Dev: add method to get real validation errors

[kenjis]

There is no way to get real validation errors only, excluding the errors saved in the session.

See codeigniter4/shield#383

[iRedds]

The validation class should not interact with the session at all.
Do not read or delete session values.

If you take a deeper look at the problem that appeared in the shield, you will see:
Suppose our application performs the same manipulations as in the shield, that is, with each request, it changes the timestamp of the activity.

public function recordActiveDate(): void
{
    if (! $this->user instanceof User) {
        throw new InvalidArgumentException(
            __METHOD__ . '() requires logged in user before calling.'
        );
    }

    $this->user->last_active = Time::now();

    $this->provider->save($this->user);
}

Now imagine that validation is enabled in the model that serves changes to the timestamp of the activity.
Then, if the previous request ended with a validation error, then the model with validation enabled, while maintaining the timestamp, will reset the errors from the previous request.
because

CodeIgniter4/system/Validation/Validation.php

Lines 109 to 115 in 42e5b69

	public function run(?array $data = null, ?string $group = null, ?string $dbGroup = null): bool
	{
	// If there are still validation errors for redirect_with_input request, remove them.
	// See `getErrors()` method.
	if (isset($_SESSION, $_SESSION['_ci_validation_errors'])) {
	unset($_SESSION['_ci_validation_errors']);
	}

Example:

// routes 
$routes->get('/', 'Home::index');
$routes->get('form', 'Home::form');

// controller
namespace App\Controllers;

use CodeIgniter\Database\Exceptions\DataException;
use CodeIgniter\Model;
use Config\Services;

class Home extends BaseController
{
    public function index()
    {
        $this->userActivity();
        dd(Services::validation()->getErrors()); // []
    }

    public function form()
    {
        $this->userActivity();
        if (! $this->validateData([], ['email' => 'required'])) {  // email => The email field is required.
            return redirect()->to('/')->withInput();
        }
    }

    private function userActivity()
    {
        $m = new class extends Model {
            protected $validationRules = [
                'time' => 'required'
            ];
        };

        try {
            $m->save(['time' => 'new timestamp']);
        } catch (DataException $e) {}
    }
}

Going to the URL /form will fail the validation and redirect to /. In the index method, validation errors from form are reset due to a change in the timestamp.

[iRedds]

@kenjis The PR you suggested only adds a workaround, but doesn't actually solve the design problem.
Currently, the framework is turning into a set of crutches and bicycles. The maintainers are talking about Semver and that we'll get it right in version 5. But this 5th version is not even visible on the horizon.

[kenjis]

@iRedds Good catch. You're correct.

CodeIgniter4/system/Validation/Validation.php

Lines 109 to 115 in 42e5b69

	public function run(?array $data = null, ?string $group = null, ?string $dbGroup = null): bool
	{
	// If there are still validation errors for redirect_with_input request, remove them.
	// See `getErrors()` method.
	if (isset($_SESSION, $_SESSION['_ci_validation_errors'])) {
	unset($_SESSION['_ci_validation_errors']);
	}

Do you have any solution?

[kenjis]

Is withErrors() really necessary?
It seems there is no clear documentation for withInput()and the validation errors.

We don't know how many times validations will be run, and it is impossible to store only one of those errors in the session and use that errors for all validations.

[iRedds]

@kenjis It seems to me that in the framework of the 4th version nothing can be done. Since receiving errors is related to the validation class and any change will result in a BC.

Earlier I thought about the solution, but some points did not give in to me. I found the solution in the Laravel.

• Validator does not depend on sessions.
• To save validation errors in the session, a method is called on the response. ->withErrors($validator->errors())
• Validation errors through the system middleware (done always before the user's middleware) are retrieved from the session on each request and placed in the shared variable of the views.

And of course, I would remove the validation from the model, focusing it as a repository.

[iRedds]

In addition, there is one interesting case in the validator in Laravel. If the validation fails, it can throw an exception, which is handled like a redirect with an automatic call to ->withErorros().

[kenjis]

Yes, the Validation class should not depends on sessions, and when we use withErrors(() we need validation errors in the views.

And of course, I would remove the validation from the model, focusing it as a repository.

I don't see your logic. How do you do in-model validation?

[iRedds]

I don't see your logic. How do you do in-model validation?

Why do validation in the model?
You can make separate validation services. Like in Symfony or FormRequest in Laravel.

In addition, the CI Model cannot by default change the validation rules for insert or update/partial update. Therefore, you need to add different scenarios of behavior.
And if you look on the forum, most of the code examples do the validation in the controller.

[kenjis]

Why do validation in the model?

Not to save invalid data in the database.

You can make separate validation services.

We have already the Validation service. In-model validation just uses it.

And if you look on the forum, most of the code examples do the validation in the controller.

Validation in the controller is for validating input data (mostly Form data) from the outside of the system.
Validation in the model is for validating database row data (Entity).

[iRedds]

@kenjis I want to say that in my opinion the DDD principle is more successful. By citing symfony and laravel as an example, I meant that in these frameworks, the model/repository is not involved in data validation.

UserController::create() call UserService::create() call UserCreateRequest() only for validation and call UserModel() only for save.
No fat controllers. No fat models. Business logic is distributed across classes, each does only what it is instructed to do.
Each element can be covered by tests.

[kenjis]

@iRedds Thank you for your opinion. I don't know the DDD principle you say, but I understand you prefer the UserCreateRequest() UserController::create() UserService::create() UserModel() pattern.

However, the model does have validation, but it is not used by default, so I don't think it would interfere with the pattern.

This is getting off topic, so I will leave this discussion here for now.

[kenjis]

I sent another PR #6384 to fix the bug.