Expresskit validator

[sjorobekov]

ExpressKit Validator

Validation framework for ExpressKit that provides:

1. Request Validation - Validate request body, params, query, and headers
2. Response Serialization - Validate and filter response data
3. Swagger Documentation - Auto-generate OpenAPI specs from schemas
4. Zod v4 Integration - Use Zod schemas for validation

Features

• ✅ Type-Safe: Full TypeScript inference from Zod schemas
• ✅ Async Support: Handles sync, async, and conditional data
• ✅ Serialized data typesafety: Serialized data should follow response data schema

TODO

• Make automatic validation of request, so req.body will be already validated in a handler
• Request validation
• Response type check
• Reponse Serialization
• Swagger integration
• AuthMiddleware to swagger
• Cache swagger final json schema
• Tests
• Allow customization of request type (json, form-data,etc)
• Allow customization of response type from controller
• Cache schemas
• Customize validation error response

[imsitnikov]

Maybe we should leave control over the 204 code to consumers?

[imsitnikov]

Calculating openApiSchema can take a long time and block the application from starting. Is it possible to wrap these lines in setImmediate(...)?

[sjorobekov]

now schema is calculated on route add to registry

[imsitnikov]

Does it work correctly with global declared appAuthHandler?

[sjorobekov]

yes

[imsitnikov]

sendTyped is still not the best name.

I'm not sure if patching the original res.send() is acceptable here, but if it is, I suggest the following naming:

• res.send() – for static type checking (now res.sendTyped()).
• res.sendOriginal() – for original method (now res.send()).
• res.sendValidated() – without any changes.

Or use res.contract.send() and res.contract.sendValidated().

@resure what do you think about this?

[resure]

The original express method should not be patched. Such an override can have a lot of side effects and is probably not worth it.

res.contract.send()

I'm not 100% sure if this is better than sendTyped, but maybe it could be a logical way to move all new helpers to new namespaces (req.contract., res.contract.). The only worry is that it might look pretty long that way.

[sjorobekov]

@imsitnikov @resure what you think about having semantic methods: req.ok(data), req.created(data), req.badRequest(data), etc, depending on what is defined in schema? They will have static validation.
And probably req.ok.validated(data) for dynamic validation?

[imsitnikov]

Looks like additional pollution of the req object, and one method will be easier to maintain than many.
Overall, I'm okay with res.contract.send() or res.sendTyped(), but I'm not the decision maker here.