DEV Community: Gbubemi Attah

I built ginvalidator — middleware-based request validation for Gin, modeled on express-validator

Gbubemi Attah — Wed, 13 May 2026 14:35:45 +0000

Here's how validation in a Gin handler usually goes. You bind JSON to a struct. You write binding:"required,email" tags. It mostly works, until you need something the tags can't express — "this email is already taken," or "this field is only required if that other field has a specific value." Then you're back to writing it by hand.

Or you skip struct binding entirely, pull values out of the request manually, write validation inline, and ten endpoints later you've got the same regex copied four different places.

If you've used express-validator in Node, you know there's a cleaner shape. Chain validators on a field, mix in sanitizers, decide what to do with the errors, move on.

ginvalidator is that, for Gin.

Repo: github.com/bube054/ginvalidator

Quick taste

package main

import (
    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.POST("/signup",
        gv.NewBodyChain("email", nil).
            Not().Empty(nil).
            Bail().
            Email(nil).
            Validate(),
        gv.NewBodyChain("username", nil).
            Trim("").
            Not().Empty(nil).
            Alphanumeric(nil).
            Validate(),
        func(ctx *gin.Context) {
            result, _ := gv.ValidationResult(ctx)
            if len(result) > 0 {
                ctx.AbortWithStatusJSON(422, gin.H{"errors": result})
                return
            }

            data, _ := gv.GetMatchedData(ctx)
            email, _ := data.Get(gv.BodyLocation, "email")
            username, _ := data.Get(gv.BodyLocation, "username")
            // both are validated, sanitized, ready to use

            ctx.JSON(200, gin.H{"email": email, "username": username})
        },
    )

    r.Run(":8080")
}

Each chain is its own middleware. Gin runs them left to right. Errors don't reject the request — they're collected, and you decide what to do with them in the handler.

What goes in a chain

Validators. Email, URL, UUID, Alpha, Alphanumeric, Numeric, Empty, Contains, Equals, Matches, CreditCard, MobilePhone, PostalCode, StrongPassword, JSON, Boolean, Date, ISO8601, and dozens more. All powered by my other validatorgo.

Sanitizers. Trim, Escape, Unescape, Blacklist, Whitelist, NormalizeEmail, StripLow, ToBoolean, ToInt, ToFloat, ToDate. Sanitized values flow forward through the chain and get stored for you to retrieve after validation.

Modifiers. Not() flips the next validator's result. Bail() stops the chain on first failure. Optional() skips the chain if the field is empty. If() and Skip() give you conditional control via a function.

Custom validators and sanitizers for when the built-ins don't cover what you need:

gv.NewBodyChain("email", nil).
    Email(nil).
    CustomValidator(func(r *http.Request, initialValue, sanitizedValue string) bool {
        return !userExistsByEmail(sanitizedValue)
    }).
    Validate()

Five places to look

Different chain constructor for each part of an HTTP request. Same chain semantics:

NewBodyChain — JSON, form, multipart body. JSON paths use GJSON syntax, so "user.profile.email" works for nested fields.
NewQueryChain — URL query parameters
NewParamChain — Gin route parameters (:id)
NewHeaderChain — HTTP headers
NewCookieChain — cookies

A few things I'm really happy with

OneOf for either/or validation. Login that accepts either an email or a phone number:

gv.OneOf(
    []gv.ValidationChain{
        gv.NewBodyChain("email", nil).Not().Empty(nil).Email(nil),
    },
    []gv.ValidationChain{
        gv.NewBodyChain("phone", nil).Not().Empty(nil).MobilePhone(nil, ""),
    },
)

If at least one group passes, the request passes. The matched data from the winning group is what GetMatchedData returns.

CheckSchema for routes with a lot of fields. Twelve fields is twelve chains. That gets verbose. Schemas collapse them into a map:

gv.CheckSchema(gv.Schema{
    "email": {
        In: gv.BodyLocation,
        Build: func(vc gv.ValidationChain) gv.ValidationChain {
            return vc.Not().Empty(nil).Bail().Email(nil)
        },
    },
    "username": {
        In: gv.BodyLocation,
        Build: func(vc gv.ValidationChain) gv.ValidationChain {
            return vc.Not().Empty(nil).Bail().Alphanumeric(nil)
        },
    },
    "bio": {
        In:       gv.BodyLocation,
        Optional: true,
        Build: func(vc gv.ValidationChain) gv.ValidationChain {
            return vc.Trim("").Escape()
        },
    },
})

One middleware. Same semantics. Easier to scan than ten chained calls.

Error reading helpers for different UI shapes. ValidationResult(ctx) gives you everything as a slice, but there's also:

HasErrors(ctx) — bool, for the "did anything fail" check
FirstError(ctx) — pointer to the first error, for "show one at a time" UIs
ErrorsByField(ctx) — map of field to errors, for forms with per-field error lists
FirstErrorByField(ctx) — same map, but at most one error per field I find myself reaching for FirstErrorByField constantly when wiring up form UIs. The shape lines up with how you'd render it.

How errors look

Standard JSON, with location info:

{
  "errors": [
    {
      "location": "body",
      "field": "email",
      "value": "nope",
      "message": "invalid email",
      "code": "invalid_format"
    },
    {
      "location": "body",
      "field": "username",
      "value": "",
      "message": "Invalid value"
    }
  ]
}

The code and message come from validatorgo when a built-in validator fails, so they're stable strings you can map for i18n or client-side handling. You can override messages per-chain, or globally with DefaultErrFmtFunc.

Where this came from

This is actually the project that spawned validatorgo. I started building a Gin port of express-validator, realized I needed validator.js's whole API surface to do it properly, and ended up extracting that into its own library. That library got finished and published first; this one is the original goal it was built to serve.

So if you've seen validatorgo, you've seen the engine. ginvalidator is what I actually wanted to build all along.

If this is useful to you

A star on the repo helps more than I'd like to admit. Gin middleware is a niche-within-a-niche, and discoverability is probably the biggest blocker for libraries like this.

Forking it and trying it on a real handler is the best way to find rough edges. The five-locations-of-chain thing means there are a lot of permutations, and edge cases tend to hide in the boring ones (cookies with weird characters, multipart fields with the same name twice, that kind of thing).

If you've used express-validator and you notice behavior that doesn't match, open an issue. Spec parity is something I actively want, and "this works in express-validator but not here" is a clear bug to me.

PRs welcome — additional sanitizers, more validators that pass through to validatorgo, doc improvements, all fair game.

validatorgo v1.0.0 is here 🎉 — the validator.js you've been missing in Go

Gbubemi Attah — Tue, 12 May 2026 11:57:43 +0000

I started this library as an internal dependency for something else I was building (a Gin middleware library modeled on express-validator). What I needed was simple: functions that take a string and tell me whether it's a valid email, IBAN, MongoDB ID, whatever. What I found in the Go ecosystem didn't quite fit, so I started writing them myself.

That "small dependency" grew teeth. Today it's 89 validators and a sanitizer subpackage, and stable enough that I'm tagging v1.0.0 and putting it out there properly. If you've ever missed validator.js while writing Go, that's pretty much what this is.

Repo: github.com/bube054/validatorgo

Why I bothered

Go has solid validation libraries. I'm not knocking them. But most of them are built around structs and tags:

type User struct {
    Email string `validate:"required,email"`
}

Which is fine for HTTP handlers. It's awkward when you've already got a string in your hand and just want to ask "is this a valid IBAN."

govalidator is closer in spirit but coverage is patchy and it hasn't really kept up. So you end up doing the regex archaeology dance: open Stack Overflow, find three different patterns for what you want, copy the one with the most upvotes, hope it's right. I got tired of that.

validator.js solved this for JavaScript years ago. So I copied the API shape and started porting things over.

Quick taste

import vgo "github.com/bube054/validatorgo"

vgo.IsEmail("user@example.com", nil)
vgo.IsMongoID("5f2a6c69e1d7a4e0077b4e6b")
vgo.IsIBAN("DE89370400440532013000", "DE")
vgo.IsCreditCard("4111111111111111", nil)
vgo.IsBTCAddress("1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa")

Each call returns (bool, error). That's the whole thing. No struct tags, no reflection, no setup.

What's actually in it

89 validators across the categories you tend to run into in real apps. Emails, URLs, IPs, FQDNs, MAC addresses. Every kind of ID I could think of: UUID, ULID, MongoID, ISIN, ISBN, ISSN, IMEI, SemVer, ISO 6346 shipping container codes. Country and locale codes (ISO 639, ISO 3166), postal codes, license plates, mobile numbers across 150+ locales, identity cards, passports, tax IDs, VAT numbers. IBANs across 70+ countries, BIC codes, credit cards, currency strings, BTC and ETH addresses. Hex, HSL, RGB colors. Dates and times in most common formats. Plus the basics: alpha, numeric, alphanumeric, JSON, Base32/58/64, hashes.

The sanitizer subpackage covers what you usually need around validation: trim, escape, whitelist/blacklist, NormalizeEmail (with provider-aware rules for Gmail, Outlook, Yahoo, iCloud), and converters like ToInt, ToFloat, ToBoolean, ToDate.

Full list and function signatures are in the README and on pkg.go.dev. I'm not going to dump the whole table here.

A few things I'm happy with

Options without ceremony. Most validators take an optional *Opts struct. Pass nil for defaults, or override only what you care about:

ok, _ := vgo.IsEmail("user@example.com", &vgo.IsEmailOpts{
    RequireTld:               vgo.Bool(false),
    DomainSpecificValidation: true,
})

Helpers like vgo.Bool(), vgo.String(), vgo.Int() make pointer fields painless. Anything you leave as nil gets a sensible default.

Errors you can actually use. When validation fails you don't get a generic false. You get a structured error with a stable code:

ok, err := vgo.IsEmail("nope", nil)
if err != nil {
    var ve *vgo.ValidationError
    if errors.As(err, &ve) {
        ve.Validator // "IsEmail"
        ve.Code      // "INVALID_FORMAT"
        ve.Message   // "invalid email format"
    }
}

Codes are stable strings like INVALID_FORMAT, TOO_SHORT, MISSING_TLD, BLACKLISTED_HOST, INVALID_CHECKSUM, OUT_OF_RANGE. Easy to map to field-level errors in an API response.

