I would advise against HTTP 400 for syntactically correct (here a 400 would be misleading), but semantically incorrect (aka invalid) request. But that should not be the topic here.
The question is more about validation and DRY.
I think, there is no golden rule to follow here. If you are doing a modern web application, there is a tradeoff between double ...
The dry way would be do handle multiple types of errors from create_record rather than do validation for each different type of validation error there can be. For example
record = create_record(inputs)
I think the question could be phrased like this:
When programming a function, should I check my function arguments to make sure they are not null and of the right type and perhaps within the correct range?
Why is this the same question? Basically one validates "input" whether it's XML or a simple object. Since I have vastly more experience in writing code ...
The controller should always handle validation. Because its the only one capable of actually presenting the problem to the user (be that a message, some sort of highlight, etc..).
That being said, always enforce invariants in the core model. I'm not talking about business rules, those should be enforced by business logic. I'm talking about structural rules. ...