Input Validation Strategies

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

// BOUNDARY LAYER: API Controller - Syntactic validation
class OrderController {
    async createOrder(request: HttpRequest): Promise<HttpResponse> {
        // Schema validation at the boundary
        const parseResult = CreateOrderSchema.safeParse(request.body);
        if (!parseResult.success) {
            return HttpResponse.badRequest(parseResult.error.issues);
        }
        
        // Validated DTO enters the application layer
        const result = await this.orderService.createOrder(parseResult.data);
        return result.match({
            success: (order) => HttpResponse.created(order),
            failure: (error) => HttpResponse.unprocessableEntity(error)
        });
    }
}
 
// APPLICATION LAYER: Orchestrates domain operations
class OrderService {
    async createOrder(dto: CreateOrderDto): Promise<Result<Order, OrderError>> {
        // Application-level validation (authorization, resource existence)
        const customer = await this.customerRepo.findById(dto.customerId);
        if (!customer) {
            return Result.failure(OrderError.customerNotFound(dto.customerId));
        }
        
        // Delegate to domain for business validation
        return this.orderFactory.create(customer, dto.items);
    }
}
 
// DOMAIN LAYER: Business rule validation in Value Objects
class Money {
    private constructor(
        private readonly amount: number,
        private readonly currency: Currency
    ) {}
    
    static create(amount: number, currency: Currency): Result<Money, ValidationError> {
        // Semantic validation: amounts must be non-negative
        if (amount < 0) {
            return Result.failure(ValidationError.negativeAmount(amount));
        }
        // Semantic validation: precision must match currency
        if (!currency.isValidPrecision(amount)) {
            return Result.failure(ValidationError.invalidPrecision(amount, currency));
        }
        return Result.success(new Money(amount, currency));
    }
}
 
// DOMAIN LAYER: Business rules in Aggregate
class Order {
    addItem(product: Product, quantity: Quantity): Result<void, OrderError> {
        // Business rule: cannot add items to shipped orders
        if (this.status === OrderStatus.Shipped) {
            return Result.failure(OrderError.cannotModifyShippedOrder());
        }
        // Business rule: maximum items per order
        if (this.items.length >= Order.MAX_ITEMS) {
            return Result.failure(OrderError.maxItemsExceeded());
        }
        // Business rule: inventory availability
        if (!product.hasInventory(quantity)) {
            return Result.failure(OrderError.insufficientInventory(product.id));
        }
        
        this.items.push(new OrderItem(product, quantity));
        return Result.success();
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

// PATTERN 1: Schema Validation with Zod
import { z } from 'zod';
 
const CreateUserSchema = z.object({
    email: z.string().email("Invalid email format"),
    password: z.string()
        .min(8, "Password must be at least 8 characters")
        .regex(/[A-Z]/, "Password must contain uppercase letter")
        .regex(/[0-9]/, "Password must contain a number"),
    age: z.number().int().min(18, "Must be 18 or older"),
    role: z.enum(["user", "admin", "moderator"]),
});
 
type CreateUserDto = z.infer<typeof CreateUserSchema>;
 
// PATTERN 2: Specification Pattern for Business Rules
interface Specification<T> {
    isSatisfiedBy(candidate: T): boolean;
    and(other: Specification<T>): Specification<T>;
    or(other: Specification<T>): Specification<T>;
    not(): Specification<T>;
}
 
class OrderValueSpecification implements Specification<Order> {
    constructor(private readonly minValue: Money) {}
    
    isSatisfiedBy(order: Order): boolean {
        return order.totalValue.isGreaterThanOrEqual(this.minValue);
    }
    
    and(other: Specification<Order>): Specification<Order> {
        return new AndSpecification(this, other);
    }
    // ... or, not implementations
}
 
// Compose complex business rules
const eligibleForFreeShipping = new OrderValueSpecification(Money.dollars(50))
    .and(new CustomerTierSpecification(CustomerTier.Gold))
    .or(new PromotionActiveSpecification("FREE_SHIP_2024"));
 