Locale-aware where it matters. Mobile numbers, postal codes, identity cards, license plates, tax IDs all take a locale. Pass "any" if you don't care, or be specific:

vgo.IsMobilePhone("+2348012345678", []string{"en-NG"}, nil)
vgo.IsPostalCode("100001", "NG")

Why v1.0.0 and not v0.x.something

I wouldn't slap "1.0" on something I wasn't ready to support, so a few notes on what stable means here.

Test coverage sits around 87%. Every validator has a test suite, including the gnarly ones. The IBAN checksums and ISO 6346 container IDs took longer to get right than I'd like to admit.

The API isn't going to break under you. From here it's semver. No surprise rewrites of how options work or what errors look like.

It's already in production through ginvalidator, the Gin middleware that started all this. So it's been hit with real input from real users.

There are still gaps. More locales for postal codes. Stricter IBAN checksums for some countries. More passport formats. That's roadmap, not a blocker for shipping.

If this is useful to you

A star on the repo genuinely helps. It's the main signal I have for whether to keep investing time, and "discoverable on GitHub" is honestly half the battle for a library like this.

Forking it and trying it on something real is even better. If it breaks on input it shouldn't break on, that's an issue I want to see. Edge cases in the wild are how this gets sharper.

If you know other Gophers, sharing this with them matters more than it should. Reach in this corner of the ecosystem is hard, and word of mouth from one developer to another beats anything else.

And contributions are open. New locales, additional ISO standards, doc improvements — all welcome. If there's a validator you want and don't see, open an issue or a PR.

Shipped v2 of go-js-array-methods — JS-style Filter, Map, Reduce for Go slices

Gbubemi Attah — Sat, 09 May 2026 22:57:15 +0000

If you've ever switched between JavaScript and Go in the same week, you've felt this. You're three lines into a Go function, you reach for .filter(), and then you remember: right, for loop. Or write a one-off helper for the third time this month.

go-js-array-methods provides Filter, Map, Reduce, Includes, At, Slice, Splice, Push, Pop — 30+ methods named exactly like their JS counterparts. Generics-powered, immutable by default, chainable if you want it.

Repo: github.com/bube054/go-js-array-methods

Quick taste

import "github.com/bube054/go-js-array-methods/v2/array"

nums := []int{1, 2, 3, 4, 5}

even := array.Filter(nums, func(n, _ int, _ []int) bool { return n%2 == 0 })
doubled := array.Map(even, func(n, _ int, _ []int) int { return n * 2 })
// [4, 8]

Or chainable, if you prefer that style:

arr := array.Array[int]{1, 2, 3, 4, 5}

result := arr.
    Filter(func(n, _ int, _ []int) bool { return n%2 == 0 }).
    Push(6).
    Reverse()
// [6, 4, 2]

Both styles are interchangeable. Use whichever fits the surrounding code.

What's in it

The 30+ methods you'd actually reach for: Filter, Map, Reduce (with ReduceRight and *Strict variants that preserve the input type), Find, FindIndex, FindLast, FindLastIndex, Every, Some, Includes, IndexOf, LastIndexOf, At, Slice, Splice, Push, Pop, Shift, Unshift, Concat, Reverse, Fill, CopyWithin, Flat, ForEach, Join, Entries, With, ToString, ValueOf.

What's intentionally not in it:

Sort — Go's slices.Sort and the sort package already handle this well. Reimplementing them just to match the JS name felt like noise.
Keys — for i := range slice is fine. You don't need a library for that one.
FlatMap — on the roadmap, just not done yet. Honestly the most likely place a contribution would land cleanly.

A few things worth knowing

Immutable by default. Every function returns a new slice. The input never changes, even for "mutating" methods like Push or Splice. JS technically mutates; this doesn't. The trade-off is you don't get aliasing bugs that show up six functions away from where the bug actually is.

Negative indexes. At(-1) gives you the last element. Slice(s, -2, -1) works the same as in JS. Out-of-range access returns an error instead of panicking.

Map is properly generic. The compiler infers the output type from your callback, so call sites stay clean:

nums := []int{1, 2, 3}
strs := array.Map(nums, func(n, _ int, _ []int) string {
    return fmt.Sprintf("#%d", n)
})
// []string{"#1", "#2", "#3"} — no type assertions, no []any

If you want to lock the output type to the input type, there's MapStrict.

One Go quirk worth flagging. Go doesn't allow type parameters on methods, only on functions. So Array[T].Map() is locked to Array[any] and can't cleanly change the output type. If you want the full type-safe Map, use array.Map as a function directly. The chainable style still works fine for the rest.

A couple of patterns I find myself using

Sum a slice without writing a manual accumulator:

nums := []int{1, 2, 3, 4}
initial := 0
sum, _ := array.ReduceStrict(nums, func(acc, n, _ int, _ []int) int {
    return acc + n
}, &initial)
// sum == 10

Flatten a mixed nested slice:

nested := []any{1, []int{2, 3}, []int{4, 5}}
flat, _ := array.Flat[int](nested)
// []int{1, 2, 3, 4, 5}

Transform a slice of strings without leaving type safety:

arr := array.Array[string]{"alice", "bob", "carol"}
shouts := arr.MapStrict(func(s string, _ int, _ []string) string {
    return strings.ToUpper(s) + "!"
})
// [ALICE! BOB! CAROL!]

More examples (runnable, with output) live in array/example_test.go and on pkg.go.dev.

If this is useful to you

A star on the repo helps more than I'd like to admit. It's the cheap signal that tells me which projects to keep working on, and most Go devs don't stumble onto this kind of library on their own — they've usually already given up and written the for loop.

If you're in JS-and-Go territory and you know someone who's complained about missing filter/map, sharing this is a real favor to them. That's the audience this is built for.

Issues for missing methods or weird edge cases are genuinely valuable. Especially if you can show me the JS behavior you'd expect — that's the spec I'm matching against, and disagreements are usually where the bug is, also PRs are welcome.

Introducing jsonvx: The Most Customisable JSON Parser, Querier & Formatter for Go

Gbubemi Attah — Thu, 28 Aug 2025 03:28:32 +0000

jsonvx is an elegant Go package that empowers developers with a fully configurable JSON parser, querier, and formatter—especially suitable for parsing non-standard JSON formats such as JSON5. Authored by Attah Gbubemi David (GitHub user bube054), this library is tailored for scenarios where strict compliance isn't guaranteed and flexibility is key.

Why jsonvx Stands Out

Supports Relaxed JSON Syntax

Beyond strict JSON per ECMA-404, jsonvx allows relaxed syntax like hexadecimal numbers, single-quoted strings, unquoted keys, trailing commas, comments, and more—making it highly suitable for parsing user-generated or legacy configuration data.
Fully Configurable via ParserConfig

Control exactly which extensions are allowed—be it AllowHexNumbers, AllowTrailingCommaArray, AllowLineComments, AllowSingleQuotes, AllowJSON5, and more. This lets you fine-tune strictness per input or use case.
Structured AST & Querying Tools

After parsing, jsonvx provides an abstract syntax tree (AST) composed of node types like Object, Array, Number, String, Boolean, and Null. Each node type offers helper methods (e.g., AsObject, AsNumber) and value accessors like .Value() to extract Go-native values.
Convenient Path-Based Querying

The QueryPath method allows you to dive into deeply nested data easily. For example, you can fetch fields like "name" → "first" or even array elements like "friends" → "0" → "last". Keys or array indices with special characters (e.g., "fav.movie") are fully supported.
Bitmap of Parsing Use Cases

Since jsonvx focuses on flexibility and correctness rather than maximum performance, it shines in use cases like building linters, CLI tools, formatters, or config loaders where input irregularities are expected.

Quick Start Example

package main

import (
  "fmt"
  "github.com/bube054/jsonvx"
)

func main() {
  data := []byte(`{
    name: { first: 'Tom', last: 'Anderson' },
    age: +37,
    children: ['Sara', 'Alex', 'Jack', ],
    // comment
    "fav.movie": 'Deer Hunter'
  }`)

  parser := jsonvx.NewParser(data, jsonvx.NewParserConfig(
    jsonvx.WithAllowUnquoted(true),
    jsonvx.WithAllowSingleQuotes(true),
    jsonvx.WithAllowLeadingPlus(true),
    jsonvx.WithAllowTrailingCommaArray(true),
    jsonvx.WithAllowLineComments(true),
  ))

  root, err := parser.Parse()
  if err != nil {
    panic(err)
  }

  obj, ok := jsonvx.AsObject(root)
  if !ok {
    panic("expected object")
  }

  ageNode, _ := obj.QueryPath("age")
  ageNum, _ := jsonvx.AsNumber(ageNode)
  ageValue, _ := ageNum.Value()
  fmt.Println("Age:", ageValue) // Output: Age: 37
}

In just a few lines, this example handles comments, unquoted keys, single-quoted strings, trailing commas, and +37 as input—all thanks to jsonvx's configurability.

Feature Highlights at a Glance

Feature	Description
Strict JSON + Relaxed Modes	Supports both strict JSON and optional relaxed syntax.
Flexible ParserConfig	Toggle syntax features individually via configuration.
AST-Based Access	Query, traverse, and manipulate JSON via structured nodes.
Path-Based Querying	Fetch nested data via `QueryPath`, even in awkward keys.
Ideal Use Cases	Tools, formatters, config parsers, linters, CLI utilities.

Getting Started

Installation Ensure Go is set up, then install with:

  go get -u github.com/bube054/jsonvx

Import & Parse

Use NewParser(data, config) to create a parser, then call .Parse().
Traverse Nodes

Use AsObject, AsArray, AsString, AsNumber, etc., and extract values through .Value() or ForEach.
Query Paths

Use QueryPath("friends", "0", "last") to navigate deeply nested structures.
Custom Config

Customize allowed syntactic variants using WithAllow... options or jsonvx.JSON5Config() for a full JSON5 setup.

Customization Options

Each option controls whether a relaxed JSON feature is allowed. Mix and match depending on your input source.

Number Handling

WithAllowHexNumbers(true) — Accept hexadecimal numbers like 0x1A.
WithAllowLeadingPlus(true) — Allow a leading + in numbers (e.g., +37).
WithAllowLeadingDecimalPoint(true) — Permit .5 instead of 0.5.
WithAllowTrailingDecimalPoint(true) — Accept 5. instead of 5.0.
WithAllowInfinity(true) — Parse Infinity and -Infinity.
WithAllowNaN(true) — Accept NaN as a valid number.

