DTOs, Zod & Input Validation

TaskFlow Phase 12 validation reference snapshot

This snapshot focuses only on the files changed by the validation phase.
It assumes the Phase 11 Prisma schema, seed, PrismaService, TasksModule, and database configuration already exist.

Run from apps/api:
  pnpm add zod@4.6.5
  pnpm run build
  pnpm run start:dev

Then run the PowerShell smoke tests in reference/tests/validation-smoke-tests.ps1.

{
  "dependencies": {
    "zod": "4.6.5"
  }
}

import { StandardSchemaValidationPipe } from "@nestjs/common";
import { NestFactory } from "@nestjs/core";
import {
  FastifyAdapter,
  NestFastifyApplication,
} from "@nestjs/platform-fastify";
import { AppModule } from "./app.module";

async function bootstrap() {
  const app = await NestFactory.create<NestFastifyApplication>(
    AppModule,
    new FastifyAdapter(),
  );

  app.useGlobalPipes(new StandardSchemaValidationPipe());

  app.enableCors({
    origin: "http://localhost:3000",
  });

import {
  Body,
  Controller,
  Delete,
  Get,
  HttpCode,
  HttpStatus,
  Param,
  Patch,
  Post,
} from "@nestjs/common";
import { TasksService } from "./tasks.service";
import {
  createTaskSchema,
  CreateTaskDto,
  taskIdSchema,
  updateTaskSchema,
  UpdateTaskDto,
} from "./tasks.schemas";

import { z } from "zod";
import {
  TaskPriority,
  TaskStatus,
} from "../generated/prisma/client";

const taskTitleSchema = z
  .string()
  .trim()
  .min(1)
  .max(200);

const taskDescriptionSchema = z
  .string()
  .trim()
  .max(2000)
  .nullable();

export const taskIdSchema = z.uuid();

import {
  Injectable,
  NotFoundException,
} from "@nestjs/common";
import { Prisma } from "../generated/prisma/client";
import { PrismaService } from "../prisma/prisma.service";
import {
  CreateTaskDto,
  UpdateTaskDto,
} from "./tasks.schemas";

@Injectable()
export class TasksService {
  constructor(private readonly prisma: PrismaService) {}

  findAll() {
    return this.prisma.task.findMany({
      orderBy: { createdAt: "desc" },
    });
  }

# Run from any PowerShell terminal while apps/api is running.

$base = "http://localhost:4000"
$projectId = "<PROJECT-ID-FROM-PHASE-11-SEED>"

# Valid create
$validCreate = @{
  projectId = $projectId
  title = "Validate TaskFlow input"
  description = "Created through a Zod-validated endpoint."
} | ConvertTo-Json

Invoke-RestMethod `
  -Method Post `
  -Uri "$base/tasks" `
  -ContentType "application/json" `
  -Body $validCreate

# Invalid: blank title
$blankTitle = @{