frontend: perform argument value validation only on server

Do not validate values of command arguments on the client and let the
server handle validation.

This will make the client more lightweight by not having it to carry
validation code and metadata with itself for the price of increasing
network traffic in case the validation fails.

Types of the arguments are still validated on both the client and the
server.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>

3 files changed, 16 insertions, 5 deletions

diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index 936757a59..119987b8e 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -448,7 +448,8 @@ class Command(HasParam):
         self.debug(
             '%s(%s)', self.name, ', '.join(self._repr_iter(**params))
         )
-        self.validate(**params)
+        if self.api.env.in_server:
+            self.validate(**params)
         (args, options) = self.params_2_args_options(**params)
         ret = self.run(*args, **options)
         if isinstance(ret, dict):
@@ -686,13 +687,18 @@ class Command(HasParam):
             if param.name in dep:
                 if param.name in kw:
                     # Parameter is specified, convert and validate the value.
-                    kw[param.name] = param(kw[param.name], **kw)
+                    value = param(kw[param.name], **kw)
+                    if self.api.env.in_server:
+                        param.validate(value, supplied=True)
+                    kw[param.name] = value
                 else:
                     # Parameter is not specified, use default value. Convert
                     # and validate the value, it might not be returned so
                     # there's no guarantee it will be converted and validated
                     # later.
                     default = param(None, **kw)
+                    if self.api.env.in_server:
+                        param.validate(default)
                     if default is not None:
                         kw[param.name] = default
                     hasdefault = True
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index 1b35b396a..ccfc204d4 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -572,7 +572,6 @@ class Param(ReadOnly):
             value = self.get_default(**kw)
         else:
             value = self.convert(self.normalize(value))
-        self.validate(value, supplied=self.name in kw)
         return value
 
     def get_param_name(self):
diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 4f90291cb..6fd1c394b 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -346,7 +346,12 @@ def add_external_pre_callback(membertype, ldap, dn, keys, options):
         if membertype == 'host':
             validator = validate_host
         else:
-            validator = api.Object[membertype].primary_key
+            param = api.Object[membertype].primary_key
+
+            def validator(value):
+                value = param(value)
+                param.validate(value)
+
         for value in options[membertype]:
             try:
                 validator(value)
@@ -1100,7 +1105,8 @@ last, after all sets and adds."""),
                         raise errors.OnlyOneValueAllowed(attr=attr)
                 # validate, convert and encode params
                 try:
-                   value = param(value)
+                    value = param(value)
+                    param.validate(value)
                 except errors.ValidationError as err:
                     raise errors.ValidationError(name=attr, error=err.error)
                 except errors.ConversionError as err: