fix(nest): honor routed request during input decoding - #1922
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
- Decode input from the routed request —
ImplementInterceptornow buildsdecodeInputfrom therequestparameter passed toresolveProcedure(the request after routing interceptors run) instead of the closed-over initialstandardRequest, so plugins that replace the request — such asRequestLimitHandlerPlugin— take effect during Nest input decoding. This matches the canonical pattern already used by the built-inOpenAPIHandlerCodecCore.resolveProcedure(decodeInput: () => this.decodeInput(matched, request)). - Regression test for request-limit enforcement — a new
request limit plugintest posts an over-limit body to aPOST /request-limitprocedure on both the Express and Fastify adapters and asserts413withPAYLOAD_TOO_LARGE.
I verified the test genuinely pins the bug: reverting the implement.ts fix makes both new tests fail with expected 200 to deeply equal 413 — i.e. the request-limit plugin is bypassed without the change. The full packages/nest/src/implement.test.ts suite (90 tests) and ESLint pass on the changed files.
One scoping note (not actionable): route params for decoding still come from the pre-routing standardRequest (per the PR's stated intent), while URL, query, and headers now come from the routed request. A routing interceptor that rewrites the request URL would therefore not affect Nest route-param extraction — consistent with the PR's declared scope.
DeepSeek Flash (free via Pullfrog for OSS) | 𝕏
More templates
@orpc/ai-sdk
@orpc/arktype
@orpc/bun
@orpc/client
@orpc/cloudflare
@orpc/contract
@orpc/experimental-effect
@orpc/evlog
@orpc/hibernation
@orpc/json-schema
@orpc/experimental-msw
@orpc/nest
@orpc/next
@orpc/node
@orpc/openapi
@orpc/opentelemetry
@orpc/pinia-colada
@orpc/pino
@orpc/publisher
@orpc/ratelimit
@orpc/server
@orpc/shared
@orpc/swr
@orpc/tanstack-query
@orpc/trpc
@orpc/valibot
@orpc/zod
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |

ImplementInterceptorcurrently decodes procedure input from the initialstandardRequest, even when a routing interceptor passes a replacement request toStandardHandler. This prevents request wrappers such asRequestLimitHandlerPluginfrom taking effect during Nest input decoding.Fixes
resolveProcedureafter routing interceptors have run.RequestLimitHandlerPluginenforcement for@orpc/nestwithout changing the public API.Testing
200for a request above the configured limit.413 PAYLOAD_TOO_LARGE.pnpm exec vitest run packages/nest/src/implement.test.ts— 90 tests passed.pnpm lintpnpm type:checkpnpm docs:validateFixes #1921