
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
hapi-forest
Advanced tools

Provides REST handlers for mongoose models. Can also generate ready to use routes, for fast bootstrapping.
npm i --save hapi-forest # or yarn add hapi-forest if you prefer
// register hapi-forest
server.register({
register: require('hapi-forest'),
options: {
// add your models here for auto route generation
bootstrap: [ require('./models/user-model') ]
}
});
Take a look at the example directory for a full example.
bootstrap: [ MongooseModel, MongooseModel, … ]
Will generate ready to use CRUD routes. hapi-forest will attempt to generate a basic joi schema based on the model.
You can use the forest handler and define your own routes, instead of auto-generating
them. This is useful if you need more control over your endpoints or want custom validation.
The forest handler behaves differently based on your route definition.
GET, POST, PATCH & PUT are supported.
For routes like GET /collection/{name}, the first URL parameter (name in this case)
is used as the "id". It will be used in the condition of the mongoose query.
{id} will translate to _id for convenience.
| Option | Description |
|---|---|
model | required – The mongoose Model for this route. |
type | Overwrites the auto selected handler. Can be one of getOne, getAll, post, put, delete |
preQuery | A Function that gets passed the current mongoose query, that was generated by forest. |
transformResponse | A Function that gets passed the response. You have to return the modified response. |
getOneReturns all documents from the specified model.
select.name in this example) will be used to queryserver.route({
method: 'GET',
path: '/users/{name}',
handler: {
forest: {
model: User,
}
}
});
getAllReturns all documents from the specified model. The result will be streamed.
select.filterByQuery option allows basic filtering of the results by sending a
query with the request. (?group=nodejs&role=developer)
transformQuery option.
You can specify a function that has to return the updated query.allowLimit option gives the client the ability to limit the number of results by
adding $limit=x to the query parameters.server.route({
method: 'GET',
path: '/users',
handler: {
forest: {
model: User,
select: 'firstName group lastName birthday',
}
}
});
postCreates a new document.
skipMongooseHooks will use a faster mongoose create implementation, skipping all hooks.server.route({
method: 'POST',
path: '/users',
handler: {
forest: {
model: User
}
}
});
putUpdates an existing document or creates a new document if it does not exist.
For now an update will not overwrite and existing document but only update it,
like patch does.
allowUpsert: false. PUT will behave like PATCH in that case.server.route({
method: 'PUT',
path: '/users/{name}',
handler: {
forest: {
model: User,
allowUpsert: true,
}
}
});
deleteDeletes a document.
name in this example) will be used to queryserver.route({
method: 'DELETE',
path: '/users/{name}',
handler: {
forest: {
model: User,
}
}
});
FAQs
A hapi plugin to generate routes based on mongoose models
We found that hapi-forest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.