270
DTO
also response model, mass assignment
The API type is not the table type. Do not bind a request onto the entity.
What is DTO?
A DTO, or response model, is the type at the boundary. It hides columns, renames fields, and stays stable when the schema changes. Binding a request body onto the entity is mass assignment: the client sets role, price, or owner_id because those columns exist. Returning the entity leaks fields you added later.
Why does DTO matter when vibe coding?
The handler returns the ORM object and “deletes password” on one path. The next endpoint forgets. Or the update endpoint accepts the entity, and a client sends is_admin: true.
How do you do DTO?
One input type and one output type per endpoint. List the fields. Ignore the rest. Map to the entity in code you can see. Do not spread the request onto the model.
How do you ask a model for DTO?
Define an input DTO and an output DTO for (endpoint). Do not bind the request onto the entity. Do not return the ORM model. Ignore fields that are not on the DTO, including role and owner.
What goes wrong with DTO?
A DTO that inherits the entity “to stay in sync.” You reopened the hole and gave it a new name.