0Pricing
NestJS Enterprise Backend APIs · レッスン

ネストしたDTOと配列のValidation

@ValidateNested、@Type、whitelist strippingを使って、ネストしたオブジェクトとコレクションを検証します

「ネストしたDTOと配列のValidation」はCoddyKit上の無料NestJS Enterprise Backend APIsレッスンです。 これはレッスン1/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはNestJS Enterprise Backend APIs学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 NestJS Enterprise Backend APIsコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Why Nested Validation Needs Help

NestJS pairs class-validator with class-transformer through the global ValidationPipe. For flat DTOs this works out of the box: decorators on each property run automatically.

But the moment a DTO contains another object or an array of objects, validation silently stops at the boundary. The validator sees a child property, but it does not know it is a class instance whose own decorators should run.

  • A nested address object is treated as an opaque value.
  • An items array is checked for being an array, but its elements are never validated.

This lesson shows how @ValidateNested, @Type, and whitelist stripping close those gaps.

The Problem in Code

Consider an order payload with a nested address. Adding @ValidateNested alone is not enough — the validator still needs the child to be an actual AddressDto instance, not a plain object.

Without @Type, class-transformer leaves address as a plain object, so the @IsString() on city never runs. Invalid data passes through unnoticed.

import { IsString, ValidateNested } from 'class-validator';

// AddressDto's own rules will NOT run yet
class AddressDto {
  @IsString()
  city: string;
}

export class CreateOrderDto {
  @ValidateNested() // declares intent, but lacks a target type
  address: AddressDto;
}

@Type Makes the Child a Real Instance

The missing piece is @Type(() => AddressDto) from class-transformer. It tells the transformer how to construct the nested value, turning the raw JSON object into a true AddressDto instance.

Only then do the child's decorators (@IsString, @IsNotEmpty, etc.) actually execute. The rule of thumb:

  • @ValidateNested() → "recurse into this property".
  • @Type(() => Child) → "build it as this class first".

You almost always need both together.

import { IsString, IsPostalCode, ValidateNested } from 'class-validator';
import { Type } from 'class-transformer';

class AddressDto {
  @IsString()
  city: string;

  @IsPostalCode('US')
  zip: string;
}

export class CreateOrderDto {
  @ValidateNested()
  @Type(() => AddressDto)
  address: AddressDto;
}

Enabling transform in the Pipe

For @Type to take effect, the ValidationPipe must run class-transformer. Enable it globally with transform: true.

This also converts primitives: a route param string '42' becomes a number when the DTO/param type says so. Without transform, nested classes stay plain and your @Type hints are ignored.

import { ValidationPipe } from '@nestjs/common';
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.useGlobalPipes(
    new ValidationPipe({
      transform: true, // run class-transformer (required for @Type)
      whitelist: true,
      forbidNonWhitelisted: true,
    }),
  );
  await app.listen(3000);
}
bootstrap();

Validating Arrays of DTOs

Arrays of objects need the same pair, with one addition: each: true. This makes @ValidateNested({ each: true }) apply the nested validation to every element of the array.

@Type(() => ItemDto) maps each raw element into an ItemDto instance. Add @IsArray() and optionally @ArrayMinSize(1) to guard the collection shape itself.

import { IsArray, ArrayMinSize, IsString, IsInt, Min, ValidateNested } from 'class-validator';
import { Type } from 'class-transformer';

class OrderItemDto {
  @IsString()
  sku: string;

  @IsInt()
  @Min(1)
  quantity: number;
}

export class CreateOrderDto {
  @IsArray()
  @ArrayMinSize(1)
  @ValidateNested({ each: true }) // validate every element
  @Type(() => OrderItemDto)
  items: OrderItemDto[];
}

Deeply Nested Structures

The pattern composes to any depth. An order has items, and each item has its own nested discount. Each level that crosses into another class repeats the @ValidateNested + @Type pair.

Validation recurses top-down: the order validates its items array, each item validates its discount object, and every leaf decorator runs. There is no special "deep" flag — you just apply the same two decorators at each boundary.

import { ValidateNested, IsString, IsNumber, Max, Min } from 'class-validator';
import { Type } from 'class-transformer';

class DiscountDto {
  @IsNumber()
  @Min(0)
  @Max(1)
  rate: number;
}

class OrderItemDto {
  @IsString()
  sku: string;

  @ValidateNested()
  @Type(() => DiscountDto)
  discount: DiscountDto;
}

export class CreateOrderDto {
  @ValidateNested({ each: true })
  @Type(() => OrderItemDto)
  items: OrderItemDto[];
}

whitelist Strips Unknown Properties

whitelist: true removes any property in the incoming payload that has no validation decorator on the DTO. This is a core security defense: clients cannot smuggle extra fields like isAdmin or role into your entities.

