
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
An Api schema middleware for Express written in typescript
yarn install rotiro
or
npm install rotiro
const express = require('express');
const { Api } = require('rotiro');
const app = express();
const port = 3000;
// Create a new api
const api = new Api();
// Add a route to the api with a controller to handle the response
api.routes.add('ping', '/ping', {
methods: {
GET: {
controller: (apiRequest) => {
apiRequest.sendResponse(apiRequest, `Pong : ${Date.now()}`);
}
}
}
});
// When all routes are added build the api
api.build();
// add the api as middleware to express
app.use(api.router());
app.listen(port, () => {
console.log(`listening on ${port}`);
});
Checkout the rotiro-express-api router for a more detailed demo
Rotiro makes it easy to design well structured, testable APIs that may need to scale to many endpoints. It provides a number of features similar to those found in Swagger middleware however it is not intended as a replacement for Swagger.
Routes can be defined cleanly, paths use the same pattern as express and the specific configuration for each endpoint can be structured in a way that is easy to follow and maintain.
By configuring the API in code, testing is easy and most of your API tests are simple unit tests with limited need to mock libraries such as express.
Configuring endpoints is as simple as
api.routes.add('ping', '/ping', pingConfig);
api.routes.add('users', '/users', usersConfig);
api.routes.add('user', '/users/:id', userConfig);
Rotiro is designed to make larger APIs more manageable. The current solution works with express however the longer-term intention is to support other frameworks such as koa.
Since the Rotiro is written in typescript, it's an ideal choice for any existing typescript project.
I've been using Swagger for years to document APIs and then run them through express on top of the swagger middleware. I love the features that swagger middleware provides such as data mapping and support for authentication however I found as my APIs grew, managing and generating the documents along with initialising the middleware to be more and more challenging. When you add typescript and other transpiling operations into the mix, it felt like time to create something that was more in line with my own workflow.
By configuring the API in code, it's easy to test and the longer-term plan is to enable the output of a swagger formatted document, which can be used with services such as Swagger UI. At that point, you'll get both a highly testable and easy to use API along with all the documentation and testing features provided via tools like SwaggerUI.
The architecture for Rotiro is still new and being refactored to make it easier to use, which means I may introduce some breaking changes.
Once the class interface is stable I'll start adding some better documentation.
In the meantime, I'm creating some more repositories with examples of how to integrate Rotiro with express.
FAQs
Rotiro API Middleware
The npm package rotiro receives a total of 16 weekly downloads. As such, rotiro popularity was classified as not popular.
We found that rotiro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.