Strings & Keys

WithAllowSingleQuotes(true) — Strings can use 'single quotes'.
WithAllowUnquoted(true) — Object keys can be unquoted ({ name: "Tom" }).
WithAllowTrailingCommaArray(true) — Arrays can end with a trailing comma.
WithAllowTrailingCommaObject(true) — Objects can end with a trailing comma.

Comments

WithAllowLineComments(true) — Allow // single-line comments.
WithAllowBlockComments(true) — Allow /* block comments */.

JSON5 Preset

WithAllowJSON5(true) Enable all JSON5-like features at once (unquoted keys, trailing commas, single quotes, comments, Infinity, NaN, etc.).

Closing Thoughts

jsonvx is a powerful, thoughtfully designed Go library for working with both standard and non-standard JSON. Its flexible configuration and AST-driven design make it especially ideal for scenarios where inputs are unpredictable or loose in format. Whether you're building tools, formatters, or config loaders, jsonvx provides the right balance between strictness and flexibility.

If you find this project useful, don’t forget to ⭐ star it on GitHub to show your support!

I Built a Beam Analysis Tool Using Slope-Deflection! 🚀

Gbubemi Attah — Sun, 19 Jan 2025 19:10:00 +0000

Hi everyone! I recently created a tool to help engineers and students analyze multi-span beams using the Slope-Deflection Method. It generates bending moment diagrams, shear force diagrams, and more in a simple, intuitive interface.

🔗 Check it out here: Web App

🔗 Tutorial Youtube video, check it out here: Video

Big thanks to my UI designer Ajayi Tomiwa for making the interface so user-friendly! 🎨

👨‍💻 Also check out my GitHub: gh link

I’d love for you to try it out and share your feedback. Let me know what you think or how it could be improved!

Developing a Simple RESTful API with Gin, ginvalidator, and validatorgo

Gbubemi Attah — Mon, 13 Jan 2025 19:54:55 +0000

This tutorial introduces the basics of writing a RESTful web service API with Go and the Gin Web Framework (Gin). Which uses my two open source libraries: ginvalidator and validatorgo.

ginvalidator is a lightweight and expressive validation library for Go, designed specifically for the Gin web framework. It is based on the popular open source js library express-validator.
validatorgo is a versatile validation library for Go, offering a wide range of validators and sanitizers. It is based on the popular open source js library validator.js.

Please check out the above libraries and don’t forget to ⭐ star, 🔁 share, and 🍴 fork!

API endpoint design

You’ll build an API that provides access to a product inventory management system. So you’ll need to provide endpoints through which a HTTP client can create, read update and delete products.

When developing an API, you typically begin by designing the endpoints. Your API’s users will have more success if the endpoints are easy to understand.

Here are the endpoints you’ll create in this tutorial.

/products
- GET - Get a list of all products, returned as JSON.
- POST - Add a new product from request data and returned as JSON.
/products/:id
- GET - Get a product by its id, returning the product data as JSON.
- UPDATE - Get a product by its id, returning the newly updated data as JSON.
- Delete - Deletes a product by its id.

To keep things simple for the tutorial, you’ll store data in memory. A more typical API would interact with a database. Note that storing data in memory means that the list of products will be lost each time you stop the server, then recreated when you start it.

Also all HTTP requests will be represented as .http code snippets. You can use any HTTP client, such as Postman, Insomnia, or the HTTP client in your IDE, to send your requests.

Writing the Code

Start by following the quick installation guide to set up the necessary dependencies.
Next, create a main.go file.
In the main.go file, define the following structs to model your product data: Dimensions, Supplier, and Product. The Dimensions and Supplier structs will be embedded within the Product struct.

  package main

  import (
    "time"
  )

  // Dimensions represents the physical dimensions of a product.
  type Dimensions struct {
    Length float64 `json:"length"` // Length of the product in centimeters
    Width  float64 `json:"width"`  // Width of the product in centimeters
    Height float64 `json:"height"` // Height of the product in centimeters
    Weight float64 `json:"weight"` // Weight of the product in kilograms
  }

  // Supplier represents information about the supplier of a product.
  type Supplier struct {
    Name    string `json:"name"`    // Name of the supplier
    Contact string `json:"contact"` // Contact details (e.g., email or phone number)
    Address string `json:"address"` // Address of the supplier
  }

  // Product represents data about an inventory product.
  type Product struct {
    ID             string     `json:"id"`             // Unique identifier for the product
    Name           string     `json:"name"`           // Name of the product
    Category       string     `json:"category"`       // Category the product belongs to
    Description    string     `json:"description"`    // Detailed description of the product
    Price          float64    `json:"price"`          // Price of the product in decimal format
    Stock          int        `json:"stock"`          // Quantity of the product available in stock
    Dimensions     Dimensions `json:"dimensions"`     // Physical dimensions of the product
    Supplier       Supplier   `json:"supplier"`       // Supplier details
    Tags           []string   `json:"tags"`           // Tags for searching and filtering
    Image          string     `json:"image"`          // URLs of product images
    ManufacturedAt time.Time  `json:"manufacturedAt"` // Timestamp when the product was manufactured
    CreatedAt      time.Time  `json:"createdAt"`      // Timestamp when the product was created
    UpdatedAt      time.Time  `json:"updatedAt"`      // Timestamp when the product was last updated
  }

Then below add a slice products, with 2 items. This slice will be where our in memory database.

  var products = []Product{
    {
        ID:          "p1",
        Name:        "Wireless Mouse",
        Category:    "Electronics",
        Description: "A high-precision wireless mouse with ergonomic design.",
        Price:       29.99,
        Stock:       150,
        Dimensions: Dimensions{
            Length: 11.5,
            Width:  6.0,
            Height: 3.5,
            Weight: 0.2,
        },
        Supplier: Supplier{
            Name:    "Tech Supplies Inc.",
            Contact: "support@techsupplies.com",
            Address: "123 Tech Street, Silicon Valley, CA",
        },
        Tags:           []string{"wireless", "mouse", "electronics", "accessories"},
        Image:          "https://example.com/images/mouse1.jpg",
        ManufacturedAt: time.Now().AddDate(0, -30, 0),
        CreatedAt:      time.Now().AddDate(0, -1, 0),
        UpdatedAt:      time.Now().AddDate(0, -1, 0),
    },
    {
        ID:          "p2",
        Name:        "Gaming Keyboard",
        Category:    "Electronics",
        Description: "Mechanical keyboard with customizable RGB lighting.",
        Price:       79.99,
        Stock:       75,
        Dimensions: Dimensions{
            Length: 45.0,
            Width:  15.0,
            Height: 3.8,
            Weight: 1.1,
        },
        Supplier: Supplier{
            Name:    "Gaming Gear Ltd.",
            Contact: "info@gaminggear.com",
            Address: "456 Gaming Road, Austin, TX",
        },
        Tags:           []string{"keyboard", "gaming", "RGB", "electronics"},
        Image:          "https://example.com/images/keyboard2.jpg",
        ManufacturedAt: time.Now().AddDate(0, -20, 0),
        CreatedAt:      time.Now().AddDate(0, -2, 0),
        UpdatedAt:      time.Now().AddDate(0, -2, 0),
    },
  }

Lets register a GET endpoint for /products in the main function. Here is the updated main function:

    func main() {
      router := gin.Default()
      router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
      )
      router.Run(":8080")
    }

Below the main function, define the productQueriesValidators and getProducts functions:

productQueriesValidators: This function returns a gin.HandlersChain (equivalent to []gin.HandlerFunc). It includes two query validators for the GET /products route:
- q: An optional query parameter. It will be validated only if present in the request, ensuring it's trimmed of leading and trailing whitespace and is not empty.
- order: An optional query parameter. It will be trimmed of whitespace and must be one of asc or desc.

  func productQueriesValidators() gin.HandlersChain {
    return gin.HandlersChain{
      gv.NewQuery("q", nil).Chain().Optional().Trim(" ").Not().Empty(nil).Validate(),
      gv.NewQuery("order", nil).Chain().Optional().Trim(" ").In([]string{"asc", "desc"}).Validate(),
    }
  }

getProducts: This is the final request handler middleware for the GET /products route. It performs the following steps:
- Checks for validation errors using gv.ValidationResult.
- If validation errors exist, it returns an HTTP 422 Unprocessable Entity status with the errors.
- If no validation errors occur, it returns the product data with an HTTP 200 OK status.

  func getProducts(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    if len(result) != 0 {
      c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
        "message": "The server encountered validation error",
        "data":    nil,
        "errors":  result,
      })
      return
    }

    c.AbortWithStatusJSON(http.StatusOK, gin.H{
      "message": "The products found successfully",
      "data":    products,
      "errors":  nil,
    })
  }

Note we don't actually use the the search params (q, order) in the getProducts handler for the sake of simplicity.

Update the dependencies at the top of your Go file to include both net/http, gin and ginvalidator (aliased as gv):

  package main

  import (
    "fmt"
    "net/http"
    "time"

      gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
  )

Run and test the code for the GET /products endpoint.

  go run main.go

Here are examples of valid and invalid requests for testing:

A valid request.

GET http://localhost:8080/products?q=electronics&order=asc HTTP/1.1
content-type: application/json

An Invalid Request: order is neither asc nor desc.

GET http://localhost:8080/products?q=&order=xyz HTTP/1.1
content-type: application/json

An Invalid Request: q is empty

GET http://localhost:8080/products?q=   &order=asc HTTP/1.1
content-type: application/json

An Invalid Request: q is empty and order is neither asc nor desc
```
GET http://localhost:8080/products?q=   &order=xyz HTTP/1.1
content-type: application/json
```
- Lets register a GET endpoint for /products/:id in the main function. Here is the updated main function:

    func main() {
      router := gin.Default()
      router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
      )
      router.GET("/products/:id",
        append(productParamIdValidators(), getProduct)...,
      )
      router.Run(":8080")
    }

Below the main function, define the productParamIdValidators and getProduct functions:

productParamIdValidators: It includes a param validator for id in /products/:id route:
- id is simply the id for each product.

  func productParamIdValidators() gin.HandlersChain {
    return gin.HandlersChain{gv.NewParam("id", nil).Chain().Trim(" ").Alphanumeric(nil).Validate()}
  }

getProducts: This is the final request handler middleware for the /products route. It performs the following steps
- Checks for validation errors using gv.ValidationResult.
- If validation errors exist, it returns an HTTP 422 Unprocessable Entity status with the errors.
- Retrieves matched data using gv.GetMatchedData.
- Searches for the product by its id in the products list.
- Return HTTP 404 if the product is not found and return HTTP 200 if the product is successfully found.

  func getProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    if len(result) != 0 {
      c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
        "message": "The server encountered validation error",
        "data":    nil,
        "errors":  result,
      })
      return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var product *Product

    for _, p := range products {
      if p.ID == id {
        product = &p
        break
      }
    }

    if product == nil {
      c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
        "message": fmt.Sprintf("Product with id %s, not found", id),
        "data":    nil,
        "errors":  nil,
      })
      return
    } else {
      c.AbortWithStatusJSON(http.StatusOK, gin.H{
        "message": "The product found successfully",
        "data":    product,
        "errors":  nil,
      })
      return
    }
  }

Run and test the code for GET on /products/:id

Quit the previous process and rerun:

  go run main.go

A valid request.

