only is not bound by declared and additional fields on serializaton

The only parameter is correctly bound to the fields that are defined in Meta.fields (#183):

class MySchema(Schema):
    class Meta:
        fields = ('a', )

MySchema(only=('b', )).dump({'a': 1, 'b': 2}).data == {}

Strangely it is not bound to the declared and additional fields:

class MySchema(Schema):
    a = fields.Str()
    class Meta:
        additional = ('b', )

MySchema(only=('c', )).dump({'a': 1, 'b': 2, 'c': 3}).data == {'c': 3}

It would be more consistent if the second example also returns an empty dict.

[lafrech]

Related to https://github.com/marshmallow-code/marshmallow/issues/698.

There seems to be an agreement on validating only, raising errors if names are passed that don’t match a field (be it declared explicitly or added with fields or additional).

To be more explicit, both examples in OP would fail with “b is not a valid field for MySchema” or “c is not…”.

I think exclude should be treated the same way.

(The only use case I can think of that would be broken is when using programmatically defined schemas where it might be easier for the caller to pass a list of fields names to exclude and let the schema just ignore fields that don’t exist. For instance, the caller could pass exclude=('blacklisted_field', ) to all his schemas without being sure the field actually exists in all of them. But this sounds like an edge case and I’m not convinced it is worth consideration. Besides, it might be doable with a Schema subclass. So I’m happy with an exception being raised.)

[deckar01]

Would it make sense to validate exclude the same way?