Accessing middleware output allows undefined properties #3166

pycanis · 2026-01-08T12:29:40Z

pycanis
Jan 8, 2026

I get correct autocompletion of properties returned from middleware in options when building an endpoint. However, due to the fact that options type also allows Record<string, never>, one can access properties that don't exist.

Is there a way to tell TypeScript to report error if non-existing property is accessed?

EDIT: options is now called ctx

Answered by RobinTail

Jan 12, 2026

🚀 Fixed in version 26.3.1
Thank you for the contribution, @pycanis

@dosu, learn

View full answer

@pycanis · 2026-01-08T12:33:59Z

dosubot[bot]
bot Jan 8, 2026

Hi @pycanis! I'm Dosu and I’m helping the express-zod-api team.

TypeScript allows access to non-existent properties on your middleware output because the initial context type is defined as Record<string, never> (called EmptyObject in express-zod-api), which is then intersected with the output types of your middlewares. This setup is meant to ensure only properties explicitly returned by your middleware chain are available in the endpoint handler. However, if you access a property that doesn't exist, TypeScript will infer its type as never—not a hard error, but a type that will usually cause a type error if you try to use it in a meaningful way (especially with noImplicitAny and strictNullChecks enabled) cite.

Recent versions (v24.4.2+) have improved this, and v25 will make TypeScript errors even more explicit when you access undefined properties cite. There’s no config option to change this, but you can enforce stricter type checking by making sure your middleware outputs are explicitly typed and don’t include index signatures. If you try to access a property not present in the context type, TypeScript should flag it as never or error, especially with strict compiler options.

If you want to guarantee compile-time errors for typos or non-existent properties, keep your middleware outputs as explicit as possible and avoid using Record<string, unknown> or similar index signatures in your context types. This way, TypeScript will only allow access to properties that are actually present in the intersection of your middleware outputs cite.

Example:

const factory = defaultEndpointsFactory
  .addMiddleware(createMiddleware({
    handler: async () => ({ user: { id: "123" } }),
  }));

factory.build({
  handler: ({ options }) => {
    // options.user is OK
    // options.foo will be type 'never' (error if used)
  }
});