Controller Integration and Validation Pipeline

Controller Integration & Validation Pipeline Attach schemas to @Body and @Param and keep controllers/services focused

Phase 12 - DTOs, Zod & Input Validation Volume 04 - Professional Backend

Architecture milestone Fastify request

↓

Nest parameter extraction

↓

schema validation

↓

controller

↓

service

Phase 12 introduces an explicit runtime validation boundary before controller and service logic.

Attach schemas to controller parameters NestJS 12 route parameter decorators can carry Standard Schema metadata. The controller remains concise because validation is declared where the data enters the handler.

import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, Patch, Post, } from "@nestjs/common"; import { TasksService } from "./tasks.service"; import { createTaskSchema, CreateTaskDto, taskIdSchema, updateTaskSchema, UpdateTaskDto, } from "./tasks.schemas";

@Controller("tasks")
export class TasksController {
constructor(private readonly tasksService: TasksService) {}

@Post() create( @Body({ schema: createTaskSchema }) body: CreateTaskDto, ) { return this.tasksService.create(body); }

@Get() findAll() { return this.tasksService.findAll(); }

@Get(":id") findOne( @Param("id", { schema: taskIdSchema }) id: string, ) { return this.tasksService.findOne(id); }

@Patch(":id")
update(
@Param("id", { schema: taskIdSchema }) id: string,
@Body({ schema: updateTaskSchema }) body: UpdateTaskDto,
) {
return this.tasksService.update(id, body);
}

@Delete(":id")
@HttpCode(HttpStatus.NO_CONTENT)
async remove(
@Param("id", { schema: taskIdSchema }) id: string,
) {
await this.tasksService.remove(id);
}
}

Read the create route in English

@Post() create( @Body({ schema: createTaskSchema }) body: CreateTaskDto, ) { return this.tasksService.create(body); }

• @Post() maps POST /tasks.

• @Body(...) extracts the JSON body.

• schema: createTaskSchema attaches the runtime contract.

• the global StandardSchemaValidationPipe parses the value before the method runs.

• CreateTaskDto documents the validated output type at compile time.

• TasksService receives already validated request shape data.

Path parameters need validation too HTTP path parameters arrive as strings. A malformed task identifier should be rejected before Prisma receives a query for it.

@Get(":id") findOne( @Param("id", { schema: taskIdSchema }) id: string, ) { return this.tasksService.findOne(id); }

Figure 1 - Invalid UUID short-circuit GET /tasks/not-a-uuid

↓

taskIdSchema fails

↓

400 Bad Request

↓

TasksService is not called

↓

Prisma is not queried

Validation reduces unnecessary database work and creates a clearer client error.

The service becomes simpler The service no longer needs to defend against “title is a boolean” or “projectId is an object.” Its remaining responsibilities are business/application behavior and persistence orchestration.

Boundary concern Owner after Phase 12

JSON shape / primitive type Zod schema

UUID syntax Zod schema

Task status vocabulary Zod schema

Does Project actually exist? TasksService

Does Task actually exist? TasksService / Prisma error mapping

Foreign key integrity PostgreSQL