Deserialization: Bytes to Objects

1. 1
   Read bytes (bounded)

   Reads the body up to a configured maximum, or rejects with 413 before buffering it.

   fails by No limit, or a limit only on some routes: one request buffers until the process dies.

2. 2
   Decode + dispatch by content type

   Interprets bytes as text in a charset and selects the parser named by Content-Type.

   fails by Sniffing the format from the body, so the caller chooses which parser runs.

3. 3
   Parse (bounded)

   Turns text into a generic structure, with depth and key-count limits.

   fails by Deep nesting burning CPU; a parse error surfacing as 500 instead of 400.

4. 4
   Schema-parse into an input type

   Names every accepted field and its type, converts, and rejects everything else.

   fails by Skipped entirely — this is where mass assignment happens.

5. 5
   Construct domain values

   Produces Money, Email, UserId — types that cannot hold an unchecked value.

   fails by Passing raw maps inward, so every later layer must re-ask "was this checked?"

Authorization is deliberately not in this list. It is a separate decision, made after you know what is being asked, and it belongs to Authorization in Backends.

app.patch('/me', async (req, res) => {
  const user = await repo.byId(req.user.id)
  Object.assign(user, req.body)   // whatever arrived
  await repo.save(user)
  res.json(user)                  // and whatever the row holds
})

const ProfileUpdate = z.object({
  displayName: z.string().min(1).max(80).optional(),
  locale: z.enum(['en', 'de', 'fr']).optional(),
}).strict()                       // unknown keys rejected

app.patch('/me', async (req, res) => {
  const input = ProfileUpdate.parse(req.body)
  const user = await repo.byId(req.user.id)
  const updated = await repo.updateProfile(user.id, input)
  res.json(toProfileResponse(updated))
})

The writable surface of the endpoint is now a list you can read, and it does not change when someone adds a role, credit_balance or is_internal column. The response is a mapped type for the same reason (Schema Leakage).