DEV Community: Sandeep Dara

Building Flow-Aware Validation in JavaScript - Behind the Scenes of sd-is@1.0.7

Sandeep Dara — Fri, 25 Jul 2025 05:45:49 +0000

In many real-world applications, especially form-heavy or wizard-style interfaces, validation isn’t just about individual fields — it’s about what happens across steps, when and how data should be validated, and how users move through a flow.

This is where most validation libraries fall short. They’re either too rigid, too form-specific, or not aware of user progression.

So I decided to solve it.

🎯 The Goal: Flow-Aware Validation Engine

The idea was simple but ambitious:

Build a schema-driven, flow-aware, and lifecycle-sensitive validation system — one that not only validates data, but understands where the user is in a flow, and what needs to be validated when.

This led to the creation of the following core building blocks in sd-is v1.0.7:

🔧 Core Concepts Introduced

1. `defineFlowSchema()`

A declarative way to define a multi-step flow, where each step has:

Its own schema
Optional onEnter / onExit hooks for lifecycle-based validation
Execution order control

const flow = defineFlowSchema({
  steps: {
    account: {
      schema: defineSchema({ email: { type: 'string' }, password: { type: 'string' } }),
      onEnter: (data) => { /* validate access */ },
      onExit: (data) => { /* check password strength */ }
    },
    profile: {
      schema: defineSchema({ name: { type: 'string' } })
    }
  },
  order: ['account', 'profile']
});

2. `validateStep()` & `validateStepAsync()`

Validate a specific step in the flow — respecting its schema, onEnter/onExit hooks, and returning a clean verdict.

const result = validateStep(flow, 'account', data); // sync
const result = await validateStepAsync(flow, 'account', data); // async

Async mode is particularly helpful for:

API checks
Debounced validations
Async business logic (e.g., blocked email detection)

3. `createFlow()`

A full-blown flow controller built on top of defineFlowSchema, managing:

Step progression (.proceed())
Navigation (.back(), .restart())
Debug logs
State tracking

const flowEngine = createFlow(flow, { debug: true });

await flowEngine.proceed({ email: 'user@example.com', password: 'pass123' });
await flowEngine.proceed({ name: 'Tony Stark' });

flowEngine.back();      // go back a step
flowEngine.restart();   // restart the flow
console.log(flowEngine.getDebugLog());

🧪 What Makes It Different?

✅ Declarative: No spaghetti conditionals, no imperative mess
✅ Lifecycle-aware: onEnter and onExit give precise control over transitions
✅ Extendable: Schema validation can be synchronous or asynchronous
✅ Developer-first: Works great with logging, tracing, and testability
✅ Dependency-free: Zero external dependencies — just clean JS

💡 Use Cases

Multi-step forms (onboarding, checkout, profile setup)
Workflow engines
Survey builders
Any staged UI with dynamic rules

📦 Now on npm

npm install sd-is

📘 Docs & README
🧪 Fully tested — with test.js showcasing all capabilities

🛠️ What's Next?

The roadmap is exciting:

⚙️ Composable sub-flows
💡 Dynamic fix suggestions
🧩 Flow tracing with context
🔄 createFlowV – a versioned, extensible flow runner for enterprise logic

🧠 Closing Thoughts

Validation shouldn't be dumb. It should understand context, user progression, and logic over time.

This evolution of sd-is aims to make validation smarter, modular, and built for real-life flows, not just single-form fields.

If you're building form-heavy apps or complex flows — I’d love for you to give it a spin and share feedback!

→ GitHub: github.com/sandeepdara-sd/sd-is

→ NPM: sd-is

Let’s build better flows, together.

🚀 Introducing sd-is v1.0.6: A Tiny JavaScript Utility for Type Checking, Smart Validation & Schemas

Sandeep Dara — Tue, 15 Jul 2025 16:50:10 +0000

🔍 What is `sd-is`?

sd-is is a zero-dependency, blazing-fast JavaScript utility library for:

✅ Clean runtime type checks
🧠 Smart validation with auto-fix suggestions
📋 Schema definition + enforcement
🔒 Emoji-enhanced developer-friendly errors

It’s like typeof, instanceof, and Array.isArray — but smarter and cleaner.

✨ What's New in `v2.0+`

Feature	Description
✅ `assertType()`	Enforce expected type at runtime
📋 `defineSchema()`	Declaratively define reusable schemas
🧪 `validateAgainst()`	Validate data against your schema (enums, custom, nested)
🧠 `smartCheck`	Check + explain + suggest fixes in human-readable format
➕ Bonus Checks	New utils: `isDate`, `isPromise`, `isSymbol`, `isRegExp`, `listFunctions`

📦 Installation

npm install sd-is

Supports CommonJS, ESM, and is fully tree-shakable.

✅ Type Checking Basics

import {
  isString,
  isNumber,
  isBoolean,
  isUndefined,
  isNotUndefined,
  isEmptyObject,
  isEmptyArray,
  isPlainObject
} from 'sd-is';

console.log(isString('hello'));          // true
console.log(isNumber(123));              // true
console.log(isBoolean(false));           // true
console.log(isEmptyArray([]));           // true
console.log(isPlainObject({ a: 1 }));    // true
console.log(isUndefined(undefined));     // true
console.log(isNotUndefined(42));         // true

🧠 smartCheck: Check + Explain + Fix

import { smartCheck } from 'sd-is';

const result = smartCheck.isEmptyObject({ x: 1 });

console.log(result.ok);        // false
console.log(result.verdict);   // ❌ Not empty or not a valid object
console.log(result.reason);    // Found 1 key(s): x
console.log(result.fix());     // {}

🔒 assertType: Catch Mistakes Early

import assertType from 'sd-is/utils/assertType.js';

assertType('hello', 'string');       // ✅
assertType(42, 'string');            // ❌ Throws: expected 'string', got 'number'

📋 defineSchema + validateAgainst

import defineSchema from 'sd-is/utils/defineSchema.js';
import validateAgainst from 'sd-is/utils/validateAgainst.js';

const productSchema = defineSchema({
  id: { type: 'string' },
  price: { type: 'number', default: 0 },
  category: { type: ['string', 'undefined'], optional: true },
  tags: { type: 'array', default: [] },
  status: { enum: ['active', 'inactive'] },
  createdAt: {
    type: 'string',
    custom: (val) =>
      /\d{4}-\d{2}-\d{2}/.test(val) || 'Must be in YYYY-MM-DD format'
  }
});

const product = {
  id: 'p-001',
  price: 89,
  tags: ['electronics', 'sale'],
  status: 'active',
  createdAt: '2025-07-14'
};

const result = validateAgainst(productSchema, product);

console.log(result.ok);      // true
console.log(result.errors);  // []

📚 All Available Utilities

Function	Description
`isBoolean`	`Check for true/false`
`isNumber`	`Check if value is number`
`isString`	`Check if value is string`
`isUndefined`	`Check if value is undefined`
`isNotUndefined`	`Opposite of isUndefined`
`isNull`	`Check if value is null`
`isFunction`	`Check if value is function`
`isPlainObject`	`Check if object is a plain {}`
`isEmptyObject`	`Check if object has no keys`
`isEmptyArray`	`Check if array is empty`
`isDate`	`Check if value is a valid Date`
`isSymbol`	`Check if value is a Symbol`
`isPromise`	`Check if value is a Promise`
`isRegExp`	`Check if value is a RegExp`
`listFunctions`	`List all available util functions`

🤔 Why Use sd-is?

🔍 No need to write typeof value === 'string' everywhere
🧠 Helpful validation, with built-in defaults and messages
⚡ Extremely fast and tiny (~2KB gzipped)
✅ Perfect for API layers, CLI tools, or raw object validation
📦 No dependencies, supports modern JS without bloat

🔗 Links

📦 NPM: sd-is
💻 GitHub: github.com/sandeepdara-sd/sd-is

🙌 Wrap Up

If you're tired of verbose type checks and want a tiny, reliable, and developer-friendly utility for validating JavaScript structures — sd-is is for you.

Let me know what you think or contribute on GitHub! ⭐

Stop Writing Type Checks from Scratch — Try sd-is Instead

Sandeep Dara — Fri, 11 Jul 2025 10:57:34 +0000

⚡ Introducing `sd-is` – A Smarter Way to Handle Type Checks in JavaScript

“Do we really need another type-checking utility?”

Probably not.

But I built one anyway — and it might just save you some sanity.

🧩 What is `sd-is`?

sd-is is a tiny JavaScript utility library built to simplify common type-checks in a clean, expressive, and developer-friendly way.

It helps answer those everyday questions like:

Is this object empty?
Is this value undefined?
Is this a plain object or something else?

