Summary: This document provides basic information about the extension Node.js + Express support for Web applications.

Extension ID

com.castsoftware.nodejs

What's new?

Please see Node.js - 2.10 - Release Notes for more information.

Description

This extension provides support for Node.js. Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient.

CAST recommends using this extension with HTML5 and JavaScript ≥ 2.0.0 for the best results.

In what situation should you install this extension?

Regarding Front-End to Back-End connections, we do support the following cross-technology stacks:


iOS Front-End connected to Node.js/PostgreSQL Back-end	iOS Front-End connected to Node.js/MSSQL Back-end	AngularJS Front-End connected to Node.js/MongoDB Back-end

If your Web application contains Node.js source code and you want to view these object types and their links with other objects, then you should install this extension:

creates a Node.js application object when an instance has been found
creates Node.js operations which represent entry-points of web services
Node.js operations are called from client applications, using jQuery Ajax for example. Supported client frameworks are:
- jQuery
- AngularJS

Supported Node.js versions

Version	Support	Comment
v0.x		No longer supported
v4.x		LTS
v5.x		Based on Javascript ES6
v6.x		Based on Javascript ES6
v7.x		Based on Javascript ES6
v8.x
v9.x
v10.x
v11.x
v12.x
v13.x
v14.x
v15.x
v16.x
v17.x
v18.x
v19.x
v20.x

Node.js Ecosystem

Node.js comes with numerous libraries and frameworks bringing data access, web services calls, microservices architectures. This list contains all supported libraries:

Library	Comment	Data Access	Web Service	Messaging	Cloud code execution	Remote Process Call
AWS.DynamoDB	Amazon database access
AWS.S3	Amazon storage service
AWS.SQS	Amazon messaging service
AWS Lambda	Cloud code execution
Azure blobs	Azure storage service
Azure Service Bus	Azure Queue Service
Azure Event Hubs	Azure Queue Service
Azure Function	Cloud code execution
Cosmos DB	Microsoft Azure NoSQL Database solution
Couchdb	Couchdb access
Couchdb-nano	Couchdb access
elasticsearch	Open-source search engine
Express	Node.js application framework
GCP Bigtable	GCP database access
GCP Cloud Storage	GCP storage service
GCP Pub/Sub	GCP messaging service
g-RPC	Remote Process Call service
Hapi	Node.js application framework
Knex	Node.js SQL query builder
Koa	Node.js application framework
Loopback	Node.js application framework
Marklogic	Marklogic access
Memcached	Storage framework
Mode-mongodb-native	MongoDB access
Mongo-client	MongoDB access
Mongoose	MongoDB access
MQTT	Messaging library
mssql	SQL server
my_connection	MySQL access
myssql	Nodejs module to manipulate MySQL database
Node-couchdb	Couchdb access
node-sqlserver	SQL server
oracledb	Oracle Database access
pg	PostgreSQL access
redis	Redis access
Sails	Node.js application framework
Seneca	Microservice toolkit

Function Point, Quality and Sizing support

This extension provides the following support:

Function Points (transactions): a green tick indicates that OMG Function Point counting and Transaction Risk Index are supported
Quality and Sizing: a green tick indicates that CAST can measure size and that a minimum set of Quality Rules exist

Function Points (transactions)
Quality and Sizing

Comparison with existing support for JavaScript

CAST AIP has provided support for analyzing JavaScript via its JEE and .NET analyzers (provided out of box in CAST AIP) for some time now. The HTML5/JavaScript extension (on which the Node.js extension depends) also provides support for JavaScript but with a focus on web applications. CAST highly recommends that you use this extension if your Application contains JavaScript and more specifically if you want to analyze a web application, however you should take note of the following:

You should ensure that you configure the extension to NOT analyze the back end web client part of a .NET or JEE application.
You should ensure that you configure the extension to ONLY analyze the front end web application built with the HTML5/JavaScript that communicates with the back end web client part of a .NET or JEE application.
If the back end web client part of a .NET or JEE application is analyzed with the Node.js extension and with the native .NET/JEE analyzers, then your results will reflect this - there will be duplicate objects and links (i.e. from the analyzer and from the extension) therefore impacting results and creating erroneous Function Point data.

In CAST AIP ≥ 8.3.x support for analyzing JavaScript has been withdrawn from the JEE and .NET analyzers.

