Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Stop Writing API Docs Twice: Introducing @restdocs for Next.js

TL;DR: I built a test-driven API documentation tool for Next.js that generates OpenAPI specs, TypeScript types, and Swagger UI directly from your tests. One test, complete documentation. No duplicate work. The Problem I…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

TL;DR: I built a test-driven API documentation tool for Next.js that generates OpenAPI specs, TypeScript types, and Swagger UI directly from your tests. One test, complete documentation. No duplicate work.









The Problem I Couldn't Ignore



Last month, I was onboarding a new frontend developer to our Next.js project. They asked a simple question:




"Where's the API documentation?"




I pointed them to our docs/api folder. It was 6 weeks out of date. Half the endpoints had changed. The TypeScript types didn't match the actual responses. The new developer spent 3 days reading code instead of building features.



This is broken.



Every Next.js team I know faces the same problem:




  1. Write tests to ensure APIs work

  2. Separately document those same APIs in OpenAPI/Swagger

  3. Watch them drift within 2-3 sprints

  4. Burn time keeping both in sync



It's like writing the same essay twice in different languages—except one version is always wrong.









The "Aha" Moment



I'd used Spring REST Docs in Java projects before. The concept was brilliant:




Document your API in your tests. Generate specs automatically.




But Node.js had nothing like it. Tools like Swagger JSDoc require maintaining docs separately. NestJS has decorators but locks you into a framework. I wanted something that:




  • Works with Next.js 15 App Router (the modern stack)


  • Zero framework lock-in (just Jest + your existing tests)


  • Generates everything (OpenAPI + TypeScript + Markdown)


  • 100% accuracy (docs are test-driven, not manually maintained)



So I built it. In a weekend. Using Vitest.









Introducing @restdocs



One test. Complete documentation. Always in sync.






Before @restdocs (The Old Way)






// Step 1: Write your test
it('creates user', async () => {
const res = await POST(request);
expect(res.status).toBe(201);
});

// Step 2: Separately write OpenAPI docs (50+ lines)
// (Imagine 50+ lines of YAML/JSON here...)

// Step 3: Manually create TypeScript types (again)
interface CreateUserRequest {
email: string;
name: string;
}

// Step 4: Keep all 3 in sync forever (impossible)






Result: 100+ lines of duplicate code. Docs drift within weeks.






After @restdocs (The New Way)






import { api, field } from '@restdocs/core';

it('creates user', async () => {
const res = await POST(request);

// This ONE call generates OpenAPI + TypeScript + Swagger UI
api.document('POST /api/users', {
description: 'Create a new user',
request: {
email: field.email().required(),
name: field.string().required().minLength(2).maxLength(50),
},
response: {
id: field.uuid(),
email: field.email(),
name: field.string(),
createdAt: field.datetime(),
},
statusCode: 201,
});

expect(res.status).toBe(201);
});






Run npm test. Get:





  • openapi.json - Full OpenAPI 3.0 spec


  • types.ts - Auto-generated TypeScript interfaces


  • api.md - Human-readable Markdown docs


  • Swagger UI at /api/__restdocs



70% less code. 100% accuracy. Zero drift.









How It Works






Architecture






Your Tests → @restdocs DSL → Schema Compiler → Generators
↓
OpenAPI + TypeScript + Markdown








  1. Fluent DSL: Type-safe schema builder with chainable methods


  2. Schema Compiler: Normalizes schemas to OpenAPI 3.0 format


  3. Test Collector: Gathers documented endpoints during test runs


  4. Multi-Format Generators: Outputs OpenAPI, TypeScript, Markdown


  5. Dev UI: Built-in Swagger UI for Next.js






Why This Approach Works



Test-driven documentation isn't new (Spring REST Docs proved it). But Node.js lacked a modern implementation:





  • Single source of truth: Tests define behavior AND documentation


  • Type inference: Auto-detect schemas from test data


  • Built-in validation: Assert responses match schemas


  • Zero runtime cost: Documentation generated at test-time


  • Framework agnostic: Works with Express, Fastify, Next.js









Real-World Impact






For Solo Developers





  • Save 5+ hours/week: No more dual maintenance


  • Better onboarding: New contributors explore APIs via Swagger UI


  • Faster iteration: Change API → update test → docs auto-sync






For Teams





  • Frontend-backend contracts: TypeScript types auto-generated


  • Reduced miscommunication: Swagger UI shows exact formats


  • Quality gates: Built-in validation catches mismatches


  • Faster code reviews: See API changes in generated docs






Metrics from Early Adopters




  • 70% reduction in documentation code

  • 10x faster API exploration for new team members

  • Zero doc drift (tests always match docs)

  • 50% faster onboarding time









Current Status: Experimental Beta (v0.3.0)



Let's be transparent: @restdocs is young.






