
koa-bouncer
An http parameter validation library for Koa web apps.
npm install --save koa-bouncer
Inspired by RocksonZeta.
Works best with koa-router for routing.
If you'd like to see how koa-bouncer looks in a real (demo) Koa application,
check out my koa-skeleton repository.
Example
Using koa-router for routing
const Koa = ;const Router =const bouncer = ;const app = ;const router = ;// extends the Koa context with some methodsapp;// POST /users - create user endpointrouterapp;
The general idea
The idea is that koa-bouncer exposes methods that transform and assert against user-input (form submissions, request bodies, query strings) within your routes.
If an assertion fails, then koa-bouncer throws a bouncer.ValidationError
that you can catch upstream. For example, maybe you want to redirect back
to the form, show a tip, and repopulate the form with the user's progress.
If validation succeeds, then you can access the validated/transformed
parameters in a ctx.vals
map that gets populated during validation.
Usage
First, you need to inject bouncer's middleware:
bouncer
This extends the Koa context with these methods for you to use in routes, the bulk of the koa-bouncer abstraction:
ctx.validateParam(key) => Validator
ctx.validateQuery(key) => Validator
ctx.validateBody(key) => Validator
ctx.check(value, [tip]) => throws ValidationError if falsey
ctx.checkNot(value, [tip]) => throws ValidationError if truthy
The first three methods return a validator that targets the value in the url param, query param, or body param that you specified with 'key'.
When you spawn a validator, it immediately populates ctx.vals[key]
with
the initial value of the parameter. You can then chain methods like
.toString().trim().isEmail()
to transform the value in ctx.vals
and
make assertions against it.
Just by calling these methods, they will begin populating ctx.vals
:
router
curl http://localhost:3000/search=> {}curl http://localhost:3000/search?sort=age=> { "sort": "age" }
We can use .required()
to throw a ValidationError when the parameter is
undefined. For example, we can decide that you must always supply a
?keyword= to our search endpoint.
And we can use .optional()
to only run the chained validations/assertions
if the parameter is undefined (not given by user) or if it is an empty
string.
router
curl http://localhost:3000/search=> Uncaught ValidationErrorcurl http://localhost:3000/search?keyword=hello=> { "keyword": "hello", "sort": [] }curl http://localhost:3000/search?keyword=hello&sort=age=> { "keyword": "hello", "sort": ["age"] }curl http://localhost:3000/search?keyword=hello&sort=age&sort=height=> { "keyword": "hello", "sort": ["age", "height"] }
If a validation fails, then the validator throws a bouncer.ValidationError that we can catch with upstream middleware.
For example, we can decide that upon validation error, we redirect the user back to whatever the previous page was and populate a temporary flash object with the error and their parameters so that we can repopulate the form.
app;router;
http --form POST localhost:3000/users=> 302 Redirect to GET /users, message='Username is required'http --form POST localhost:3000/users username=bo=> 302 Redirect to GET /users, message='Username must be 3-15 chars'http --form POST localhost:3000/users username=freeman=> 200 OK, You successfully registered
You can pass options into the bouncer.middleware()
function.
Here are the default ones:
app;
You can override these if the validators need to look in a different place
to fetch the respective keys when calling the validateParam
, validateQuery
,
and validateBody
methods.
You can always define custom validators via Validator.addMethod
:
const Validator = Validator;Validator;
Maybe put that in a custom_validations.js
file and remember to load it.
Now you can use the custom validator method in a route or middleware:
ctx;
These chains always return the underlying validator instance. You can access
its value at any instant with .val()
.
const validator = ctx;console;
Here's how you'd write a validator method that transforms the underlying value:
Validator;
In other words, just use this.set(newVal)
to update the object
of validated params. And remember to return this
so that you can continue
chaining things on to the validator.
Validator methods
.val()
Returns the current value currently inside the validator.
router;
curl http://localhost:3000/search?q=hello&sort=created_at// 200 OK ["hello", "created_at"]
I rarely use this method inside a route and prefer to access
values from the ctx.vals
object. So far I only use it internally when
implementing validator functions.
.required([tip])
Only fails if val is undefined
. Required the user to at least provie
ctx
.optional()
If val is undefined
or if it an empty string (after being trimmed)
at this point, then skip over the rest of the methods.
