Domain Driven Design(DDD) has an abstract repository pattern to handle saving and fetching/finding entities in storage (db, external service, doesn't matter). My question is if Repository Pattern has to only bring the objects to system and put it away and it is basically, for example, objects of database drivers like Mongo or other ORM like JPA, then is there any point to implement any validation there?

My hunch says me that I have to implement validations as a constraints in Factories or Aggregates. So, I don't have to use implementation's mechanisms. However, there are plenty ORMs that require to get a constraints for each field/property, so that it might cause a code duplications.

  • 3
    Validation in the Repository sounds like a really bad idea..
    – Alternatex
    Feb 16, 2016 at 9:40
  • @Alternatex, thanks for this opinion. I have just concern about validation mechanisms that are provided with common ORM frameworks. Do I have to use them or get rid of them totally?
    – Dawid Pura
    Feb 16, 2016 at 9:48
  • 1
    I only have experience with Entity Framework and Eloquent and you are in no way forced to use validation in those ORMs. It's understandable why they have validation mechanisms but when you're abstracting away the data layer the responsibility of validation should come from higher. I would get rid of the validation rules in any ORM that's going to be abstracted away with a Repository. For my lack of experience I won't submit this as an answer. +1
    – Alternatex
    Feb 16, 2016 at 10:01
  • Some basic validation is usually needed. for example you may be storing a string in a varchar[50]
    – Ewan
    Feb 16, 2016 at 13:56
  • 1
    @DawidPura what do you mean by validations ? An example maybe ? Is this about defining constraints in some database schema that will be generated by your ORM, or enforcing some rules on your objects in memory just before saving them ? Or both ? Feb 16, 2016 at 14:41

2 Answers 2


Business validation (i.e. checking if the value follows the rules) should occur in the business layer (BLL), not the DAL where the repositories live.

Data validation (i.e. checking if the entered value is allowed by the database) happens on the data layer, but it is usually handled by the ORM itself and doesn't require explicit validation by you. You may need to handle exceptions, or intentionally let them bubble up, but you usually shouldn't be validating things explicitly here.

It's allowed to already pre-check certain data validations (e.g. string length) on the business level as well (similarly, you can additionally check this on the UI level as well), but then the validation should be in the business logic and not in the repository.

I am thinking about validation something like a postcode validation that requires some regexp, I mean format rather than dependencies between other objects in system

Bardr's answer is already a good response to this, but I just want to point out that what you're describing here is business validation, and should thus happen on the business layer (usually that is the layer that consumes the DAL).


I am thinking about validation something like a postcode validation that requires some regexp, I mean format rather than dependencies between other objects in system

This is not the job of repositories. Repositories are meant for providing an abstract way of persistence related concerns and most important, they live (interfaces) in the domain layer so they're part of UL.

Checking whether a postcode is in correct format (and so on) is the responsibility of the application layer. This layer carries out such tasks like: input validation, using repositories to fetch entities, orchestrate domain logic, save entities, sending emails...

If your validation is related to domain logic (has some business value, exists in UL, e.g checking whether postcode belongs to a special area where we provide discounts or other benefits) then it's the job of the domain layer and it should be implemented there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.