Re: [Txauth] Polymorphism (Was: JSON Schema?)

[Justin Richer <[e-mail]>]

I’m glad that you’re looking at polymorphism as a possible solution to this, though I would contend that this particular style of polymorphism is not doing much more than pushing the mutual-exclusivity check down a layer instead of solving it. 

Using multiple types can in fact solve this problem, and several others, as long as you’re willing to let go of the syntax that OAuth 2 invented to solve a problem that we don’t have to solve here (passing an array-type value over the front channel). In XYZ’s syntax, the request for a single access token would look like this:

{
  “resources”: [ “read”, “write” ]
}

And the request for the multiple access tokens would look like this:

{
  “resources": {
     “reader": [ “read” ],
     “writer”: [ “write” ]
  }
}

I find this to be much simpler to parse and generate, as you no longer need to check for a specially-reserved field name (“type”), and you no longer have to do a sub-parse on one of the values to get what you really want (the space-separated scope string into a set). It’s also a lot simpler for the developers that need to write this.

 — Justin

> On Jul 7, 2020, at 7:30 PM, Dick Hardt <[e-mail]> wrote:
> 
> 
> 
> On Tue, Jul 7, 2020 at 3:40 AM Justin Richer <[e-mail] <mailto:[e-mail]>> wrote:
> I wanted to respond to this comment more fully:
> 
> > wrt. my authorization / authorizations oddness, polymorphism would not solve it as the contents of both authorization / authorizations in XAuth are objects. 
> 
> It’s not surprising that this is the case, as the XAuth protocol was not designed with polymorphism as a tool to consider. This is exactly the reason that I say we should have polymorphism in the toolbox from the start, as it allows us to avoid this kind of awkwardness in many cases.
> 
>  What evidence do you have to make this statement? "XAuth protocol was not designed with polymorphism as a tool to consider"
> 
> It sounds like you are saying I did not consider polymorphism in the XAuth protocol design.
> 
> I will restate my comment above about polymorphism. 
> 
> Using different JSON types does not solve the problem, but as I suggest in my comments, polymorphism of different JSON objects is one solution. An authorization, or a dictionary of authorizations. It has the restriction that the string "type" cannot be used as a label in the dictionary. An example:
> 
> {
>     "authorizations" {
>         "type": "oauth_scope",
>         "scope": "read write"
>     }
> }
> 
> {
>     "authorizations" {
>         "reader": {
>             "type": "oauth_scope",
>             "scope": "read"
>         },
>         "writer": {
>             "type": "oauth_scope",
>             "scope": "write"
>         },
>     }
> }
> 
> 
> I am looking at making this change in XAuth and in the implementation.
> 
> 
> 
> ᐧ