Skip to content

docs(examples): add a dependent process example for Section 4.5 - #35

Open
gautamgb wants to merge 2 commits into
OWASP:mainfrom
gautamgb:examples/dependent-processes
Open

docs(examples): add a dependent process example for Section 4.5#35
gautamgb wants to merge 2 commits into
OWASP:mainfrom
gautamgb:examples/dependent-processes

Conversation

@gautamgb

Copy link
Copy Markdown
Contributor

The worked example I said I would write in Discussion #20, after you asked for one REST dependency with the coupling shown before and after: #20 (reply in thread)

It has been sitting in that thread as a branch link since 15 August. Opening it as a pull request so it is somewhere reviewable.

One file. A checkout service calls a remote tax and pricing service over REST, written twice. The contrast is coupling and not a defect; both versions are code a competent software engineer writes. In the first, the response's field names become the order's, and a total the caller could derive arrives in the response instead. In the second, one function parses the response into a type the caller declares, the subtotal is derived from the caller's own catalog, and the tax figure is taken as it came, because recomputing it locally would make the caller a second authority for a fact the far side owns.

It is written to the consolidated Section 4.5, for the kind of dependency a team calls rather than the kind it takes into its build. It reads the Isolated Integrity Principle (4.4.1.2) from the other end of the wire, a caller refusing to let a callee dictate what it accepts, and the Canonical Parsing Principle (4.4.1.1) pointed outward, since a response is input arriving at a boundary. Nothing in it cites a section that no longer exists.

Python 3.10 or later, standard library only. The three code blocks are one file and run in order. The tests are the last of them: each names a property and asserts it against both variants, so the contrast is the assertion rather than a claim made in the prose. A closing section names the result against SSEM attributes, including the one attribute both versions already have and the one that was traded away on purpose.

Placement is yours. It sits in examples/dependent_processes/ to match examples/code_attributes/. Rename the folder or move the file if you have a scheme, and I will follow.

place_order announced that the caller's own door is a boundary and then
examined only quantity. An unknown sku reached CATALOG_CENTS and left as a
KeyError raised from inside this caller's pricing. destination was never
examined at all and went out verbatim inside the request, so the far side
received whatever arrived.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant