Best place to handle data validation with mongoose and express

Question

Maybe there is not a definitive answer here but I would like to know where to handle data validation when dealing with express.js and mongoose. Which of the following is the best practice (I currently use a combination and it's starting to feel very clumsy):

1. the Model (mongoose)
2. the Controller / Route (express)

Some older posts I have read are:

• this;
• this;
• and, this;

but conflicting answers just add to the confusion. Maybe it simply isn't clear cut, in which case is one a better option?

Answer 1

When using mongoose I would push most of my validation logic to the mongoose model/schema. You can use mongoose-validator which is just a wrapper around node-validator for simple model validation. If you need validation against other models or more complex logic in the validation you can write your own custom mongoose pre validate or post validate hook (see mongoose middleware).

An additional benefit you gain when using mongoose to validate your model is that mongoose adds an error property to your model which can be accessed via model.errors[property]. This property can be used for validation error messages on the web or for a service client.

When writing more/very complex software tying the validation to the model may become a problem. But I'd deal with this problem when it arises. Since JavaScript has functions as first class citizens your validation functions still can be reused even in these complex situations.

Answer 2

The mongoose validator is a great place to start on a model level, but if you need to have controller specific validation, I use the following code in a utils.js file:

var async = require('async')
exports.validator = function (reqProps, props, mongoEnt, next) {
    var propsErr = [];
    var mongoErr = {};

    async.parallel([function (cb) {
        reqProps.forEach(function (rp) {
            if (!props[rp])propsErr.push(rp);
        })
        cb()
    }, function (cb) {
        if (mongoEnt != null) {
            var test = new mongoEnt(props);

            test.validate(function (err) {
                mongoErr = err;
                cb();
            });
        } else {
            mongoErr = null;
            cb();
        }
    }], function (err, result) {
        if (propsErr.length != 0) {
                return next(new Error('The following props were not included: ' + propsErr));
        } else if(mongoErr != null) {
                return next(new Error('The following prop was not included: ' +mongoErr.errors[Object.keys(mongoErr.errors).pop()].path));
        } else {
            return next(null);
        }
    })
}

This allows me to both validate using the mongoose validator and check for the additional props that I include in the reqProps property in one line of code. Though this is only checking for required properties, you could easily extend it for your own validation scheme.

An example of usage for this code:

var Person = mongoose.model('Person')

exports.addUSCitizen = function(props, next){ 
    utils.validator(['ssn'], props, Person, function (err) {
        if(err) return next(err);
        //do something using props.ssn
    })
}