06-dto-and-validation

What problem does it solve?

Input validation is a security boundary, not optional polish. A DTO (Data Transfer Object) is specifically designed to carry data across layers — it is not a domain model and not a persistence entity. This skill focuses on allowlisting fields, validating types and formats, and enforcing safe input before it touches business logic.

Core Features & Use Cases

• Separate create, update, and query contracts to enforce different validation rules.
• Prevent client from setting protected fields like id, role, createdAt, or updatedAt.
• Provide deterministic, per-field validation errors at the boundary to improve API reliability.

Quick Start

Define separate CreateDto and UpdateDto contracts, exclude fields like id, role, createdAt, and updatedAt, and wire controller-level validation to return 400 on invalid input.