Server should not allow setting values that are not in data provider

[vursen]

Description

Some components like Select, RadioButtonGroup, CheckboxGroup (and possibly ComboBox), allow setting values that aren't in the data provider and then getting them back through getValue(). After being set, these values are only available on the server, while the web component keeps the previous valid value. Each of these components also has a test that relies on this behavior, for example:

flow-components/vaadin-select-flow-parent/vaadin-select-flow/src/test/java/com/vaadin/flow/component/select/SelectTest.java

Lines 791 to 807 in eb6b138

	@Test
	public void setIdentifierProviderOnId_setItemWithNullId_shouldFailToSelectExistingItemById() {
	CustomItem first = new CustomItem(1L, "First");
	CustomItem second = new CustomItem(2L, "Second");
	CustomItem third = new CustomItem(3L, "Third");
	List<CustomItem> items = new ArrayList<>(
	Arrays.asList(first, second, third));
	Select<CustomItem> select = new Select<>();
	SelectListDataView<CustomItem> listDataView = select.setItems(items);
	// Setting the following Identifier Provider makes the component
	// independent from the CustomItem's equals method implementation:
	listDataView.setIdentifierProvider(CustomItem::getId);
	select.setValue(new CustomItem(null, "First"));
	Assert.assertNull(select.getValue().getId());
	}

Expected outcome

The tests assert behavior that shouldn't be supported because it leads to an inconsistent state between server and client and thus is misleading. When trying to set such a value, the component should either throw an exception or revert it and log a warning.

Minimal reproducible example

You can observe the issue in the mentioned test.

Additional context

This issue is why vaadin/flow#19310 had to be reverted despite being a correct solution.

Environment

Vaadin version(s): 24.5 and earlier
OS: Mac OS

Browsers

No response

[sissbruecker]

For ComboBox there are use-cases where this is useful: #6442 (comment). So basically as an auto-complete where you don't want to add custom values to the list of options.

[stefanuebe]

For ComboBox there are use-cases where this is useful: #6442 (comment). So basically as an auto-complete where you don't want to add custom values to the list of options.

When custom values are explicitly allowed, I would see this as a valid behaviour. But without, I would also rather expect the CB to not allow setting a "custom" value on the server side. Or with other words, it should allow the same input programmatically, that is allowed from the user.

[web-padawan]

See also #1546

[stefanuebe]

The multi CB also has this problem. It feels even more "present" due to its displayment as chips.