AIP Core compatibility

This extension is compatible with:

AIP Core release	Supported
8.3.x

Supported DBMS servers

DBMS	Supported?
CSS / PostgreSQL

Prerequisites

An installation of any compatible release of AIP Core (see table above)

Dependencies with other extensions

Some CAST extensions require the presence of other CAST extensions in order to function correctly. The Node.js extension requires that the following other CAST extensions are also installed:

HTML5/JavaScript
Web services linker service (internal technical extension)

Note that when using the CAST Extension Downloader to download the extension and the Manage Extensions interface in CAST Server Manager to install the extension, any dependent extensions are automatically downloaded and installed for you. You do not need to do anything.

Download and installation instructions

The extension will be automatically downloaded and installed in CAST Console. You can manage the extension using the Application - Extensions interface:

Packaging, delivering and analyzing your source code

Once the extension is downloaded and installed, you can now package your source code and run an analysis. The process of packaging, delivering and analyzing your source code is described below:

Click here to expand...

Packaging and delivery

Note that the jQuery extension does not contain any CAST Delivery Manager Tool discoverers or extractors, therefore, no "jQuery" projects will be detected. However, the Web Files Discoverer extension will be automatically installed (it is a "shipped" extension which means it is delivered with AIP Core) and will automatically detect projects as HTML5 if specific files are delivered, therefore ensuring that Analysis Units are created for your source code.

Using CAST Console

Application onboarding

Using CAST Management Studio

Click here to expand...

create a new Version
create a new Package for your Node.js source code using the Files on your file system option:

Define the root folder of your Application source code:

Run the Package action
Before delivering the source code, check the packaging results:

Without the Web Files Discover

If you are not using the Web Files Discoverer, the following will occur:

the CAST Delivery Manager Tool will not find any "projects" related to the Node.js application source code - this is the expected behaviour. However, if your Node.js related source code is part of a larger application (for example a JEE application), then other projects may be found during the package action (click to enlarge):

With the Web Files Discoverer

If you are using the Web Files Discoverer, the following will occur:

the CAST Delivery Manager Tool will automatically detect "HTML5 file projects" (see Web Files Discoverer for more technical information about how the discoverer works) related to the Node.js application source code. In addition, if your Node.js related source code is part of a larger application (for example a JEE application), then other projects may also be found during the package action (click to enlarge):

Deliver the Version

Analyzing

Using CAST Console

AIP Console exposes the technology configuration options once a version has been accepted/imported, or an analysis has been run. Click Universal Technology (3) in the Config (1) > Analysis (2) tab to display the available options for your Node.js source code:

Then choose the relevant Analysis Unit (1) to view the configuration:

Using the CAST Management Studio

Click here to expand...

Accept and deploy the Version in the CAST Management Studio.

Without the Web Files Discover

If you are not using the Web Files Discoverer, the following will occur:

No Analysis Units will be created automatically relating to the Node.js source code - this is the expected behaviour. However, if your Node.js related source code is part of a larger application (for example a JEE application), then other Analysis Units may be created automatically:

In the Current Version tab, add a new Analysis Unit specifically for your Node.js source code, selecting the Add new Universal Analysis Unit option:

Edit the new Analysis Unit and configure in the Source Settings tab:
- a name for the Analysis Unit
- ensure you tick the HTML5/JavaScript option (the Node.js extension depends on the HTML5 and JavaScript extension - and therefore the Universal Analyzer language for the AngularJS extension is set as HTML5/JavaScript)
- define the location of the deployed Node.js source code (the CAST Management Studio will locate this automatically in the Deployment folder):

Run a test analysis on the Analysis Unit before you generate a new snapshot.

With the Web Files Discoverer

If you are using the Web Files Discoverer, the following will occur:

"HTML5" Analysis Units will be created automatically (see Web Files Discoverer for more technical information about how the discoverer works) related to the Node.js application source code. In addition, if your Node.js related source code is part of a larger application (for example a JEE application), then other Analysis Units may also be created:

There is nothing further to do, you can now run a test analysis on the Analysis Unit before you generate a new snapshot.

Analysis warning and error messages

Click here to expand...

Message ID	Message Type	Logged during	Impact	Remediation	Action
NODEJS-001	Warning	Analysis	An internal issue occured when parsing a statement in a file. A part of a file was badly analyzed.		Contact CAST Technical Support

What results can you expect?

