DEV Community

"in" operator considered harmful in Typescript

Vincent Jaubert on October 18, 2023

Let say you have two types of users in your app, regular users and superUsers. type RegularUser = { id: string; username: string; email: s...

Read full post

Chris Cook • Oct 20 '23

I have to disagree with you that the in operator is an anti-pattern in Typescript.

The in operator checks at runtime if the property is available somewhere in the property chain. TypeScript correctly infers the type of user.userName as unknown. However, if you add a return type to the getUserName() function, you will get the expected type error:

TypeScript Playground

function getUserName(user: User): string {
    if ("userName" in user){
      //> error: Type 'unknown' is not assignable to type 'string'.(2322)
        return user.userName; 
    }
    return "";
}

In my opinion, if you rely on types, you should completely type input and output, especially if you use dynamic accessors like in or Object.hasOwn().

Danny McGee • Oct 22 '23

I personally prefer to omit return-type annotations and let TS infer the correct type when possible — at times, this even yields more correct results, because the return type annotation can act as a sort of type-cast under certain circumstances. Without the return type, you would still get the expected error as soon as you tried to actually do anything useful with the returned value:

// ...
const users: { [key: string]: User } = {};
const user: User = {
    type: "regular",
    username: "foo",
    email: "foo@foo.com",
    id: "foo",
}

const userName = getUserName(user);
if (userName in users) {
//  ^^^^^^^^ Error: 'userName' is of type 'unknown'.
    console.log(users[userName]);
//                    ^^^^^^^^ Error: Type 'unknown' cannot be used as an index type.
}

Andrew McCallum • Oct 23 '23

This is an excellent point you raise.

I think this is a strong example of why using explicit return types is good.

There is more room for error with implicit return types.

Cody Swartz • Oct 24 '23

💯 on return types. Your consumers should not be what enforces and validates your contact, but rather be explicit of what it's expected to return.

Maybe your assumption is that the function should return void if the property wasn't found. If consumers are utilizing this then this is valid code.

Exhaustive unit tests, and code reviews are the winners in this case, especially a typo too. If you wrote 100% test coverage there's a logical branch in the code which returns void. If you write the test covering that scenario to get 100% coverage, then you've either realized your code doesn't do what you want, or you've now documented that it's expected behavior.

Joshua Baker • Oct 23 '23

Although your example is correct, Typescript's inference with the "in" operator is sometimes unsound. Here's a modified playground to demonstrate what I mean: Playground

So it's important to be aware of the danger of "in" in Typescript, but it's only dangerous in certain circumstances.

Chris Cook • Oct 23 '23 • Edited

Sorry, I can't follow why your example should be wrong:

You defined the isSuperUser as type true and you checked if it exists on the given object with the in operator. TypeScript infers the type as true (because it exists) and lets you call toString() on it.

That all sounds right to me. Why do you think the type should be unknown in this case?

Yeom suyun • Oct 18 '23

I think the best way to fix the first example is to add isSuperUser?: false to RegularUser.
compiler does not complain about isSuperUser, and we can see that newly added roles should have isSuperUser if we add a new role to the User type without isSuperUser, the code will emit an error.

Vincent Jaubert • Oct 19 '23

Thank you for your comment.
Why would you make the isSuperUser optional on the RegularUser ?

Yeom suyun • Oct 19 '23

From a business perspective, I would use a structure like roles: ("ADMIN"|"GUEST")[] for permission checking.
However, from a type perspective, flags like isXX are not a problem.

John Dennehy • Oct 23 '23

This was my thought too.

Even if we REALLY needed separate types, I would possibly still add 'isSuperUser: Never' to the User type or something similar.

Etienne Burdet • Oct 19 '23 • Edited

I agree in can be confusing for type assertion in TS and I don't think I use it at all these days. The code you write isn't wrong in itself, it's just a bad assertion in the first place. But with other patterns than in TS can warn you better indeed.

Something like :

function isSuperUser(user: User): user is SuperUser{
  return user.type === 'super'
}

Will yield much better safety indeed.

ScorbicLife • Oct 19 '23 • Edited

I think it would be nice if you could elaborate that the reason why the following compiles

function getUserName(user: User){
    if ("userName" in user){
        return user.userName; //no error reported
    }
    return "";
}

is because you can pass this into getUserName

const userWithUserName = {
  id: "0",
  name: "Admin I. Strator",
  email: "foo@bar.com",
  type: "super",
  userName: "root",
} as const satisfies SuperUser;
const name = getUserName(userWithUserName); // "root"

Which is valid because, as you mentioned, typescript types are structurally typed. (Edited for clarity)

Vincent Jaubert • Oct 19 '23

Thank you for your comment.
Doesn't it make the article more complicated to grasp ?
I just mentioned structural typing so the reader understand this is not necessarily a design mistake, and most typescripters already knows about structural typing or can easily learn about it from other sources.

ScorbicLife • Oct 19 '23 • Edited

I thought it would be nice to know upfront what's happening exactly and that this is not a bug in TypeScript, but I guess it could be overwhelming for a subset of the target audience. Thanks for the response.

Danny McGee • Oct 21 '23

You make some good points here, but I think it's incorrect to conflate the in operator with arbitrary type casting. To use a contrived example, TypeScript will accept this code, but it will "crash" your JavaScript application:

type Foo = { userName: string };
const foo = {};
console.log((foo as unknown as Foo).userName.toUpperCase());

This would be the "equivalent" code with an in check, but TypeScript will not accept it as valid:

type Foo = { userName: string };
const foo = {};
if ("userName" in foo) {
  console.log(foo.userName.toUpperCase());
  //          ^^^^^^^^^^^^ Error: 'foo.userName' is of type 'unknown'.
}

You would need to add an additional runtime check for TypeScript to be happy with it:

type Foo = { userName: string };
const foo = {};
if ("userName" in foo && typeof foo.userName === "string") {
  console.log(foo.userName.toUpperCase());
}

Now, that is still misleading code — the block will never be entered, because it's impossible for foo to have a userName property — but that's really not the same as causing your application to crash.

The fact is that JavaScript is a dynamically typed language, and sometimes in the real world we will encounter keys on objects that our types haven't fully accounted for (especially when depending on third-party JavaScript modules). But TS type annotations and runtime checks like if (<key> in <object>) <...> are fundamentally different things — TypeScript provides us some compile-time safety (and a nice developer experience), but as a static analysis tool, it's possible for its assumptions to be incorrect. It's not possible for an if (...) block with a falsey condition to be entered at runtime, so the only thing TypeScript is doing here is updating its assumptions to reflect the reality that the runtime check has established.

Michael Kochell • Oct 23 '23

What you change the function signature from

function isSuperUser(user: User){
return "isSuperUser" in user;
}

function isSuperUser(user: User): user is SuperUser {
return "isSuperUser" in user;
}

Cody Swartz • Oct 24 '23

Enabling explicit return types, exhaustive unit tests, and code reviews are the winners in this case, especially a typo too.

Even without exploring return types, if you wrote 100% test coverage there's a logical branch in the code which returns void that you would have to test. If you write the test covering that scenario to get 100% coverage, then you've either realized your code doesn't do what you want, or you've now documented that it's expected behavior.