Serialization inadhibiti jinsi objects zinavyobadilishwa kuwa JSON inayotumwa katika majibu — muhimu zaidi, kutoa fields nyeti (kama passwords) na kuunda muundo wa output. NestJS inashughulikia hili kwa ClassSerializerInterceptor na decorators za class-transformer.
()
() {
..(id);
}
Kurudisha database entities moja kwa moja kunaweza kufichua fields ambazo hazipaswi kufikia mteja kamwe (password hashes, internal flags, tokens) — suala kubwa la usalama/faragha.
import { Exclude } from "class-transformer";
export class User {
id: number;
name: string;
email: string;
@Exclude() // this field is REMOVED from responses
password: string;
}
// enable the serializer interceptor (globally or per-controller)
@UseInterceptors(ClassSerializerInterceptor)
@Controller("users")
export class UsersController {
@Get(":id")
findOne(@Param("id") id): User {
return this.usersService.findOne(id); // password is automatically stripped
}
}
// or globally: app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector)))
ClassSerializerInterceptor inatumia decorators za class-transformer wakati wa serializing majibu, kwa hivyo fields za @Exclude() zinaondolewa kiotomatiki — lakini tu ikiwa unarudisha class instances (sio plain objects).
export class User {
@Expose() id: number; // explicitly include (with excludeAll strategy)
@Exclude() password: string; // remove from output
@Expose({ name: "full_name" }) // rename in the output
name: string;
@Transform(({ value }) => value.toUpperCase()) // transform the value
code: string;
@Exclude({ toPlainOnly: true }) // exclude only when serializing OUT (not on input)
internalField: string;
}
// ⚠️ the interceptor only transforms CLASS INSTANCES — plain objects pass through unchanged
return new User(data); // ✅ decorators apply
return plainToInstance(User, data); // ✅ convert a plain object to an instance
return { ...data }; // ❌ plain object — @Exclude is IGNORED!
Gotcha ya kawaida: serialization decorators zinafanya kazi tu kwenye class instances halisi, kwa hivyo lazima urudishe instance (ORM entities kwa kawaida ni instances; plain objects zilizoundwa kwa mkono zinahitaji ubadilishaji).
Instead of decorating entities, map to a separate Response DTO containing only the
fields meant for the client — explicit, decoupled from the DB model, and very safe.
Kudhibiti response serialization ni muhimu kwa usalama na kwa muundo safi wa API.
Sababu muhimu zaidi ni kuzuia uvujaji wa data nyeti — kurudisha database entities moja kwa moja kunaweza kufichua password hashes, internal fields, tokens, au data nyingine ambayo haipaswi kufikia wateja kamwe, udhaifu wa kawaida na mkubwa.
ClassSerializerInterceptor ya NestJS yenye decorators za class-transformer (@Exclude, @Expose, @Transform) inatoa njia safi, ya kitangazo (declarative) ya kuunda muundo wa majibu — kuondoa kiotomatiki fields zilizotengwa, kubadilisha majina, na kubadilisha values.
Kuelewa hili ni maarifa muhimu ya kila siku kwa API yoyote inayorudisha data ya mtumiaji au domain, na kujua gotcha kuu — kwamba serialization inafanya kazi tu kwenye class instances, sio plain objects (chanzo cha kawaida cha bug za "kwa nini password bado inaonekana?") — ni muhimu kivitendo.
Wa thamani vivyo hivyo ni kutambua mtindo mbadala wa dedicated response DTOs (kuramani entities kwa output classes za wazi zenye fields salama kwa mteja tu), unaotenganisha mkataba wa API kutoka kwa database model na ni njia salama zaidi kwa data nyeti.
Kudhibiti serialization kwa usahihi ni alama ya API za NestJS zilizo salama, zilizobuniwa vizuri na suala linalofaa mara kwa mara katika programu halisi zinazoshughulikia data yoyote isiyo ya umma.