16 ms·
JsonLogic – Build complex rules, serialize them as JSON
- liquidise 10y agoAs a strictly experimental project, i applaud this effort and i hope the author learned a lot about building a library. The web presentation is above average as far as library projects go. As the library itself, i would't touch this with a 100 foot pole. Serializing logic shatters encapsulation as well as cohesion, both cornerstone object oriented principles. Also, when you serialize logic, you leave yourself handicapped to fix code bugs, as your code bugs are now data bugs by definition. Imagine solving an off-by-one style error in persisted JSON logic. Your choices would be regex (shiver) or a script to parse all json blocks and modify accordingly? Yikes. As an experiment, this is quite nice. Perhaps too nice. Given the quality of presentation, i feel bad for the shops that decide to adopt this into production usage.
- Vanit 10y agoI agree if we're talking about serialising app logic, but I think this library is for when your data is a ruleset you want to save/execute, some kind of conditional tasker etc.
- btown 10y agoAs soon as you begin accepting user data, all your code bugs, even those as simple as forgetting to collect some metadata you might need later, are data bugs. And to the specific point about serializing logic being considered harmful, I'm sure https://www.periscopedata.com/ https://www.periscopedata.com/ would beg to differ! Seriously, though, there's nothing wrong with using this for a presentation layer. Define a group of user-selectable client-side filters in a JSON constants document, which will have a much smaller "error surface" than defining custom filter functions. Just because it looks like JSON doesn't mean it necessarily needs to be serialized. That said, there are a number of inefficiencies in the implementation. Certainly not production ready, but a great effort.
- emidln 10y ago> Also, when you serialize logic, you leave yourself handicapped to fix code bugs, as your code bugs are now data bugs by definition. This seems to be an orthogonal architectural problem. If you need to be able to reprocess after changes to logic, chances are that you are storing your original source document somewhere and can retransform if necessary.
- emilong 10y agoIs there a security statement about this? I don't immediately see any dangerous operations, but code sharing should always be suspect. If this catches on, it won't be long before someone asks for something that would open vulnerabilities. All that being said, this is a really interesting approach and having a language for shared, declarative logic is often useful.
- pkghost 10y agoIf you're building an extensible platform of some kind, maybe, but otherwise I'd use a build system.
- bschwindHN 10y agoThe only thing that comes to mind is a poor man's Clojure(Script)
- rubyfan 10y agoI've seen similar XML based approaches for expressing configurable business rules but never any as JSON. Love it
- donpdonp 10y agoAmbitious developer discovers abstract syntax trees expressed as JSON, film at 11.
- Liron 10y agoIt's nice to have a standard.
- bbcbasic 10y agoBut what if the code was just the same as the data. The code could process other code as if it were just data. What would THAT language be like?
- jimktrains2 10y ago(not (know '(I) '(that)))
- jcoffland 10y agoIt's called Lisp.
- noir_lord 10y agoI rather suspect that was the intended joke.
- iamleppert 10y agoPlease not another DSL. We already have a way to express logic; it's called code. If you want to make a different programming language that's fine. Data is code. Maybe what you really want is a finite state machine? http://machina-js.org/ http://machina-js.org/
- ng12 10y agoI've worked on a service that did something like this, except everything was passed through a middleman who was managing a bunch of live-reloading Groovy code where the actual business logic was stored. Would this have been a better approach? Maybe! But at the very least its an interesting idea and even if interesting ideas fail they might serve to inspire something new. I don't see a reason to be openly hostile just because it's a "DSL".
- sandGorgon 10y agointeresting!! can you please talk about the architecture? how was the groovy code stored(db/disk files)? was it user editable.. what about security then? why groovy?
- asciimike 10y agoSure, but what if you're building a serverless framework or other multi-tenant system and the goal is for an external developer to not write backend code? You need a compact way to represent and evaluate authentication and authorization, maintain schema or referential integrity, or do simple business logic checks.
- andrewstuart2 10y agoThis is code. Instructions codified into a machine-readable format. It's just really verbose and complex code. It reads almost exactly like Polish notation [1], assembly code, an abstract syntax tree. Except encapsulated in JSON trees rather than space-separated lists. The problem is that it's almost entirely optimized for a machine to read, and not for a human. Next thing you know, you've written something a little complex in this new format and realized it's pretty hard to maintain. So what should you do? Create a program to generate it, perhaps, from a higher level, easier to read, representation. In other words, a compiler. [1] https://en.wikipedia.org/wiki/Polish_notation https://en.wikipedia.org/wiki/Polish_notation
- eschutte2 10y agoPretty cool. Coincidentally I just spent the last couple days implementing configurable JSON-serialized rules in our app. The bigger part of the challenge for us was coming up with a human-friendly UI for defining the rules.
