Writing a web application we have many places where validation takes (or potentially could take) place: - front-end application form - front-end application service - back-end application view function - ORM object
It would be nice to make sure that front-end form validation matches back-end data format expected by back-end and finally that it matches ORM expected format.
Example: Let's say we have a registration form and I want the "username" to meet some requirements:
- min length
- max length
- no space
- no special characters
My question is: Should my ORM model reflect those requirements? Should I use some validator on my model to make sure that if I create a database object User and set its username field then it raises validation error if it does not conform mentioned conditions? Or maybe it is related to business logic and should not be checked at this level?
The thing is that I would like to have consistent validation across my application. I.e. if I have a limitation to the number of characters in username than I would like to have the same limitation in my JSON schema protocol to correctly validate API requests and later to have the same "constraint" on DB ORM object. Currently, I have defined schema that I use to test: - front-end registration form - front-end outgoing requests (from the front-end to the back-end API) - back-end input requests
What I've left are ORM objects. But I wonder what level of validation should I have on ORM objects. Can I assume that if an object passes validation against JSON schema then it should pass ORM object validation?
An example against it: Let's assume I don't want to allow the user to set a weak password on registration but I'd like to have an admin view that can set any password.