Node.js source code will be categorised in CAST Dashboards as "HTML5/JavaScript".

Once the analysis/snapshot generation has completed, you can view the results in the normal manner (for example via CAST Enlighten):

Node.js application with MongoDB data storage exposing web services

Detailed analysis results per framework

See below for more details about how the extension handles each supported framework:

Objects

The following specific objects are displayed in CAST Enlighten:

Icon	Description
	Node.js Application
	Node.js Port
	Node.js Delete Operation Service
	Node.js Get Operation Service
	Node.js Post Operation Service
	Node.js Put Operation Service
	Node.js Service Node.js Express Use Node.js Call to gRPC service method Node.js gRPC service method
	Node.js Express Controller
	Node.js Get Http Request Service
	Node.js Post Http Request Service
	Node.js Put Http Request Service
	Node.js Delete Http Request Service
	Node.js Unknown Database
	Node.js Collection
	Node.js Memcached Connection
	Node.js Memcached Value
	Node.js Call to Java Program
	Node.js Call to Generic Program
	Node.js Restify Get Operation
	Node.js Restify Post Operation
	Node.js Restify Put Operation
	Node.js Restify Delete Operation
	Node.js AWS SQS Publisher Node.js AWS SNS Publisher Node.js Azure Service Bus Publisher NodeJS Azure Event Hub Publisher NodeJS GCP Pub/Sub Publisher
	Node.js AWS SQS Receiver Node.js AWS SNS Subscriber Node.js Azure Service Bus Receiver NodeJS Azure Event Hub Receiver NodeJS GCP Pub/Sub Receiver
	Node.js AWS SQS Unknown Publisher Node.js AWS SNS Unknown Publisher Node.js Azure Unknown Service Bus Publisher NodeJS Azure Unknown Event Hub Publisher NodeJS GCP Unknown Pub/Sub Publisher
	NodeJS AWS SQS Unknown Receiver NodeJS AWS SNS Unknown Subscriber NodeJS Azure Unknown Service Bus Receiver NodeJS Azure Unknown Event Hub Receiver NodeJS GCP Unknown Pub/Sub Receiver
	NodeJS GCP Pub/Sub Subscription
	NodeJS Azure Function
	NodeJS Call to Azure Function
	NodeJS Call to Unknown Azure Function
	NodeJS AWS call to Lambda Function
	NodeJS AWS call to unknown Lambda Function
	NodeJS SignalR Hub Method
	NodeJS SignalR Call to Hub Method
	NodeJS SignalR Call to Unknown Hub Method
	NodeJS S3 Bucket NodeJS Azure Blob Container NodeJS GCP Cloud Storage Bucket
	NodeJS S3 Unknown Bucket NodeJS Azure Unknown Blob Container NodeJS GCP Unknown Cloud Storage Bucket
	NodeJS CosmosDB Collection NodeJS AWS DynamoDB Table NodeJS Elasticsearch Index NodeJS GCP Bigtable table NodeJS Marklogic collection NodeJS Redis Collection
	NodeJS CosmosDB Unknown Collection NodeJS Elasticsearch Unknown Index NodeJS GCP Unknown Bigtable table

External link behavior

Behaviour is different depending on the version of CAST AIP you are using the extension with:

From 7.3.6, SQL queries are sent to the external links exactly like standard CAST AIP analyzers.
From 7.3.4 and before 7.3.6, a degraded mode takes place: The Node.js extension analyzes the FROM clause to retrieve table names, then sends the table names only to external links.
For all versions, if no links are found via external links, unresolved objects are created (with type CAST_NodeJS_Unknown_Database_Table).

Structural Rules

The following structural rules are provided:

2.10.0-funcrel	https://technologies.castsoftware.com/rules?sec=srs_nodejs&ref=\|\|2.10.0-funcrel
2.10.0-beta1	https://technologies.castsoftware.com/rules?sec=srs_nodejs&ref=\|\|2.10.0-beta1

Known Limitations

In this section we list the most significant functional limitations that may affect the analysis of applications using Node.js:

With regard to external links degraded mode, only statements with a FROM clause are correctly handled.
NodeJS objects are only supported for ES5 standard.
Analysis of AWS Lambda function needs have access to the serverless.yml file mapping routes and handlers together
Technology specific known limitations are listed in the dedicated framework page: