Is there a way to add server-side entity validation?

[Chris Haws (ChristopherHaws)]

I was wondering if there is a way to add server-side entity validation. Looking through the docs didn't point me anywhere and I couldn't find anyone else asking about it in an issue. If not, what is the recommended approach to ensuring bad data doesn't get saved into the database?

[Aniruddh Munde (Aniruddh25)]

Hi Chris Haws (@ChristopherHaws)
Could you please elaborate on what you mean by entity validation with an example request and expected response?

[Chris Haws (ChristopherHaws)]

Here is a contrived example:

HTTP Request:

PUT /api/staff HTTP/1.1
Host: hogwarts.edu
Content-Type: application/json
Accept: application/problem+json

{
  "id": "d3187bfc-bc9f-4765-a199-e0a4d516d4ac",
  "firstName": "Albus",
  "lastName": "Percival Wulfric Brian Dumbledore",
  "age": 115,
  "email": "albus@hogwarts"
}

HTTP Response:

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json
Content-Language: en

{
  "type": "https://hogwarts.edu/validation-error",
  "title": "Validation Error",
  "status": 400,
  "errors": [
    {
      "property": "lastName",
      "message": "The combination of 'First Name' and 'Last Name' must be less than 35 characters. You entered 40 characters."
    },
    {
      "property": "age",
      "message": "Age must be between 18 and 100. You entered 115."
    },
    {
      "property": "email",
      "message": "Email must be a valid email address."
    }
  ]
}

Our team uses FluentValidation for doing backend validation, so our code would look similar to this:

public class StaffMember {
    public Guid Id { get; init; }
    public string FirstName { get; set; }
    public string LastName { get; set; }
    public string Email { get; set; }
    public int Age { get; set; }
}

public class StaffMemberValidator : AbstractValidator<StaffMember> {
    public StaffMemberValidator() {
        RuleFor(x => x.Id).NotEmpty();
        RuleFor(x => x.FirstName).Length(0, 35);
        RuleFor(x => x.LastName).MaximumLength(35).NotEmpty()
            .Must((model, _) => model.FirstName.Length + model.LastName.Length < 35)
            .WithMessage(x => $"The combination of 'First Name' and 'Last Name' must be less than 35 characters. You entered {x.FirstName.Length + x.LastName.Length} characters.");
        RuleFor(x => x.Email).EmailAddress();
        RuleFor(x => x.Age).InclusiveBetween(18, 100);
    }
}

[Aniruddh Munde (Aniruddh25)]

I see what you mean. You are right, at the moment, you cannot plugin request data validation directly into dab.
Before we support it, here are some ways I can think of how you could achieve this:

• Do validation on client-side
• Write an Azure Function to do the validation for you then redirect only the valid requests to the dab api
• Embed your validation in a stored procedure on the database and execute the stored proc using a POST.

[George Qiao (qiaohaojie)]

• Embed your validation in a stored procedure on the database and execute the stored proc using a POST.

This is my preferred way to perform some complex validation (or data manipulation). However, I am struggling to find a way to expose the custom validation message to DAB, so that the client is notified what exception occurs.

I have a question posted and a screenshot of what my stored proc returns.

#1826 (comment)