Where do we validate surface attributes?

[raof at ubuntu.com]

Hey all,

In response to Alan's comment¹ and my follow-up² I'd like to bring up 
a design question: do we validate surface states before handing them 
off to the shell, and if so, where?

Previously we ensured that client couldn't create invalid surfaces - a 
menu without a parent, a normal surface with a parent, etc - by making 
impossible to express such surfaces through the client API.

We've abandoned that approach, as it was starting to impose significant 
costs for not a huge gain, and now clients can create whatever 
MirSurfaceSpec they desire.

I think we should still do that validation before handing off to the 
shell. My understanding is that AbstractShell::WindowManager is 
expected to be Shell code, so this would be a filter between 
FrontendShell and AbstractShell?

What do others think? Do we want to do the validation at all, or should 
we punt it to the shell?

¹: 
https://code.launchpad.net/~raof/mir/input-methods-can-specify-foreign-parents/+merge/258001/comments/656064
²: 
https://code.launchpad.net/~raof/mir/input-methods-can-specify-foreign-parents/+merge/258001/comments/658830