No frills. Just clarity.

✅ Key Features

Minimal API: isEmptyObject, isEmptyArray, isPlainObject, isUndefined, isNotUndefined
🔍 New: smartCheck – returns a verdict, reason, and fix suggestion
Lightweight and zero dependencies
Built by a developer, for developers

📦 Installation

npm install sd-is

🧪 Usage

1. Simple Type Checks

const { isEmptyObject, isUndefined } = require('sd-is');

console.log(isEmptyObject({})); // true
console.log(isUndefined(undefined)); // true

2. Smart Checks with Context

Want more than just true or false?

const { smartCheck } = require('sd-is');

const result = smartCheck.isPlainObject(new Date());

console.log(result.ok);        // false
console.log(result.verdict);   // ❌ Not a plain object
console.log(result.reason);    // It's a Date object, not a literal
console.log(result.fix());     // returns {}

Perfect for debugging, logging, and validation logic.

🤔 Why I Built It

I was tired of writing the same verbose checks every day:

typeof x !== 'undefined' && x !== null && Object.keys(x).length === 0

So I decided to make something that felt easier and more readable — and then added smartCheck to give context and optional fallbacks too.

This isn’t a groundbreaking package, and it’s not trying to replace Lodash — it’s just a developer-first tool I wanted to exist.

🌱 What’s Next?

I'm planning to expand the smart check library with:

Type-safe checks (boolean, string, number, etc.)
Customizable fix() functions
CLI helper for validating data

🔗 Links

📦 NPM: sd-is
💻 GitHub: sandeepdara-sd/sd-is

💬 Feedback?

If you try it, I’d love your thoughts!

Feel free to open an issue or drop feedback on GitHub.

🧑‍💻 Built by Sandeep Dara

Just a developer sharing something I found useful — maybe it’ll help you too.

npm install sd-is

One package, many checks. Clean code, happy dev.

Building a Secure Authentication System in MERN Stack: My Experience with JWT, Refresh Tokens, RBAC, and CORS

Sandeep Dara — Tue, 11 Mar 2025 17:58:47 +0000

Introduction

Hey everyone! If you've ever worked on a full-stack project, you know that authentication and authorization can be a real headache. When I first started working with the MERN stack (MongoDB, Express.js, React.js, Node.js), I struggled with setting up a solid authentication system. Debugging token issues, handling user sessions, and dealing with CORS errors were some of the most frustrating parts. But after digging deep and trying out different approaches, I finally figured out how to do it the right way.

In this blog, I'll share my experience building a secure authentication system using JWT (JSON Web Tokens), Refresh Tokens, and Role-Based Access Control (RBAC). I'll also cover CORS (Cross-Origin Resource Sharing) and how to configure it properly. Let's get started! 🚀

1. Authentication vs. Authorization (The Confusion I Had)

When I started, I used to mix up authentication and authorization. Here’s the difference:

Authentication: Verifying who the user is (e.g., logging in with an email and password).
Authorization: Deciding what the authenticated user can do (e.g., admin vs. regular user access).

Once I got this straight, things became a lot easier.

2. Implementing JWT-Based Authentication

My Experience with JWT

JWT (JSON Web Token) is a widely used way to handle authentication in web apps. At first, I found it confusing, but once I understood its structure, it made perfect sense. A JWT consists of:

Header (Algorithm & Token Type)
Payload (User Information & Claims)
Signature (Verifies authenticity)

How I Implemented JWT Authentication in MERN

Backend (Node.js + Express)

Installed the required dependencies:

   npm install jsonwebtoken bcryptjs dotenv

Wrote a function to generate JWT tokens:

   const jwt = require("jsonwebtoken");
   const generateToken = (userId) => {
       return jwt.sign({ id: userId }, process.env.JWT_SECRET, { expiresIn: "1h" });
   };

Created middleware to protect routes:

   const authMiddleware = (req, res, next) => {
       const token = req.header("Authorization").replace("Bearer ", "");
       if (!token) return res.status(401).json({ message: "No token, authorization denied" });

       try {
           const decoded = jwt.verify(token, process.env.JWT_SECRET);
           req.user = decoded;
           next();
       } catch (error) {
           res.status(401).json({ message: "Invalid token" });
       }
   };

Frontend (React.js)

I stored the JWT token securely in HTTP-only cookies instead of localStorage for better security.
Every protected API request included the token in the Authorization header.

3. Refresh Tokens (Fixing Expired Sessions)

I noticed that JWTs expire quickly (for security reasons), which frustrated users since they had to log in frequently. The solution? Refresh Tokens.

How I Implemented Refresh Tokens

Generated a refresh token along with the access token:

   const refreshToken = jwt.sign({ id: user._id }, process.env.REFRESH_SECRET, { expiresIn: "7d" });

Stored the refresh token securely (e.g., in an HTTP-only cookie).
Created an endpoint to refresh the JWT token:

   app.post("/refresh-token", (req, res) => {
       const { refreshToken } = req.body;
       jwt.verify(refreshToken, process.env.REFRESH_SECRET, (err, user) => {
           if (err) return res.status(403).json({ message: "Invalid refresh token" });
           const newToken = generateToken(user.id);
           res.json({ token: newToken });
       });
   });

4. Role-Based Access Control (RBAC) - Making My App Secure

Why I Needed RBAC

I wanted admin users to have extra privileges while regular users had limited access. That’s where RBAC (Role-Based Access Control) helped me.

How I Implemented RBAC

Added a role field to the User model:

   const UserSchema = new mongoose.Schema({
       username: String,
       email: String,
       password: String,
       role: { type: String, enum: ["admin", "user"], default: "user" }
   });

Created middleware to protect admin routes:

   const roleMiddleware = (roles) => (req, res, next) => {
       if (!roles.includes(req.user.role)) {
           return res.status(403).json({ message: "Access denied" });
       }
       next();
   };

Applied it to admin routes:

   app.get("/admin-dashboard", authMiddleware, roleMiddleware(["admin"]), (req, res) => {
       res.json({ message: "Welcome to the admin dashboard" });
   });

5. CORS (Fixing Annoying Frontend Errors)

My Issue with CORS

At one point, my frontend (React) was unable to call my backend (Node.js) due to CORS errors. I fixed it by properly configuring CORS in my Express server.

Fixing CORS in Express.js

Installed the CORS package:

   npm install cors

Configured CORS in Express.js:

   const cors = require("cors");
   app.use(cors({
       origin: "http://localhost:3000", // React frontend
       credentials: true,
   }));

Sent requests from React using:

   axios.get("http://localhost:5000/api", { withCredentials: true });

Conclusion

This journey of implementing JWT, refresh tokens, RBAC, and CORS in my MERN app taught me a lot. Debugging authentication issues was frustrating at first, but solving them helped me gain a deep understanding of how security works in full-stack applications. If you're working on authentication, I hope this guide helps you avoid the struggles I faced! 🚀

Let me know if you've faced similar issues or have any better approaches! Drop your thoughts in the comments. 😊

Is MERN Still the Best Full-Stack Choice in 2025?

Sandeep Dara — Sat, 01 Mar 2025 18:04:23 +0000

Introduction

The tech world evolves fast. Is MERN still the go-to stack in 2025, or are new players taking over?

When I first started working with the MERN stack, my journey began with building a Blog Application. The idea of handling both frontend and backend with JavaScript felt exciting, but I quickly realized there was more to it than just writing code.

Over time, I worked on projects like:

Stock Portfolio Tracker – Managing stock data efficiently.
Rule Engine Abstract Syntax Tree – Handling complex logic processing.
City-Wise Live Temperature Display – Fetching real-time weather updates.

Each project pushed me to explore MERN more deeply. Now, in 2025, let's break down whether MERN is still the best choice.

What's New in MERN in 2025?

React Updates – Making UI More Efficient

✅ React Server Components – Significantly improves load times by reducing JavaScript sent to the client.

✅ Improved State Management – Libraries like Recoil and Jotai make handling state easier.

✅ Automatic Code Splitting – A game-changer for performance, especially for dashboards.

Node.js & Backend Enhancements

🚀 Bun.js vs Node.js – Bun is proving to be a faster alternative to Node.js. If I had access to it earlier, I’d have used it to speed up API responses.

🚀 Express.js Alternatives – Fastify and NestJS offer better performance and structured development.

MongoDB Evolution

🔍 Vector Search & AI Integration – MongoDB now supports AI-based search, useful for intelligent recommendations.

🔍 Optimized Indexing – Better indexing helps in managing large datasets efficiently.

