We are having a heated discussion about this at work: For sake of simplicity, I will use examples in the question.
Assume there is an application with an account request form, for which we have these requirements:
- Dates and Email must match a regex
- If the user already has an account request, he should not request for another
The problem is: where to verify the second requirement?
If we check on the controller, we would have to access the database from there and it is a business logic, so it doesn't seem right.
If we validate on the business layer, we would have to somehow return the validation information in case of a failed validation. Doing this would require either:
- Each business method to have an "out" parameter;
- We to encapsulate our return object into a "response" object with the validation information
- The use of exceptions in case of failed validations (which, to me, falls in the anti-pattern of using exceptions for programm flow).
How should we design this?