- thom_nic 10y agoBeen considering the same problem here - how to allow some sort of user-defined rules/ logic flow? The UI is indeed more difficult to (well) do than the data representation of said rules. Anything you can share?
- ilaksh 10y agoLook into the business process management, workflow engines, projection editors (Intentional Domain Workbench).
- existencebox 10y agoIt's funny this discussion comes up now, since I've been working on this exact same problem for an odd week on and off now. Building the syntax, interpreter, serializer/deserializer took a day. Writing the JS to render it? Still working on it. (largely hindered by my being a backend eng masquerading as a terribly incompetent frontend web dev) My approach however was to treat it as a literal syntax tree. we can represent trees reasonably well graphically, and if you connect the blocks sensibly you can make the visualization even flow well enough. Things start to decay past certain levels of depth; and I've addressed that with modularity. A tree can be "named" and become a single node within another tree. (yes yes rewriting programming languages badly or something). Thus far the biggest problems I've had with this approach have been primarily just learning the words I need to use to search for the right concepts in web-UX space; I've actually been pretty damn happy with the view. Tech wise, just a grid, jquery, bootstrap.
- eschutte2 10y agoSure, here's a screenshot: http://jsreports.com/blog/wp-content/uploads/2016/10/conditional-rules.png http://jsreports.com/blog/wp-content/uploads/2016/10/conditi... This does conditional formatting for a report designer. We thought a lot about how to limit the complexity the UI exposes and still have enough power to achieve most things people would need. We worked pretty closely with the customers to make sure it made sense to them (via mockups etc) before building anything.
- michaelcampbell 10y agoJelly, anyone? https://en.wikipedia.org/wiki/Apache_Jelly https://en.wikipedia.org/wiki/Apache_Jelly
- fbreduc 10y agoLisp anyone?
- sriram_iyengar 10y agointeresting - but why would i use jsonlogic instead of javascript ?
- thom_nic 10y agoAllowing user-defined rules comes to mind. AFAIK `eval()`-ing user input is can't be done in a safe way. Probably OK on browser but not on the server.
- catnaroek 10y ago> Probably OK on browser but not on the server. Probably OK on someone else's machine but not mine? :-p
- flushot 10y agoI don't see why a language like JS couldn't be used for evaluating rules when sandboxed. Looks like there's a project that does just that: https://developers.google.com/caja/ https://developers.google.com/caja/
- ilaksh 10y agoI believe that eventually software development may move in general to structured serializations rather than plain text. The main thing holding that back is just that programming is defined by cryptic colored text and they are afraid they won't look technical enough if they don't stick to that. I am a programmer myself btw and of course I use text editors.
- Zecc 10y agoSource code is a structured serialization. And it also happens to be plain text. Edit: or were you referring to data rather than logic?
- murukesh_s 10y agoIf data can be code, code can be data too. There are people who hated react for mixing view with logic.
- TeMPOraL 10y agoPossibly another example of the common mistake of web developers - extending "don't put business logic in views" to "don't put logic in views". That leads to invention of the silly things called "template languages", which desperately try (and fail) to avoid being programming languages, and they create a mess because they manually glue HTML (which is a tree) from dumb strings.
- deleted 10y ago[deleted]
- bbcbasic 10y agoReminds me of https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-and-query.html https://www.elastic.co/guide/en/elasticsearch/reference/curr...
- SloughFeg 10y agoReminds me of the early 00s where everyone and their son were making unmaintainable DSLs in XML
- virtualized 10y agoPeople still make them. Because, you know, "everyone can use them" and they are "simple". In reality, only software developers are able to do anything with such a crap DSL and it takes a lot more effort and workarounds to get anything done vs a sane programming language.
- mvitorino 10y agoEven if only the developers can use a DSL, that doesn't not mean DSLs don't have a place as a solution and that a generic programming language is always preferable. In complex enough domains DSLs can be key to tackle that complexity and they can take many forms.
