Why should you care?

MongoDB accepts any BSON shape; bad input must stop at the API boundary.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

import { z } from 'zod';

const createTransferSchema = z.object({
  fromAccountId: z.string().length(24),
  toAccountId: z.string().length(24),
  amountCents: z.number().int().positive().max(10_000_000_00)
});

export function validateCreateTransfer(req: Request, res: Response, next: NextFunction) {
  const parsed = createTransferSchema.safeParse(req.body);
  if (!parsed.success) {
    return res.status(422).json({ code: 'VALIDATION', issues: parsed.error.flatten() });
  }
  req.body = parsed.data;
  next();
}

What happened?

• safeParse returns success flag without throwing.
• flatten gives field errors for Angular forms.
• Parsed data replaces req.body with typed values.

Practice next

1. Define Zod schema mirroring Angular TransferDto.
2. Build validate middleware factory per schema.
3. Return 422 with issues array for UI mapping.
4. Add .refine for from !== to account rule.
5. Generate OpenAPI from same Zod schemas.

Remember

Validate at API edge always. Share schema types with TypeScript infer. 422 responses guide form error display.

Wire fraud prevention

Amount over limit rejected before DB touch.

Outcome: Validator blocks invalid transfers; audit log records attempt.