Compile-time safety for enumerations in Go
vladimir.varank.in
vladimir.varank.in
The other 'gotcha' is that in switch statements the compiler can't tell whether you enumerated on all your cases as there is no true enum type so it's not uncommon to have a catch all default case that either returns an error or panics and hope you can catch it during tests if you missed a case.
I just wish go had proper sum types.
I believe it's in golangci-lint.
It's by far my favorite feature of Swift.
Enums + Payloads + switches are incredibly simple yet so effective. You can make a simple state object, isolate it with an actor, then stream it anywhere with Combine (or now Observability). You'll get full compiler safety too, forcing any new state to be handled everywhere.
You can even stack that with _generic_ payloads that conform to protocols, and if you're feel brave you can make those payloads equable completions for _typed returns_.
for example (I hate formatting on here, but I'll give it a shot)
// A user state enum that conforms to loggable.
// The state is generic, any object T that conforms to "Partner" protocol can be a partner
enum UserState<T: Partner>: Loggable {
// Your states
case loggedOut(error: String?)
case loggingIn(email: Email) // Email type is a string that's been validated
case loggedIn(authToken: String, user: User, partner: T)
case loggingOut(exampleBlock: (String) -> Bool) // You can embed a callback here
// Utility Functions
/// Is the user logged in?
func isLoggedIn() -> Bool {
switch self {
case .loggedOut, .loggingIn: return false
case .loggedIn: return true
}
}
/// Loggable conformance
func logText() -> String {
// switch that converts state into something that's safe for your logging service
}
}In the above, any subscriber that gets a UserState object can switch on it, and for example if you're logged in you 100% get the auth token, user, etc. It's impossible to be logged in without those in-context.
It might look something like this in your UI:
/// Called by a subscriber that's hooked in to the state stream
func onUserStateChanged(newState: UserState) {
switch newState {
case let .loggedOut:
// Impossible? Error UI
case let .loggingIn, .loggingOut:
// loading UI
case let .loggedIn(authToken: _, user: user, parner: partner):
// set some text "hello \(user.userName)"
// display an image: \(MyRemoteLoader.url(url: partner.primaryLogoURL))
// Button to website: Button(url: partner.homePageURL)
}
}add a new state later? The compiler will error in the 500 places in your codebase you didn't handle the new case with one build command.
What I really wish Go had was sum types, Rust style. That'd cover enumerations and more.
Pattern matching and exhaustive checks are massive benefits of them though. I guess I'm just oddly conflicted here.
I do think that long term, sum types are going to become more prevalent. I'm excited to see it, I'm just interested in how that adoption occurs in existing languages without them.
Sum types are useful, even very useful in the right place, but I do think there's a lot of people who use them a couple of times, probably in one of those "right places" and then mistakenly label them in their mind as "better". Just, universally, Platonically "better". They aren't in fact "better"; they're a tool. Sometimes they're the right tool for the job, but much, much more often, they're just a tool that works, and so do several other tools. People who get too excited about sum types need to be sure they square their understanding of how useful they are with the fact that the vast majority of programs are written without them.
I feel this pain basically any time I hand-write lexical scanners/parsers in Go or even C++.
That's because they are. jerf subtly shifts the point to one they can criticise, but it does not change the basic fact that sum types are a critical tool which is just... missing.
There's probably no tool which can't be misused, even the humble boolean, that's not an issue with the tool, and pointing that out is at best irrelevant. It does not change the fact of the matter: you're missing a critical axis of composition. It's like saying screwdrivers are useful but you can misuse them to hammer nails as if that justified trying to screw with a hammer.
Moreover, Go seems to attract this sort of criticism as if Go is Uniquely Broken and it's nirvana in all the other languages... but I've used enough of them to know better. Sum types are great, until you hit the branch of the expression problem where you really need the other side, and if you're in a language that favors them, you're going to get the same 75% experience, just mirror imaged.
Which other side? Product types (aka structs)? I don't think there are any languages with Sum types that don't also include Product types.
