Mojo cpp bindings: add support for validating incoming messages.

mojo/public/cpp/bindings/lib/validator_chain.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_VALIDATOR_CHAIN_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_VALIDATOR_CHAIN_H_
+
+#include <assert.h>
+
+#include <vector>
+
+#include "mojo/public/cpp/bindings/lib/message_validator.h"
+#include "mojo/public/cpp/bindings/message.h"
+#include "mojo/public/cpp/bindings/no_interface.h"
+#include "mojo/public/cpp/system/macros.h"
+
+namespace mojo {
+namespace internal {
+
+class ValidatorChain {
+  MOJO_MOVE_ONLY_TYPE_FOR_CPP_03(ValidatorChain, RValue)
+
+ public:
+  // Doesn't take ownership of |sink|. Therefore |sink| has to stay alive while
+  // this object is alive. If |sink| is NULL, set_sink() has to be called to set
+  // a valid sink before this object can be used to validate messages.
+  explicit ValidatorChain(MessageReceiver* sink = NULL);
+
+  // Move-only constructor and operator=.
+  ValidatorChain(RValue other);
+  ValidatorChain& operator=(RValue other);
+
+  ~ValidatorChain();
+
+  // Takes ownership of |validator|.
+  ValidatorChain& Append(MessageValidator* validator);
+  ValidatorChain& Append(NoValidator* validator);
+
+  // Doesn't take ownership of |sink|. Therefore |sink| has to stay alive while
+  // this object is alive.
+  void set_sink(MessageReceiver* sink) {
+    assert(!sink_);
+    sink_ = sink;
+  }
+
+  // Returns a receiver to accept messages for validation. Messages reach
+  // |sink_| only if they pass all the validators in the chain.
+  MessageReceiver* GetHead();
+
+ private:
+  // Owned by this object.
+  std::vector<MessageValidator*> validators_;
+
+  MessageReceiver* sink_;
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_VALIDATOR_CHAIN_H_