zod VS class-validator

If you are coming from JavaScript or TypeScript, this is what you are used to do with JSON.parse and zod. And you are right, in Haskell, this is quite verbose and boilerplate-driven. But it is quite principled and type-safe. For example, you can parse and map, but cannot perform IO operations when defining your ToJSON and FromJSON instances. Also, you cannot have multiple JSON representations of the same data type (so-called type-class instance coherence in Haskell). You need newtype wrappers for that:

Author here. I wrote a fairly detailed writeup here[0] for those who are interested in the reasons for this approach.

Ultimately you're right that npm doesn't work well to manage the situation Zod finds itself in. But Zod is subject to a bunch of constraints that virtually no other libraries are subject to. There are dozens or hundreds of libraries that directly import interfaces/classes from "zod" and use them in their own public-facing API.

Since these libraries are directly coupled to Zod, they would need to publish a new major version whenever Zod does. That's ultimately reasonable in isolation, but in Zod's case it would trigger a "version avalanche" would just be painful for everyone involved. Selfishly, I suspect it would result in a huge swath of the ecosystem pinning on v3 forever.

The approach I ended up using is analogous to what Golang does. In essence a given package never publishes new breaking versions: they just add a new subpath when a new breaking release is made. In the TypeScript ecosystem, this means libraries can configure a single peer dependency on zod@^3.25.0 and support both versions simultaneously by importing what they need from "zod/v3" and "zod/v4". It provides a nice opt-in incremental upgrade path for end-users of Zod too.

[0] https://github.com/colinhacks/zod/issues/4371

There are libraries that let you define refinement types[0] but it does require a bit of runtime overhead, and the added complexity depends on the library.

[0] https://zod.dev/?id=refine as an example

Zod Documentation

Use libraries like Joi or Zod to validate the chaos

Zod - https://zod.dev/

@apexjs-org/openapi is an OpenAPI 3.1+ description library for TypeScript. You can use this package to easily create a type-safe OpenAPI (Swagger) description with Zod schema support in Node.js. In this tutorial, we use express-openapi-validator to bring the OpenAPI description to life with automatic validation and request handling.

note: In the boilerplate we used zod but you can use any other similare libraries for this part.

I'm a big fan of Zod and find it the best choice regarding the ecosystem and developer experience it provides. Although, despite its large size, it's tailored more toward the frontend world. If you're developing a backend or an application with high throughput, you should definitely give Sury a try.

In this project, we take a code-first approach when working with Firestore. Instead of relying on Firestore rules or ad-hoc validation, we define the shape and structure of a valid message directly in our application code using Zod.

class-validator is a powerful library that allows you to apply constraints and validations on class properties. It’s beneficial in various scenarios, especially for validating user inputs in your applications. Using decorators, you can easily express validation rules, enabling your code to be more readable and maintainable.

Class Validator Documentation

In 14.03.2022 I asked a question1 in class-validator repo about throwing an error when a user sends multiple data while we're gonna allow them to only send one of them.

You can learn more from the documentation here.

This is the request body when creating a new task. The IsString decorator provided by class-validator rejects all types other than strings, including undefined or null. The task name value object does not consider the possibility of values other than strings.

In this class, we are using the famous class-validator to decorate our request parameters. This way it is more clear how we are going to use our request object and everything.

We add validation using https://github.com/typestack/class-validator.

I will make sure we get this documented.

Also OP can check out class-transformer + class-validator if he want to properly instantiate objects and validate them with precise and verbose output of potential format errors. OP can even go the god tier way by setting up a custom RxJS operator that does that for him easily.

Start by installing the class-transformer and class-validator packages for dto validation (see more in the docs), sharp for image optimization, and the S3 client packages.