  GET http://localhost:8080/products/p2 HTTP/1.1
  content-type: application/json

Invalid request: id which is p2 is not alphanumeric

  GET http://localhost:8080/products/@#! HTTP/1.1
  content-type: application/json

Lets register a DELETE endpoint for /products/:id in the main function. Here is the updated main function:

    func main() {
      router := gin.Default()
      router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
      )
      router.GET("/products/:id",
        append(productParamIdValidators(), getProduct)...,
      )
      router.DELETE("/products/:id",
        append(productParamIdValidators(), deleteProduct)...,
      )
      router.Run(":8080")
    }

productParamIdValidators function will be reused.

deleteProduct: This is the final request handler middleware for the DELETE /products/:id route. It performs the following steps:
- Validates the request parameters using gv.ValidationResult.
- Returns an HTTP 422 status if validation errors are present.
- Retrieves matched data using gv.GetMatchedData.
- Searches for the product by its id in the products list.
- If the product exists, its removed from the list and returns HTTP 200 with the deleted product details.
- If the product does not exist, returns HTTP 404.

  func deleteProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    if len(result) != 0 {
      c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
        "message": "The server encountered validation error",
        "data":    nil,
        "errors":  result,
      })
      return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": "The server encountered an unexpected error.",
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var deletedProduct *Product
    var filteredProducts = []Product{}

    for _, prod := range products {
      if prod.ID == id {
        deletedProduct = &prod
        break
      } else {
        filteredProducts = append(filteredProducts, prod)
      }
    }

    if deletedProduct == nil {
      c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
        "message": fmt.Sprintf("Product with id %s, not found", id),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    products = filteredProducts
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
      "message": fmt.Sprintf("Product with id %s, deleted", id),
      "data":    deletedProduct,
      "errors":  nil,
    })
  }

Run and test the code for DELETE /products/:id

Quit the previous process and rerun:

  go run main.go

A valid request.

  DELETE http://localhost:8080/products/p2 HTTP/1.1
  content-type: application/json

Invalid request: id which is p2 is not alphanumeric

  DELETE http://localhost:8080/products/@#! HTTP/1.1
  content-type: application/json

Lets register a POST endpoint for /products in the main function. Here is the updated main function:

    func main() {
      router := gin.Default()
      router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
      )
      router.GET("/products/:id",
        append(productParamIdValidators(), getProduct)...,
      )
      router.DELETE("/products/:id",
        append(productParamIdValidators(), deleteProduct)...,
      )
      router.POST("/products",
        append(productBodyValidators(), postProduct)...,
      )
      router.Run(":8080")
    }

productBodyValidators: This function validates the request body for POST and PUT requests to the /products route. It validates:
- name: Must not be empty.
- category: Must belong to predefined categories (Electronics, Apparels, Groceries, Home-Appliances).
- description: Length should be between 5 and 100 characters.
- price: Must have at least 2 decimal places and use the en-US locale.
- stock: Should be an integer, with a minimum value of 0.
- dimensions:
  - length, width, height, weight: Must be numeric.
- supplier:
  - name: Trimmed and not empty.
  - contact: Must be a valid email address.
  - address: Must match the regex format (number street, city, state abbreviation).
- tags: Should be an array of strings.
- image: Must be a valid URL.
- manufacturedAt: Should follow the ISO8601 format and be after 2020-05-10T00:00:00Z.

  func productBodyValidators() gin.HandlersChain {
    var (
      minDesc         uint     = 5
      maxDesc         uint     = 100
      minStock        int      = 0
      validCategories []string = []string{"Electronics", "Apparels", "Groceries", "Home-Appliances"}
    )

    return gin.HandlersChain{
      gv.NewBody("name", nil).Chain().Not().Empty(nil).Validate(),
      gv.NewBody("category", nil).Chain().In(validCategories).Validate(),
      gv.NewBody("description", nil).Chain().Length(&vgo.IsLengthOpts{Min: uint(minDesc), Max: &maxDesc}).Validate(),
      gv.NewBody("price", nil).Chain().Decimal(&vgo.IsDecimalOpts{DecimalDigits: vgo.DecimalDigits{Min: 2}, ForceDecimal: false, Locale: "en-US"}).Validate(),
      gv.NewBody("stock", nil).Chain().Int(&vgo.IsIntOpts{Min: &minStock}).Validate(),
      gv.NewBody(`dimensions.length`, nil).Chain().Numeric(nil).Validate(),
      gv.NewBody("dimensions.width", nil).Chain().Numeric(nil).Validate(),
      gv.NewBody("dimensions.height", nil).Chain().Numeric(nil).Validate(),
      gv.NewBody("dimensions.weight", nil).Chain().Numeric(nil).Validate(),
      gv.NewBody("supplier.name", nil).Chain().Trim(" ").Not().Empty(nil).Validate(),
      gv.NewBody("supplier.contact", nil).Chain().Email(nil).Validate(),
      gv.NewBody("supplier.address", nil).Chain().Matches(regexp.MustCompile(`^\d+\s[\w\s]+,\s[\w\s]+,\s[A-Z]{2}$`)).Validate(),
      gv.NewBody("tags", nil).Chain().Array(nil).Validate(),
      gv.NewBody("image", nil).Chain().URL(nil).Validate(),
      gv.NewBody("manufacturedAt", nil).Chain().Date(&vgo.IsDateOpts{Format: vgo.ISO8601ZuluLayout, StrictMode: true}).After(&vgo.IsAfterOpts{ComparisonDate: "2020-05-10T00:00:00Z"}).Validate(),
    }
  }

postProduct: This is the final request handler middleware for the POST /products route. It performs the following steps:
- Validates the request body using gv.ValidationResult.
- Returns an HTTP 422 status if validation errors are present.
- Binds the JSON request body to a Product struct.
- Adds a unique ID, CreatedAt, and UpdatedAt fields to the new product.
- Appends the new product to the products slice.
- Returns HTTP 200 with the created product details.

  func postProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    if len(result) != 0 {
      c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
        "message": "The server encountered validation error",
        "data":    nil,
        "errors":  result,
      })
      return
    }

    var newProduct Product

    if err := c.BindJSON(&newProduct); err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    newProduct.ID = fmt.Sprintf("p%d", len(products)+1)
    newProduct.CreatedAt = time.Now()
    newProduct.UpdatedAt = newProduct.CreatedAt

    products = append(products, newProduct)
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
      "message": fmt.Sprintf("Product with id %s, has been created", newProduct.ID),
      "data":    newProduct,
      "errors":  nil,
    })
  }

Update the dependencies at the top of your Go file to include validatorgo (aliased as vgo):

  package main

  import (
    "fmt"
    "net/http"
      "regexp"
    "time"

      gv "github.com/bube054/ginvalidator"
      vgo "github.com/bube054/validatorgo"
    "github.com/gin-gonic/gin"
  )

Run and test the code for POST /products

Quit the previous process and rerun:

  go run main.go

A valid request.

  POST http://localhost:8080/products HTTP/1.1
  content-type: application/json

  {
    "name": "Ultra HD Monitor",
    "category": "Electronics",
    "description": "27-inch 4K Ultra HD monitor with HDR support and ultra-slim bezels.",
    "price": 345.99,
    "stock": 30,
    "dimensions": {
      "length": 61.0,
      "width": 36.0,
      "height": 5.0,
      "weight": 4.5
    },
    "supplier": {
      "name": "VisionTech Co.",
      "contact": "sales@visiontech.com",
      "address": "123 Display Lane, San Francisco, CA"
    },
    "tags": ["monitor", "4K", "HDR", "electronics", "display"],
    "image": "https://example.com/images/monitor1.jpg",
    "manufacturedAt": "2023-09-11T11:34:56Z"
  }

An invalid request.

  POST http://localhost:8080/products HTTP/1.1
  content-type: application/json

  {
    "name": "",
    "category": "Equipment",
    "description": "four",
    "price": 345.99,
    "stock": 30,
    "dimensions": {},
    "supplier": {
      "name": "",
      "contact": "123 Display Lane, San Francisco, CA",
      "address": "sales@visiontech.com",
    },
    "tags": null,
    "image": "image-here",
    "manufacturedAt": "2019-09-11T11:34:56Z"
  }

Lets register a PUT endpoint for /products/:id in the main function. Here is the updated main function:

    func main() {
      router := gin.Default()
      router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
      )
      router.GET("/products/:id",
        append(productParamIdValidators(), getProduct)...,
      )
      router.DELETE("/products/:id",
        append(productParamIdValidators(), deleteProduct)...,
      )
      router.POST("/products",
        append(productBodyValidators(), postProduct)...,
      )
      router.PUT("/products/:id",
        append(append(productParamIdValidators(), productBodyValidators()...), putProducts)...,
      )
      router.Run(":8080")
    }

We will re-use productParamIdValidators and productBodyValidators functions.

putProduct: This is the final request handler middleware for the POST /products route. It performs the following steps:
- Validates the request parameters and body: Uses gv.ValidationResult to check for validation errors in both the route parameters and the request body.
- Retrieves matched data using gv.GetMatchedData.
- Finds the product: Matches the provided id with the existing products.
- Updates the product: If the product is found, it updates its details and sets a new UpdatedAt timestamp.
- It returns HTTP 200 with the updated product details if successful.
- It returns HTTP 404 if the product is not found.
- It returns HTTP 422 for validation errors.

  func putProducts(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    if len(result) != 0 {
      c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
        "message": "The server encountered validation error",
        "data":    nil,
        "errors":  result,
      })
      return
    }

    var newProduct Product

    if err := c.BindJSON(&newProduct); err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
      c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
        "message": "The server encountered an unexpected error.",
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var EditedProduct *Product
    var newProducts = make([]Product, len(products))

    for ind, prod := range products {
      if prod.ID == id {
        newProduct.ID = id
        newProduct.CreatedAt = prod.CreatedAt
        newProduct.UpdatedAt = time.Now()
        newProducts[ind] = newProduct
        EditedProduct = &newProduct
      } else {
        newProducts[ind] = prod
      }
    }

    if EditedProduct == nil {
      c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
        "message": fmt.Sprintf("Product with id %s, not found", id),
        "data":    nil,
        "errors":  nil,
      })
      return
    }

    products = newProducts
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
      "message": fmt.Sprintf("Product with id %s, has been edited", id),
      "data":    EditedProduct,
      "errors":  nil,
    })
  }

Run and test the code for PUT /products

Quit the previous process and rerun:

  go run main.go

A valid request.

