Let’s add some schema validation to our Express application. We’ll start by sketching out our schemas.

const TaskSchema = z.object({
  id: z.string(),
  title: z.string(),
  description: z.string().optional(),
  completed: z.boolean(),
});

const NewTaskSchema = TaskSchema.omit({ id: true, completed: true });
const UpdateTaskSchema = TaskSchema.partial().omit({ id: true });

Validating Our Tasks from the Database

The first step is making sure what we’re getting back from the database is valid.

// Validate the task
const result = TaskSchema.parse(task);

return res.json(result);

It’ll technically blow up—but that’s because SQLite stores our completed boolean as either a 1 or a 0. Luckily, we can coerce it into what we’re expecting.

const TaskSchema = z.object({
  id: z.coerce.number(),
  title: z.string(),
  description: z.string().optional(),
  completed: z.coerce.boolean(),
});

We could also choose to shorten everything like this:

const task = TaskSchema.or(z.undefined()).parse(await getTask.get([id]));

Validating All the Tasks

We can do something similar to /tasks.

const TasksSchema = z.array(TaskSchema);

It’ll now look like this:

app.get('/tasks', async (req: Request, res: Response) => {
  const { completed } = req.query;
  const query = completed === 'true' ? completedTasks : incompleteTasks;

  try {
    const tasks = TasksSchema.parse(await query.all());
    return res.json(tasks);
  } catch (error) {
    return handleError(req, res, error);
  }
});

Adding Schema Validation to the Request Body

We can use NewTaskSchema here.

app.post('/tasks', async (req: Request, res: Response) => {
  try {
    const task = NewTaskSchema.parse(req.body);
    await createTask.run([task.title, task.description]);
    return res.sendStatus(201);
  } catch (error) {
    return handleError(req, res, error);
  }
});

Updating Tasks

Again, there are no suprises here.

app.put('/tasks/:id', async (req: Request, res: Response) => {
  try {
    const { id } = req.params;

    const previous = TaskSchema.parse(await getTask.get([id]));
    const updates = UpdateTaskSchema.parse(req.body);
    const task = { ...previous, ...updates };

    await updateTask.run([task.title, task.description, task.completed, id]);
    return res.sendStatus(200);
  } catch (error) {
    return handleError(req, res, error);
  }
});

Next

• Validating Request Parameters