This is so that you can validate a val only if user provided one.
ctx// Only called if ctx.request.body is `undefined`
ctx// Always called since we are ensuring that val is always defined
Mutating ctx.vals
to define a val inside an optional validator will
turn off the validator's validator.isOptional()
flag.
ctx;ctxvalsemail = 'hello@example.com';ctx; // This will run
You can see the optional state of a validator with its .isOptional()
method:
const validator = ctx;console; //=> truectxvalsemail = 'hello@example.com';console; //=> falsevalidator; // This will run
The reason koa-bouncer considers empty strings to be unset (instead of
just undefined
) is because the browser sends empty strings for
text inputs. This is usually the behavior you want.
Also, note that .required()
only fails if the value is undefined
. It
succeeds on empty string. This is also usually the behavior you want.
.isIn(array, [tip])
Ensure val is included in given array (=== comparison).
ctx
.isNotIn(array, [tip])
Ensure val is not included in given array (=== comparison).
ctx
.defaultTo(defaultVal)
If val is undefined
, set it to defaultVal.
ctx
.isString([tip])
Ensure val is a string.
Note: Also works with strings created via new String()
where typeof new String() === 'object'
.
ctx
It's a good practice to always call one of the .is*
methods since
they add explicit clarity to the validation step.
.isArray([tip])
Ensure val is an Array.
ctx
curl http://localhost:3000/?recipients=joey=> ValidationErrorcurl http://localhost:3000/?recipients=joey&recipients=kate&recipients=max=> 200 OK, ctx.vals => ['joey', 'kate', 'max']
Note: The previous example can be improved with .toArray
.
ctx
curl http://localhost:3000/?recipients=joey=> 200 OK, ctx.vals.recipients => ['joey']curl http://localhost:3000/?recipients=joey&recipients=kate&recipients=max=> 200 OK, ctx.vals.recipients => ['joey', 'kate', 'max']
.eq(otherVal::Number, [tip])
Ensures val === otherVal
.
ctx
.gt(otherVal::Number, [tip])
Ensures val > otherVal
.
ctx
.gte(otherVal::Number, [tip])
Ensures val >= otherVal
.
ctx
.lt(otherVal::Number, [tip])
Ensures val < otherVal
.
ctx
.lte(otherVal::Number, [tip])
Ensures val <= otherVal
.
ctx
.isLength(min:Int, max:Int, [tip])
Ensure val is a number min <= val <= max
(inclusive on both sides).
ctx
.isInt([tip])
Ensures val is already an integer and that it is within integer range
(Number.MIN_SAFE_INTEGER <= val <= Number.MAX_SAFE_INTEGER
).
ctx
.isFiniteNumber([tip])
Ensures that val is a number (float) but that it is not Infinity
.
Note: This uses Number.isFinite(val)
internally. Rather, it does not
use the global isFinite(val)
function because isFinite(val)
first
parses the number before checking if it is finite. isFinite('42') => true
.
ctx// will always fail
.match(regexp::RegExp, [tip])
Ensures that val matches the given regular expression.
You must ensure that val is a string.
ctx
Note: Remember to start your pattern with ^
("start of string") and
end your pattern with $
("end of string") if val is supposed to
fully match the pattern.
.notMatch(regexp::RegExp, [tip])
Ensure that val does not match the given regexp.
You must ensure that val is a string.
Note: It is often useful to chain .notMatch
after a .match
to refine
the validation.
ctx
.check(result, [tip]) and .checkNot(result, [tip])
Unlike most of the other validator methods, .check
and .checkNot
do not
every look at the current val. They only look at the truthy/falseyness of
the result
you pass into them.
.check(result, [tip])
passes ifresult
is truthy..checkNot(result, [tip])
passes ifresult
is falsey.
They are a general-purpose tool for short-circuiting a validation, often based on some external condition.
Example: Ensure username is not taken:
ctx
Example: Ensure that the email system is online only if they provide an email:
ctx
.checkPred(fn, [tip]) and .checkPredNot(fn, [tip])
Pipes val into given fn
and checks the result.