What's Stable




  • Core DSL and schema system (247 tests passing)

  • Next.js 15 App Router integration

  • Jest reporter and test collection

  • OpenAPI 3.0 + TypeScript + Markdown generation

  • Dev UI with Swagger






What's Experimental





  • Scale testing: Validated with ~50 endpoints, not 500+


  • Complex schemas: Nested objects work, edge cases may exist


  • Production readiness: Use in dev/staging first


  • Framework support: Next.js is solid, others are lighter






Roadmap




  • Vitest native support

  • Advanced schema features (discriminated unions, recursive types)

  • Performance optimization for large APIs

  • Plugin ecosystem for custom generators

  • Fastify/Hono/Express deep integration



Use it. Break it. Help make it production-ready.









Getting Started (5 Minutes)






Install






npm install @restdocs/nextjs --save-dev









Configure Next.js






// next.config.ts
import { withRestDocs } from '@restdocs/nextjs/config';

export default withRestDocs({
restdocs: {
enabled: process.env.NODE_ENV === 'development',
path: '/api/__restdocs',
},
});









Configure Jest






// jest.config.js
const nextJest = require('next/jest');
const createJestConfig = nextJest({ dir: './' });

module.exports = createJestConfig({
reporters: [
'default',
['@restdocs/jest/reporter', {
outputDir: './docs/api',
formats: ['openapi', 'markdown', 'typescript'],
}],
],
});









Create Dev UI Route






// app/api/__restdocs/route.ts
import { createDevUIHandler } from '@restdocs/nextjs/dev-ui';

const handler = createDevUIHandler();
export { handler as GET };









Document Your First API






// __tests__/api/users.test.ts
import { api, field } from '@restdocs/core';
import { POST } from '@/app/api/users/route';

it('creates user', async () => {
const res = await POST(request);

api.document('POST /api/users', {
description: 'Create a new user',
request: {
email: field.email().required(),
name: field.string().required().minLength(2),
},
response: {
id: field.uuid(),
email: field.email(),
name: field.string(),
},
statusCode: 201,
});

expect(res.status).toBe(201);
});









Run Tests






npm test






You'll get:




  • docs/api/openapi.json

  • docs/api/types.ts

  • docs/api/api.md



Start dev server:




npm run dev
open http://localhost:3000/api/__restdocs






Interactive Swagger UI with all your APIs!









Lessons Learned






1. TypeScript Type Inference is Hard



Getting schema inference to preserve literal types required deep dives into TypeScript's type system.




const schema = api.infer({ status: 'active' as const });
// schema.status is 'active', not string









2. OpenAPI 3.0 is Complex



Edge cases like oneOf, allOf, discriminator are tricky. We support the 80% use case well.






3. Developer Experience Matters Most



Method chaining wins:




// Verbose
field.string({ required: true, minLength: 2 })

// Fluent (better!)
field.string().required().minLength(2)









4. Testing Documentation Tools is Meta



Writing tests for a tool that documents tests... recursion all the way down.









What's Next?



Short-term (v0.4.0)




  • Vitest native support

  • Performance benchmarks (100+ endpoints)

  • Plugin system

  • Advanced schema features



Medium-term (v0.5.0)




  • Fastify, Hono, Elysia integrations

  • React Query/tRPC codegen

  • Postman collection generator



Long-term (v1.0.0)




  • Production-ready guarantees

  • Enterprise support

  • Cloud-hosted docs service









Join the Journey



@restdocs is experimental. I need your help!






Ways to Contribute











Final Thoughts



API documentation doesn't have to suck. It shouldn't require duplicate effort. And it definitely shouldn't drift out of sync.



@restdocs is my attempt to fix this for Next.js. It's experimental, imperfect, and needs your feedback.



If you hate writing docs twice, give it a try. Let me know what breaks. Help me make it better.



Let's build the Node.js equivalent of Spring REST Docs together.









Try It Now






npm install @restdocs/nextjs --save-dev






Full example: nextjs-app-router



Star the repo: github.com/json-choi/restdocs ⭐






Built with ❤️ for developers who believe API docs should just work.



Questions? Drop them in the comments or open a discussion on GitHub!

Twice: Introducing @restdocs for Next.js

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Stop Writing API Docs Twice: Introducing @restdocs for Next.js
id: 147c6fbc-36ac-440b-a971-dcd5d19424dc
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Stop Writing API Docs Twice: I" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Stop Writing API Docs Twice Introducing ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Stop Writing API Docs Twice Introducing *"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Stop Writing API Docs Twice Introducing "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Stop Writing API Docs Twice: Introducing @restdocs for Next.js

Thematisch verwandte Begriffe: Stop, Writing, Docs, Twice · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag