DTOs: shaping the request

The untyped body problem

In module 05 your BookingsController took a booking and handed it to a service. But look at what actually arrives on a POST /bookings: @Body() gives you whatever JSON the client sent — and the client can send anything. A missing walkerId, a durationMinutes of -999, a status of "free please", or fifty fields you never asked for.

TypeScript types don't save you here. Types are a compile-time promise; at runtime the body is just a parsed object. If you trust it and pass it to the database, you've built the classic injection-shaped bug: garbage in, corrupted rows out.

The senior instinct: never trust the request body. A DTO is where you turn an unknown blob into a known, validated shape before a single line of business logic runs.