Nested parameter whitelisting about validations

[AlfonsoUceda]

Folks, if you don't mind, I'm going to close this issue, for now don't use filled.schema just schema for nested structures. By the way, thanks for this issue.

[mjq]

Here's a one-file gist that I think demonstrates the reported issue: https://gist.github.com/mjq/ab7ccae8a7620f34843897ce3da65699

The first assertion passes, but the second two fail, just as @rodrigopk described: :email is whitelisted at the first level, but not at the second.

Through experimentation, things work as expected (tests pass) with:

  params do
    required(:id).filled(:int?)
    optional(:user).schema do
      optional(:first_name).filled
      optional(:last_name).filled
    end
  end

(Note that filled was removed from :user and added to :first_name and :last_name).

I'm not sure if there's really a bug here or if the original code was unexpected/wrong. It would be nice if errors were thrown when hanami-validations sees unexpected validation constructions (like the filled.schema chain, or the optional rules without filled or any other conditions).

[AlfonsoUceda]

@mjq @rodrigopk I've talked with dry maintainers and they told me that it is a limitation, chaining is not supported, right now we don't raise an error but they will improve the behaviour in dry-v 1.0

[AlfonsoUceda]

Hi @rodrigopk do you have that config inside params block in the action class?

IMO that behaviour is right, because you are defining something like the following structure:

:id
:user
  |-> :first_name
  |-> :last_name

so you'll have to access it using params[:user][:email], if you want access the email to the first level, then don't declare them inside :user, for example check this: https://github.com/hanami/controller#validations--coercions of course you should send parameters outside user scope.

[AlfonsoUceda]

@mjq ok, now I understand better the problem. I think the problem is use .filled in required(:user).filled.schema { ... }, when you have a nested data, you have to use required(:user).schema { ... } and if that nested data is optional you can use required(:user).maybe { ... }.

Anyway, I'll ask to dry-validation maintainers why with filled.schema doesn't work well.