Data Validation models

Data validation models
Marcin Czarnecki - Tech Lead

<?php
require(‘user_functions.php’);
if (!empty($_POST['email'])) {
if (!empty($_POST['password'])) {
if (!empty($_POST['username'])) {
save_user($_POST);
echo "User created";
exit();
}
die("empty username");
}
die("empty password");
}
die("empty email");

<?php
use SymfonyComponentValidatorConstraints as Assert;
class User
{
/**
* @AssertNotBlank
* @AssertString
* @AssertEmail
*/
public $email
/**
* @AssertNotBlank
* @AssertLength(min=“3”)
*/
public $username;
}

<?php
use AssertAssert;
class User
{
private string $username;
private string $email;
/* @throw InvalidArgumentException */
public function __construct(string $username, string $email)
{
Assert::stringNotEmpty($username);
Assert::minLength($username, 3);
Assert::stringNotEmpty($email);
Assert::email($email);
$this->username = $username;
$this->email = $email;
}
}

create table users
(
id bigint not null primary key auto_increment,
email varchar(100) not null,
username varchar(100) not null,
constraint email_unique unique (email),
constraint username_unique unique (username)
)

Optional section title
Syntactic
Checks if data has the proper
data type and format
2020-02-30
Invalid date
2030-02-03
Looks like a valid date!
Semantic
Checks if data makes sense in
our use case
2030-02-03
Seems to be invalid DoB
1903-01-02
??? ??? ??? ??? ??? ???

{
"email": “mczarnecki@example.com" // valid
}

{
}
{
"email": 12345679 // invalid - wrong data type
}

{
}
{
}
{
"email": “mczarnecki@example" // invalid - wrong domain
}

{
}
{
}
{
}
{
"email": “” // invalid - empty string
}

{
}
{
}
{
}
{
"email": “” // invalid - empty string
}
{
"email": “mczarnecki+spam@example.com" // valid
}

Is it so simple?
filter_var($email, FILTER_VALIDATE_EMAIL) vs RFC5321

mczarnecki(comment)@example.com
уникум@из.рф
"this is v@lid!"@example.com
"()<>[]:,;@"!#$%&'*+-/=?^_`{}| ~.a”@example.org
" “@example.org
localpart.ending.with.dot.@example.com

When should I be more careful about syntax
validation?
➔ Integrations with external APIs (for example oAuth)
➔ It is a core of our application
Usually it will be just an edge case

I got mczarnecki@example.com as input, but such
user already exists. Is it valid?

➔ Register user context
● Definitely NO!

● Definitely NO!
➔ Login user context
● Yes, it is valid

● Definitely NO!
➔ Search for friend
● No such validation rule.

● Definitely NO!
➔ Search for friend
● No such validation rule.
➔ Send order confirmation email
● Yes, it is required to exist in database

As soon as possible
Before deserialisation or just after it.

<?php
class RegisterUserRequest {
/**
* @AssertNotBlank
* @AssertString
*/
public $email
/**
* @AssertNotBlank
* @AssertLength(min=“3”)
*/
public $username;
}

Make sure that you will
always operate on valid object
Use Argument Resolver and kernel.exception listener to handle
invalid requests

<?php
class RegisterUserRequestResolver implements ArgumentValueResolverInterface
{
private SerializerInterface $serializer;
private ValidatorInterface $validator;
public function __construct(
SerializerInterface $serializer,
ValidatorInterface $validator
)
{
$this->serializer = $serializer;
$this->validator = $validator;
}

<?php
class RegisterUserRequestResolver implements ArgumentValueResolverInterface
{
public function supports(Request $request, ArgumentMetadata $argument)
{
return RegisterUserRequest::class === $argument->getType();
}
public function resolve(Request $request, ArgumentMetadata $argument)
{
$dto = $this->serializer->deserialize($request->getContent(),
RegisterUserRequest::class, 'json');
$errors = $this->validator->validate($dto);
if($errors->count()){
throw new Exception((string)$errors);
}
yield $dto;
}
}

<?php
class ExceptionListener
{
public function onKernelException(ExceptionEvent $event)
{
$exception = $event->getThrowable();
$response = new Response();
$response->setContent($exception->getMessage());
$response->setStatusCode(Response::HTTP_BAD_REQUEST);
$event->setResponse($response);
}
}

<?php
class UserController
{
public function index(RegisterUserRequest $request)
{
$this->usersService->createUser(
$request->email,
$request->username,
);
return new Response('', Response::HTTP_CREATED);
}
}

Domain model should be
always valid
To keep your code DRY most of the semantic validation should take
place in the application / domain layer.

<?php
class UserController
{
public function index(RegisterUserRequest $request)
{
$this->usersService->createUser(
new Username($request->username),
new Email($request->email),
);
return new Response('', Response::HTTP_CREATED);
}
}

<?php
use WebmozartAssertAssert;
class Email
{
public function __construct(string $email)
{
}
}

<?php
class UserService
{
public function createUser(Username $username, Email $email)
{
if($this->usersRepository->findByEmail($email)){
throw new UserAlreadyExists();
}
if($this->usersRepository->findByUsername($username)){
throw new UserAlreadyExists();
}
$this->usersRepository->add(new User(
$email,
$username
));
}

<?php
use WebmozartAssertAssert;
class User
{
public function __construct(string $email)
{
}
}

+-------------------------+----------+----------+
| benchmark | mean | mem_peak |
+-------------------------+----------+----------+
| BeberleiAssertBench | 4.490μs | 1.237mb |
| WebmozartValidatorBench | 4.376μs | 1.200mb |
| BeberleiLazyAssertBench | 20.786μs | 1.295mb |
| Symfony4ValidatorBench | 25.435μs | 1.384mb |
| LaravelBench | 15.470μs | 2.339mb |
| LaminasBench | 97.789μs | 1.296mb |
+-------------------------+----------+----------+

Try it out
github.com/scyzoryck/php-validators-benchmark
Thanks to phpbench/phpbench

Take away
➔Syntactic validation should be done as soon as possible
➔Semantic validation should be implemented in the
application / domain level
➔We should avoid of operating on incorrect objects
➔Always validate your input :)

Thank you
twitter.com/scyzoryck
 
github.com/scyzoryck

Data Validation models

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Data Validation models

Ähnlich wie Data Validation models (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Data Validation models