Data-Modeling on Brian Faust

Validate at the Boundary You Control

Thu, 01 Mar 2018 00:00:00 +0000

A booking request contains a recipient email and a phone number made entirely of spaces.

For one delivery service, email is enough. For the same service with a particular handoff option, a phone number is mandatory. For another service, phone is always mandatory.

So is the phone optional? That question is already too vague. There is no honest global rule such as “phone is nullable” or “phone is required.” The answer depends on the operation the request asks the system to perform.

Soft Deletes Preserve Ambiguity Too

Tue, 01 Aug 2017 00:00:00 +0000

Adding deleted_at to a table answers one question: when was this row marked as deleted? It does not answer whether the row was safe to mark, who should still see it, whether its credentials remain valid, whether it still occupies a unique business slot, how it can be restored, or when its data should be erased.

A cart cleanup could not safely reduce those questions to one nullable timestamp. Old carts might still have a shipment, a payment session, a booking attempt, or item work which had crossed a meaningful boundary. The eventual policy archives a deliberately narrow set and preserves the aggregate as evidence. Soft deletion preserves rows, but it also preserves every ambiguity which the lifecycle never defined.

An Identifier Should Outlive Its Storage Engine

Sat, 01 Jul 2017 00:00:00 +0000

A billing export once had enough information to reconstruct a missing account, but not enough to name it. The account still existed in an older system and its stable identifier reached the export action. What did not exist was a matching row in the newer application’s user table.

The action worked around that absence by building a temporary object with safe fallback details. It even gave the object a synthetic local identifier. The field used as the export identity remained null, though, and a queued data object later rejected the payload because that field had to be a string. The fallback had solved the missing attributes while losing the one fact the export actually needed: which account it was about.