{"action":"created","issue":{"url":"https://api.github.com/repos/lcobucci/jwt/issues/73","repository_url":"https://api.github.com/repos/lcobucci/jwt","labels_url":"https://api.github.com/repos/lcobucci/jwt/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/lcobucci/jwt/issues/73/comments","events_url":"https://api.github.com/repos/lcobucci/jwt/issues/73/events","html_url":"https://github.com/lcobucci/jwt/pull/73","id":131432450,"number":73,"title":"Replaced Token->validate with Validator class handling token validation","user":{"login":"dannydorfel","id":432109,"avatar_url":"https://avatars.githubusercontent.com/u/432109?v=3","gravatar_id":"","url":"https://api.github.com/users/dannydorfel","html_url":"https://github.com/dannydorfel","followers_url":"https://api.github.com/users/dannydorfel/followers","following_url":"https://api.github.com/users/dannydorfel/following{/other_user}","gists_url":"https://api.github.com/users/dannydorfel/gists{/gist_id}","starred_url":"https://api.github.com/users/dannydorfel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dannydorfel/subscriptions","organizations_url":"https://api.github.com/users/dannydorfel/orgs","repos_url":"https://api.github.com/users/dannydorfel/repos","events_url":"https://api.github.com/users/dannydorfel/events{/privacy}","received_events_url":"https://api.github.com/users/dannydorfel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-02-04T18:25:09Z","updated_at":"2016-02-07T12:17:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/lcobucci/jwt/pulls/73","html_url":"https://github.com/lcobucci/jwt/pull/73","diff_url":"https://github.com/lcobucci/jwt/pull/73.diff","patch_url":"https://github.com/lcobucci/jwt/pull/73.patch"},"body":"@lcobucci I kept the responsibility for validating in the claim, since they are like value objects and know best how to validate themselves. I'm not sure where to put the error message. In the claim itself? \r\n\r\nAlso documentation still needs update in this PR. \r\n\r\nYour comments please?"},"comment":{"url":"https://api.github.com/repos/lcobucci/jwt/issues/comments/181002720","html_url":"https://github.com/lcobucci/jwt/pull/73#issuecomment-181002720","issue_url":"https://api.github.com/repos/lcobucci/jwt/issues/73","id":181002720,"user":{"login":"lcobucci","id":201963,"avatar_url":"https://avatars.githubusercontent.com/u/201963?v=3","gravatar_id":"","url":"https://api.github.com/users/lcobucci","html_url":"https://github.com/lcobucci","followers_url":"https://api.github.com/users/lcobucci/followers","following_url":"https://api.github.com/users/lcobucci/following{/other_user}","gists_url":"https://api.github.com/users/lcobucci/gists{/gist_id}","starred_url":"https://api.github.com/users/lcobucci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcobucci/subscriptions","organizations_url":"https://api.github.com/users/lcobucci/orgs","repos_url":"https://api.github.com/users/lcobucci/repos","events_url":"https://api.github.com/users/lcobucci/events{/privacy}","received_events_url":"https://api.github.com/users/lcobucci/received_events","type":"User","site_admin":false},"created_at":"2016-02-07T12:17:17Z","updated_at":"2016-02-07T12:17:17Z","body":"About @Ocramius and @henriquemoody comments:\r\n\r\n> Depends on whether they are exposed or not\r\n\r\nThey're not exactly exposed. `Token#getHeaders()` and `Token#getClaims()` returns a list of them however it's way easier to just use `Token#getHeader($name)` and `Token#getClaim($name)` that hides the usage of `Claim`.\r\n\r\n> Sounds like overkill/implementation detail. The current validation is sufficient and very simple, IMO. The only thing to be fixed is the stateful validator (really bad!)\r\n\r\n> In that case, having just a validator interface and letting the user implement the validator seems more reasonable for a first version, or else you might be getting out of the 80/20 use-cases. Don't overdo it, IMO.\r\n\r\n> I thought about creating a JWT rule on Respect\\Validation sometimes. Of course we can do that but we need to write too much code from this library on our library then the chances of breaking the API is higher than using a single point of failure, that's why this feature is so useful. Also I don't thing it's fair to force someone to install one more library to have a fature that's simple for you to have here.\r\n\r\nI think need to explain my suggestion better :smile:\r\n\r\nThe most important thing here (and I'm glad that we all agree on this HAHAHA) is to introduce an interface for the validator. In my mind it would be something like:\r\n\r\n```php\r\nnamespace Lcobucci\\JWT;\r\n\r\nuse Lcobucci\\JWT\\Validation\\Result;\r\n\r\ninterface Validator\r\n{\r\n    public function validate(Token $token):Result;\r\n}\r\n```\r\n\r\nOur default implementation would receive all the validation constraints (instances of `Respect\\Validation\\Validator`) and the `Validator#validate()` would just validate all the constraints (basically using the `Respect\\Validation\\Validator::allOf()`) and create a `Result` from that.\r\n\r\nThat means that we need an easy way to configure our validator's constraint list and that's where the builder enters. It would be the glue point with the chosen validation lib.\r\n\r\nIt's interface would be something like:\r\n\r\n```php\r\nnamespace Lcobucci\\JWT\\Validation;\r\n\r\nuse Respect\\Validation\\Validator as Constraint;\r\n\r\nclass Builder\r\n{\r\n    public function assertId($id):Builder {}\r\n    public function assertIssuer($issuer):Builder {}\r\n    // the same for the other default claims\r\n    public function assertThat($claim, Constraint $constraint):Builder {}\r\n    public function getValidator():Validator {}\r\n}\r\n```\r\n\r\nI'm just considering the idea of adding another dependency because we wouldn't have to deal here with the creation of error messages and also that we would allow users to validate the data in the token with some different validators."}}