Robust Server-Side Input Validation with Joi

const express = require('express');
const Joi = require('joi'); // npm install joi
const app = express();

app.use(express.json()); // Middleware to parse JSON request bodies

// Define a Joi schema for user registration data
const userRegistrationSchema = Joi.object({
  username: Joi.string()
    .alphanum()
    .min(3)
    .max(30)
    .required()
    .messages({
      'string.alphanum': 'Username must contain only alphanumeric characters',
      'string.min': 'Username must be at least {#limit} characters long',
      'string.max': 'Username cannot exceed {#limit} characters',
      'any.required': 'Username is required'
    }),
  email: Joi.string()
    .email({
      minDomainSegments: 2, tlds: { allow: ['com', 'net', 'org'] }
    })
    .required()
    .messages({
      'string.email': 'Please provide a valid email address',
      'any.required': 'Email is required'
    }),
  password: Joi.string()
    .pattern(new RegExp('^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$'))
    .required()
    .messages({
      'string.pattern.base': 'Password must be at least 8 characters, include uppercase, lowercase, number, and special character',
      'any.required': 'Password is required'
    }),
  age: Joi.number()
    .integer()
    .min(18)
    .max(100)
    .optional()
});

// Route for user registration
app.post('/register', async (req, res) => {
  try {
    // Validate the request body against the schema
    const validatedData = await userRegistrationSchema.validateAsync(req.body, { abortEarly: false });
    // If validation passes, processedData contains the valid input
    console.log('User data is valid:', validatedData);
    res.status(200).json({ message: 'User registered successfully!', user: validatedData });
  } catch (error) {
    // If validation fails, return a 400 Bad Request with error details
    console.error('Validation Error:', error.details);
    res.status(400).json({ error: error.details.map(d => d.message) });
  }
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});