MERN vs Other Stacks in 2025 – My Perspective

MERN vs Next.js

Next.js has gained popularity with server-side rendering (SSR) and better SEO.
However, MERN provides full control over the backend, ideal for extensive API handling.

MERN vs Django & Spring Boot

Django: Best for structured enterprise apps with built-in security.
Spring Boot: Great for large-scale applications with strong backend support.
MERN: The best choice when you need speed, flexibility, and a JavaScript-based full-stack environment.

Best Practices for MERN in 2025

Performance Optimizations

✅ Implement lazy loading and code splitting for faster load times.

✅ Explore server-side rendering (SSR) with Next.js when needed.

Security Best Practices

✅ Use OAuth 2.0 instead of JWT for enhanced authentication security.

✅ Implement rate limiting and API throttling to prevent DDoS attacks.

Scalability Strategies

✅ Microservices architecture is the way forward—something I wish I had used earlier.

✅ Deploy to AWS, GCP, or Vercel for robust hosting.

Conclusion – My Thoughts on MERN in 2025

Having built multiple MERN applications, I still see it as a powerful and flexible stack in 2025. However, with the rise of Next.js, Bun.js, and NestJS, it’s essential to stay updated and explore alternatives.

🚀 Next Goal: I plan to integrate Bun.js and NestJS into my future projects to boost performance and scalability.

💬 What’s your take on MERN in 2025? Let’s discuss in the comments!

📢 Follow me for more tech insights! Connect with me on LinkedIn or check out my portfolio here.

#MERN #JavaScript #React #NodeJS #WebDevelopment

DEV Community: Sandeep Dara

Building Flow-Aware Validation in JavaScript - Behind the Scenes of sd-is@1.0.7

🎯 The Goal: Flow-Aware Validation Engine

🔧 Core Concepts Introduced

1. defineFlowSchema()

2. validateStep() & validateStepAsync()

3. createFlow()

🧪 What Makes It Different?

💡 Use Cases

📦 Now on npm

🛠️ What's Next?

🧠 Closing Thoughts

🚀 Introducing sd-is v1.0.6: A Tiny JavaScript Utility for Type Checking, Smart Validation & Schemas

🔍 What is sd-is?

✨ What's New in v2.0+

📦 Installation

✅ Type Checking Basics

🧠 smartCheck: Check + Explain + Fix

🔒 assertType: Catch Mistakes Early

📋 defineSchema + validateAgainst

📚 All Available Utilities

🤔 Why Use sd-is?

🔗 Links

🙌 Wrap Up

Stop Writing Type Checks from Scratch — Try sd-is Instead

⚡ Introducing sd-is – A Smarter Way to Handle Type Checks in JavaScript

🧩 What is sd-is?

✅ Key Features

📦 Installation

🧪 Usage

1. Simple Type Checks

2. Smart Checks with Context

🤔 Why I Built It

🌱 What’s Next?

🔗 Links

💬 Feedback?

🧑‍💻 Built by Sandeep Dara

Building a Secure Authentication System in MERN Stack: My Experience with JWT, Refresh Tokens, RBAC, and CORS

Introduction

1. Authentication vs. Authorization (The Confusion I Had)

2. Implementing JWT-Based Authentication

My Experience with JWT

How I Implemented JWT Authentication in MERN

Backend (Node.js + Express)

Frontend (React.js)

3. Refresh Tokens (Fixing Expired Sessions)

How I Implemented Refresh Tokens

4. Role-Based Access Control (RBAC) - Making My App Secure

Why I Needed RBAC

How I Implemented RBAC

5. CORS (Fixing Annoying Frontend Errors)

My Issue with CORS

Fixing CORS in Express.js

Conclusion

Is MERN Still the Best Full-Stack Choice in 2025?

Introduction

What's New in MERN in 2025?

React Updates – Making UI More Efficient

Node.js & Backend Enhancements

MongoDB Evolution

MERN vs Other Stacks in 2025 – My Perspective

MERN vs Next.js

MERN vs Django & Spring Boot

Best Practices for MERN in 2025

Performance Optimizations

Security Best Practices

Scalability Strategies

Conclusion – My Thoughts on MERN in 2025

1. `defineFlowSchema()`

2. `validateStep()` & `validateStepAsync()`

3. `createFlow()`

🔍 What is `sd-is`?

✨ What's New in `v2.0+`

⚡ Introducing `sd-is` – A Smarter Way to Handle Type Checks in JavaScript

🧩 What is `sd-is`?