indexmap 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 513c19d20a8373690c66fa99a0251db934298589a19139c2b77654340ce7006a
-  data.tar.gz: '087bd725e6ecaf81ff07510f78f7c5fa1d613730cd7b735c9f0ed60ecb3f4676'
+  metadata.gz: 38fa952c31358e79a900d348041a2475d5f597d19652837b50d27713f2004250
+  data.tar.gz: 6889768f6be1e01b6de1938687a757b050a52f7f9dbf2af58d1818cca2fdc977
 SHA512:
-  metadata.gz: 2f4065163991559ca5a1df38f1f01aafbdc539936f40aa81d78a3c5aa4abe34bdbc7cdb0df25d970a8a243e1b552c1946ec97c640f8d64350a46ef0d8de36006
-  data.tar.gz: d0ebff2036cefb30689a22ebddf313c89ac45a6dda11277a4a5322b6c39c6257e6d05e3615e0167ca876f985b14dc5ac21eba096f947876ab72be32bc6a73c33
+  metadata.gz: 612858ebdac07d01107af653411182685e161b1e501670e569d84265e1dbcd455dbb6a7e55615f802d112037875d9eb15d94c11747a2c15e6cbd1b9f63b804de
+  data.tar.gz: 512df6e55dbad711516e9558cda07b0b90b65f7f950441e36699fe696965296690c52a478247b707ff9e15801b49b73a5d3428cea92dd1e0b49e9861c14580d2

data/CHANGELOG.md

@@ -5,12 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.4.1] - 2026-04-22
+## [0.5.0] - 2026-04-24
 
 
-### Added
+### Fixed
 
-- add output to ping tasks (#6)
+- namespace rake tasks and harden sitemap validation (#8)
 
 
 

data/README.md

@@ -80,12 +80,12 @@ end
 Then run:
 
 ```bash
-bin/rails sitemap:create
-bin/rails sitemap:format
-bin/rails sitemap:validate
+bin/rails indexmap:sitemap:create
+bin/rails indexmap:sitemap:format
+bin/rails indexmap:sitemap:validate
 ```
 
-`sitemap:create` is the main task. It writes sitemap files, formats them, and validates the result.
+`indexmap:sitemap:create` is the main task. It writes sitemap files, formats them, and validates the result.
 
 ### Default Index Mode
 
@@ -129,8 +129,15 @@ Indexmap::Validator.new.validate!
 The built-in validator checks for:
 
 - missing sitemap files
+- malformed sitemap XML
+- empty sitemap files
+- missing or duplicate child sitemap references
 - duplicate sitemap URLs
 - parameterized URLs in sitemap entries
+- fragment URLs in sitemap entries
+- non-HTTP or relative URLs
+- URLs outside the configured `base_url`
+- invalid `lastmod` values
 
 ## Search Engine Ping
 
@@ -139,11 +146,11 @@ The built-in validator checks for:
 Available rake tasks:
 
 ```bash
-bin/rails sitemap:validate
-bin/rails sitemap:google:ping
-bin/rails sitemap:index_now:ping
-bin/rails sitemap:index_now:write_key
-bin/rails sitemap:ping
+bin/rails indexmap:sitemap:validate
+bin/rails indexmap:google:ping
+bin/rails indexmap:index_now:ping
+bin/rails indexmap:index_now:write_key
+bin/rails indexmap:ping
 ```
 
 ### Google Search Console
@@ -156,7 +163,7 @@ Indexmap.configure do |config|
 end
 ```
 
-If `config.google.credentials` is blank, `sitemap:google:ping` skips Google submission.
+If `config.google.credentials` is blank, `indexmap:google:ping` skips Google submission.
 
 You can optionally override the Search Console property identifier:
 
@@ -184,21 +191,21 @@ Indexmap.configure do |config|
 end
 ```
 
-If `config.index_now.key` is set, `sitemap:create` also writes the matching `public/<key>.txt` verification file automatically.
+If `config.index_now.key` is set, `indexmap:sitemap:create` also writes the matching `public/<key>.txt` verification file automatically.
 
 If you prefer the file-based flow, run:
 
 ```bash
-bin/rails sitemap:index_now:write_key
+bin/rails indexmap:index_now:write_key
 ```
 
 That task:
 
 - reuses an existing valid key file when present
 - otherwise generates a new key in `public/<key>.txt`
-- makes that key available to `sitemap:index_now:ping` without adding `config.index_now.key`
+- makes that key available to `indexmap:index_now:ping` without adding `config.index_now.key`
 
-If neither a configured key nor a valid key file is present, `sitemap:index_now:ping` skips IndexNow submission.
+If neither a configured key nor a valid key file is present, `indexmap:index_now:ping` skips IndexNow submission.
 
