Models & ViewModels in ASP.NET Core

1. Entity: Database Blueprint

Used by EF Core. Has every column, even secrets.

public class Product
{
    public int Id { get; set; }
    public string Name { get; set; }
    public decimal CostPrice { get; set; } // Secret!
    public decimal SellPrice { get; set; }
    public DateTime CreatedAt { get; set; }
    public virtual ICollection<OrderItem> OrderItems { get; set; } // Navigation
}

Problem: Send this to View → HTML shows CostPrice. Or triggers lazy-loading = 50 DB queries.

2. ViewModel: Safe Shape for UI

Only what View needs. No secrets, no navigation props.

public class ProductListViewModel
{
    public int Id { get; set; }
    public string Name { get; set; }
    public decimal SellPrice { get; set; }
    public string FormattedPrice => $"${SellPrice:F2}";
}

Rule: 1 View = 1 ViewModel. Don't reuse.

3. Mapping: Controller's Job

public async Task<IActionResult> Index()
{
    var entities = await _db.Products.ToListAsync(); // Entity from DB

    var vms = entities.Select(p => new ProductListViewModel
    {
        Id = p.Id,
        Name = p.Name,
        SellPrice = p.SellPrice
    }).ToList(); // Map to ViewModel

    return View(vms); // View gets safe data
}

4. Data Annotations: Validation Rules

Put rules on ViewModel, not Entity. EF ignores them.

public class ProductCreateViewModel
{
    [Required(ErrorMessage = "Name is required")]
    [StringLength(100)]
    public string Name { get; set; }

    [Range(0.01, 10000)]
    public decimal SellPrice { get; set; }
}

Controller: if (!ModelState.IsValid) return View(vm); shows errors.

1. DTO vs Entity vs ViewModel

What is DTO? Data Transfer Object. Like ViewModel but for APIs. No UI logic. ProductDto for JSON response.

2. AutoMapper: Stop Manual Mapping

Writing vm.Name = entity.Name 20 times is pain. AutoMapper does it.

// Install: AutoMapper.Extensions.Microsoft.DependencyInjection
// Program.cs
builder.Services.AddAutoMapper(typeof(Program));

// MappingProfile.cs
public class MappingProfile : Profile
{
    public MappingProfile()
    {
        CreateMap<Product, ProductListViewModel>();
    }
}

// Controller
public class ProductController : Controller
{
    private readonly IMapper _mapper;
    public ProductController(IMapper mapper) { _mapper = mapper; }

    public async Task<IActionResult> Index()
    {
        var entities = await _db.Products.ToListAsync();
        var vms = _mapper.Map<List<ProductListViewModel>>(entities);
        return View(vms);
    }
}

What is Profile? Class where you define mappings. AutoMapper scans it on startup.

3. Validation: ModelState Deep Dive

ModelState.IsValid checks 3 things:

1. Binding: Can "abc" convert to int Age? No → Error
2. DataAnnotations: [Range(18,100)] violated? → Error
3. Custom: ModelState.AddModelError("Name", "Taken")

[HttpPost]
public IActionResult Create(ProductCreateViewModel vm)
{
    if (_db.Products.Any(p => p.Name == vm.Name))
        ModelState.AddModelError("Name", "Name already exists");

    if (!ModelState.IsValid)
        return View(vm); // Shows all errors

    // Save...
}

View: <span asp-validation-for="Name"></span> shows error.

4. Input vs Output Models

Never use same model for GET form and POST save.

// GET: Show form
public class ProductCreateViewModel
{
    public string Name { get; set; }
    public decimal SellPrice { get; set; }
}

// POST: Save
public class ProductCreateDto // Different!
{
    public string Name { get; set; }
    public decimal SellPrice { get; set; }
    public int CreatedByUserId { get; set; } // Hidden, not in form
}

Why separate? Prevents overposting. Hacker adds <input name="IsAdmin" value="true"> to form. If you bind to Entity, they become admin. Bind to InputDto = safe.

5. Flat vs Nested ViewModels

Bad: Nested Entity

public class OrderViewModel
{
    public Product Product { get; set; } // Leaks entire Entity!
}

Good: Flat

public class OrderViewModel
{
    public int ProductId { get; set; }
    public string ProductName { get; set; }
    public decimal ProductPrice { get; set; }
}

Flat = no accidental navigation property lazy-loading.