- deleted 10y ago[deleted]
- userbinator 10y agoFor some reason this reminds me of http://thedailywtf.com/articles/the-inner-json-effect http://thedailywtf.com/articles/the-inner-json-effect
- alanh 10y agoHere to say JSON is not a good place to encode logic because JSON doesn’t allow comments, and whenever you are encoding logic, you are going to have to clarify that $conterintuitive_rule is needed because $stakeholder decided $such_and_such. OK, I’m done shitting all over what’s probably a perfectly cromulent library now…
- deleted 10y ago[deleted]
- asciimike 10y agoWhen you're building a serverless framework with the goal of direct client access to managed infrastructure without writing server side code, rules languages like this are an awesome tool to have. You need to: authenticate users, authorize their actions, validate schema, ensure referential integrity, and perform business logic checks. Most (if not all) BaaS platforms have something like this: - Firebase: Database Rules (https://firebase.google.com/docs/database/security/ https://firebase.google.com/docs/database/security/), Storage Rules (https://firebase.google.com/docs/storage/security/ https://firebase.google.com/docs/storage/security/) - Parse: Roles and ACLs (https://parseplatform.github.io//docs/js/guide/#roles https://parseplatform.github.io//docs/js/guide/#roles) - Horizon: http://horizon.io/docs/permissions/ http://horizon.io/docs/permissions/ - Couchbase Mobile: http://developer.couchbase.com/documentation/mobile/1.3/develop/guides/sync-gateway/authorizing-users/index.html http://developer.couchbase.com/documentation/mobile/1.3/deve... - Deepstream: https://deepstream.io/docs/server/valve-permissions/ https://deepstream.io/docs/server/valve-permissions/ When used for AuthN/Z, most seem to align with Role Based Access Control (RBAC), while others go for Attribute Based Access Control (ABAC). The former is generally easier to reason about and build, while the latter is more powerful though harder to build and explain. Most IaaS IAM systems (like those in AWS [http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_po...], GCP [https://cloud.google.com/compute/docs/access/iam] https://cloud.google.com/compute/docs/access/iam]) are RBAC, while BaaS solutions seem to trend to ABAC for schema validation + business logic. Kubernetes also has a cool way of doing this: http://kubernetes.io/docs/admin/authorization/ http://kubernetes.io/docs/admin/authorization/ Disclosure: I work on this at Firebase
- sandGorgon 10y agois something like this applicable for complex math formula as well. For example if you were building a web based financial spreadsheet.
- yogthos 10y agoGreenspun's tenth rule in action.
- efaref 10y agoGreenspun's tenth rule meets Atwood's law?
- dabernathy89 10y agoI see a lot of folks who are a lot smarter than me crapping on this, but I think it could be really useful. I've thought about the problem before of how to share complex rules between front-end and back-end safely, and came up with a UI for it: https://dabernathy89.github.io/vue-query-builder/ https://dabernathy89.github.io/vue-query-builder/ I honestly didn't put too much thought into the actual structure of the JSON, so I wonder if there is someway I can now integrate JsonLogic into the query builder. Good work!
- foota 10y agoThis seems a lot like Facebook's graphql
- couchand 10y agoI would suggest that, at first glance, your structure is actually preferable for most applications where this would be useful. The real advantage of a DSL is when it provides a concise way to solve a specific problem domain. The OP just provides a verbose way to describe a general problem domain, without any benefit of regularization. Your schema, on the other hand, uses explicit node names and types, which should make automated analysis much simpler and less error-prone. The few changes I'd suggest are mostly just cosmetic: standardizing the schema (the type radio seems to imply the operator equals), renaming properties (why selectedOperator when just operator will do?), and maybe compressing levels where appropriate, for instance the query-builder-group could itself have the logicalOperator property.
- dabernathy89 10y agothat makes sense - and thanks for the feedback!
- deleted 10y ago[deleted]
- itaifrenkel 10y agoElasticSearch new Painless scripting language is a secure lava-like DSL language which is a superset to just logic. Although it seems to be jvm opinionated. https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-painless.html https://www.elastic.co/guide/en/elasticsearch/reference/mast...
- sandGorgon 10y agohas anyone built a system where complex math had to be made part of the system... yet had to be user editable? would something like this help?
- deleted 10y ago[deleted]
- jcoffland 10y agoAdding computation to a data description language is always a bad idea. I've seen this done with XML. XSLT is a great example of why this sucks. This has been done with JSON before anyway. Here are several examples: https://github.com/json-schema/json-schema/wiki/switch-(v5-proposal) https://github.com/json-schema/json-schema/wiki/switch-(v5-p... http://www.ibm.com/support/knowledgecenter/SSEPEK_11.0.0/json/src/tpc/db2z_jsonlogicaloperators.html http://www.ibm.com/support/knowledgecenter/SSEPEK_11.0.0/jso... https://www.npmjs.com/package/lib-jsl https://www.npmjs.com/package/lib-jsl http://jsonnet.org/language/design.html http://jsonnet.org/language/design.html
- dirtyaura 10y agoWhy is it always a bad idea? For example there can be content that is triggered by rules and these rules need to be edited by non-programmers. Furthermore these rules need to be evaluate in different execution contexts (in our case in Android and iOS) This is a situation that requires describing simple logic alongside data.