I am not clear what you mean by that, exactly, but generally I model a state machine as a type that composes a state:
type State interface {
isState()
}
// a whole bunch of state types here
type StateMachine struct {
State // exported or not exported, depending on local needs
// additional data
}
func (sm *StateMachine) Event1(args...) error {
// can call current state and change it here
}
You can add an "Execute" method on to the State and have it return an entire state if that's how you want to do it. The state machine can pass in any cross-state data. There's a number of options. You aren't obligated to do exactly, only, and precisely what you'd do in another language, and program X in Y. For some reason, that's common wisdom in the programming world... except for functional programming. I say "don't program X in Y" is simply true and there is no carveout for functional programming in non-FP languages any more than there is the other way around for OO in FP languages.> I don't really care if you do or do not stay angry at the language you're forced to work in for your job. What I do want for you is to be able to make the best of the situation you're in and not be unhappy.
Because maybe enumerations in Go are subpar compared to other languages (FP or not).
This is especially true in cases where a function returns a collection of results where each result is independent from other results and a result can succeed or fail.
For instance, a batch report generator that is called every $INTERVAL might return a ([]Report metadata, error) today, but each report could have succeeded or failed without impacting the others.
The output is emailed to $SOMEONE to let them know the reports ran and information about each.
In today's world, the "error" could be a special error type that capture failures on a per report basis. The ReportMetadata type could also have an Error field, but one is not forced to check either.
Sum types could force checking for error on a per report basis, increasing the odds something is done with the error.
type Vehicle interface {
isVehicle()
}
type Car struct {}
func (c Car) isVehicle() {}
type Van struct {}
func (v Van) isVehicle() {}
func VehicleType(vehicle Vehicle) {
switch v := vehicle.(type) {
case Car:
fmt.Println("car")
case Van:
fmt.Println("van")
default:
fmt.Println("unknown vehicle")
}
This covers most, but not all, of the bases, in that you don't get exhaustiveness checking at compile time, unless you adjoin a linter to your compile process: https://github.com/BurntSushi/go-sumtype enum Message {
Action1(String, Option<Mode>),
Action2(String),
}
Action1 and Action2 are variants not types and I cannot make functions that take an Action1 or an Action2 as a parameter. To get around this people will often make each enum variant just a container for some struct with the same name but that's more verbose and matching becomes slightly uglier. Code like this is fairly common: struct Action1(String, Option<Mode>);
struct Action2(String);
enum Message {
Action1(Action1),
Action2(Action2),
}
Ideally I'd like to be able to succinctly say something like: type A = B | C
and have A be dependent on B and C but have both B and C be completely independent types.Though, I still like the flexibility of adding additional fields to `Action1`. In golang I end up with fields that are conditionally populated based on the state of an Enum which is less than ideal and leads to lots of error checking (though this is relatively rare).
It doesn't have to be one or the other though. A bit more polishing on the Rust-style enums (perhaps in a different language) could lead to pretty ergonomic code.
Is this... right? You can't use enum variants as types in function signatures, variable declarations, etc.
func main() {
c := color.Red
cptr := (*string)(&c)
*cptr = "orange"
PrintColor(c) // successfully compiles, and prints "orange"
}c = Color("orange") does not compile.
I'm sympathetic to the points, I think. But I also don't have a problem with someone pushing for some type safety as long as you avoid actively trying to go against it.
If we're talking compile-time, then: yes, absolutely!
Type hinting doesn't provide type safety, because type safety isn't a spectrum.
Is "type safety" something you saw defined in a PL book or something, which has a more rigid definition to you?
A compiler that catches 7 errors is more safe than one that catches 4, and one that catches 4 is more safe than one that catches 0.
Casting is by definition an escape hatch.
c := color.Red
c = Color("orange")
PrintColor(c)Doesn't matter, the point is they're getting in a value which is not part of the defined set, demonstrating that this emulation is not actually typed-safe.
> If that's the point you're intending to make, then couldn't you make it more easily with this?:
cannot convert "orange" (untyped string constant) to type Color...then it's broken, because the Go compiler, factually, cannot (in general) check or enforce the validity of specific values.