 ## Development
 

data/lib/indexmap/pinger/google.rb

@@ -38,7 +38,7 @@ module Indexmap
         sitemap_url = URI.join(host, File.basename(sitemap_file)).to_s
 
         unless authorized?
-          logger.error("Google Search Console does not have access to the site: #{root_domain}")
+          logger.debug("Google Search Console does not have access to the site: #{root_domain}")
           return {
             status: :failed,
             reason: :unauthorized,
@@ -62,7 +62,7 @@ module Indexmap
       end
 
       def authorized?
-        webmasters_service.list_sites.site_entry.any? { |site| site.site_url.include?(root_domain) }
+        @authorized ||= accessible_site_urls.include?(property_identifier)
       end
 
       def property_identifier
@@ -104,6 +104,10 @@ module Indexmap
           failures: failures
         }
       end
+
+      def accessible_site_urls
+        @accessible_site_urls ||= Array(webmasters_service.list_sites.site_entry).map(&:site_url)
+      end
     end
   end
 end

data/lib/indexmap/pinger/index_now.rb

@@ -8,6 +8,8 @@ require "time"
 module Indexmap
   module Pinger
     class IndexNow < Base
+      KEY_FORMAT = /\A[a-f0-9]{32}\z/
+
       def initialize(configuration: Indexmap.configuration, connection: nil)
         super(configuration: configuration)
         @connection = connection
@@ -41,20 +43,21 @@ module Indexmap
       end
 
       def write_key_file(key: index_now_configuration.key, path: nil)
-        key = key.to_s.strip
+        key = normalized_configured_key(key)
         return if key.empty?
 
         path ||= index_now_configuration.key_path(public_path: configuration.public_path, key: key)
         FileUtils.mkdir_p(path.dirname)
-        File.write(path, "#{key}\n")
+        File.write(path, key)
         path
       end
 
       def ensure_key_file
-        configured_key = index_now_configuration.key.to_s.strip
+        configured_key = normalized_configured_key(index_now_configuration.key)
         return write_key_file(key: configured_key) unless configured_key.empty?
 
-        return existing_key_file if existing_key_file
+        existing_path = existing_key_file
+        return existing_path if existing_path
 
         key = generated_key
         write_key_file(key: key, path: configuration.public_path.join("#{key}.txt"))
@@ -143,6 +146,9 @@ module Indexmap
 
       def submit_batch(api_key:, urls:)
         payload = {host: hostname, key: api_key, urlList: urls}
+        location = key_location(api_key: api_key)
+        payload[:keyLocation] = location if location
+
         response = index_now_connection.post("/indexnow") do |request|
           request.headers["Content-Type"] = "application/json"
           request.body = payload.to_json
@@ -168,30 +174,50 @@ module Indexmap
       end
 
       def read_api_key
-        configured_key = index_now_configuration.key.to_s.strip
+        configured_key = normalized_configured_key(index_now_configuration.key)
         return configured_key unless configured_key.empty?
 
-        existing_key_file&.read&.strip
+        existing_key_file&.read
       end
 
       def existing_key_file
         configured_path = index_now_configuration.key_path(public_path: configuration.public_path)
         return configured_path if valid_key_file?(configured_path)
 
-        configuration.public_path.glob("*.txt").find { |file| valid_key_file?(file) }
+        configuration.public_path.glob("*.txt").sort.find { |file| valid_key_file?(file) }
+      end
+
+      def key_location(api_key:)
+        path = index_now_configuration.key_path(public_path: configuration.public_path, key: api_key) || existing_key_file
+        return unless path
+
+        public_path = configuration.public_path.expand_path
+        key_path = path.expand_path
+        relative_path = key_path.relative_path_from(public_path)
+
+        URI.join("#{host}/", relative_path.to_s).to_s
+      rescue ArgumentError
+        nil
       end
 
       def valid_key_file?(path)
         return false unless path&.file?
 
         filename = path.basename(".txt").to_s
-        return false unless filename.match?(/\A[a-zA-Z0-9-]{8,128}\z/)
+        return false unless filename.match?(KEY_FORMAT)
 
