Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
superstruct
Advanced tools
The superstruct npm package is a library for validating, coercing, and structuring data in JavaScript and TypeScript. It allows developers to define interfaces and run-time type checks for JavaScript data structures, ensuring that data conforms to specified schemas.
Validation
Superstruct can be used to validate data against a defined schema. The example shows how to define a User struct and validate an object against it.
{"User": "const User = struct({name: 'string', age: 'number'}); const data = {name: 'Alice', age: 25}; const [error, user] = User.validate(data); if (error) { throw error; }"}
Coercion
Superstruct can coerce data to match a schema by applying default values. In the example, a UserWithDefaults struct is defined with an optional isAdmin field that defaults to false.
{"UserWithDefaults": "const UserWithDefaults = struct({name: 'string', age: 'number', isAdmin: 'boolean?'}); const data = {name: 'Bob', age: 30}; const user = UserWithDefaults.create(data);"}
Partial Structs
Superstruct allows creating partial structs, which can validate data that may not include all fields of the struct. The example demonstrates how to define a partial struct based on the User struct.
{"PartialUser": "const User = struct({name: 'string', age: 'number'}); const PartialUser = struct.partial(User); const data = {name: 'Charlie'}; const [error, partialUser] = PartialUser.validate(data); if (error) { throw error; }"}
Dynamic Structs
Superstruct can define dynamic structs that change based on the input data. The example shows a DynamicUser struct that requires a permissions array only if the isAdmin property is true.
{"DynamicUser": "const DynamicUser = struct.dynamic((value, branch, path) => { if (value && value.isAdmin) { return struct({name: 'string', age: 'number', permissions: 'array'}); } else { return struct({name: 'string', age: 'number'}); } }); const data = {name: 'Dave', age: 40, isAdmin: true, permissions: ['read', 'write']}; const [error, dynamicUser] = DynamicUser.validate(data); if (error) { throw error; }"}
Joi is a powerful schema description language and data validator for JavaScript. It offers a similar API to superstruct but with a more extensive set of features for describing and validating data structures, including custom validation functions.
Yup is a JavaScript schema builder for value parsing and validation. It defines a schema with an expressive API and is often used with form libraries like Formik. Yup schemas are immutable and composable, and it provides a slightly different API compared to superstruct.
Ajv is a JSON schema validator that supports draft-06/07/2019-09 JSON Schema standards. It is known for its performance and is used to validate JSON data on the server-side and in the browser. Unlike superstruct, Ajv relies on JSON Schema, which is a declarative language for validating the structure of JSON data.
A simple and composable way
to validate data in JavaScript.
Usage • Why? • Principles • Demo • Examples • Documentation
Superstruct makes it easy to define interfaces and then validate JavaScript data against them. Its type annotation API was inspired by Typescript, Flow, Go, and GraphQL, giving it a familiar and easy to understand API.
But Superstruct is designed for validating data at runtime, so it throws (or returns) detailed runtime errors for you or your end users. This is especially useful in situations like accepting arbitrary input in a REST or GraphQL API. But it can even be used to validate internal data structures at runtime when needed.
Superstruct exports a struct
factory for creating structs that can validate data against a specific schema:
import { struct } from 'superstruct'
const Article = struct({
id: 'number',
title: 'string',
is_published: 'boolean?',
tags: ['string'],
author: {
id: 'number',
}
})
const data = {
id: 34,
title: 'Hello World',
tags: ['news', 'features'],
author: {
id: 1,
}
}
const article = Article(data)
// This will throw when the data is invalid, and return the data otherwise.
// If you'd rather not throw, use `Struct.validate()` or `Struct.test()`.
It recognizes all the native JavaScript types out of the box. But you can also define your own custom data types—specific to your application's requirements—by using the superstruct
export:
import { superstruct } from 'superstruct'
import isUuid from 'is-uuid'
import isEmail from 'is-email'
const struct = superstruct({
types: {
uuid: value => isUuid.v4(value),
email: value => isEmail(value) && value.length < 256,
}
})
const User = struct({
id: 'uuid',
email: 'email',
is_admin: 'boolean?',
})
const data = {
id: 'c8d63140-a1f7-45e0-bfc6-df72973fea86',
email: 'jane@example.com',
}
const user = User(data)
Superstruct supports more complex use cases too like defining list or scalar structs, applying default values, composing structs inside each other, returning errors instead of throwing them, etc. For more information read the full Documentation.
There are lots of existing validation libraries—joi
, express-validator
, validator.js
, yup
, ajv
, is-my-json-valid
... But they exhibit many issues that lead to your codebase becoming hard to maintain...
They don't expose detailed errors. Many validators simply return string-only errors or booleans without any details as to why, making it difficult to customize the errors to be helpful for end-users.
They make custom types hard. Many validators ship with built-in types like emails, URLs, UUIDs, etc. with no way to know what they check for, and complicated APIs for defining new types.
They don't encourage single sources of truth. Many existing APIs encourage re-defining custom data types over and over, with the source of truth being spread out across your entire code base.
They don't throw errors. Many don't actually throw the errors, forcing you to wrap everywhere. Although helpful in the days of callbacks, not using throw
in modern JavaScript makes code much more complex.
They don't pre-compile schemas. Many validators define schemas as plain JavaScript objects, which means they delegate the parsing of the schema logic to validation time, making them much slower.
They're tightly coupled to other concerns. Many validators are tightly coupled to Express or other frameworks, which results in one-off, confusing code that isn't reusable across your code base.
They use JSON Schema. Don't get me wrong, JSON Schema can be useful. But it's kind of like HATEOS—it's usually way more complexity than you need and you aren't using any of its benefits. (Sorry, I said it.)
Of course, not every validation library suffers from all of these issues, but most of them exhibit at least one. If you've run into this problem before, you might like Superstruct.
Which brings me to how Superstruct solves these issues...
Customizable types. Superstruct's power is in making it easy to define an entire set of custom data types that are specific to your application, and defined in a single place, so you have full control over your requirements.
Unopinionated defaults. Superscript ships with native JavaScript types, and everything else is customizable, so you never have to fight to override decisions made by "core" that differ from your application's needs.
Composable interfaces. Superstruct interfaces are composable, so you can break down commonly-repeated pieces of data into components, and compose them to build up the more complex objects.
Terse schemas. The schemas in Superstruct are designed to be extremely terse and expressive. This makes them very easy to read and write, encouraging you to have full data validation coverage.
Compiled validators. Superstruct does the work of compiling its schemas up front, so that it doesn't spend time performing expensive tasks for every call to the validation functions in your hot code paths.
Useful errors. The errors that Superstruct throws contain all the information you need to convert them into your own application-specific errors easy, which means more helpful errors for your end users!
Familiar API. The Superstruct API was heavily inspired by Typescript, Flow, Go, and GraphQL. If you're familiar with any of those, then its schema definition API will feel very natural to use, so you can get started quickly.
Try out the live demo on JSFiddle to get an idea for how the API works, or to quickly verify your use case:
Superstruct's API is very flexible, allowing it to be used for a variety of use cases on your servers and in the browser. Here are a few examples of common patterns...
Read the getting started guide to familiarize yourself with how Superstruct works. After that, check out the full API reference for more detailed information about structs, types and errors...
This package is MIT-licensed.
FAQs
A simple and composable way to validate data in JavaScript (and TypeScript).
The npm package superstruct receives a total of 1,033,625 weekly downloads. As such, superstruct popularity was classified as popular.
We found that superstruct demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.