การตรวจสอบ DTO ซ้อนกันและอาร์เรย์

NestJS pairs class-validator with class-transformer through the global ValidationPipe. For flat DTOs this works out of the box: decorators on each property run automatically.

But the moment a DTO contains another object or an array of objects, validation silently stops at the boundary. The validator sees a child property, but it does not know it is a class instance whose own decorators should run.

• A nested address object is treated as an opaque value.
• An items array is checked for being an array, but its elements are never validated.

This lesson shows how @ValidateNested, @Type, and whitelist stripping close those gaps.

Consider an order payload with a nested address. Adding @ValidateNested alone is not enough — the validator still needs the child to be an actual AddressDto instance, not a plain object.

Without @Type, class-transformer leaves address as a plain object, so the @IsString() on city never runs. Invalid data passes through unnoticed.

The missing piece is @Type(() => AddressDto) from class-transformer. It tells the transformer how to construct the nested value, turning the raw JSON object into a true AddressDto instance.

Only then do the child's decorators (@IsString, @IsNotEmpty, etc.) actually execute. The rule of thumb:

• @ValidateNested() → "recurse into this property".
• @Type(() => Child) → "build it as this class first".

You almost always need both together.

For @Type to take effect, the ValidationPipe must run class-transformer. Enable it globally with transform: true.

This also converts primitives: a route param string '42' becomes a number when the DTO/param type says so. Without transform, nested classes stay plain and your @Type hints are ignored.

Arrays of objects need the same pair, with one addition: each: true. This makes @ValidateNested({ each: true }) apply the nested validation to every element of the array.

@Type(() => ItemDto) maps each raw element into an ItemDto instance. Add @IsArray() and optionally @ArrayMinSize(1) to guard the collection shape itself.

The pattern composes to any depth. An order has items, and each item has its own nested discount. Each level that crosses into another class repeats the @ValidateNested + @Type pair.

Validation recurses top-down: the order validates its items array, each item validates its discount object, and every leaf decorator runs. There is no special "deep" flag — you just apply the same two decorators at each boundary.

whitelist: true removes any property in the incoming payload that has no validation decorator on the DTO. This is a core security defense: clients cannot smuggle extra fields like isAdmin or role into your entities.

Crucially, whitelisting works recursively on validated nested objects. If a nested AddressDto only declares city and zip, an injected country field on the nested object is stripped too — but only because @ValidateNested + @Type made the validator descend into it.

There are two postures for unknown fields:

• whitelist: true — silently strips unknown properties and continues.
• whitelist + forbidNonWhitelisted: true — rejects the whole request with 400, listing the offending property.

For public APIs, forbidding is stricter and surfaces client mistakes early. Note that forbidNonWhitelisted only has an effect when whitelist is also enabled.

Outside NestJS, the same engine works directly. This standalone snippet builds a nested instance with plainToInstance and validates it with validateSync — exactly what the ValidationPipe does internally.

Run it to see how @ValidateNested + @Type surface a nested error.

A nested object that may be absent should be marked @IsOptional(). When present, it is still validated; when missing, it is skipped. Combine this with @ValidateNested and @Type as usual.

For arrays, @IsOptional() lets the whole array be omitted, while @ArrayMinSize still enforces a minimum once the array is provided. Keep each: true so present elements remain validated.

Watch for these failures, which all let bad data through silently:

• Forgetting @Type — nested object stays plain; child decorators never run.
• Forgetting transform: true — the pipe never invokes class-transformer, so @Type is ignored.
• Missing each: true on arrays — only the first/whole array is checked, not each element.
• No reflect-metadata import — decorators emit no metadata; validation no-ops.
• Disabling whitelist — unknown fields flow straight into your service layer.

You now know how to validate nested and array DTOs in NestJS:

• @ValidateNested() tells the validator to recurse into a child object; add { each: true } for arrays.
• @Type(() => Child) from class-transformer turns raw JSON into real class instances so child decorators run.
• transform: true on the ValidationPipe is mandatory for @Type to take effect.
• whitelist: true strips undeclared properties recursively; forbidNonWhitelisted: true rejects them with a 400 instead.
• Always import reflect-metadata and repeat the @ValidateNested + @Type pair at every class boundary, however deep.