Validate Transactions on the Server

Client validation improves the experience, but the server must remain the final authority.

Create server/src/domain/transactions.js and move transaction rules there. Validate date, description, amount, type, and category rules before changing the database.

if (!Number.isSafeInteger(amountCents) || amountCents <= 0) {
  return "amountCents must be a positive integer";
}

Test it

Send a request with invalid JSON data or use the browser form with developer tools to alter the request. The server should still reject it with a 400 response.

Checkpoint

The API cannot be bypassed simply by skipping the client form.