.checkPred(fn, [tip])
ensures thatfn(val)
returns truthy..checkPredNot(fn, [tip])
ensures thatfn(val)
returns falsey.
These methods are general-purpose tools that let you make your own arbitrary assertions on the val.
Example: Ad-hoc predicate function:
ctx
Example: Custom predicate function:
{// ...}ctx
.isAlpha([tip])
Ensures that val is a string that contains only letters a-z (case insensitive).
ctx
.isAlphanumeric([tip])
Ensures that val is a string that contains only letters a-z (case insensitive) and numbers 0-9.
ctx
.isNumeric([tip])
Ensures that val is a string that contains only numbers 0-9.
ctx
.isAscii([tip])
Ensures that val is a string that contains only ASCII characters (https://es.wikipedia.org/wiki/ASCII).
In other words, val must only contain these characters:
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ?
@ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _
` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~
ctx
.isBase64([tip])
Ensures that val is a base64-encoded string.
Note: An empty string (""
) is considered valid.
ctx
.isEmail([tip])
Ensures that val is a valid string email address.
ctx
.isHexColor([tip])
Ensures that val is a hex color string.
Accepts both 6-digit and 3-digit hex colors with and without a leading '#' char.
These are all valid: '#333333'
, '#333'
, 333333
, 333
.
ctx
.isUuid([version::String], [tip])
Ensure that val is a valid uuid string.
version
can be one of 'v3'
, 'v4'
, 'v5'
, 'all'
. default is 'all'
.
koa-bouncer can handle any of these:
.isUuid('v4', 'must be uuid v4');
.isUuid('must be any uuid');
.isUuid('v4');
.isUuid();
router;
.isJson([tip])
Ensures that val is a valid, well-formed JSON string.
Works by simply wrapping JSON.parse(val)
with a try/catch.
ctx
Methods that convert/mutate the val
.set(newVal)
Sets val to arbitrary value newVal
.
Used internally by validator methods to update the value. Can't think of a reason you'd actually use it inside a route.
ctx
curl http://localhost:3000// 200 OK, ctx.vals.test => 42curl http://localhost:3000/?test=foo// 200 OK, ctx.vals.test => 42
Note: .set(42)
is equivalent to .tap(x => 42)
.
.toArray()
Converts val to an array if it is not already an array.
If val is not already an array, then it puts it into an array of one item.
If val is undefined, then sets it to empty array []
.
ctx// Always succeeds
curl http://localhost:3000/// 200 OK, ctx.vals.friends => []curl http://localhost:3000/?friends=joey// 200 OK, ctx.vals.friends => ['joey']curl http://localhost:3000/?friends=joey&friends=kate// 200 OK, ctx.vals.friends => ['joey', 'kate']
.toInt([tip])
Parses and converts val into an integer.
Fails if val cannot be parsed into an integer or if it is out of safe integer range.
Uses parseInt(val, 10)
, so note that decimals and extraneous characters
will be truncated off the end of the value.
ctx
curl http://localhost:3000/?age=42// 200 OK, ctx.vals.age => 42curl http://localhost:3000/?age=-42// 200 OK, ctx.vals.age => -42 (parses negative integer)curl http://localhost:3000/?age=42.123// 200 OK, ctx.vals.age => 42 (truncation)curl http://localhost:3000/?age=42abc// 200 OK, ctx.vals.age => 42 (truncation)curl http://localhost:3000/?age=9007199254740992// ValidationError (out of integer range)
.toInts([tip])
Converts each string in val into an integer.
If val is undefined, sets it to empty array []
.
Fails if any item cannot be parsed into an integer or if any parse into integers that are out of safe integer range.
ctx
curl http://localhost:3000/// 200 OK, ctx.vals.guesses => []curl http://localhost:3000/?guesses=42// 200 OK, ctx.vals.guesses => [42]curl http://localhost:3000/?guesses=42&guesses=100// 200 OK, ctx.vals.guesses => [42, 100]curl http://localhost:3000/?guesses=42&guesses=100&guesses=9007199254740992// ValidationError (out of safe integer range)curl http://localhost:3000/?guesses=abc// ValidationError (one guess does not parse into an int because it is alpha)curl http://localhost:3000/?guesses=1.2345// ValidationError (one guess does not parse into an int because it is a decimal)
.uniq
Removes duplicate items from val which must be an array.