Crucially, whitelisting works recursively on validated nested objects. If a nested AddressDto only declares city and zip, an injected country field on the nested object is stripped too — but only because @ValidateNested + @Type made the validator descend into it.

forbidNonWhitelisted: Reject vs Strip

There are two postures for unknown fields:

  • whitelist: true — silently strips unknown properties and continues.
  • whitelist + forbidNonWhitelisted: true — rejects the whole request with 400, listing the offending property.

For public APIs, forbidding is stricter and surfaces client mistakes early. Note that forbidNonWhitelisted only has an effect when whitelist is also enabled.

// Payload: { "city": "Austin", "zip": "73301", "hack": "x" }

// whitelist: true (only)
//   -> { city: 'Austin', zip: '73301' }  // 'hack' stripped

// whitelist: true + forbidNonWhitelisted: true
//   -> 400 Bad Request
//   -> message: ["property hack should not exist"]

A Pure class-validator Example You Can Run

Outside NestJS, the same engine works directly. This standalone snippet builds a nested instance with plainToInstance and validates it with validateSync — exactly what the ValidationPipe does internally.

Run it to see how @ValidateNested + @Type surface a nested error.

import 'reflect-metadata';
import { IsString, IsInt, Min, ValidateNested, validateSync } from 'class-validator';
import { plainToInstance, Type } from 'class-transformer';

class ItemDto {
  @IsString() sku!: string;
  @IsInt() @Min(1) quantity!: number;
}

class OrderDto {
  @ValidateNested({ each: true })
  @Type(() => ItemDto)
  items!: ItemDto[];
}

const payload = { items: [{ sku: 'A1', quantity: 0 }] };
const dto = plainToInstance(OrderDto, payload);
const errors = validateSync(dto);

console.log(JSON.stringify(errors[0].children[0].children, null, 2));

Optional and Nullable Nested Objects

A nested object that may be absent should be marked @IsOptional(). When present, it is still validated; when missing, it is skipped. Combine this with @ValidateNested and @Type as usual.

For arrays, @IsOptional() lets the whole array be omitted, while @ArrayMinSize still enforces a minimum once the array is provided. Keep each: true so present elements remain validated.

import { IsOptional, ValidateNested, IsString } from 'class-validator';
import { Type } from 'class-transformer';

class BillingDto {
  @IsString()
  taxId: string;
}

export class UpdateAccountDto {
  @IsOptional()
  @ValidateNested()
  @Type(() => BillingDto)
  billing?: BillingDto;
}

Common Pitfalls

Watch for these failures, which all let bad data through silently:

  • Forgetting @Type — nested object stays plain; child decorators never run.
  • Forgetting transform: true — the pipe never invokes class-transformer, so @Type is ignored.
  • Missing each: true on arrays — only the first/whole array is checked, not each element.
  • No reflect-metadata import — decorators emit no metadata; validation no-ops.
  • Disabling whitelist — unknown fields flow straight into your service layer.

Quick Check

You have an array of nested DTOs to validate. Which combination is required?

Recap

You now know how to validate nested and array DTOs in NestJS:

  • @ValidateNested() tells the validator to recurse into a child object; add { each: true } for arrays.
  • @Type(() => Child) from class-transformer turns raw JSON into real class instances so child decorators run.
  • transform: true on the ValidationPipe is mandatory for @Type to take effect.
  • whitelist: true strips undeclared properties recursively; forbidNonWhitelisted: true rejects them with a 400 instead.
  • Always import reflect-metadata and repeat the @ValidateNested + @Type pair at every class boundary, however deep.

よくある質問

「ネストしたDTOと配列のValidation」レッスンは無料ですか？

はい。「ネストしたDTOと配列のValidation」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、NestJS Enterprise Backend APIsコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 NestJS Enterprise Backend APIsコースには全4レッスンが含まれています。

「ネストしたDTOと配列のValidation」で何を学びますか？

@ValidateNested、@Type、whitelist strippingを使って、ネストしたオブジェクトとコレクションを検証します ブラウザで直接実行するハンズオンコードでNestJS Enterprise Backend APIsを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

NestJS Enterprise Backend APIsを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのNestJS Enterprise Backend APIsは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン1/4です。

「ネストしたDTOと配列のValidation」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このNestJS Enterprise Backend APIsレッスンでコードを書いて実行できますか？

はい。すべてのNestJS Enterprise Backend APIsレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

  1. ネストしたDTOと配列のValidation
  2. カスタムValidatorと非同期Constraint
  3. ClassSerializerInterceptorによるレスポンス整形
  4. 条件付きバリデーションと動的グループ
← NestJS Enterprise Backend APIsに戻る