Input Safety

// src/users/dto/create-user.dto.ts
import { Type } from 'class-transformer';
import {
  IsEmail,
  IsInt,
  IsOptional,
  IsString,
  Length,
  Max,
  Min,
  ValidateNested,
} from 'class-validator';

class AddressDto {
  @IsString()
  @Length(1, 120)
  line1!: string;

  @IsString()
  @Length(2, 2)
  country!: string;
}

export class CreateUserDto {
  @IsEmail()
  email!: string;

  @IsString()
  @Length(12, 200) // an upper bound too: hashing a 1MB password is a DoS
  password!: string;

  @IsOptional()
  @IsInt()
  @Min(13)
  @Max(130)
  age?: number;

  // Nested objects are NOT validated without both of these. @Type() tells
  // class-transformer which class to build, @ValidateNested() tells
  // class-validator to walk into it - and whitelist only strips unknown
  // properties inside an object it was told to walk into.
  @ValidateNested()
  @Type(() => AddressDto)
  address!: AddressDto;

  // No decorator on purpose: with whitelist: true this property is
  // stripped from every request, so a caller cannot set their own role.
  // role?: string;
}

// src/webhooks/webhooks.module.ts
import { Module } from '@nestjs/common';
import { HttpClientModule } from '@nestjs/http-client';
import { CallbackService } from './callback.service.js';

@Module({
  imports: [
    // A client with a baseUrl only sends requests to that origin: an
    // absolute URL on another host throws before anything leaves the
    // process. That is what keeps a body value from pointing this
    // client's API key at 169.254.169.254 or at an internal admin port.
    HttpClientModule.register({
      name: 'partner',
      baseUrl: 'https://hooks.partner.example.com',
      headers: { 'x-api-key': process.env.PARTNER_API_KEY! },
      timeout: '5s',
      // fetch drops authorization and cookie when it follows a redirect
      // to another origin, but not a custom header like x-api-key.
      // 'error' fails with HttpNetworkError instead of leaking the key.
      redirect: 'error',
    }),
  ],
  providers: [CallbackService],
})
export class WebhooksModule {}

// src/webhooks/callback.service.ts
import { Injectable } from '@nestjs/common';
import { HttpClient, InjectHttpClient } from '@nestjs/http-client';

@Injectable()
export class CallbackService {
  constructor(
    @InjectHttpClient('partner') private readonly partner: HttpClient,
  ) {}

  async notify(tenantId: string, event: unknown) {
    // Request values go in params, never into the path by interpolation.
    // params fills the :name segments URI-encoded, and a value that would
    // move the request elsewhere ('', '.', '..') throws.
    await this.partner.post('/tenants/:tenantId/events', {
      params: { tenantId },
      json: event,
    });
  }
}

// src/products/dto/find-products.query.ts
import { Type } from 'class-transformer';
import { IsIn, IsInt, IsOptional, IsUUID, Max, Min } from 'class-validator';

export class FindProductsQuery {
  // Query and path values always arrive as strings. With transform: true
  // the declared type drives the conversion; @Type() makes it explicit
  // and survives a later change to the global pipe options.
  @IsOptional()
  @Type(() => Number)
  @IsInt()
  @Min(1)
  @Max(100) // the cap that stops ?limit=1000000 from scanning the table
  limit?: number = 20;

  @IsOptional()
  @Type(() => Number)
  @IsInt()
  @Min(0)
  offset?: number = 0;

  // An allowlist, because this value reaches an ORDER BY clause.
  @IsOptional()
  @IsIn(['name', 'price', 'createdAt'])
  sort?: string = 'createdAt';
}

// src/products/dto/product-params.ts
export class ProductParams {
  // Constrain the id too. It reaches the database, a cache key, and
  // sometimes a file path.
  @IsUUID('4')
  id!: string;
}

// src/products/products.controller.ts
import { Controller, Get, Param, Query } from '@nestjs/common';
import { ProductsService } from './products.service.js';
import { FindProductsQuery } from './dto/find-products.query.js';
import { ProductParams } from './dto/product-params.js';

@Controller('products')
export class ProductsController {
  constructor(private readonly products: ProductsService) {}

  @Get()
  findAll(@Query() query: FindProductsQuery) {
    return this.products.findAll(query);
  }

  // @Param() with no argument hands the whole params object to the pipe,
  // which is what lets ProductParams validate it. @Param('id') would
  // give the pipe a bare string and the @IsUUID() would never run.
  @Get(':id')
  findOne(@Param() params: ProductParams) {
    return this.products.findOne(params.id);
  }
}