> there's no reason for you to also include runtime checks. Other developers breaking your defined contract is not your responsibility, it's not even a bug.
It is absolutely the responsibility of the function
func PrintColor(c Color)
to ensure, at runtime, that `c` is a valid Color. My example code -- which allowed an invalid Color value of "orange" -- is absolutely a bug in PrintColor.What strategies do you use in your programs to ensure type safety in the event of debugging, mmap, and other mechanisms that can be used to subvert the memory layouts your compiler thinks it produced?
Most instructions are not atomic, so even if you had runtime checks something like a debugger could still inject invalid state in between your checks, making them ineffective.
If real-time code injection is your threat model, I don't see how runtime checks would get you anywhere.
Can you give an example where someone has done similar casts accidentally? It seems like it would be hard to accidentally typo. That leaves malice, which seems difficult to defend against, in light of the kinds of system calls that are available to a program.
I don't doubt that there are niches where such explicit type coercion patterns are common in Go and susceptible to mistakes, but I doubt usage of constant identifiers is such a niche.
Rust is currently the standard bearer for strong, static type safety, and it even has both the enum types and pattern matching construct which Go lacks. AFAIU, you can use unsafe{} Rust code to perform a similar type punning trick, successfully assigning an invalid value to an enum object. I don't know if Rust's code generator always inserts runtime validity checks in match statements on an enum value without a catchall/default case, but certainly it's possible for Rust code to have an explicit if/else chain that at compile time appears comprehensive but which would neither panic nor produce the expected behavior. Does that mean Rust programmers shouldn't rely on Rust's static typing, instead always adding explicit code to handle unknown/invalid enum values?
Maybe the assertion that Go code should have such checks is more reasonable than for Rust code, but you haven't explained how. At least to me, the simplest, minimal code to achieve the subversion in both Go and Rust seems similarly stilted and similarly unlikely to be written by mistake. (To be clear, the context of this subthread as I understand it assumes the interface method hack, the subversion of which requires the type punning.)
If I write a function that takes Foo as an argument. I have a Foo implementation exposed elsewhere in my program. It is absolutely expected that I mean MY Foo, not your Foo. If you pass me your Foo, you will get unexpected results that are not a bug, not a side effect, not my responsibility. It’s yours, the caller, to adhere to the contract.
There are valid reasons to not adhere. To pass your own implementation. At that point, you are responsible for its use. Not me. If it adheres to MY Foo’s interface, you might get by, but it’s is not my responsibility to validate all permutations of unknown types to ensure you’re passing me mine. In go, it’s perfectly valid to return structs but accept interfaces as arguments so that you, the program author calling my api, can craft the correct program flow.
So please, leave that runtime type check reflection for Java and C# and the land of JS. We have no need for it here in machine code land.
Of course it is! If you provide an API that takes a Color, and you define valid Colors as exclusively Red, Green, and Blue, then you are absolutely responsible for validating input Color values and rejecting anything which is not Red, Green, or Blue. If you delegate that responsibility to the caller, then your API provides no meaningful encapsulation, and isn't a useful abstraction -- it's entirely leaky. No bueno.
(That said, the Go syntax looks far less "scary" than `unsafe { transmute::<_, Colour>("orange") }`, which I'd definitely call a design issue.)
Likewise GLint is just a type alias for int. There are only value types (str, int, float, etc), everything else is a construct. The only true types are those value types (and pointers to them). If you call a type a Color and I call a type a Color, you are using my lib to build a program (not me using yours), you must adhere to my contract of what a Color type is to my API. Period. You can not call a function with an unknown type and expect it to behave properly.
If it panics, it’s your fault.
In Go, they are not. Aliases establish precise equivalence between types, type redefinitions establish new types altogether.
package color
type Color interface {
void()
}
type color struct {
v string
}
func (c color) void() {}
func (c color) String() string {
return c.v
}
var (
Red color = color{"red"}
Green color = color{"green"}
Blue color = color{"blue"}
) func fn(c color.Color) {
switch c {
case color.Red, color.Green, color.Blue:
log.Printf("c=%#+v -- OK", c)
default:
log.Printf("c=%#+v -- should not be possible", c)
}
}
func main() {
var c color.Color
fn(c)
}
Output: c=<nil> -- should not be possible
:shrug:"Oh but someone may try to cast arbitrary values to my package type" Okay but who is that going to hurt? You or them? Will they get hit with errors early on in the development lifecycle if they do something silly like this? Are you actually going through all these lengths for nothing?