  PUT http://localhost:8080/products HTTP/1.1
  content-type: application/json

  {
    "name": "Ultra 8k Monitor",
    "category": "Electronics",
    "description": "27-inch 8K Ultra HD monitor with HDR support and ultra-slim bezels.",
    "price": 390.99,
    "stock": 15,
    "dimensions": {
      "length": 16.0,
      "width": 63.0,
      "height": 0.5,
      "weight": 4.5
    },
    "supplier": {
      "name": "VisionTech Co.",
      "contact": "sales@visiontech.com",
      "address": "123 Display Lane, San Francisco, CA"
    },
    "tags": ["8K", "HDR", "electronics", "display"],
    "image": "https://example.com/images/monitor1-edited.jpg",
    "manufacturedAt": "2023-09-11T11:34:56Z"
  }

An invalid request.

  PUT http://localhost:8080/products HTTP/1.1
  content-type: application/json

  {
    "name": "",
    "category": "Equipment",
    "description": "four",
    "price": 345.99,
    "stock": 30,
    "dimensions": null,
    "supplier": {
      "name": "",
      "contact": "123 Display Lane, San Francisco, CA",
      "address": "sales@visiontech.com",
    },
    "tags": null,
    "image": "image-here",
    "manufacturedAt": "2019-09-11T11:34:56Z"
  }

Final thoughts

Now you can see how straightforward it is to validate your HTTP requests in Gin using both ginvalidator and validatorgo.

For more details on customizing error messages, check out this guide. To learn more about field syntax extraction, refer to this section.

If you prefer not to use the append method in the route registration handlers, you can break down the middleware validator handlers into smaller chunks and add them individually to the registration handler.

Thanks for reading, and see you next time!

Full Code

package main

import (
    "fmt"
    "net/http"
    "regexp"
    "time"

    gv "github.com/bube054/ginvalidator"
    vgo "github.com/bube054/validatorgo"
    "github.com/gin-gonic/gin"
)

// Dimensions represents the physical dimensions of a product.
type Dimensions struct {
    Length float64 `json:"length"` // Length of the product in centimeters
    Width  float64 `json:"width"`  // Width of the product in centimeters
    Height float64 `json:"height"` // Height of the product in centimeters
    Weight float64 `json:"weight"` // Weight of the product in kilograms
}

// Supplier represents information about the supplier of a product.
type Supplier struct {
    Name    string `json:"name"`    // Name of the supplier
    Contact string `json:"contact"` // Contact details (e.g., email or phone number)
    Address string `json:"address"` // Address of the supplier
}

// Product represents data about an inventory product.
type Product struct {
    ID             string     `json:"id"`             // Unique identifier for the product
    Name           string     `json:"name"`           // Name of the product
    Category       string     `json:"category"`       // Category the product belongs to
    Description    string     `json:"description"`    // Detailed description of the product
    Price          float64    `json:"price"`          // Price of the product in decimal format
    Stock          int        `json:"stock"`          // Quantity of the product available in stock
    Dimensions     Dimensions `json:"dimensions"`     // Physical dimensions of the product
    Supplier       Supplier   `json:"supplier"`       // Supplier details
    Tags           []string   `json:"tags"`           // Tags for searching and filtering
    Image          string     `json:"image"`          // URLs of product images
    ManufacturedAt time.Time  `json:"manufacturedAt"` // Timestamp when the product was manufactured
    CreatedAt      time.Time  `json:"createdAt"`      // Timestamp when the product was created
    UpdatedAt      time.Time  `json:"updatedAt"`      // Timestamp when the product was last updated
}

var products = []Product{
    {
        ID:          "p1",
        Name:        "Wireless Mouse",
        Category:    "Electronics",
        Description: "A high-precision wireless mouse with ergonomic design.",
        Price:       29.99,
        Stock:       150,
        Dimensions: Dimensions{
            Length: 11.5,
            Width:  6.0,
            Height: 3.5,
            Weight: 0.2,
        },
        Supplier: Supplier{
            Name:    "Tech Supplies Inc.",
            Contact: "support@techsupplies.com",
            Address: "123 Tech Street, Silicon Valley, CA",
        },
        Tags:           []string{"wireless", "mouse", "electronics", "accessories"},
        Image:          "https://example.com/images/mouse1.jpg",
        ManufacturedAt: time.Now().AddDate(0, -30, 0),
        CreatedAt:      time.Now().AddDate(0, -1, 0),
        UpdatedAt:      time.Now().AddDate(0, -1, 0),
    },
    {
        ID:          "p2",
        Name:        "Gaming Keyboard",
        Category:    "Electronics",
        Description: "Mechanical keyboard with customizable RGB lighting.",
        Price:       79.99,
        Stock:       75,
        Dimensions: Dimensions{
            Length: 45.0,
            Width:  15.0,
            Height: 3.8,
            Weight: 1.1,
        },
        Supplier: Supplier{
            Name:    "Gaming Gear Ltd.",
            Contact: "info@gaminggear.com",
            Address: "456 Gaming Road, Austin, TX",
        },
        Tags:           []string{"keyboard", "gaming", "RGB", "electronics"},
        Image:          "https://example.com/images/keyboard2.jpg",
        ManufacturedAt: time.Now().AddDate(0, -20, 0),
        CreatedAt:      time.Now().AddDate(0, -2, 0),
        UpdatedAt:      time.Now().AddDate(0, -2, 0),
    },
}

func main() {
    router := gin.Default()
    router.GET("/products",
        append(productQueriesValidators(), getProducts)...,
    )
    router.GET("/products/:id",
        append(productParamIdValidators(), getProduct)...,
    )
    router.DELETE("/products/:id",
        append(productParamIdValidators(), deleteProduct)...,
    )
    router.POST("/products",
        append(productBodyValidators(), postProduct)...,
    )
    router.PUT("/products/:id",
        append(append(productParamIdValidators(), productBodyValidators()...), putProducts)...,
    )
    router.Run(":8080")
}

func productQueriesValidators() gin.HandlersChain {
    return gin.HandlersChain{
        gv.NewQuery("q", nil).Chain().Optional().Trim(" ").Not().Empty(nil).Validate(),
        gv.NewQuery("order", nil).Chain().Optional().Trim(" ").In([]string{"asc", "desc"}).Validate(),
    }
}

func productParamIdValidators() gin.HandlersChain {
    return gin.HandlersChain{gv.NewParam("id", nil).Chain().Trim(" ").Alphanumeric(nil).Validate()}
}

func productBodyValidators() gin.HandlersChain {
    var (
        minDesc         uint     = 5
        maxDesc         uint     = 100
        minStock        int      = 0
        validCategories []string = []string{"Electronics", "Apparels", "Groceries", "Home-Appliances"}
    )

    return gin.HandlersChain{
        gv.NewBody("name", nil).Chain().Not().Empty(nil).Validate(),
        gv.NewBody("category", nil).Chain().In(validCategories).Validate(),
        gv.NewBody("description", nil).Chain().Length(&vgo.IsLengthOpts{Min: uint(minDesc), Max: &maxDesc}).Validate(),
        gv.NewBody("price", nil).Chain().Decimal(&vgo.IsDecimalOpts{DecimalDigits: vgo.DecimalDigits{Min: 2}, ForceDecimal: false, Locale: "en-US"}).Validate(),
        gv.NewBody("stock", nil).Chain().Int(&vgo.IsIntOpts{Min: &minStock}).Validate(),
        gv.NewBody(`dimensions.length`, nil).Chain().Numeric(nil).Validate(),
        gv.NewBody("dimensions.width", nil).Chain().Numeric(nil).Validate(),
        gv.NewBody("dimensions.height", nil).Chain().Numeric(nil).Validate(),
        gv.NewBody("dimensions.weight", nil).Chain().Numeric(nil).Validate(),
        gv.NewBody("supplier.name", nil).Chain().Trim(" ").Not().Empty(nil).Validate(),
        gv.NewBody("supplier.contact", nil).Chain().Email(nil).Validate(),
        gv.NewBody("supplier.address", nil).Chain().Matches(regexp.MustCompile(`^\d+\s[\w\s]+,\s[\w\s]+,\s[A-Z]{2}$`)).Validate(),
        gv.NewBody("tags", nil).Chain().Array(nil).Validate(),
        gv.NewBody("image", nil).Chain().URL(nil).Validate(),
        gv.NewBody("manufacturedAt", nil).Chain().Date(&vgo.IsDateOpts{Format: vgo.ISO8601ZuluLayout, StrictMode: true}).After(&vgo.IsAfterOpts{ComparisonDate: "2020-05-10T00:00:00Z"}).Validate(),
    }
}

func getProducts(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    if len(result) != 0 {
        c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
            "message": "The server encountered validation error",
            "data":    nil,
            "errors":  result,
        })
        return
    }

    c.AbortWithStatusJSON(http.StatusOK, gin.H{
        "message": "The products found successfully",
        "data":    products,
        "errors":  nil,
    })
}

func getProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    if len(result) != 0 {
        c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
            "message": "The server encountered validation error",
            "data":    nil,
            "errors":  result,
        })
        return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var product *Product

    for _, p := range products {
        if p.ID == id {
            product = &p
            break
        }
    }

    if product == nil {
        c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
            "message": fmt.Sprintf("Product with id %s, not found", id),
            "data":    nil,
            "errors":  nil,
        })
        return
    } else {
        c.AbortWithStatusJSON(http.StatusOK, gin.H{
            "message": "The product found successfully",
            "data":    product,
            "errors":  nil,
        })
        return
    }
}

func deleteProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    if len(result) != 0 {
        c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
            "message": "The server encountered validation error",
            "data":    nil,
            "errors":  result,
        })
        return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": "The server encountered an unexpected error.",
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var deletedProduct *Product
    var filteredProducts = []Product{}

