When you said "You can't rely upon UI validation alone in a secure application" I can't agree more but I wasn't sure if you were implying that the VM is also UI validation. The VM (at least in this case) is on the client and therefore subject to attack and for that reason alone I question making the model more knowledgable but then that still means having validation to maintain in two domains which is also distasteful. Fortunately in our case our current applications are all internal.

 

Your questions are actually good ones to send directly to Ward, since he loves to talk theory.  :-)

 

If you're not binding directly to any entity properties then you're right that you're not benefiting from validation on the model itself.  At least not for displaying validation errors within the UI.  Validation on entities is still performed on the server by default, however, and actually for security purposes you probably do always want this validation to be performed and to have it be fairly thorough.  You can't rely upon UI validation alone in a secure application.

 

You can also use the VerifierEngine and DevForce verifiers on any type of object, not just an Entity.  So you can use it directly in your ViewModels if it would help manage the validation process. 

 

We've got several samples which use MVVM in various flavors and also make use of DevForce validation.  If interested, you can find  them here - http://drc.ideablade.com/xwiki/bin/view/Documentation/DevForce-MVVM-Patterns. 

I see the validation at the model level to be very base level validation. It cannot handle all the validation that the UI would need and I don't believe it should (or could) know enough to perform validation based on business or security logic. Any validation that occurs on the model should only be validation that can be applied across any use of that model which either means you don't reuse the model much (or any) or you have few validation points in your model.

 

Then when I add the fact that I don't like binding the V directing to the M even through an exposed property on the VM - so any validation raised on the M now has to be routed on up. This adds a little complexity but nothing to worry about. Then if the VM has a few of its own validations to perform you may need to manage the display of the various sources of the validation sent to the V.

 

I realize not everyone needs the complex validation that my apps do and for drag-n-drop simplicity it seems like (and is) a quick and easy solution but maybe I am over-thinking this or missing a piece of the puzzle.

 

The above is my opinion which is based on the apps I have personally developed.

 

tap...

 

tap...

 

I have not seen much value in using the verification but perhaps I am missing something. I was under the impression I would have to attach to the entity events to bubble them(verification errors) up through my VM - is this correct? Please enlighten me.