API proposal for opt-out attribute for unified validations

[oroztocil]

Background and Motivation

Currently, the new shared validation support (used in Minimal APIs and Blazor) does not have a mechanism for declaring that some properties of a validated type or parameters of a validated endpoint should be skipped (i.e. the validator should not recurse into validating their types and their nested properties).

We want to add an opt-out attribute similar to the ValidateNever attribute from MVC. This will allow users to exclude specific properties or parameters from validation when needed.

Proposed API

namespace Microsoft.Extensions.Validation
{
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Parameter | AttributeTargets.Property)]
+    public sealed class SkipValidationAttribute : Attribute
+    {
+        public SkipValidationAttribute() -> void
+    }
}

Usage Examples

[ValidatableType]
public class ComplexType
{
    public NestedType ValidatedObjectProperty { get; set; }

    // Skip validation on complex type properties
    [SkipValidation]
    public NestedType SkippedObjectProperty { get; set; }
 
    // Skip validation on collection properties
    [SkipValidation]
    public List<NestedType> SkippedListOfObjects { get; set; }

    // This is also skipped due to the attribute on the class itself
    public AlwaysSkippedType AlwaysSkippedProperty { get; set; }

    // Skip validation on a simple property?
    [SkipValidation]
    [Range(10, 100)]
    public int IntegerWithRange { get; set; }
}
 
// Skip validation on an entire type
[SkipValidation]
public class AlwaysSkippedType
{
    public NestedType ObjectProperty { get; set; }
}
 
// Skip validation on method parameters
app.MapPost("/abraka", ([SkipValidation] NestedType skippedData, NestedType validatedData) => "OK");

Alternative Designs

Instead of introducing an opt-out mechanism, we could make nested validations opt-in.

• The experimental ObjectGraphDataAnnotationsValidator did it that way.
• However, opt-out is consistent with MVC and has less potential for business logic bugs.

We could also force people to write dedicated types for validated and non-validated data.

Risks

• There may be confusion with the existing ValidateNever attribute from MVC.
• People using the experimental ObjectGraphDataAnnotationsValidator will have to switch their logic opt-in/opt-out logic when migrating.

[halter73]

API Review Notes

• This will use the [Expiremental] attribute
• Do we like the name?
  • [ValidationIgnore] might be more discoverable.
  • But we prefer the sound of [SkipValidation]

API approved!

[javiercn]

@oroztocil feel free to close this if you don't expect any change to it, since we approved it as is