Re: [Json] Schemas & so on

[Phillip Hallam-Baker <[e-mail]>]

If we did get into extended schema discussions, one of my main issues that
I don't see well supported in existing schema systems is support for
encryption and signature. These are features that I really would like to be
able to have supported in the 'validation' layer.

In the Mesh I have nested structures where portions of the inner structure
are signed. A user profile contains a set of application profiles, both of
which are signed. One side effect is that every profile structure ends up
having two flavors - signed and unsigned. And that is messy.

So for example, say this is my schema without signatures

UserProfile Class
    Applications     List <ApplicationProfile>
    Devices      List <DeviceProfile>

ApplicationProfile Class <Abstract>
    ... fields

And a JSON encoded object would be:

"UserProfile" : { "Applications" : [ {"MailApplicationProfile" : {...} } ] }

Since Application Profile is an abstract class, the deserializer needs to
know which particular subtype is being decoded. So the instances of the
class need to be tagged.


Easy enough, right? Well if we add signatures (or encryption) they are in
effect just wrappers round a class. But they have the effect of burying
that tag I need to decode the object.

So I would like to have something like:

ApplicationProfile Class <Signed Abstract>

"UserProfile" : { "Applications" : [
     ["Jose-Header" ,  $$ {"MailApplicationProfile" : {...} } ] } $$,
"Jose-trailer" ]
      ] ...] }

Where $$...$$ is the base 64 signed data blob as a string. Same for
encrypted data.


This type of approach would let me move all the signature validation parts
into code. I would still need to hand code the path math for validation of
the signing keys. When rendered in C#, I would get a class like this:

class UserProfile : JSON.Object {
   List <ApplicationProfile> Applications;
   List <DeviceProfile> Devices;
   }

abstract class ApplicationProfile : JSON.SignedObject {
   ... fields
   }

class MailApplicationProfile : ApplicationProfile {
   ...
   }

The JSON.SignedObject class would inherit from JSON.Object and provide
mechanisms for verifying signatures, etc. Using the array allows the order
of the JOSE data items to be forced which helps a lot in writing
verification code into the deserializer which is of course essential if you
want to do a one pass deserialization on a constrained device.

Encryption would be handled in a similar way by JSON.EncryptedObject.