Bug: [Validation] `required_without` will not work if the field is specified with asterisk

[kenjis]

See #5922 (comment)

The following test fails. The validation passes.

    public function testRequireWithoutWithWildCard()
    {
        $data = [
            'a' => [
                ['b' => 1, 'c' => 2],
                ['c' => ''],
            ],
        ];

        $this->validation->setRules([
            'a.*.c' => 'required_without[a.*.b]',
        ])->run($data);

        $this->assertSame(
            'The a.*.c field is required when a.*.b is not present.',
            $this->validation->getError('a.1.c')
        );
    }

[ping-yee]

I think the description of required_without is strange.

The field is required when all of the other fields are present in the data but not required.

Is the description different from the value of getError means ?

The a..c field is required when a..b is not present.

[ping-yee]

@kenjis What kind of design should I use?

[kenjis]

Is the description different from the value of getError means ?

Yes. The explanation is the same as the following comment, but it seems different from the Example blow:

CodeIgniter4/system/Validation/Rules.php

Lines 274 to 279 in ac2ad22

	* The field is required when all of the other fields are present
	* in the data but not required.
	*
	* Example (field is required when the id or email field is missing):
	*
	* required_without[id,email]

[ping-yee]

The field is required when all of the other fields are present in the data but not required.

I think this explanation and description of official document of required_without[] isn't right , the right explanation should be as below.

The field is required when any of the other required fields are not present in any data.

[ping-yee]

CodeIgniter4/system/Validation/Rules.php

Lines 302 to 304 in ac2ad22

	if ((strpos($field, '.') === false && (! array_key_exists($field, $data) || empty($data[$field]))) || (strpos($field, '.') !== false && empty(dot_array_search($field, $data)))) {
	return false;
	}

empty(dot_array_search($field, $data))

As the conditional shows, it judge whether the param field of required_without[] isn't presented in data.

For example:

public function testRequireWithoutWithWildCard()
    {
        $data = [
            'a' => [
                ['b' => 1, 'c' => 2],
                ['c' => ''],
            ],
        ];

        $this->validation->setRules([
            'a.*.c' => 'required_without[a.*.b]',
        ])->run($data);

        $this->assertSame(
            'The a.*.c field is required when a.*.b is not present.',
            $this->validation->getError('a.1.c')
        );
    }

In this test case, a.*.c field will be required when all of a.*.b field don't present in data.
If any data is presented in a.*.b field, a.*.c will not be required, so the dataset of this test case should be chaged as below.

$data = [
    'a' => [
        ['b' => '', 'c' => 2],
        ['c' => ''],
    ],
];

[kenjis]

@ping-yee Do you mean this is not a bug?

I thought that a.1.c field will be required when a.1.b field doesn't present in data.
It seems we need a realistic use case.

[ping-yee]

Do you mean this is not a bug?

Yes. I think this is not a bug, it just need to change the command out and the description of official document.

I thought that a.1.c field will be required when a.1.b field doesn't present in data.

Yes. It should be that.
So the data set of this case should be as below.

    public function testRequireWithoutWithWildCard()
    {
        $data = [
            'a' => [
                ['b' => '', 'c' => 2],
                ['c' => ''],
            ],
        ];

        $this->validation->setRules([
            'a.*.c' => 'required_without[a.*.b]',
        ])->run($data);

        $this->assertSame(
            'The a.*.c field is required when a.*.b is not present.',
            $this->validation->getError('a.1.c')
        );
    }

When a.0.b field doesn't present in data, the a.0.c and a.1.c field will be required.
But a.1.c field doesn't have any data, it will get the error The a.*.c field is required when a.*.b is not present..

[kenjis]

When a.0.b field doesn't present in data, the a.0.c and a.1.c field will be required.

I thought the checking should be done for each array (a.0, a.1).
When a.0.b field does not pass required check, the a.0.c field will be required.
When a.1.b field does not pass required check, the a.1.c field will be required.

[MGatner]

I read through this whole thread and thought to myself: "has our validation system gotten too abstruse?"

I can't think of an example where I would use this, but also it seems so difficult to understand I think if I did have such a case I would break it into smaller validations.

[kenjis]

To be frank, I am not sure of the correct specifications.
I would like to hold off until a use case can be found.

[ping-yee]

Sorry, I think What I express is too abstruse 😢, I think I figure out and find a bug last night.

And I want to check the process logic and design with you all.

In asterisk fields case.

    public function index()
    {
        $data = [
            'a' => [
                ['b' => 1, 'c' => ''],
                ['b' => '', 'c' => 2],
                ['c' => ''],
            ],
        ];

        $this->validation->setRules([
            'a.*.c' => 'required_without[a.*.b]',
        ])->run($data);
        
        dd($this->validation->getError('a.2.c'));
    }

To begin with, we can see these code in last run() function as below :

CodeIgniter4/system/Validation/Validation.php

Lines 168 to 176 in ac2ad22

	if (strpos($field, '*') !== false) {
	// Process multiple fields
	foreach ($values as $dotField => $value) {
	$this->processRules($dotField, $setup['label'] ?? $field, $value, $rules, $data, $field);
	}
	} else {
	// Process single field
	$this->processRules($field, $setup['label'] ?? $field, $values, $rules, $data);
	}

In this case, it input the one by one a.*.c field (a.0.c, a.1.c, etc...) by using foreach into the processRules() function to judge this field whether following the rule of setRule() or not.

