Input Validation and Rejecting Bad Requests

Required tools

• Node.js (20.x or 22.x LTS)
• npm (10.x (bundled with Node.js))

Setup

1. Reuse the `learning-api` project from the Express setup lab earlier in this course.
2. Add a new file `src/errors.js` with the AppError class below.
3. Update `src/routes/enrollments.routes.js` and `src/server.js` per the starter files below.
4. Restart the server with `node src/server.js`.

Project structure

learning-api/
  src/
    server.js (updated: registers the error handler last)
    errors.js (new)
    routes/
      courses.routes.js
      enrollments.routes.js (updated: validates input)

Starter files

export class AppError extends Error {
  constructor(status, code, message, fields) {
    super(message);
    this.status = status;
    this.code = code;
    this.fields = fields;
  }
}

import { Router } from "express";
import { AppError } from "../errors.js";

const router = Router();
const ENROLLMENTS = [];

function validateEnrollment(body) {
  const errors = {};
  if (typeof body.courseId !== "number") errors.courseId = "courseId must be a number";
  if (typeof body.status !== "string" || !["active", "completed"].includes(body.status)) {
    errors.status = "status must be 'active' or 'completed'";
  }
  return errors;
}

router.get("/", (req, res) => {
  res.json(ENROLLMENTS);
});

router.post("/", (req, res, next) => {
  // TODO: validate req.body with validateEnrollment. If there are errors,
  // call next(new AppError(400, "VALIDATION_ERROR", "Invalid enrollment", errors))
  // instead of responding directly. Otherwise create and respond 201 as before.
  const enrollment = { id: ENROLLMENTS.length + 1, ...req.body };
  ENROLLMENTS.push(enrollment);
  res.status(201).json(enrollment);
});

export default router;

import express from "express";
import coursesRouter from "./routes/courses.routes.js";
import enrollmentsRouter from "./routes/enrollments.routes.js";

const app = express();
app.use(express.json());

app.use("/courses", coursesRouter);
app.use("/enrollments", enrollmentsRouter);

// TODO: add a centralized error-handling middleware HERE, after all routes.
// It must have exactly 4 parameters: (err, req, res, next).

const PORT = 3001;
app.listen(PORT, () => {
  console.log("Learning API listening on port " + PORT);
});

Requirements

• POST /enrollments rejects an invalid body with status 400 and a structured error body naming the invalid fields
• The error-handling middleware is registered ONCE, after all routes, with exactly 4 parameters
• A valid POST /enrollments request still succeeds with 201, unaffected by the new validation
• No route handler contains its own ad hoc try/catch that duplicates the centralized error response shape

Commands to run

• Start the server

  node src/server.js

• Test invalid input

  curl -i -X POST http://localhost:3001/enrollments -H "Content-Type: application/json" -d "{}"

Expected behavior

POST /enrollments with an empty or malformed body responds 400 with { error: { code: 'VALIDATION_ERROR', fields: {...} } } naming every invalid field. A well-formed body still responds 201 as before.

Verify it yourself

• curl -i -X POST http://localhost:3001/enrollments -H "Content-Type: application/json" -d "{}"

  Expected: HTTP 400 with a body naming both courseId and status as invalid

• curl -i -X POST http://localhost:3001/enrollments -H "Content-Type: application/json" -d "{\"courseId\":1,\"status\":\"active\"}"

  Expected: HTTP 201 with the created enrollment, exactly as before adding validation

Troubleshooting

• The error-handling middleware never runs, even after calling next(new AppError(...)) — Confirm the error-handling middleware is registered with app.use() AFTER every route, and that it has exactly 4 parameters (err, req, res, next) — Express identifies error handlers by that specific arity.
• Calling next(err) causes the default Express error page to appear instead of the JSON response — This means the centralized handler either isn't registered, or is registered before some routes — move it to the very end of server.js, after all app.use() route registrations.

Extension challenge

Add validation to the courses route's (hypothetical) POST endpoint too, reusing the same AppError and centralized handler, to confirm the error handling genuinely works across more than one route without duplication.