Portable Form Contracts via Declarative Expression Trees

说明与用途

文章讨论了使用回调进行验证的表单缺乏可移植性的问题。它建议使用声明性表达式树（JSON），这些树可以被序列化并在不同的运行时中执行，确保客户端和服务器之间的一致性契约。

问题

Standard form libraries rely on executable callbacks for validation and conditional logic, which cannot be serialized as JSON. This prevents forms from being portable across different runtimes, backends, or visual editors, breaking the contract between client and server.

结果

By decoupling form behavior from executable code and using declarative expression trees, forms become portable contracts. This enables consistent validation across clients and servers, supports visual editors, and eliminates security risks associated with remote code execution.

工作流

• Identify form logic that relies on imperative callbacks.
• Replace callbacks with a declarative expression tree format (e.g., { op: 'eq', left: { path: [...] }, right: { literal: ... } }).
• Use a typed builder (TypeScript) for authoring to ensure type safety and reference checking.
• Serialize the resulting structure to JSON for transport.
• Implement interpreters in target runtimes to execute the declarative rules.
• Validate the form contract independently on the server using the same JSON definition.

证据

A form configuration is not a portable form contract if part of its meaning still lives inside executable callbacks.

来源

The remote document never contains JavaScript, serialized callbacks or instructions to evaluate arbitrary source code. It only contains data from a closed vocabulary.

来源