Which is almost always trivial except when it isn't.
It's not a bogeyman.
It's pkg.fun(someVar) where someVar is accidentally 0 or "" because it comes from 3 functions away.
Proper enums would be elegant, not this.
type Foo interface { A | B | C }
and the interface type is the union of those type-sets. Such interfaces can not currently be used outside of type constraints, but if that is relaxed, and type switches are updated to support and enforce exhaustive matching (and understand such sealed / nominative interfaces), you've got all the bits you need.You'd need to newtype variants to add payloads of similar underlying type e.g. `int | int`, but that's not a huge imposition, and the variants being types themselves is often convenient so it's a 50:50 tradeoff compared to classic sum type (where constructors disambiguate all variants but are not themselves types).
var foo interface{ A | B }
then foo either has to be boxed (so the default value is a nil interface) or unboxed and arbitrarily initialized as an A or a B.I don't see how unboxing would have to be "arbitrarily initialized as an A or a B" either. Even with a novel bespoke implementation you still need a discriminant between the two nested. You could keep a nil default by reserving the zero discriminant for that purpose.
I think it would be weird if an unboxed union of A and B was initialized to a value that wasn't the default value of either A or B, although I take your point that it's a technically possible implementation.
Yep, fixed, sorry about that.
> I think it would be weird if an unboxed union of A and B was initialized to a value that wasn't the default value of either A or B
On the one hand yes, on the other hand it would be consistent with the langage semantics (the default value of an interface type is a nil), and I don’t think defaulting to the default value of an arbitrary variant is better.
Although I can see the similarity with iota / newtype constants, the first item being the default, and similarly people could set the first type as relevantly named (possibly unexported) empty struct if they want / need the signal.
var c color.Color
That's a valid color whether it's a nil interface value or an empty typed string.You can return a private type to prevent this, but that also means they can't refer to it as an argument or return value anywhere outside the implementing package, which is a rather severe limit in many cases.
Sometimes* I really miss constructors.
*: all the time
package color
type Color struct {
val string
}
func (c Color) String() string {
return c.val
}
var (
Red = Color{val: "red"}
Green = Color{val: "green"}
Blue = Color{val: "blue"}
)
Since `val` is not exported, external packages cannot create arbitrary `Color`.for enums I prefer just direct structs: https://github.com/nikolaydubina/go-enum-example
One idea is to make a DB table dedicated to enumerations and then use foreign key constraints. Define a unique namespace for each set of enumerated values, and catch foreign key constraint failures on DB writes.
But what problem does this actually solve?
When I see a type alias of a string and enumerated variants then why would I pass in arbitrary strings?
There are _always_ ways to break assumptions. Putting arbitrary, complex guard rails at every call site doesn’t make a program magically better.
An API is primarily about affordances. We provide utility to the caller.
This type of pattern can be used to force other developers to check if the value is garbage before calling $BUSINESS_LOGIC that uses the enum
Ideally, of course, the release notes of the library would spell out the issue, and you’d read them, but even then, making sure you fix this everywhere is way easier if the compiler refuses to compile your code if it doesn’t handle the new case.
type ColorWrapper struct {
color.Color
...
}
ColorWrapper will implement color.Color. I don't know what the point would be, but another way to break the compile-time type safety.As stated in that proposal, the interaction between what people want from “enums,” “discriminated unions,” “sum types,” (as well as “optional values” and “nil safety”) and fundamental Go tenets like zero values, make this a tough sell, which is very likely to make no one happy.
Unless you mean: is it enough of a language to be useful for its intended usages? In which case my decade of paychecks would like to let you know that it is, in fact, sufficiently complete for many business needs.
Enumerations aren't an advanced language feature at all and Go was released in 2010.