Resistor

Resist mass assignment vulnerabilities - map the important bits

Installation

npm install resistor --save

Usage

Middleware

Instead of validating input directly in your route handler resistor will generate a piece of middleware to do the heavy lifting:

 
var validateSignup = resistor({
  email : { type : 'string', required : true },
  password : { type : 'string', required : true }
});
 
router.post('/signup', validateSignup, function(req, res, next) {
  // req.model is set and resistor ensures that req.model.email and req.model.password are set 
});
 

Out of the box resistor will send 400 JSON responses if a request is not valid. To modify this behaviour the errorHandler option comes to rescue:

 
function renderErrorView(req, res) {
  res
    .status(400)
    .render('error', req.model);
}
 
var validateSignup = resistor({
  email : { type : 'string', required : true },
  password : { type : 'string', required : true }
}, { errorHandler : renderErrorView });
 
router.post('/signup', validateSignup, function(req, res, next) {
  // req.model is set and resistor ensures that req.model.email and req.model.password are set 
});
 

Plain Javascript

To use resistor model binding outside of a middleware context resistor exposes the binder function to construct a binder

 
var binder = resistor.binder({ input : '=' });
var model = binder.bind({ input : 'value'});
 
console.log(model.input); // prints `value` to stdout 
      

Model binding/validation errors can be accessed by checking the errors field of the model

 
var binder = resistor.binder({ input : { type : 'string', required : true }});
var model = binder.bind({});
 
console.log(model.errors); // prints `{ input: [ { validator: 'required', value: undefined } ] }` to stdout