You must ensure that val is already an array.
ctx
curl http://localhost:3000/?nums=42// 200 OK, ctx.vals.nums => [42] curl http://localhost:3000/?nums=42&nums=42&nums=42// 200 OK, ctx.vals.nums => [42]
.toBoolean()
Coerces val into boolean true
| false
.
Simply uses !!val
, so note that these will all coerce into false
:
- Empty string
""
- Zero
0
null
false
undefined
ctx
.toDecimal([tip])
Converts val to float, but ensures that it a plain ol decimal number.
In most application, you want this over .toFloat / .toFiniteFloat.
A parsed decimal will always pass a .isFiniteNumber() check.
ctx// <-- Redundant
.toFloat([tip])
Converts val to float, throws if it fails.
Note: it uses Number.parseFloat(val)
internally, so you will have to
chain isFiniteNumber()
after it if you don't want Infinity
:
Number.parseFloat('Infinity') => Infinity
Number.parseFloat('5e3') => 5000
Number.parseFloat('1e+50') => 1e+50
Number.parseFloat('5abc') => 5
Number.parseFloat('-5abc') => -5
Number.parseFloat('5.123456789') => 5.123456789
Use .toDecimal instead of .toFloat when you only want to allow decimal numbers rather than the whole float shebang.
ctx
.toFiniteFloat([tip])
Shortcut for:
ctx
.toString()
Calls val.toString()
or sets it to empty string ""
if it is falsey.
Note: If val is truthy but does not have a .toString()
method,
like if val is Object.create(null)
, then koa-bouncer will break since this
is undefined behavior that koa-bouncer does not want to make assumptions about.
TODO: Think of a use-case and then write an example.
.trim()
Trims whitespace off the left and right side of val which must be a string.
You almost always use this for string user-input (aside from passwords) since leading/trailing whitespace is almost always a mistake or extraneous.
You do not want to call it on the user's password since space is perfectly legal and if you trim user passwords you will hash a password that the user did not input.
koa-bouncer will break if you do not ensure that val is a string when you
call .trim()
.
ctx;
.fromJson([tip])
Parses val into a JSON object.
Fails if it is invalid JSON or if it is not a string.
ctx
.tap(fn, [tip])
Passes val into given fn
and sets val to the result of fn(val)
.
General-purpose tool for transforming the val.
Almost all the validator methods that koa-bouncer provides are just convenience
methods on top of .tap
and .checkPred
, so use these methods to implement
your own logic as you please.
fn
is called with this
bound to the current validator instance.
tip
is used if fn(val)
throws a ValidationError error.
ctx
curl http://localhost:3000/?direction=WeST=> 200 OK, ctx.vals.direction => 'west'
.encodeBase64([tip])
Converts val string into base64 encoded string.
Empty string encodes to empty string.
ctxvalsmessage = 'hello';ctx; //=> 'aGVsbG8='
.decodeBase64([tip])
Decodes val string from base64 to string.
Empty string decodes to empty string.
ctxvalsmessage = 'aGVsbG8=';ctx; //=> 'hello'
.clamp(min::Number, max::Number)
Defines a number range that val is restricted to. If val exceeds this range in either direction, val is updated to the min or max of the range.
ie. If val < min, then val is set to min. If val > max, then val is set to max.
Note: You must first ensure that val is a number.
router;
curl http://localhost:3000/users// 200 OK, ctx.vals['per-page'] === 50curl http://localhost:3000/users?per-page=25// 200 OK, ctx.vals['per-page'] === 25 (not clamped since it's in range)curl http://localhost:3000/users?per-page=5// 200 OK, ctx.vals['per-page'] === 10 (clamped to min)curl http://localhost:3000/users?per-page=350// 200 OK, ctx.vals['per-page'] === 100 (clamped to max)
Changelog
6.0.0
- Supports Koa 2 by default instead of Koa 1.
5.1.0
- Added
.toFiniteFloat
.
5.0.0
.optional()
now considers empty strings (after trimming) to be unset instead of justundefined
values.
License
MIT