Skip to content

fix(nest): honor routed request during input decoding - #1922

Merged
dinwwwh merged 3 commits into
middleapi:mainfrom
Gyeonghun-Park:fix/nest-request-limit-decoding
Aug 22, 2026
Merged

fix(nest): honor routed request during input decoding#1922
dinwwwh merged 3 commits into
middleapi:mainfrom
Gyeonghun-Park:fix/nest-request-limit-decoding

Conversation

@Gyeonghun-Park

Copy link
Copy Markdown
Contributor

ImplementInterceptor currently decodes procedure input from the initial standardRequest, even when a routing interceptor passes a replacement request to StandardHandler. This prevents request wrappers such as RequestLimitHandlerPlugin from taking effect during Nest input decoding.

Fixes

  • Decode procedure input from the request passed to resolveProcedure after routing interceptors have run.
  • Restore RequestLimitHandlerPlugin enforcement for @orpc/nest without changing the public API.
  • Keep the existing Nest route parameter extraction behavior unchanged.

Testing

  • Added an integration regression test for both Express and Fastify adapters.
  • Before the fix, both cases returned 200 for a request above the configured limit.
  • After the fix, both cases return 413 PAYLOAD_TOO_LARGE.
  • pnpm exec vitest run packages/nest/src/implement.test.ts — 90 tests passed.
  • pnpm lint
  • pnpm type:check
  • pnpm docs:validate

Fixes #1921

@vercel

vercel Bot commented Aug 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
orpc Skipped Skipped Aug 22, 2026 5:38am

@Gyeonghun-Park
Gyeonghun-Park marked this pull request as ready for review August 22, 2026 04:31

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes

  • Decode input from the routed requestImplementInterceptor now builds decodeInput from the request parameter passed to resolveProcedure (the request after routing interceptors run) instead of the closed-over initial standardRequest, so plugins that replace the request — such as RequestLimitHandlerPlugin — take effect during Nest input decoding. This matches the canonical pattern already used by the built-in OpenAPIHandlerCodecCore.resolveProcedure (decodeInput: () => this.decodeInput(matched, request)).
  • Regression test for request-limit enforcement — a new request limit plugin test posts an over-limit body to a POST /request-limit procedure on both the Express and Fastify adapters and asserts 413 with PAYLOAD_TOO_LARGE.

I verified the test genuinely pins the bug: reverting the implement.ts fix makes both new tests fail with expected 200 to deeply equal 413 — i.e. the request-limit plugin is bypassed without the change. The full packages/nest/src/implement.test.ts suite (90 tests) and ESLint pass on the changed files.

One scoping note (not actionable): route params for decoding still come from the pre-routing standardRequest (per the PR's stated intent), while URL, query, and headers now come from the routed request. A routing interceptor that rewrites the request URL would therefore not affect Nest route-param extraction — consistent with the PR's declared scope.

Pullfrog  | View workflow run | Using DeepSeek Flash (free via Pullfrog for OSS) | 𝕏

@pkg-pr-new

pkg-pr-new Bot commented Aug 22, 2026

Copy link
Copy Markdown
More templates

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1922

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1922

@orpc/bun

npm i https://pkg.pr.new/@orpc/bun@1922

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1922

@orpc/cloudflare

npm i https://pkg.pr.new/@orpc/cloudflare@1922

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1922

@orpc/experimental-effect

npm i https://pkg.pr.new/@orpc/experimental-effect@1922

@orpc/evlog

npm i https://pkg.pr.new/@orpc/evlog@1922

@orpc/hibernation

npm i https://pkg.pr.new/@orpc/hibernation@1922

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1922

@orpc/experimental-msw

npm i https://pkg.pr.new/@orpc/experimental-msw@1922

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1922

@orpc/next

npm i https://pkg.pr.new/@orpc/next@1922

@orpc/node

npm i https://pkg.pr.new/@orpc/node@1922

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1922

@orpc/opentelemetry

npm i https://pkg.pr.new/@orpc/opentelemetry@1922

@orpc/pinia-colada

npm i https://pkg.pr.new/@orpc/pinia-colada@1922

@orpc/pino

npm i https://pkg.pr.new/@orpc/pino@1922

@orpc/publisher

npm i https://pkg.pr.new/@orpc/publisher@1922

@orpc/ratelimit

npm i https://pkg.pr.new/@orpc/ratelimit@1922

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1922

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1922

@orpc/swr

npm i https://pkg.pr.new/@orpc/swr@1922

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1922

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1922

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1922

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1922

commit: 89b66c0

@codecov

codecov Bot commented Aug 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@codspeed-hq

codspeed-hq Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

Merging this PR will not alter performance

✅ 30 untouched benchmarks


Comparing Gyeonghun-Park:fix/nest-request-limit-decoding (89b66c0) with main (cc68d42)

Open in CodSpeed

@dinwwwh
dinwwwh merged commit 8a3e0a2 into middleapi:main Aug 22, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[v2] RequestLimitHandlerPlugin does not enforce limits with @orpc/nest

2 participants