Now a.0.c field in first round

In processRules() function, it load the correspondence rule instances and put $value, $param, $data, $error these data into correspondence rule function (like required_with(), required_without(), etc...) as below :

CodeIgniter4/system/Validation/Validation.php

Lines 313 to 315 in ac2ad22

	$passed = $param === false
	? $set->{$rule}($value, $error)
	: $set->{$rule}($value, $param, $data, $error);

There is value of each required_without() params :
$value => "" (This is key of setRule() field data, in this case is a.0.c field data so that is "")
$param => "a.*.b" (This is the param field of required_without[] in this case, so it's a.*.b)
$data => $data array (This is the data set of present in).
$error => This isn't used in this case.

Here we are required_without() function, it call the required() function to judge the $str (I don't think this is a good name, $str correspond $value as shown above) whether the field value isn't empty string or not In line 293.

If it isn't empty string, means there is data in key of setRule() field this time then return true and finish the judgement of this field (because key of setRule() field have data, it will never error occur in this rule) in line 296.

If it is empty string, then we keep go on. 😓

CodeIgniter4/system/Validation/Rules.php

Lines 283 to 308 in ac2ad22

	public function required_without($str = null, ?string $fields = null, array $data = []): bool
	{
	if ($fields === null || empty($data)) {
	throw new InvalidArgumentException('You must supply the parameters: fields, data.');
	}
	// If the field is present we can safely assume that
	// the field is here, no matter whether the corresponding
	// search field is present or not.
	$fields = explode(',', $fields);
	$present = $this->required($str ?? '');
	if ($present) {
	return true;
	}
	// Still here? Then we fail this test if
	// any of the fields are not present in $data
	foreach ($fields as $field) {
	if ((strpos($field, '.') === false && (! array_key_exists($field, $data) || empty($data[$field]))) || (strpos($field, '.') !== false && empty(dot_array_search($field, $data)))) {
	return false;
	}
	}
	return true;
	}

CodeIgniter4/system/Validation/Rules.php

Lines 214 to 229 in ac2ad22

	public function required($str = null): bool
	{
	if ($str === null) {
	return false;
	}
	if (is_object($str)) {
	return true;
	}
	if (is_array($str)) {
	return $str !== [];
	}
	return trim((string) $str) !== '';
	}

In line 301 - 308, it have some condition to judge whether the param field(s) of required_without[] have data or not.
The param field is a.*.b in this case, the condition is strpos($field, '.') !== false && empty(dot_array_search($field, $data)).

The function of dot_array_search($field, $data) is search all data of incoming field, in this case it return array of all of a.*.b data.
But if there is only one field in data set, it will only return the string type without array. (This is a bug but I have fixed in PR because empty() function can't judge whether all of array value is empty or not, it will be always be false even all of array value is empty).

array(2) {
  [0]=>
  string(0) ""
  [1]=>
  string(0) ""
}

The condition judge whether the array return by dot_array_search($field, $data) function is empty or not.
if it return false, then this round key of setRule() field will store in the $this->errors[$field] (like this round field a.0.c) as below.

CodeIgniter4/system/Validation/Validation.php

Lines 340 to 347 in ac2ad22

	$this->errors[$field] = $error ?? $this->getErrorMessage(
	$rule,
	$field,
	$label,
	$param,
	(string) $value,
	$originalField
	);

Continue to a.1.c field judge, until all of a.*.c finish judged.

And $this->validation->getError('a.1.c') get the error message with passin field in $error array.

This is all of process logic and there is a design problem will show at next comment.
Thanks for reading.

[ping-yee]

I find a bug is empty(dot_array_search($field, $data)) only can judge whether the field value is empty or not in one field.

If there are more than two fields in data set, dot_array_search($field, $data) will return all of this $field values in array type, then empty() function can't judge whether all of values of this return array are empty or not (it will always return false) as shown above.

So I fixed this issue in PR, Add these to check whether dot_array_search() return data in array type or not.

if (strpos($field, '.') !== false && is_array(dot_array_search($field, $data))) {
    foreach (dot_array_search($field, $data) as $value) {
        if (empty($value)) {
            return false;
        }
    }
}

And this change can all pass in ValidationTest.php and RulesTest.php files unit test.

In asterisk field case.

But this design is when any of required_without[] param field is empty, the key of setRule() field is required (I think this is what the author design).

    public function index()
    {
        $data = [
            'a' => [
                ['b' => 1, 'c' => ''],
                ['b' => '', 'c' => 2],
                ['c' => ''],
            ],
        ];

        $this->validation->setRules([
            'a.*.c' => 'required_without[a.*.b]',
        ])->run($data);
        
        // This will error occur.
        dd($this->validation->getError('a.0.c'));

        // This will not error occur.
        dd($this->validation->getError('a.1.c'));
        
        // This will error occur.
        dd($this->validation->getError('a.2.c'));
    }

In this case, becase a.1.b field doesn't present in data, make all of a.*.c field become required.

And this is why a.0.c and a.2.c fields will get error message, becasue these two fields don't present in data.

After figure out what the author of this class design, I think this is reasonable for this design becasue it conform the word required_without[] means like:

required_without[] param field is main required, if any required_without[] param field don't present in data then the key of setRule() field need to support the main required to become second required.

I think this is make sense.