Binding tag: add 'skipped' on top of 'required'

[manuel-huez]

Currently, when using c.Bind(), it is possible to set the binding tag to required to ensure that the field must be set. It would be useful to also be able to set this field to something like skipped so that when using c.Bind(), the field is skipped and isn't actually decoded.

To give a bit of matter to this issue, my current use case is as follows: I have a model (struct) which I use to interact with my database and to also encode/decode json from my users requests (my application is an API). The model has an ID field which contains the ID of the object referenced in the database. This field should automatically be set by my application, but it should also be returned to the user when requested (when encoding the response's JSON).

Basically, being able to set the binding tag to skipped would give the ability to have fields as read-only.

[i19]

+1

[appleboy]

@manuel-huez @i19 You mean that skip this struct field from validation?

[i19]

i mean skipped from binding.
if an field was set as skipped, then it should not be updated from user request.

[i19]

i checked the code, and i found that gin use the tag binding in validation, that's a little odd.

gin first decode the user request to a data model then check the validation by tag binding. correct my if i was wrong.

if so, if i want to set an field as readonly, it seem that i have to set json:"-", right ?

[thinkerou]

@i19 you can use "binding":"-" skip it.
like this:

type Login struct {
          User     string `form:"user" json:"user" binding:"required"`
          Password string `form:"password" json:"password" binding:"-"` // HERE USE - 
 }

[thinkerou]

@manuel-huez please read https://github.com/gin-gonic/gin#model-binding-and-validation thanks!

[manuel-huez]

Hhey @thinkerou thanks for the feedback! The issue is actually from a few years ago now, so we found some work-arounds at that time.
The solution you mentioned with binding:"-" seems to answer the need we had early in the days though, so I'll close that issue. Thanks!

[bazaglia]

@manuel-huez @thinkerou I don't think adding binding:"-" closes this issue. It doesn't make the field read-only. It is still decoded by c.Bind.

I have some unsafe fields in my application that I don't want to be bind by the request form, and form:"-" also doesn't help as the request can still pass - as the key in the form to set the unsafe field.

[bazaglia]

@thinkerou Tests in my PR are actually passing. Builds are sometimes timing out, but it's happening even on the master branch: https://travis-ci.org/gin-gonic/gin/builds/475558492

[thinkerou]

#1733 merged!