globally or per-controller)
@UseInterceptors(ClassSerializerInterceptor)
@Controller("users")
export class UsersController {
@Get(":id")
findOne(@Param("id") id): User {
return this.usersService.findOne(id); // password is automatically stripped
}
}
// or globally: app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector)))
ClassSerializerInterceptor nerapake decorator class-transformer nalika serialisasi response, supaya field @Exclude() otomatis dihapus — nanging cuma menawa bali instance kelas (ora obyek kosong).
export class User {
@Expose() id: number; // explicitly include (with excludeAll strategy)
@Exclude() password: string; // remove from output
@Expose({ name: "full_name" }) // rename in the output
name: string;
@Transform(({ value }) => value.toUpperCase()) // transform the value
code: string;
@Exclude({ toPlainOnly: true }) // exclude only when serializing OUT (not on input)
internalField: string;
}
// ⚠️ the interceptor only transforms CLASS INSTANCES — plain objects pass through unchanged
return new User(data); // ✅ decorators apply
return plainToInstance(User, data); // ✅ convert a plain object to an instance
return { ...data }; // ❌ plain object — @Exclude is IGNORED!
Gotcha umum: decorator serialisasi cuma bisa makarya ing instance kelas sing asli, dadi sampeyan kudu bali instance (entitas ORM biasane instance; obyek kosong sing dibangun manual perlu konversi).
Instead of decorating entities, map to a separate Response DTO containing only the
fields meant for the client — explicit, decoupled from the DB model, and very safe.
Ngontrol serialisasi response penting banget kanggo keamanan lan desain API sing bersih.
Alasan paling kritis yaiku nyegah kebocoran data sensitif — mbalekake entitas basis data langsung bisa mbukak hash password, field internal, token, utawa data liyane sing kudu ora nganti tekan klien, kerentanan umum lan serius.
ClassSerializerInterceptor NestJS karo decorator class-transformer (@Exclude, @Expose, @Transform) nyedhiyake cara sing resik lan deklaratif kanggo mbentuk response — otomatis ngasingake field sing dikecualike, ngganti jeneng, lan ngubah nilai.
Ngerteni iki penting banget kanggo pengetahuan saben dina kanggo API apa pun sing mbalekake data pangguna utawa domain, lan ngerti gotcha utama — serialisasi cuma makarya ing instance kelas, ora ing obyek kosong (sumber sing kerep ing bug "mengapa password isih katon?") — penting banget kanthi praktis.
Sanadyan penting yaiku ngakoni pola alternatif DTO response khusus (mapping entitas menyang kelas output eksplisit sing mung ngandhut field sing aman kanggo klien), sing pisah kontrak API saka model basis data lan cara paling aman kanggo data sensitif.
Ngontrol serialisasi kanthi bener yaiku ciri API NestJS sing aman lan dirancang kanthi apik, lan kepedulian sing kerep relevan ing aplikasi nyata sing nangani data non-publik apa pun.