- vbezhenar 10y agoIMO it's always strictly better to use something real, like LUA. WoW uses lua as a programming language for user interface and users can make their additions (addons and macroses). A lot of users, who don't know anything about programming, can successfully use those lua snippets. Also when real programmers have to interact with those systems (and my practice shows, that business users don't want to program, they ask programmers to do it), it's so much pain to use those GUI languages or whatever and it's so easy just to write some code in sane language.
- josephearl 10y agoApple has restrictions on downloading executable code, which downloading a Lua script would likely fall afoul of. It's also a potential security risk - the downloaded script could perform things other than logic and so would require sandboxing/whitelisting of commands. Putting logic in JSON avoids both of these issues since the actual handling of the logic is performed by a client-side library.
- ckarthik17 10y agoWe built a system, where user can construct complex search criteria and submitted for result. We were passing the criteria using a custom dsl (lot of coding in front-end to construct and parsing logic in back-end). This will be a perfect match for those kind of cases.
- softwarelimits 10y agohttps://en.wikipedia.org/wiki/Business_Process_Modeling_Language https://en.wikipedia.org/wiki/Business_Process_Modeling_Lang... http://bpmn.io/ http://bpmn.io/
- zn44 10y agoMade me think of http://thedailywtf.com/articles/the-inner-json-effect http://thedailywtf.com/articles/the-inner-json-effect
- banachtarski 10y agoSo, a JSON AST. The whole point of programming languages is to give you something better than an AST to work with. Code is already data and we have functions for evaluating/compiling/interpreting said data natively/in-vms/in-interpreters.
- bboreham 10y agoAs others have said, this is code. In my experience, folks writing code come to need a VCS ("oops, didn't mean to change that"), a debugger ("why did it do that?"), a test environment ("what happens if I change that"), and perhaps an audit trail ("who changed that?"). Set against that, the effort required to parse expressions is trivial.
- zamalek 10y ago> Set against that, the effort required to parse expressions is trivial. Especially s-expressions.
- ctvo 10y agoThere are use cases for rule-based logic like this stored outside of application code and JSON is a very easy format regardless of warts. The amount of salt in here from 1) Gross JSON! 2) why did you implement an AST?! is astounding.
- mshenfield 10y agoOne use case might be the backend of a logic engine a la Drools. I imagine that needs a well defined, serializable subset of a full programming language.
- al2o3cr 10y agoTwo thoughts on this: (1) We have a similar sort of "expression language" at my job; in our case, the value it provides is ready access to the pseudo-AST we parse it into. We transform that AST at runtime (along with subexpression results) into a human-friendly error message like "Total Amount must be less than $X when Blah Mumble is under Y". The downside is that that "configuration" data now behaves more like code but doesn't have any of the tooling of the host language: we've had to add specific code to provide a stacktrace-equivalent hint about where expression evaluation failed. (2) The bummer design decision in JsonLogic, IMO, is the leakage of the JS equality operator into what could have been a language-agnostic description. That's going to be nasty to implement elsewhere.
- fiatpandas 10y agoLooking over the examples, I thought of MongoDB's aggregation pipeline. You pass in a similar tree of JSON-only logic to perform more complex database operations/transformations. In Mongo's case, the idea is to have direct access to "native" calls, skipping Javascript execution altogether.
- chukye 10y agoI don't understand... Why just dont get all the complex logic from server/client, generate a .js with it and use in server/send to client? Why JSON? JSON is not designed for this.
- tk120404 10y agowhy suddenly everybody is talking abt this when nobody noticed it when it was post 2 months back?
- shanemhansen 10y agoThese mini-languages almost always become really painful to work with. If I find myself needing to implement some sort of configurable shared thing more complex than a table of regular expressions I just jump straight to the endgame and embed lua or a lisp. I think the target audience of JsonLogic is sharing code on the frontend/backend. I think these days javascript is common for that. A tiny lisp would be suitable as well. There's a special place in hell reserved for people who make me edit ad-hoc turing complete configuration languages embedded in json or xml.