Data Transfer Objects (DTOs)

A data transfer object (DTO) carries the fields intended for a specific boundary. Database entities often include private or internal fields that a public API should not send. Build response DTOs deliberately rather than JSON-serializing every property of the database model.

The mapping explicitly selects id and email; the password hash never enters the returned response object. Pick guides compile-time expectations, while the explicit object construction controls runtime output.

A compile-time Omit<UserRecord,"passwordHash"> annotation alone does not strip passwordHash from an already constructed runtime object.

This source was compiled using TypeScript 5.8.3 with strict checking, then executed with Node.js 22.16.0. Its stdout below is the actual captured output. The core logic is runnable without a framework or a remote API; integration-specific examples appear in a separate lab when needed.

TypeScript source

type UserRecord = { id: number; email: string; passwordHash: string };
type PublicUser = Pick<UserRecord, "id" | "email">;
function toPublicUser(user: UserRecord): PublicUser {
  return { id: user.id, email: user.email };
}
console.log(JSON.stringify(toPublicUser({ id: 4, email: "user@example.test", passwordHash: "secret-hash" })));

Verified output

{"id":4,"email":"user@example.test"}

Compile: npx tsc --strict --target es2022 --module commonjs data-transfer-objects-dtos.ts; run: node data-transfer-objects-dtos.js. For examples importing node: modules, install @types/node as a development dependency; for browser or React projects use the separate lab setup.

The mapping explicitly selects id and email; the password hash never enters the returned response object. Pick guides compile-time expectations, while the explicit object construction controls runtime output.

Before editing the code, predict what the output will be for one changed input. Run it and compare your prediction with the actual result.

A compile-time Omit<UserRecord,"passwordHash"> annotation alone does not strip passwordHash from an already constructed runtime object.

Determine whether the issue belongs to the type system, a trust boundary, or actual runtime behavior before choosing a correction.

Add an internal role field and verify that the public response omits it even when the source record contains it.

Record expected success and failure outcomes, run the code, and compare the observed behavior. Keep the exercise compatible with strict type checking.

The mapping explicitly selects id and email; the password hash never enters the returned response object. Pick guides compile-time expectations, while the explicit object construction controls runtime output.

Apply the same reasoning to the practice task, then integrate it into a real app only when the runtime and dependency setup are ready.