Rejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.
@sap/cds Enforces @mandatory, @assert.range, @assert.format, @assert.target and @assert with a CXL case expression whenever data is written: the static checks on the input, the expressions collected into one query and run in the database, and a failure rejects the request and rolls the transaction back.
com.sap.cds:cds-services-bom Enforces declarative @assert and @mandatory constraints whenever data is written, and translates the resulting validation error messages out of the box.
Not covered: It stops at what a range, a regular expression or a CXL expression run in the database can say about an entity's elements: @assert.format takes a pattern and has no named format such as email or uri, and @assert.target does not check across services or against a target created in the same deep insert. Past that the check is a before handler of the developer's own, or a second vocabulary: JSON Schema keywords per element, evaluated by AjvAjvA JSON Schema validator for JavaScript. Where something here validates against JSON Schema rather than against the CDS model, Ajv is what compiles the schema and runs it., in sap-cap-validator-pluginsap-cap-validator-pluginA CAP plugin that checks incoming data against JSON Schema rules written as @Validator annotations on model elements, evaluated by Ajv, with no handler to register.independent, cap, and Zod schemas registered in a before handler in cds-validatecds-validateA package that runs Zod schemas as CAP validation middleware, so one schema replaces the hand-written checks at the top of a handler and failures come back as OData 422 errors per field.independent, cap. capire's own advice at that edge is to try the declarative constraints first and to write the before handler only past them; in CAP Java the Before phase is the one meant for validating the incoming parameters.
Neither the package manifest nor the repository tree declares a licence.
@assert.range accepts open intervals, a min or max wrapped in parentheses, and an underscore for infinity. Before this release a range was a closed [min, max] and a one-sided bound needed a case expression or a handler. CAP Java gained the same in 3.5.0.
Advice that @assert.range cannot express 'strictly positive' or an unbounded side, and the before handlers written for that.
capability:input-validation