Future direction of validation

[oxisto]

Since it has been a long standing issue to support configuration of certain validation options, I finally dedicated some time to implement several options. There are two guiding principles in designing and implementing this library

• We do not want to break stuff (sorry that we shortly did so), e.g., no changes on the public API within the same major version
• We want your feedback and get a feel for the community that is using this library.

I have therefore implemented three different approaches in three pull requests and I want to use this meta-issue here to engage the community into a discussion which direction we want to go to. After we (hopefully) reach a concencus, I will implement the rest of the options in the chosen approach and finalise it.

• Validation Options - Experiment 1: Embedding validation options in claim #208
• Validation Options - Experiment 2: New approach using external Validator struct #209
• Validation Options - Experiment 3 : Introducing new (optional) ClaimsWithOptions interface next to Claims #210

[mfridman]

Thanks for putting these up, I'll carve out some time and provide feedback (probably in this discussion)?

[mfridman]

Turns out 1-2 weeks was more like 1-2 months 😅

I've been coming back to these PR's, checking them out and testing them on and off.

Option 2 seems like the best approach (at first), but the con you highlighted is quite a footgun.

However, if the user calls Valid() on the claim, this will not take the validator with the options but the default one (because we have no way to supply the validator to the claim in this PR).

So then I got to option 3, and at that point it just felt like a /v5 would make more sense. The current /v4 package has the security and bug fixes, but without it's limitations. Whereas a /v5 we know the set of features we'd like to add, so instead of working around in the current version we just (hopefully) get it right with a slightly better set of interfaces.

[oxisto]

Turns out 1-2 weeks was more like 1-2 months 😅

I've been coming back to these PR's, checking them out and testing them on and off.

Option 2 seems like the best approach (at first), but the con you highlighted is quite a footgun.

However, if the user calls Valid() on the claim, this will not take the validator with the options but the default one (because we have no way to supply the validator to the claim in this PR).

So then I got to option 3, and at that point it just felt like a /v5 would make more sense. The current /v4 package has the security and bug fixes, but without it's limitations. Whereas a /v5 we know the set of features we'd like to add, so instead of working around in the current version we just (hopefully) get it right with a slightly better set of interfaces.

I more or less came to the same conclusion. So if I have time in the coming days, I will try to prepare an option “5” with breaking changes. Is there anything we want to merge before we can switch over to a v5 tree?

[oxisto]

I have started a branch-off point for v5 here: #234

[oxisto]

Turns out 1-2 weeks was more like 1-2 months 😅

I've been coming back to these PR's, checking them out and testing them on and off.

Option 2 seems like the best approach (at first), but the con you highlighted is quite a footgun.

However, if the user calls Valid() on the claim, this will not take the validator with the options but the default one (because we have no way to supply the validator to the claim in this PR).

So then I got to option 3, and at that point it just felt like a /v5 would make more sense. The current /v4 package has the security and bug fixes, but without it's limitations. Whereas a /v5 we know the set of features we'd like to add, so instead of working around in the current version we just (hopefully) get it right with a slightly better set of interfaces.

So thinking in the direction of v5, I assume that your favourite is option 2 but with a cleaner interface, now that we can break some of the API?

[mfridman]

I believe so, ye.

ps. I'm wrapping up a large chunk of work for my day job, so will have more bandwidth to help out and review PR's closer to the end of Sept. Thanks agains for spearheading the efforrt.