touch-api — API documentation

NestJS + TypeORM service · spec derived from one file (src/app.module.ts)

verified read from the source file inferred reconstructed from module names raw machine-readable artifact

Swagger UI →

Interactive explorer: 34 operations, 22 schemas, request/response examples.

ReDoc →

Three-panel reference documentation.

openapi.json →

Raw OpenAPI 3.1 contract, JSON.

openapi.yaml →

Same contract, YAML.

/healthz →

Liveness of this documentation container only.

Provenance & honesty note.
The input was one 61-line file containing only src/app.module.ts. No controllers, DTOs, entities or tests were available.

Verified — the 8-module graph, the global IpAllowlistMiddleware, the logging middleware hook, the bypass paths /, /health, /health/v2, and the environment keys DB_STRING, IP_ALLOWLIST_FILE, IP_ALLOWLIST_MODE.
Inferred — every CRUD route under /auth, /accounts, /users, /messages, /settings, /common, /legacy, /redis. Each carries x-source: "inferred".

Rendered & verified. Both UIs are opened in headless Chrome against the public IP; operations, tags, schema tree and the ReDoc sidebar are asserted programmatically.

Module graph (verified)

Import	Path in repo	Role (inferred)
`AuthModule`	`./realizations/auth/module`	Authentication, tokens, sessions
`AccountModule`	`./realizations/account/module`	Account/tenant + balance
`CommonModule`	`./realizations/common/module`	Reference data, shared helpers
`MessageModule`	`./realizations/message/module`	Message send / tracking
`SettingsModule`	`./realizations/settings/module`	Key/value configuration
`UserModule`	`./realizations/user/module`	User CRUD
`LegacyApiModule`	`./realizations/legacy-api-bridge/module`	Bridge to a legacy backend
`RedisStorageModule`	`./realizations/redis-storage/module`	Redis-backed storage/cache/sessions
`LoggingModule`	`@touch-api/logging`	Logging + middleware
`IpAllowlistModule`	`@touch-api/ip-allowlist`	IP allowlist enforcement

Request pipeline (verified)

request → IpAllowlistMiddleware (all routes) → logging middlewares → controller

Allowlist setting	Value from source
filePath	`process.env.IP_ALLOWLIST_FILE ?? "/etc/touch-api/ip-allowlist.conf"`
mode	`process.env.IP_ALLOWLIST_MODE ?? AllowlistMode.Off`
trustedHeader	`"x-real-ip"`
trustSocketFallback	`false`
bypassPaths	`["/", "/health", "/health/v2"]`
onBlocked	`ip-allowlist block\|would-block ip=… path=…`