Mapping a NestJS Backend Automatically: DB Schemas, REST Endpoints, and Catching an Auth Bug

Omar Wael — Sun, 25 Oct 2026 20:25:09 +0000

Whenever I start working on an unfamiliar backend project, I spend the first few hours bouncing between controller files, middlewares, and ORM entities just to learn how the database tables link together and how the API routes function.

I created DocFlow to generate that map automatically from a GitHub repository. It works across full-stack and backend frameworks (Next.js, Nuxt, Angular, NestJS, Express, etc.), and to test it on a real backend, I ran it against the nestjs-realworld-example-app repository.

Here is what it pulled out of the codebase automatically:

1. Interactive Database Schema (0:00 in the demo)

(Drag and drop a screenshot of your Database Schema tab at 0:05 here)

Instead of reading entity files one by one, it builds an interactive React Flow graph showing all 6 tables (user, article, comment, tag, follows, article_favorites_user), column types, primary and foreign keys, and the 1:N and N:M relationships between them.

2. Backend API Explorer (0:16 in the demo)

(Drag and drop a screenshot of your APIs tab at 0:18 here)

It scanned the NestJS controllers and listed all 19 REST endpoints (GET, POST, PUT, DELETE), linking each route directly to its controller file (like src/article/article.controller.ts and src/user/user.controller.ts).

3. Line-Cited Architecture Chat & Catching a Real Bug (0:25 in the demo)

(Drag and drop a screenshot of the Chat response at 0:45 here)

When I asked the codebase chat how authentication and authorization work, it didn't just give a generic summary:

It traced the JWT token generation and middleware down to the exact lines (src/user/auth.middleware.ts:14-31).
It generated a route protection table showing which routes run through AuthMiddleware in UserModule, ProfileModule, and ArticleModule.
The best part (at 0:45): It flagged an actual authorization gap in the repo where PUT /articles/:slug (src/article/article.controller.ts:50-63) and DELETE /articles/:slug (src/article/article.controller.ts:57-71) authenticate the user via middleware, but never check the author's userId in the service before updating or deleting an article.

How it works under the hood

Backend: Runs on NestJS with BullMQ queues to clone and index repository trees asynchronously.
Indexing & RAG: Combines structural code parsing (to extract ORM schemas, client pages, and API routes) with PostgreSQL and pgvector for hybrid search so the chat cites exact file paths and line numbers instead of guessing.
Frontend: Built with Next.js and React Flow for the interactive schema diagrams.

Try it out

You can test the live nestjs-realworld-example-app example or connect up to 2 of your own repositories on the free tier here: https://docflow.software