    for _, prod := range products {
        if prod.ID == id {
            deletedProduct = &prod
            break
        } else {
            filteredProducts = append(filteredProducts, prod)
        }
    }

    if deletedProduct == nil {
        c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
            "message": fmt.Sprintf("Product with id %s, not found", id),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    products = filteredProducts
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
        "message": fmt.Sprintf("Product with id %s, deleted", id),
        "data":    deletedProduct,
        "errors":  nil,
    })
}

func postProduct(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    if len(result) != 0 {
        c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
            "message": "The server encountered validation error",
            "data":    nil,
            "errors":  result,
        })
        return
    }

    var newProduct Product

    if err := c.BindJSON(&newProduct); err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    newProduct.ID = fmt.Sprintf("p%d", len(products)+1)
    newProduct.CreatedAt = time.Now()
    newProduct.UpdatedAt = newProduct.CreatedAt

    products = append(products, newProduct)
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
        "message": fmt.Sprintf("Product with id %s, has been created", newProduct.ID),
        "data":    newProduct,
        "errors":  nil,
    })
}

func putProducts(c *gin.Context) {
    result, err := gv.ValidationResult(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    if len(result) != 0 {
        c.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
            "message": "The server encountered validation error",
            "data":    nil,
            "errors":  result,
        })
        return
    }

    var newProduct Product

    if err := c.BindJSON(&newProduct); err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": fmt.Sprintf("The server encountered an unexpected error: %v", err),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    data, err := gv.GetMatchedData(c)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
            "message": "The server encountered an unexpected error.",
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    id, _ := data.Get(gv.ParamLocation, "id")

    var EditedProduct *Product
    var newProducts = make([]Product, len(products))

    for ind, prod := range products {
        if prod.ID == id {
            newProduct.ID = id
            newProduct.CreatedAt = prod.CreatedAt
            newProduct.UpdatedAt = time.Now()
            newProducts[ind] = newProduct
            EditedProduct = &newProduct
        } else {
            newProducts[ind] = prod
        }
    }

    if EditedProduct == nil {
        c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
            "message": fmt.Sprintf("Product with id %s, not found", id),
            "data":    nil,
            "errors":  nil,
        })
        return
    }

    products = newProducts
    c.AbortWithStatusJSON(http.StatusOK, gin.H{
        "message": fmt.Sprintf("Product with id %s, has been edited", id),
        "data":    EditedProduct,
        "errors":  nil,
    })
}

Simplifying String Validation in Go: Introducing validatorgo

Gbubemi Attah — Thu, 14 Nov 2024 10:26:59 +0000

A library of string validators and sanitizers, based on the js library validator.js

Why Choose validatorgo?

Why not use popular Go libraries like Package validator or govalidator? While both libraries are well-known, validatorgo focuses on standalone string validation and provides an extensive collection of customizable validators inspired by validator.js, which neither of these Go libraries fully implement.

Here’s how validatorgo stands out compared to go-playground/validator and govalidator:

1. Compared to `go-playground/validator`

Direct String Validation: go-playground/validator is primarily built for validating struct fields using tags, which is ideal for handling JSON or struct-based data. However, it’s not designed for validating individual strings, which ValidatorGo does seamlessly, without the need for struct tags or additional setup.
Performance: go-playground/validator relies on reflection to dynamically inspect struct tags. While powerful, reflection can introduce performance overhead—especially when large or complex data structures are validated. validatorgo avoids reflection, which boosts performance, making it faster and more efficient for scenarios where single-field validations are needed.

2. Compared to `asaskevich/govalidator`

Customization and Flexibility: govalidator provides a range of validators for strings, but validatorgo enhances flexibility by allowing specific options and configurations for individual validators. For example, date formats or locale specifications can be customized, giving developers more control over validation rules tailored to project needs.

Project Motivation

I created validatorgo to serve as a dependency for another Go library called ginvalidator, which validates HTTP requests in Go web applications. Inspired by express-validator, the popular validation library for Node.js and Express, ValidatorGo fills a gap in the Go ecosystem for efficient, customizable, and straightforward string validation. Since other libraries were either overkill, lacked functionality, or didn’t meet my use case, I built validatorgo to offer a practical solution.

Installation

Using go get.

 go get github.com/bube054/validatorgo

Then import the package into your own code.

 import (
   "fmt"
   "github.com/bube054/validatorgo"
 )

If you are unhappy using the long validatorgo package name, you can do this.

 import (
   "fmt"
   vgo "github.com/bube054/validatorgo"
 )

Simple validator example

 func main(){
   id := "5f2a6c69e1d7a4e0077b4e6b"
   validId := vgo.IsMongoID(id)
   fmt.Println(validId) // true
 }

Some Validators

Below is a list of validators provided by the validatorgo package, which covers various string formats and types, making it versatile for multiple validation needs.

Validator	Description
`Contains`	Checks if a string contains a specified substring.
`Equals`	Validates if a string is exactly equal to a comparison string.
`IsAbaRouting`	Checks if the string is a valid ABA routing number (US bank accounts).
`IsAfter`	Validates if a date string is after a specified date.
`IsAlpha`	Ensures the string contains only letters (a-zA-Z).
`IsAlphanumeric`	Validates if a string contains only letters and numbers.
`IsAscii`	Checks if the string contains only ASCII characters.
`IsBase32`	Checks if the string is a valid Base32 encoded value.
`IsBase64`	Validates if a string is in Base64 encoding.
`IsBefore`	Ensures the date is before a specified date.
`IsBoolean`	Checks if the string is either "true" or "false".
`IsCreditCard`	Validates if the string is a valid credit card number.
`IsCurrency`	Checks if the string is a valid currency format.
`IsDate`	Validates if a string is a valid date.
`IsDecimal`	Ensures the string represents a valid decimal number.
`IsEmail`	Checks if the string is a valid email address format.
`IsEmpty`	Validates if a string is empty.
`IsFQDN`	Checks if the string is a fully qualified domain name.
`IsFloat`	Ensures the string represents a floating-point number.
`IsHexColor`	Validates if a string is a valid hex color (e.g., #FFFFFF).
`IsIP`	Checks if the string is a valid IP address (IPv4 or IPv6).
`IsISO8601`	Validates if the string is in ISO8601 date format.
`IsLength`	Checks if the string’s length is within a specified range.
`IsMimeType`	Validates if the string is a valid MIME type.
`IsMobilePhone`	Checks if the string is a valid mobile phone number for specified locales.
`IsMongoID`	Validates if the string is a valid MongoDB ObjectID.
`IsNumeric`	Ensures the string contains only numeric characters.
`IsPostalCode`	Checks if the string is a valid postal code for specified locale.
`IsRFC3339`	Validates if the string is in RFC3339 date format.
`IsSlug`	Checks if the string is URL-friendly (only letters, numbers, and dashes).
`IsStrongPassword`	Ensures the string meets common password strength requirements.
`IsURL`	Validates if the string is a URL.
`IsUUID`	Checks if the string is a valid UUID (versions 1-5).
`IsUpperCase`	Ensures the string is all uppercase.
`IsVAT`	Checks if the string is a valid VAT number for specified countries.
`Matches`	Validates if the string matches a specified regular expression.

This table should cover most validators currently available in validatorgo. Make sure to refer to the package's documentation for more detailed usage of each validator.

⚠ Caution

When using a validator that requires an options struct (either a pointer or non-pointer), always provide values for all the struct fields explicitly.
Unlike in validator.js, where missing fields are automatically set to defaults, Go uses strict types.
This means missing values will default to false for booleans, 0 for number types, etc.
Not specifying all fields could lead to unexpected behavior if you're used to the JavaScript version.

Examples

  // do this (using the default options specified in the docs)
  ok := validatorgo.IsFQDN("example", nil)

  // or this (explicitly setting all possible fields for the structs)
  ok := validatorgo.IsFQDN("example", &validatorgo.IsFQDNOpts{
    RequireTld: false,
    AllowUnderscores: false,
    AllowTrailingDot: true,
    AllowNumericTld: false,
    IgnoreMaxLength: true
  })

  // but rarely this(not explicitly setting all possible fields)
  ok := validatorgo.IsFQDN("example", &validatorgo.IsFQDNOpts{ RequireTld: false, })

Simple sanitizer example

  import (
   "fmt"
   "github.com/bube054/validatorgo/sanitizer"
 )

 func main(){
   str := sanitizer.Whitelist("Hello123 World!", "a-zA-Z")
   fmt.Println(str) // "HelloWorld"
 }

Sanitizers

Sanitizer	Description
`Trim`	Removes whitespace from both ends of the string.
`LTrim`	Removes whitespace from the left side of the string.
`RTrim`	Removes whitespace from the right side of the string.
`ToLower`	Converts the entire string to lowercase.
`ToUpper`	Converts the entire string to uppercase.
`Escape`	Escapes HTML characters in the string to prevent injection attacks.
`Unescape`	Reverts escaped HTML characters back to normal characters.
`NormalizeEmail`	Standardizes an email address, e.g., removing dots in Gmail addresses.
`Blacklist`	Removes characters from the string that match specified characters or patterns.
`Whitelist`	Retains only characters in the string that match specified characters or patterns.
`Replace`	Replaces occurrences of a substring with a specified replacement.
`StripLow`	Removes control characters, optionally allowing some specified ones.
`TrimSpace`	Trims all types of whitespace from both ends of the string.
`ToBoolean`	Converts common truthy and falsy values in strings into boolean `true` or `false`.
`ToInt`	Converts a numeric string into an integer, if possible.
`ToFloat`	Converts a numeric string into a floating-point number, if possible.

These sanitizers are often used to ensure data consistency and security by stripping out or modifying potentially unwanted or dangerous characters.

Make sure to refer to the official validatorgo documentation for specific implementations and examples of each sanitizer.

Summary

validatorgo is the ideal choice if you need:

Efficient, reflection-free validations for individual fields without the performance costs associated with struct-based reflection.
Highly customizable validation options that align with modern data formats, providing the same robustness as validator.js.

With validatorgo, you get a tool specifically designed for string validation, supporting both standalone and web application requirements in Go.

Maintainers

bube054 - Attah Gbubemi David (author)

Simplify Gin Input Validation in Go with ginvalidator

Gbubemi Attah — Wed, 13 Nov 2024 18:38:22 +0000

Overview

ginvalidator is a set of Gin middlewares that wraps the extensive collection of validators and sanitizers offered by my other open source package validatorgo. It also uses the popular open-source package gjson for JSON field syntax, providing efficient querying and extraction of data from JSON objects.

