Validation

Global validation pipeline

MUZE uses NestJS’s ValidationPipe applied globally in main.ts:

app.useGlobalPipes(
  new ValidationPipe({
    whitelist: true,
    forbidNonWhitelisted: true,
    transform: true,
  }),
);

Option	Effect
`whitelist: true`	Strips any property not decorated in the DTO class
`forbidNonWhitelisted: true`	Returns 400 if unknown properties are present in the request body
`transform: true`	Automatically transforms plain objects to DTO class instances

DTO pattern

All request bodies are validated against DTO classes using class-validator decorators:

export class CreateEmployeeDto {
  @IsString()
  @IsNotEmpty()
  name: string;

  @IsEmail()
  email: string;

  @IsEnum(EmploymentType)
  employmentType: EmploymentType;

  @IsOptional()
  @IsString()
  jobTitle?: string;

  @IsString()
  @IsNotEmpty()
  storeId: string;
}

Validation rules by type

String fields

Decorator	Purpose
`@IsString()`	Must be a string
`@IsNotEmpty()`	Cannot be empty string
`@Matches(/regex/)`	Must match a pattern (e.g. order number format)

Numeric fields

Decorator	Purpose
`@IsNumber()`	Must be a number
`@Min(0)`	Minimum value
`@Max(n)`	Maximum value
`@IsInt()`	Must be an integer

Enum fields

Decorator	Purpose
`@IsEnum(EnumType)`	Must be one of the enum values

Date fields

Decorator	Purpose
`@IsDateString()`	Must be a valid ISO 8601 date string

Nested objects

Decorator	Purpose
`@ValidateNested()`	Validates nested DTO objects
`@Type(() => NestedDto)`	Specifies the nested DTO class for transformation

Arrays

Decorator	Purpose
`@IsArray()`	Must be an array
`@ValidateNested({ each: true })`	Validates each element in the array

Query parameter validation

Query parameters are also validated via DTOs:

@Get()
async findAll(@Query() query: ListEmployeesDto) {
  // query is validated and transformed
}

export class ListEmployeesDto {
  @IsOptional()
  @IsString()
  search?: string;

  @IsOptional()
  @IsEnum(SortOrder)
  sortOrder?: SortOrder;

  @IsOptional()
  @Min(1)
  page?: number;
}

File upload validation

File uploads use multipart/form-data and are validated at the service level:

File type checking (CSV for imports, PDF for documents)
File size limits enforced by the 20MB Express body limit
CSV column headers validated against expected schema
Invalid rows are skipped with error reporting (imports are partial-failure tolerant)

Error response format

Validation errors return a consistent 400 response:

{
  "statusCode": 400,
  "message": [
    "name should not be empty",
    "email must be an email"
  ],
  "error": "Bad Request"
}

What is not validated

Area	Current state
Request body size	Limited to 20MB by `express.json({ limit: '20mb' })`
URL length	No explicit limit; browser/server defaults apply
Rate limiting	100 requests/minute via `@nestjs/throttler`
SQL injection	Prevented by Prisma’s parameterized queries
XSS	Prevented by React’s default escaping + Helmet headers

Overview

System Architecture

Security

Business Engines

Notifications & Reports

Data

Operations

Engineering

Global validation pipeline

DTO pattern

Validation rules by type

String fields

Numeric fields

Enum fields

Date fields

Nested objects

Arrays

Query parameter validation

File upload validation

Error response format

What is not validated

​Global validation pipeline

​DTO pattern

​Validation rules by type

​String fields

​Numeric fields

​Enum fields

​Date fields

​Nested objects

​Arrays

​Query parameter validation

​File upload validation

​Error response format

​What is not validated

Global validation pipeline

DTO pattern

Validation rules by type

String fields

Numeric fields

Enum fields

Date fields

Nested objects

Arrays

Query parameter validation

File upload validation

Error response format

What is not validated