How to deal with Model and ViewModel validation in ASP.Net MVC - asp.net-mvc

Question

I have an ASP.Net MVC application which contains Model and ViewModel, this app have UI and API interfaces which works through different controllers, UI works with ViewModel, API works with Model. ViewModel has validation with data annotations (C# attributes) and Model hasn't so now API allows to save to DB any unconsistent models.
What I have now:
// Model
public class Contact
{
public string Email { get; set; }
...
}
// ViewModel
public class CreateContactViewModel
{
[Required(ErrorMessage = "*")]
[EmailAddress(ErrorMessageResourceType = typeof(CreateContact), ErrorMessageResourceName = "Validation_invalid_email", ErrorMessage = null)]
public string Email { get; set; }
...
}
// View
...
<div style="padding-bottom:13px;">
#Html.TextBoxFor(x => x.Email, new { style = "width:405px;" })
#Html.ValidationMessage("Email", new { style = "color:red;" })
</div>
...
// UI controller
[HttpPost]
public ActionResult Create(CreateContactViewModel model, GetContactsViewModel contactsModel)
{
/* Now validation work only on client side, should be fixed? */
var newContact = new Contact()
{
Email = model.Email,
...
};
UnitOfWork.ContactRepository.Insert(newContact);
UnitOfWork.Save();
return GetContactsList(contactsModel);
}
// API Controller
public class ContactsController : BaseApiController
{
...
public IHttpActionResult Post(Contact contact)
{
if (!ModelState.IsValid)
{
return BadRequest(ModelState);
}
UnitOfWork.ContactRepository.Insert(contact);
try
{
UnitOfWork.Save();
}
catch (DbUpdateException)
{
if (ContactExists(contact.Id))
{
return Conflict();
}
else
{
throw;
}
}
return Created(contact);
}
...
}
I suppose that the better way is to move validation attributes to the Model (and also more complex busines logic validation will be added in the future) and check Model validity manualy after mapping from ViewModel I found the same idea here http://blogs.msdn.com/b/simonince/archive/2010/12/07/view-model-versus-domain-entity-validation-with-mvc.aspx. (Manual validation call works for me)
What should I do in this case to support validation both in API and UI?
Probably app architecture is not good enough and I am glad to get any advices but I am not fully authorized to change anything now.

Answer 1

As you already know (or figured out), validation can, will and should occur on many levels.
The first thing you need to do is differentiate what should be a UI validation from what should be a business rule validation.
Assuming I have a register <form>...</form>. Within that form, I have a simple email textbox.
Assuming my rules are the following:
The email textbox is mandatory
The email should not be a duplicate
I can quickly differentiate that the mandatory textbox should be a UI validation.
As for the “no duplicate email” rule, this requires a trip to the database to see if the given email address does not already exist. To me this is a business rule validation.
So basically, my RegisterViewModel would have a [required] data annotation attribute set on the email property. This would take care of the UI Validation.
Upon submit, I would validate my ViewModel with Model.IsValid() for server-side validation.
Once the ViewModel is ok, I would pass the ViewModel to the API (or some people prefer to transform the ViewModel into a POCO before sending it to the API).
Inside the API, I would invoke the database and check if the given email address does not already exist.
If it does exist, the method would return false (assuming your method returns true or false).
The Controller would check if the returned value is false and perhaps add some error to the UI.
If it doesn’t exist, then great! Convert your ViewModel (if it hasn’t been transformed before) into a POCO (or into what you call your Model object) in order to save it to your database.
In my example (and in most of my POCO’s) I rarely have data annotations I usually leave those to the ViewModel and whatever more complex validation I need, I do manually within the API layer.