It allows you to combine them in many ways so that you can validate and sanitize your Gin requests, and offers tools to determine if the request is valid or not, which data was matched according to your validators.

It is based on the popular js/express library express-validator

Support

This version of ginvalidator requires that your application is running on Go 1.16+.
It's also verified to work with Gin 1.x.x.

Rationale

Why not use?

Handwritten Validators: You could write your own validation logic manually, but that gets repetitive and messy fast. Every time you need a new validation, you’re writing the same kind of code over and over. It’s easy to make mistakes, and it’s a pain to maintain.
Gin's Built-in Model Binding and Validation: Gin has validation built in, but it’s not ideal for everyone. Struct tags are limiting and make your code harder to read, especially when you need complex rules. Plus, the validation gets tied too tightly to your models, which isn't great for flexibility.
Other Libraries (like Galidator): There are other libraries out there, but they often feel too complex for what they do. They require more setup and work than you’d expect, especially when you just want a simple, straightforward solution for validation.

Installation

Make sure you have Go installed on your machine.

Step 1: Create a New Go Module

Create an empty folder with a name of your choice.
Open a terminal, navigate (cd) into that folder, and initialize a new Go module:

go mod init example.com/learning

Step 2: Install Required Packages

Use go get to install the necessary packages.

Install Gin:

go get -u github.com/gin-gonic/gin

Install ginvalidator:

go get -u github.com/bube054/ginvalidator

Getting Started

One of the best ways to learn something is by example! So let's roll the sleeves up and get some coding happening.

Setup

The first thing that one needs is a Gin server running. Let's implement one that says hi to someone; for this, create a main.go then add the following code:

package main

import (
    "net/http"

    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello", func(ctx *gin.Context) {
        person := ctx.Query("person")
        ctx.String(http.StatusOK, "Hello, %s!", person)
    })

    r.Run() // listen and serve on 0.0.0.0:8080
}

Now run this file by executing go run main.go on your terminal.

go run main.go

The HTTP server should be running, and you can open http://localhost:8080/hello?person=John to salute John!

💡 Tip:
You can use Air with Go and Gin to implement live reload. These automatically restart the server whenever a file is changed, so you don't have to do this yourself!

Adding a validator

So the server is working, but there are problems with it. Most notably, you don't want to say hello to someone when the person's name is not set.
For example, going to http://localhost:8080/hello will print "Hello, ".

That's where ginvalidator comes in handy. It provides validators, sanitizers and modifiers that are used to validate your request.
Let's add a validator and a modifier that checks that the person query string cannot be empty, with the validator named Empty and modifier named Not:

package main

import (
    "net/http"

    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello", gv.NewQuery("person", nil).
        Chain().
        Not().
        Empty(nil).
        Validate(), func(ctx *gin.Context) {
            person := ctx.Query("person")
            ctx.String(http.StatusOK, "Hello, %s!", person)
        })

    r.Run()
}

📝 Note:

For brevity, gv is used as an alias for ginvalidator in the code examples.

Now, restart your server, and go to http://localhost:8080/hello again. Hmm, it still prints "Hello, !"... why?

Handling validation errors

ginvalidator validation chain does not report validation errors to users automatically.
The reason for this is simple: as you add more validators, or for more fields, how do you want to collect the errors? Do you want a list of all errors, only one per field, only one overall...?

So the next obvious step is to change the above code again, this time verifying the validation result with the ValidationResult function:

package main

import (
    "net/http"

    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello",
        gv.NewQuery("person", nil).
            Chain().
            Not().
            Empty(nil).
            Validate(),
        func(ctx *gin.Context) {
            result, err := gv.ValidationResult(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            if len(result) != 0 {
                ctx.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
                    "errors": result,
                })
                return
            }

            person := ctx.Query("person")
            ctx.String(http.StatusOK, "Hello, %s!", person)
        })

    r.Run()
}

Now, if you access http://localhost:8080/hello again, you’ll see the following JSON content, formatted for clarity:

{
  "errors": [
    {
      "location": "queries",
      "message": "Invalid value",
      "field": "person",
      "value": ""
    }
  ]
}

Now, what this is telling us is that

there's been exactly one error in this request;
this field is called person;
it's located in the query string (location: "queries");
the error message that was given was "Invalid value".

This is a better scenario, but it can still be improved. Let's continue.

Creating better error messages

All request location validators accept an optional second argument, which is a function used to format the error message. If nil is provided, a default, generic error message will be used, as shown in the example above.

package main

import (
    "net/http"

    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello",
        gv.NewQuery("person",
            func(initialValue, sanitizedValue, validatorName string) string {
                return "Please enter your name."
            },
        ).Chain().
            Not().
            Empty(nil).
            Validate(),
        func(ctx *gin.Context) {
            result, err := gv.ValidationResult(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            if len(result) != 0 {
                ctx.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
                    "errors": result,
                })
                return
            }

            person := ctx.Query("person")
            ctx.String(http.StatusOK, "Hello, %s!", person)
        })

    r.Run()
}

Now if you access http://localhost:8080/hello again, what you'll see is the following JSON content, with the new error message:

{
  "errors": [
    {
      "location": "queries",
      "message": "Please enter your name.",
      "field": "person",
      "value": ""
    }
  ]
}

Accessing validated/sanitized data

You can use GetMatchedData, which automatically collects all data that ginvalidator has validated and/or sanitized. This data can then be accessed using the Get method of MatchedData:

package main

import (
    "net/http"

    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello",
        gv.NewQuery("person",
            func(initialValue, sanitizedValue, validatorName string) string {
                return "Please enter your name."
            },
        ).Chain().
            Not().
            Empty(nil).
            Validate(),
        func(ctx *gin.Context) {
            result, err := gv.ValidationResult(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            if len(result) != 0 {
                ctx.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
                    "errors": result,
                })
                return
            }

            data, err := gv.GetMatchedData(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            person, ok := data.Get(gv.QueryLocation, "person")
            if !ok {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            ctx.String(http.StatusOK, "Hello, %s!", person)
        })

    r.Run()
}

open http://localhost:8080/hello?person=John to salute John!

The available locations are BodyLocation, CookieLocation QueryLocation, ParamLocation and HeaderLocation.
Each of these locations includes a String method that returns the location where validated/sanitized data is being stored.

Sanitizing inputs

While the user can no longer send empty person names, it can still inject HTML into your page! This is known as the Cross-Site Scripting vulnerability (XSS).
Let's see how it works. Go to http://localhost:8080/hello?person=<b>John</b>, and you should see "Hello, John!".
While this example is fine, an attacker could change the person query string to a <script> tag which loads its own JavaScript that could be harmful.
In this scenario, one way to mitigate the issue with ginvalidator is to use a sanitizer, most specifically Escape, which transforms special HTML characters with others that can be represented as text.

package main

import (
    "net/http"

    gv "github.com/bube054/ginvalidator"
    "github.com/gin-gonic/gin"
)

func main() {
    r := gin.Default()

    r.GET("/hello",
        gv.NewQuery("person",
            func(initialValue, sanitizedValue, validatorName string) string {
                return "Please enter your name."
            },
        ).Chain().
            Not().
            Empty(nil).
            Escape(). // Added sanitizer
            Validate(),
        func(ctx *gin.Context) {
            result, err := gv.ValidationResult(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            if len(result) != 0 {
                ctx.AbortWithStatusJSON(http.StatusUnprocessableEntity, gin.H{
                    "errors": result,
                })
                return
            }

            data, err := gv.GetMatchedData(ctx)
            if err != nil {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            person, ok := data.Get(gv.QueryLocation, "person")
            if !ok {
                ctx.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{
                    "message": "The server encountered an unexpected error.",
                })
                return
            }

            ctx.String(http.StatusOK, "Hello, %s!", person)
        })

    r.Run()
}

Now, if you restart the server and refresh the page, what you'll see is "Hello, <b>John<b>!". Our example page is no longer vulnerable to XSS!

⚠️ Caution:

ginvalidator does not modify http.Request values during sanitization. To access sanitized data, always use the GetMatchedData function.

The Validation Chain

The validation chain is one of the main concepts in ginvalidator, therefore it's useful to learn about it, so that you can use it effectively.

But don't worry: if you've read through the Getting Started guide, you have already used validation chains without even noticing!

What are validation chains?

Validation chains are created using the following functions, each targeting a specific location in the HTTP request:

NewBody: Validates data from the http.Request body. Its location is BodyLocation.
NewCookie: Validates data from the http.Request cookies. Its location is CookieLocation.
NewHeader: Validates data from the http.Request headers. Its location is HeaderLocation.
NewParam: Validates data from the Gin route parameters. Its location is ParamLocation.
NewQuery: Validates data from the http.Request query parameters. Its location is QueryLocation.

They have this name because they wrap the value of a field with validations (or sanitizations), and each of its methods returns itself.
This pattern is usually called method chaining, hence why the name validation chain.

Validation chains not only have a number of useful methods for defining validations, sanitizations and modifications but they also have methods Validate which returns the Gin middleware handler function.

This is an example of how validation chains are usually used, and how you can read one:

  r.Get(
    "newsletter",
    // For the `email` field in ctx.GetRawData()...
    gv.NewBody("email", nil)
    // the actual validation chain
    .Chain()
    // ...mark the field as optional
    .Optional()
    // ...and when it's present, trim its value, then validate it as an email address
    .Trim("")
    .Email(nil),
    maybeSubscribeToNewsletter,
  )

Features

A validation chain has three kinds of methods: validators, sanitizers and modifiers.

Validators determine if the value of a request field is valid. This means checking if the field is in the format that you expect it to be. For example, if you're building a sign up form, your requirements could be that the username must be an e-mail address, and that passwords must be at least 8 characters long.

If the value is invalid, an error is recorded for that field using some error message. This validation error can then be retrieved at a later point in the Gin route handler and returned to the user.

They are:

Sanitizers transform the field value. They are useful to remove noise from the value and perhaps even to provide some basic line of defense against threats.

Sanitizers persist the updated fields value back into the Gin Contexts, so that it's usable by other ginvalidator functions, your own route handler code, and even other middlewares.

They are:

Modifiers define how validation chains behave when they are run.