// PATTERN 3: Validation Result Pattern (accumulating errors)
class ValidationResult {
    private constructor(
        private readonly errors: ValidationError[]
    ) {}
    
    static valid(): ValidationResult {
        return new ValidationResult([]);
    }
    
    static invalid(...errors: ValidationError[]): ValidationResult {
        return new ValidationResult(errors);
    }
    
    combine(other: ValidationResult): ValidationResult {
        return new ValidationResult([...this.errors, ...other.errors]);
    }
    
    get isValid(): boolean {
        return this.errors.length === 0;
    }
    
    get allErrors(): ValidationError[] {
        return [...this.errors];
    }
}
 
// Usage: Accumulate all errors for user feedback
function validateUserProfile(data: UserProfileData): ValidationResult {
    return ValidationResult.valid()
        .combine(validateEmail(data.email))
        .combine(validatePhoneNumber(data.phone))
        .combine(validateAddress(data.address))
        .combine(validateDateOfBirth(data.dateOfBirth));
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

// SECURE: Allowlist validation for file uploads
const ALLOWED_EXTENSIONS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp']);
const ALLOWED_MIME_TYPES = new Set([
    'image/jpeg', 'image/png', 'image/gif', 'image/webp'
]);
 
function validateFileUpload(file: UploadedFile): Result<void, SecurityError> {
    // Validate extension (case-insensitive)
    const ext = path.extname(file.originalName).toLowerCase();
    if (!ALLOWED_EXTENSIONS.has(ext)) {
        return Result.failure(SecurityError.invalidFileType(ext));
    }
    
    // Validate MIME type from actual file content, not headers
    const detectedMime = detectMimeType(file.buffer);
    if (!ALLOWED_MIME_TYPES.has(detectedMime)) {
        return Result.failure(SecurityError.mimeTypeMismatch(detectedMime));
    }
    
    // Validate file size
    if (file.size > MAX_FILE_SIZE) {
        return Result.failure(SecurityError.fileTooLarge(file.size));
    }
    
    // Validate filename doesn't contain path traversal
    if (file.originalName.includes('..') || file.originalName.includes('/')) {
        return Result.failure(SecurityError.pathTraversal());
    }
    
    return Result.success();
}
 
// SECURE: Path validation preventing directory traversal
class SecureFileAccess {
    constructor(private readonly baseDirectory: string) {
        // Ensure base directory is absolute and canonical
        this.baseDirectory = path.resolve(baseDirectory);
    }
    
    getFilePath(userProvidedPath: string): Result<string, SecurityError> {
        // Resolve to absolute path
        const requestedPath = path.resolve(this.baseDirectory, userProvidedPath);
        
        // Verify it's still within base directory (canonical path comparison)
        if (!requestedPath.startsWith(this.baseDirectory + path.sep)) {
            return Result.failure(SecurityError.pathTraversal());
        }
        
        return Result.success(requestedPath);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

// Composable Validator Interface
interface Validator<T, E = ValidationError> {
    validate(value: T): Result<T, E[]>;
}
 
// Validator Combinators
class Validators {
    // Combine validators, collecting all errors
    static all<T>(...validators: Validator<T>[]): Validator<T> {
        return {
            validate(value: T): Result<T, ValidationError[]> {
                const errors: ValidationError[] = [];
                for (const validator of validators) {
                    const result = validator.validate(value);
                    if (result.isFailure) {
                        errors.push(...result.error);
                    }
                }
                return errors.length > 0 
                    ? Result.failure(errors)
                    : Result.success(value);
            }
        };
    }
    
    // Chain validators, stopping on first failure
    static chain<T>(...validators: Validator<T>[]): Validator<T> {
        return {
            validate(value: T): Result<T, ValidationError[]> {
                for (const validator of validators) {
                    const result = validator.validate(value);
                    if (result.isFailure) {
                        return result;
                    }
                }
                return Result.success(value);
            }
        };
    }
    
    // Conditional validator
    static when<T>(
        condition: (value: T) => boolean,
        validator: Validator<T>
    ): Validator<T> {
        return {
            validate(value: T): Result<T, ValidationError[]> {
                if (condition(value)) {
                    return validator.validate(value);
                }
                return Result.success(value);
            }
        };
    }
}
 
// Reusable primitive validators
const nonEmpty = (field: string): Validator<string> => ({
    validate: (value) => value.trim().length > 0
        ? Result.success(value)
        : Result.failure([ValidationError.required(field)])
});
 
const maxLength = (max: number, field: string): Validator<string> => ({
    validate: (value) => value.length <= max
        ? Result.success(value)
        : Result.failure([ValidationError.tooLong(field, max)])
});
 
// Compose domain-specific validators from primitives
const usernameValidator = Validators.all(
    nonEmpty("username"),
    maxLength(50, "username"),
    {
        validate: (value: string) => /^[a-zA-Z0-9_]+$/.test(value)
            ? Result.success(value)
            : Result.failure([ValidationError.invalidFormat("username")])
    }
);