Defense-in-Depth Validation

Overview

When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks.

Core principle: Validate at EVERY layer data passes through. Make the bug structurally impossible.

Why Multiple Layers

Single validation: "We fixed the bug" Multiple layers: "We made the bug impossible"

Different layers catch different cases:

• Entry validation catches most bugs
• Business logic catches edge cases
• Environment guards prevent context-specific dangers
• Debug logging helps when other layers fail

The Four Layers

Layer 1: Entry Point Validation

Purpose: Reject obviously invalid input at API boundary

typescript
1function createProject(name: string, workingDirectory: string) {
2  if (!workingDirectory || workingDirectory.trim() === '') {
3    throw new Error('workingDirectory cannot be empty');
4  }
5  if (!existsSync(workingDirectory)) {
6    throw new Error(`workingDirectory does not exist: ${workingDirectory}`);
7  }
8  if (!statSync(workingDirectory).isDirectory()) {
9    throw new Error(`workingDirectory is not a directory: ${workingDirectory}`);
10  }
11  // ... proceed
12}

Layer 2: Business Logic Validation

Purpose: Ensure data makes sense for this operation

typescript
1function initializeWorkspace(projectDir: string, sessionId: string) {
2  if (!projectDir) {
3    throw new Error('projectDir required for workspace initialization');
4  }
5  // ... proceed
6}

Layer 3: Environment Guards

Purpose: Prevent dangerous operations in specific contexts

typescript
1async function gitInit(directory: string) {
2  // In tests, refuse git init outside temp directories
3  if (process.env.NODE_ENV === 'test') {
4    const normalized = normalize(resolve(directory));
5    const tmpDir = normalize(resolve(tmpdir()));
6
7    if (!normalized.startsWith(tmpDir)) {
8      throw new Error(
9        `Refusing git init outside temp dir during tests: ${directory}`
10      );
11    }
12  }
13  // ... proceed
14}

Layer 4: Debug Instrumentation

Purpose: Capture context for forensics

typescript
1async function gitInit(directory: string) {
2  const stack = new Error().stack;
3  logger.debug('About to git init', {
4    directory,
5    cwd: process.cwd(),
6    stack,
7  });
8  // ... proceed
9}

Applying the Pattern

When you find a bug:

1. Trace the data flow - Where does bad value originate? Where used?
2. Map all checkpoints - List every point data passes through
3. Add validation at each layer - Entry, business, environment, debug
4. Test each layer - Try to bypass layer 1, verify layer 2 catches it

Example from Session

Bug: Empty projectDir caused git init in source code

Data flow:

1. Test setup → empty string
2. Project.create(name, '')
3. WorkspaceManager.createWorkspace('')
4. git init runs in process.cwd()

Four layers added:

• Layer 1: Project.create() validates not empty/exists/writable
• Layer 2: WorkspaceManager validates projectDir not empty
• Layer 3: WorktreeManager refuses git init outside tmpdir in tests
• Layer 4: Stack trace logging before git init

Result: All 1847 tests passed, bug impossible to reproduce

Key Insight

All four layers were necessary. During testing, each layer caught bugs the others missed:

• Different code paths bypassed entry validation
• Mocks bypassed business logic checks
• Edge cases on different platforms needed environment guards
• Debug logging identified structural misuse

Don't stop at one validation point. Add checks at every layer.