Model Binding и Validation: DataAnnotations, FluentValidation?

POST /api/shops/42/orders?notify=true HTTP/1.1
X-Request-Id: 7f3a
Content-Type: application/json

{ "customerEmail": "ann@example.uz", "items": [ { "sku": "A-1", "qty": 2 } ] }

[HttpPost("api/shops/{shopId:int}/orders")]
public IActionResult Create(
    [FromRoute] int shopId,                         // 42 — из маршрута
    [FromQuery] bool notify,                        // true — из строки запроса
    [FromHeader(Name = "X-Request-Id")] string? requestId,
    [FromBody] CreateOrderRequest body,             // JSON-тело (System.Text.Json)
    [FromServices] IOrderService orders)            // из DI
    => Ok();

public sealed class CreateOrderRequest : IValidatableObject
{
    [Required, EmailAddress, StringLength(254)]
    public string CustomerEmail { get; init; } = "";

    [Required, MinLength(1, ErrorMessage = "Заказ должен содержать хотя бы одну позицию")]
    public List<OrderItemDto> Items { get; init; } = [];

    [Range(0, 100)]
    public int DiscountPercent { get; init; }

    public DateOnly? DeliveryDate { get; init; }

    // Перекрёстная проверка нескольких полей
    public IEnumerable<ValidationResult> Validate(ValidationContext ctx)
    {
        if (DeliveryDate is { } d && d < DateOnly.FromDateTime(DateTime.UtcNow))
            yield return new ValidationResult("Дата доставки в прошлом", [nameof(DeliveryDate)]);
    }
}

public sealed record OrderItemDto([Required] string Sku, [Range(1, 1000)] int Qty);

{
  "type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "errors": {
    "CustomerEmail": ["The CustomerEmail field is not a valid e-mail address."],
    "Items[0].Qty": ["The field Qty must be between 1 and 1000."]
  },
  "traceId": "00-7f3a..."
}

public sealed class CreateOrderValidator : AbstractValidator<CreateOrderRequest>
{
    public CreateOrderValidator(ICustomerRepository customers)
    {
        RuleFor(x => x.CustomerEmail)
            .NotEmpty().EmailAddress().MaximumLength(254)
            .MustAsync(async (email, ct) => !await customers.IsBlockedAsync(email, ct))
            .WithMessage("Покупатель заблокирован");

        RuleFor(x => x.Items).NotEmpty();
        RuleForEach(x => x.Items).ChildRules(item =>
        {
            item.RuleFor(i => i.Sku).NotEmpty().Matches("^[A-Z]-\\d+$");
            item.RuleFor(i => i.Qty).InclusiveBetween(1, 1000);
        });

        RuleFor(x => x.DeliveryDate)
            .GreaterThanOrEqualTo(DateOnly.FromDateTime(DateTime.UtcNow))
            .When(x => x.DeliveryDate.HasValue);
    }
}

// Регистрация всех валидаторов сборки
builder.Services.AddValidatorsFromAssemblyContaining<CreateOrderValidator>();

app.MapPost("/orders", async (CreateOrderRequest req, IValidator<CreateOrderRequest> validator, IOrderService svc, CancellationToken ct) =>
{
    var result = await validator.ValidateAsync(req, ct);
    if (!result.IsValid) return Results.ValidationProblem(result.ToDictionary());
    return Results.Ok(await svc.CreateAsync(req, ct));
});

// Привязать "1,2,3" из query к int[]
public sealed class CsvIntArrayBinder : IModelBinder
{
    public Task BindModelAsync(ModelBindingContext ctx)
    {
        var raw = ctx.ValueProvider.GetValue(ctx.ModelName).FirstValue;
        if (string.IsNullOrEmpty(raw)) return Task.CompletedTask;
        try { ctx.Result = ModelBindingResult.Success(raw.Split(',').Select(int.Parse).ToArray()); }
        catch (FormatException) { ctx.ModelState.TryAddModelError(ctx.ModelName, "Ожидается список чисел через запятую"); }
        return Task.CompletedTask;
    }
}

public IActionResult Get([ModelBinder(typeof(CsvIntArrayBinder))] int[] ids) => Ok(ids);