Best practices for Data Validation in Node.js MVC Architecture

[WUKLH]

Hello,

I'm seeking guidance on best practices for data validation in Node.js, especially in the context of an MVC architecture. My main questions are:

1. Is it generally preferable to utilize schema-based validation (using packages like Joi, express-validator, etc.) over custom validation code? For instance, here's an excerpt from our codebase where validation logic is implemented within a model file:

async validateImport(isUpdate: boolean): Promise<{ isValid: boolean, message?: string }> {
        if (this.userId && typeof (this.userId) != 'number' || Number.isNaN(this.userId)) {
            return { isValid: false, message: "invalid userId, must be a number" };
        }

        if (!this.employeeId) {
            return { isValid: false, message: "missing employee ID" };
        }

        if (!this.validateEmployeeId(this.employeeId)) {
            return { isValid: false, message: "employee ID invalid format" };
        }

        if (typeof (this.email) != 'string') {
            return { isValid: false, message: "email not a string" };
        }

        if (!this.email) {
            return { isValid: false, message: "missing email" };
        }

       
        return { isValid: true };
    }

This approach works, but I'm wondering if it's less advisable compared to using a schema, which might be more readable and maintainable. Are there scenarios where custom validation like this is more suitable, especially when dealing with complex or highly specific validation requirements?

2. Should the validation logic be kept separate from the models in an MVC framework? Our current setup has the validation within the model files, and I'm considering whether it's more effective to abstract it out, perhaps like this:

src
├── controller
├── routes
├── models
└── validation
    └── user.validation.ts

Discussion, experiences and thoughts would be greatly appreciated!

Thanks

[opjarretop]

@WUKLH I've found using a library like Joi or Zod tends to scale a lot easier. There is nothing stopping you from creating custom validation when needed. Custom validation is a valid option and it really depends on your use case.