They are:

📝 Note:

These methods are thoroughly documented using GoDoc within the pkg.go.dev ginvalidator documentation. If any details are unclear, you may also want to refer to related functions within the validatorgo package for additional context, which I’ll be explaining below.

Standard validators/sanitizers

All of the functionality exposed by the validation chain actually comes from validatorgo, one of my other open source go packages which specializes in string validation/sanitation. Please check it out, star and share 🙏🙏🙏, Thank You.

This includes all of validatorgo validators and sanitizers, from commonly used IsEmail, IsLength, and Trim to the more niche IsISBN, IsMultibyte and StripLow!

These are called standard validators and standard sanitizers in ginvalidator. But without the Is prefix from validatorgo.

Chaining order

The order in which you call methods on a validation chain usually matters.
They are almost always run in the order that they are specified, therefore you can tell what a validation chain will do just by reading its definition, from first chained method to last.

Take the following snippet as an example:

// Validate if search_query is not empty, then trim it
NewQuery("search_query", nil).Chain().Not().Empty().Trim("").Validate();

In this case, if the user passes a "search_query" value that is composed of whitespaces only, it won't be empty, therefore the validation passes. But since the .Trim() sanitizer is there, the whitespace's will be removed, and the field will become empty, so you actually end up with a false positive.

Now, compare it with the below snippet:

// Trim search_query, then validate if it's not empty
NewQuery("search_query", nil).Chain().Trim("").Not().Empty().Validate();

This chain will more sensibly remove whitespace's, and then validate if the value is not empty.

One exception to this rule is .Optional(): It can be placed at any point in the chain and it will mark the chain as optional.

Reusing validation chains

If you wish to reuse the same chain, it's a good idea to return them from functions:

func createEmailValidator() gin.HandlerFunc {
  return gv.NewBody("email", nil).Chain().Email(nil).Validate()
}

func handleLoginRoute(ctx *gin.Context) {
  // Handle login route
}

func handleSignupRoute(ctx *gin.Context) {
  // Handle signup route
}

r.POST("/login", createEmailValidator(), handleLoginRoute)
r.POST("/signup", createEmailValidator(), handleSignupRoute)

Field Selection

In ginvalidator, a field is any value that is either validated or sanitized and it is string.

Pretty much every function or value returned by ginvalidator reference fields in some way. For this reason, it's important to understand the field path syntax both for when selecting fields for validation, and when accessing the validation errors or validated data.

Syntax

Body fields are only valid for the following Content-Types:
- application/json: This uses GJSON path syntax for extracting values. Please refer to the linked documentation for details.
- Example:
```
  {
    "user": {
      "name": "John",
      "email": "john.doe@example.com"
    }
  }
```
With path user.name, the extracted value would be "John".
- application/x-www-form-urlencoded: Typically used for HTML form submissions. Fields are submitted as key-value pairs in the body.
- Example:
```
  Content-Type: application/x-www-form-urlencoded
```
Body:
```
  name=John&email=john.doe@example.com
```
Field "name" would have the value "John", and "email" would have the value "john.doe@example.com".
- multipart/form-data: Commonly used for file uploads or when submitting form data with files.
- Example:
```
  Content-Type: multipart/form-data
```
Body:
```
  --boundary
  Content-Disposition: form-data; name="name"

  John
  --boundary
  Content-Disposition: form-data; name="file"; filename="resume.pdf"
  Content-Type: application/pdf

  [binary data]
  --boundary--
```
Field "name" would have the value "John", and "file" would be the uploaded file.
Query fields correspond to URL search parameters, and their values are automatically url unescaped by Gin.

Examples:
- Field: "name", Value: "John"
```
/hello?name=John
```
- Field: "full_name", Value: "John Doe"
```
/hello?full_name=John%20Doe
```
Param fields represent URL path parameters, and their values are automatically unescaped by ginvalidator.

Example:
- Field: "id", Value: "123"
```
/users/:id
```
Header fields are HTTP request headers, and their values are not unescaped. A log warning will appear if you provide a non-canonical header key.

Example:
- Field: "User-Agent", Value: "Mozilla/5.0"
```
Header: "User-Agent", Value: "Mozilla/5.0"
```
Cookies fields are HTTP cookies, and their values are automatically url unescaped by Gin.

Example:
- Field: "session_id", Value: "abc 123"
```
Cookie: "session_id=abc%20123"
```

Customizing express-validator

If the server you're building is anything but a very simple one, you'll need validators, sanitizers and error messages beyond the ones built into ginvalidator sooner or later.

Custom Validators and Sanitizers

A classic need that ginvalidator can't fulfill for you, and that you might run into, is validating whether an e-mail address is in use or not when a user signing up.

It's possible to do this in ginvalidator by implementing a custom validator.

A CustomValidator is a method available on the validation chain, that receives a special function CustomValidatorFunc, and have to returns a boolean that will determine if the field is valid or not.

A CustomSanitizer is also a method available on the validation chain, that receives a special function CustomSanitizerFunc, and have to returns the new sanitized value.

Implementing a custom validator

A CustomValidator can be asynchronous by using goroutines and a sync.WaitGroup to handle concurrent operations. Within the validator, you can spin up goroutines for each asynchronous task, adding each task to the WaitGroup. Once all tasks complete, the validator should return a boolean.

For example, in order to check that an e-mail is not in use:

func isUserPresent(email string) bool {
    return email == "existing@example.com"
}

r.POST("/create-user",
    gv.
      NewBody("email", nil).
      Chain().
      CustomValidator(
        func(req *http.Request, initialValue, sanitizedValue string) bool {
          var exists bool
          var wg sync.WaitGroup
          wg.Add(1)

          go func() {
            defer wg.Done()
            exists = isUserPresent(sanitizedValue)
          }()

          wg.Wait()

          return !exists
        },
      ).
      Validate(),

    func(ctx *gin.Context) {
      // Handle the request
    },
)

Or maybe you could also verify that the password matches the repeat:

type createUser struct {
  Password             string `json:"password"`
  PasswordConfirmation string `json:"passwordConfirmation"`
}

r.POST("/create-user",
    gv.NewBody("password", nil).
    Chain().
    Matches(regexp.MustCompile(`^[A-Za-z\d]{8,}$`)).
    Validate(),
  gv.NewBody("passwordConfirmation", nil).
    Chain().
    CustomValidator(func(req *http.Request, initialValue, sanitizedValue string) bool {
      data, err := io.ReadAll(req.Body)
      if err != nil {
      return false
      }

      // Refill the request body to allow further reads, if needed.
      req.Body = io.NopCloser(bytes.NewBuffer(data))

      var user createUser
      json.Unmarshal(data, &user)

      return sanitizedValue == user.PasswordConfirmation
    }).
    Validate(),
  func(ctx *gin.Context) {
    // Handle request
  },
)

⚠️ Caution:
If the request body will be accessed multiple times—whether in the same validation chain, in another validation chain for the same request context, or in subsequent handlers—ensure you reset the request body after each read. Failing to do so can lead to errors or missing data when the body is read again.

Implementing a custom sanitizer

CustomSanitizer don't have many rules. Whatever the value that they return, is the new value that the field will acquire.
Custom sanitizers can also be asynchronous by using goroutines and a sync.WaitGroup to handle concurrent operations.

r.POST("/user/:id",
    gv.NewParam("id", nil).
      Chain().
      CustomSanitizer(
        func(req *http.Request, initialValue, sanitizedValue string) string {
          return strings.Repeat(sanitizedValue, 3) // some string manipulation
        },
      ).
      Validate(),

    func(ctx *gin.Context) {
      // Handle request
    },
)

Error Messages

Whenever a field value is invalid, an error message is recorded for it.
The default error message is "Invalid value", which is not descriptive at all of what the error is, so you might need to customize it. You can customize by

gv.NewBody("email",
    func(initialValue, sanitizedValue, validatorName string) string {
        switch validatorName {
        case gv.EmailValidatorName:
            return "Email is not valid."
        case gv.EmptyValidatorName:
            return "Email is empty."
        default:
            return gv.DefaultValChainErrMsg
        }
    },
).
Chain().
Not().Empty(nil).
Email(nil).
Validate()

initialValue is the original value extracted from the request (before any sanitization).
sanitizedValue is the value after it has been sanitized (if applicable).
validatorName is the name of the validator that failed, which helps identify the validation rule that did not pass.

For a complete list of validator names, refer to the ginvalidator constants.

Maintainers

bube054 - Attah Gbubemi David (author)

DEV Community: Gbubemi Attah

I built ginvalidator — middleware-based request validation for Gin, modeled on express-validator

Quick taste

What goes in a chain

Five places to look

A few things I'm really happy with

How errors look

Where this came from

If this is useful to you

Links

validatorgo v1.0.0 is here 🎉 — the validator.js you've been missing in Go

Why I bothered

Quick taste

What's actually in it

A few things I'm happy with

Why v1.0.0 and not v0.x.something

If this is useful to you

Links

Shipped v2 of go-js-array-methods — JS-style Filter, Map, Reduce for Go slices

Quick taste

What's in it

A few things worth knowing

A couple of patterns I find myself using

If this is useful to you

Links

Introducing jsonvx: The Most Customisable JSON Parser, Querier & Formatter for Go

Why jsonvx Stands Out

Quick Start Example

Feature Highlights at a Glance

Getting Started

Customization Options

Number Handling

Strings & Keys

Comments

JSON5 Preset

Closing Thoughts

I Built a Beam Analysis Tool Using Slope-Deflection! 🚀

Developing a Simple RESTful API with Gin, ginvalidator, and validatorgo

API endpoint design

Writing the Code

Final thoughts

Full Code

Simplifying String Validation in Go: Introducing validatorgo

Why Choose validatorgo?

1. Compared to go-playground/validator

2. Compared to asaskevich/govalidator

Project Motivation

Installation

Simple validator example

Some Validators

Simple sanitizer example

Sanitizers

Summary

Maintainers

Simplify Gin Input Validation in Go with ginvalidator

Overview

Support

Rationale

Installation

Step 1: Create a New Go Module

Step 2: Install Required Packages

Getting Started

Setup

Adding a validator

Handling validation errors

Creating better error messages

Accessing validated/sanitized data

Sanitizing inputs

The Validation Chain

What are validation chains?

Features

Standard validators/sanitizers

Chaining order

Reusing validation chains

Field Selection

Syntax

Customizing express-validator

Custom Validators and Sanitizers

Implementing a custom validator

Implementing a custom sanitizer

1. Compared to `go-playground/validator`

2. Compared to `asaskevich/govalidator`