[bv-dev] Cross parameter validation convergence

I would like to bring home cross parameter validation which is one of the main open issues in method validation. We have been discussing it for literally 11 months, it's time to converge. If you could give your feedback quickly, Gunnar might be able to add it to the spec in the next few days. I am already pushing him harder than I should to move BV forward so give him some help :) The following is a less readable copy of what you can find at http://beanvalidation.org/proposals/BVAL-232/ ### Cross parameter validation and return value Do we agree that validating both the parameters and the return value in a single constraint validator is not a use case we want to cover? To me that would be awkward to support it as we would need to execute the method to validate it. ### Where to host cross-parameter constraints We use the method as host to the return value constraints and possibly `@Valid`. That is unfortunately also the natural place for cross parameter constraints. I cannot think of another place to put them. There is also no easy way to add a visual cue and differentiate a regular constraint from a cross param constraint except by its meta annotation. We would rely on the user adding a visual cue in the constraint name. Which kind of cue? Put `param` in the constraint name? Any one can think of a better approach? #### Bean Validation class @interface CrossParameterConstraint { public Class<? extends CrossParameterConstraintValidator<?, ?>>[] validatedBy(); } interface CrossParameterConstraintValidator<A extends Annotation> { void initialize(A constraintAnnotation); [...] } #### Constraint coder class @CrossParameterConstraint(validatedBy=CheckRetypedPasswordValidator.class) @interface CheckRetypedPasswordParameter { String message() default "..."; Class<?>[] groups() default {}; class<? extends Payload>[] payload(); } class CheckRetypedPasswordValidator implements CrossParameterConstraintValidator<CheckRetypedPasswordParameter> { ... } #### User code class AccountService { //cross param constraints @CheckRetypedPasswordParameter //return value constraints @Valid @NotNull User createUser(@NotEmpty String username, @Email String email, String password, String retypedPassword); } ### What is the cross parameter constraint validator contract? There has been two leading proposals. the others are described in the [previous proposal][previous proposal]. #### Generic approach interface CrossParameterConstraintValidator<A extends Annotations> { void initialize(...) { ... } boolean isValid(Object[] parameterValues, ConstraintValidatorContext context); } #### Type-safe approach (with annotation processors) A more type-safe approach is to reuse the parameters signature of the method to match. While the Java compiler cannot discover problems, both an annotation processor and the bean validation provider at runtime can detect inconsistent contracts and raise respectively compilation errors and deployment time exception. class CheckRetypedPasswordValidator implements CrossParameterConstraintValidator<CheckRetypedPasswordParameter> { void initialize(...) { ... } boolean isValid(String username, String email, String password, String retypedPassword, ConstraintValidatorContext context) { ... } } #### Discussions I think we must put the generic approach in because that's the only way to write non method specific cross parameter constraints. Two examples of such constraints are - script based constraints - generic password retype checks based on the parameter indexes `@AreEqual(indexes={2,3}, message="Passwords must be identical")` So the remaining question is do we also support the type-safe approach in parallel? I am inclined to think yes. We can do it on the same `CrossParameterConstraintValidator` implementation: class CheckRetypedPasswordValidator implements CrossParameterConstraintValidator<CheckRetypedPasswordParameter> { void initialize(...) { ... } boolean isValid(Object[] parameterValues, ConstraintValidatorContext context); boolean isValid(String username, String email, String password, String retypedPassword, ConstraintValidatorContext context) { ... } } If the method validated has a matching signature, we use it, otherwise we use the generic method. Do we keep the generic `isValid` method on the interface, thus forcing people to implement it? Or is that an optional non constrained contract? I am tempted to think that forcing is a better approach (the implementation can raise an exception). Thoughts? [jira]: https://hibernate.onjira.com/browse/BVAL-232 [previous proposal]: /proposals/BVAL-241/#cross_parameter