How to guarantee deserialization invokes appropriate constructor or validator?

[vdods]

I've got various protobuf message types, and I want to have prost deserialization guarantee that they're validated appropriately using ergonomic Rust patterns. For example:

message EmailAddress {
    required string value = 1;
}

And later in my Rust code, I have something like:

fn is_valid_email_address(s: &str) -> anyhow::Result<()> {
    ...
}

impl TryFrom<String> for EmailAddress {
    type Error = anyhow::Error;
    fn try_from(s: String) -> Result<Self, Self::Error> {
        anyhow::ensure!(is_valid_email_address(&s), "invalid email address");
        Ok(Self { value: s })
    }
}

How do I guarantee that EmailAddress::try_from would be called when deserializing an EmailAddress? Effectively this is the Rust newtype pattern, but applied to protobuf message types.

The motivation here is that I want to guarantee data validation, and not have to add validation boilerplate everywhere by hand, potentially missing it somewhere, leaving a security hole.

[LucioFranco]

I think what you want to do is convert from the prost rust type -> your domain type and make it such that the only way to do it is via the TryFrom aka put the domain types in a private module that only allow construction in that module and via TryFrom publically. Prost really only concerns itself with the protobuf binary format -> the corresponding rust type and nothing beyond that.