Who should validate the request data, controller or useCase?

Question

I use the controller to extract data from a request and Use Cases/Interactors to validate the data. But can I use the controller to extract and validate the request data?

Answer 1

That depends upon what you mean by validate. The use case should not be doing things like ensuring a string is actually an integer, that should have been handled previously, but it can do security validation, it SHOULD be doing business validation as well as data integrity validation.

So, for instance if a json or xml string is being passed in, then it should assume that the string has been correctly formatted. But if a database id was passed in, it shouldn’t assume that id is present in the database, that may have been the case when the input for the use case was constructed, but the use case doesn’t know how long ago that was and what has happened since. Of course as the programmer, you may know and judge verifying that as a waste of time, and that’s fine it’s your choice, but it’s not inherent to the use case design.

The same situation can apply to access privileges, you can check before or in or both and it’s all OK, that’s just design decisions you’ve made.

Input on the the other hand, should be assumed to have been validated and to say what it is supposed to say — that may not be acceptable due to some business requirement, but it should be correct. For instance, a desired process state (pending, completed, approved) can be expected to be a valid state, not random junk, but that doesn’t mean the state will be accepted, perhaps there is a missing email address or an amount is too high or low.