Type/Interface used with request body validation is ignored

Question

Given the following interface defined inside a controller:

interface idAndAge {
 id : string,
 age : number
}

and here is the endpoint definition:

@put('/tests')
  async replaceById(
    @requestBody() test: idAndAge,// <--to validate the input
  ): Promise<void> {
    await this.testRepository.updateAll(test,{id : test.id});
  }

When this endpoint receives the following input for example (which has properties not defined in the interface):

{ anyKey: anyValue }

it accept it and ignore the validation

it should not allow the below values - because they are not included/against our interface idAndAge

{ anyKey: anyValue }

please check this repo , if you'd like to test the issue

Answer 1

According to the documentation you need to add the corresponding model decorators to your model:

In order to use @requestBody in a parameter type, the model in the parameter type must be decorated with @model and @property.

So you could simply do:

@model()
class idAndAge {
  @property({ required: true })
  id: string;
  @property({ required: true })
  age: number
}

and loopback will correctly validate the request body against the generated json-schema.

Update: Afaik there's currently no support to add a "allowAdditionalProperties" decorator, but you could directly use the json-schema in your requestBody-decorator as follows:

@requestBody({
      required: true,
      content: {
        'application/json': {
          schema: {
            type: 'object',
            additionalProperties: false, // <=== important
            properties: {
              id: { type: 'string' },
              age: { type: 'number' }
            },
            required: [
              "id"
            ]
          }
        }
      }})