microsoft / microsoft/typespec
Operations that use models with visibility decorators should have client side validation
- Dominant language
- Java
- Stars
- 5.9k
- Forks
- 394
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 104
Description
If an operation uses a model with visibility decorators, the generated code should throw if a property that shouldn't be set is set when the service method is called. For instance, if a property has a visibility of "create", and it is set on a `@get` operation, we should throw.
For roundtrippable models, we should not throw if a "restricted" property is set as part of deserialization by the library itself. We would only throw when the user explicitly sets the property (detected by the public setters being used).
The one exception is "read" visibility as this actually changes whether or not a property has setters, so no client-side validation is needed there.
For properties that have a visibility set, they should probably not be included in the model constructor as they won't be required in all contexts. For visibilities other than "read", they will need to have setters if not in the constructor.
This [Cadl-Ranch scenario](https://github.com/Azure/cadl-ranch/blob/main/packages/cadl-ranch-specs/http/type/model/visibility/main.tsp) has an example of the various visibility values.
Contributor guide
Assessment
This issue has not been assessed yet.