
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@qest/swagger-utils
Advanced tools
Generate swagger data from splitted files, add swagger UI to our express, etc.
Install package to our dependencies from NPM.
yarn add @qest/swagger-utils
or
npm install @qest/swagger-utils
It generates swagger yaml or json from partials yaml files which is merged together. You can separate documentation to folders to the code that implements functionality.
Yamls has parts of swagger yaml. You can separate routes, responses, object definitions and security definitions.
This is example for file with some route
paths:
/API/v1/swagger:
get:
produces:
- text/plain
description: get swagger documentation of project in raw (string) format
responses:
200:
description: documentation of project in raw (string) format
...other can be like this
paths:
/API/v1/something/{id}
get:
responses:
200:
$ref: '#/responses/somethingResponse'
delete:
responses:
200:
description: delete something
...and file with responses and object can be together.
responses:
somethingResponse:
description: this is response with array of someting
schema:
type: "object"
properties:
data:
type: "array"
items:
$ref: '#/responses/TreeItem'
definitions:
Item:
type: object
properties:
id:
type: string
name:
type: string
Swagger generator has configuration object with these properties:
| Property | Type | Default | Description |
|---|---|---|---|
| descriptorInfo | Object{ title:string; version:string; description:string; } | Info object whitch title, version and base description | |
| includePaths | string[] | ['./src'] | Paths of folders that will be recursively crawled to find the yamls |
| excludedDirsFromPaths | string[] | This paths will be excludet from crawling. but only this folders, not their subfolders | |
| schemes | string[] | Swagger definition of schemes (http, https, ws, etc..). If it's not defined, scheme of UI will be taken in swagger UI. Only for Swagger 2.0 | |
| host | string | Swagger host of API. If it's not defined, host of UI will be taken in swagger UI | |
| basePath | string | Swagger basepath of API | |
| changeLogPath | string | If you have changelog txt file in your application, it can be included to description of API | |
| swaggerVersion | 2.0 or 3.0 | 2.0 | Version of swagger documentation |
Example of configuration and use:
const swaggerGenerator = new SwaggerGenerator({
descriptorInfo: {
version: '1.0.0',
title: 'something app',
description: 'description of app',
},
includePaths: ['./path-to-docs-folders'],
swaggerVersion: '2.0',
});
const objectResult = swaggerGenerator.getAsObject();
const jsonResult = swaggerGenerator.getAsJson();
The resulting structure for getAsObject() will contain all of files from previous example in one object .
{
"basePath":"/",
"swagger":"2.0",
"info":{
"version":"1.0.0",
"title":"something app",
"description":"description of app"
},
"paths":{
"/API/v1/swagger":{
"get":{...},
},
"/API/v1/something/{id}":{
"get":{...},
"delete":{...},
},
}
"definitions":{
"Item":{...}
},
"securityDefinitions":{...},
"tags":[]
}
In project are express middlewares for integraion of documentation to our project. First middleware are for swagger UI and the second for datasource.
Router()
.get('/api/v1/swagger', swaggerDataMiddleware(swaggerGenerator))
.use('/swagger', swaggerUiMiddleware({
swaggerOptions: {
url: '/api/v1/swagger',
},
})
);
You must have instance of swagger generator and the second parameter say how data you can (json or yaml) in response.
For configuration see configuration of swagger UI library
FAQs
Generate swagger data from splitted files, add swagger UI to our express, etc.
We found that @qest/swagger-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.