-        path.read.strip == filename
+        path.read == filename
       end
 
       def generated_key
-        SecureRandom.uuid
+        SecureRandom.hex(16)
+      end
+
+      def normalized_configured_key(value)
+        key = value.to_s.strip
+        return key if key.empty? || key.match?(KEY_FORMAT)
+
+        raise ConfigurationError, "IndexNow key must be a 32-character lowercase hexadecimal string"
       end
 
       def summarize_results(results)

data/lib/indexmap/validator.rb

@@ -1,5 +1,10 @@
 # frozen_string_literal: true
 
+require "nokogiri"
+require "date"
+require "time"
+require "uri"
+
 module Indexmap
   class Validator
     def initialize(configuration: Indexmap.configuration, path: nil)
@@ -14,9 +19,15 @@ module Indexmap
       )
       raise ValidationError, "Missing sitemap file: #{sitemap_path}" unless File.exist?(sitemap_path)
 
+      validate_sitemap_file!(sitemap_path)
       entries = Parser.new(path: sitemap_path).entries
+      validate_presence!(entries)
       validate_duplicates!(entries)
       validate_parameterized_urls!(entries)
+      validate_fragment_urls!(entries)
+      validate_absolute_http_urls!(entries)
+      validate_same_host_urls!(entries)
+      validate_lastmods!(entries)
       true
     end
 
@@ -24,6 +35,65 @@ module Indexmap
 
     attr_reader :configuration, :path
 
+    def validate_sitemap_file!(sitemap_path)
+      document = read_xml_document(sitemap_path)
+      root_name = document.root&.name
+
+      case root_name
+      when "urlset"
+        validate_urlset_document!(document, sitemap_path)
+      when "sitemapindex"
+        validate_sitemap_index_document!(document, sitemap_path)
+      else
+        raise ValidationError, "Invalid sitemap root element in #{sitemap_path}: #{root_name || "none"}"
+      end
+    end
+
+    def read_xml_document(file_path)
+      document = Nokogiri::XML(File.read(file_path, encoding: "UTF-8")) { |config| config.strict }
+      document.remove_namespaces!
+      document
+    rescue Nokogiri::XML::SyntaxError => error
+      raise ValidationError, "Invalid sitemap XML in #{file_path}: #{error.message.lines.first.strip}"
+    end
+
+    def validate_urlset_document!(document, sitemap_path)
+      return if document.xpath("/urlset/url/loc").any?
+
+      raise ValidationError, "Sitemap has no URLs: #{sitemap_path}"
+    end
+
+    def validate_sitemap_index_document!(document, sitemap_path)
+      child_locations = document.xpath("/sitemapindex/sitemap/loc").map { |node| node.text.to_s.strip }.reject(&:empty?)
+      raise ValidationError, "Sitemap index has no child sitemap URLs: #{sitemap_path}" if child_locations.empty?
+
+      duplicate_children = child_locations.group_by(&:itself).select { |_loc, values| values.size > 1 }.keys
+      unless duplicate_children.empty?
+        raise ValidationError, "Duplicate child sitemap URLs detected: #{duplicate_children.first(5).join(", ")}"
+      end
+
+      child_locations.each do |location|
+        child_path = local_child_path(sitemap_path, location)
+        raise ValidationError, "Missing child sitemap file: #{child_path}" unless File.exist?(child_path)
+
+        validate_sitemap_file!(child_path)
+      end
+    end
+
+    def local_child_path(sitemap_path, location)
+      uri = URI.parse(location)
+      filename = (uri.absolute? || location.start_with?("/")) ? File.basename(uri.path) : location
+      File.expand_path(filename, File.dirname(sitemap_path))
+    rescue URI::InvalidURIError
+      File.expand_path(location, File.dirname(sitemap_path))
+    end
+
+    def validate_presence!(entries)
+      return unless entries.empty?
+
+      raise ValidationError, "Sitemap has no URLs"
+    end
+
     def validate_duplicates!(entries)
       duplicates = entries.map(&:loc).group_by(&:itself).select { |_url, values| values.size > 1 }.keys
       return if duplicates.empty?
@@ -37,5 +107,55 @@ module Indexmap
 
       raise ValidationError, "Parameterized sitemap URLs detected: #{param_urls.first(5).join(", ")}"
     end
+
+    def validate_fragment_urls!(entries)
+      fragment_urls = entries.map(&:loc).select { |url| parse_uri(url)&.fragment }
+      return if fragment_urls.empty?
+
+      raise ValidationError, "Fragment sitemap URLs detected: #{fragment_urls.first(5).join(", ")}"
+    end
+
+    def validate_absolute_http_urls!(entries)
+      invalid_urls = entries.map(&:loc).reject do |url|
+        uri = parse_uri(url)
+        uri&.absolute? && %w[http https].include?(uri.scheme)
+      end
+      return if invalid_urls.empty?
+
+      raise ValidationError, "Invalid sitemap URLs detected: #{invalid_urls.first(5).join(", ")}"
+    end
+
+    def validate_same_host_urls!(entries)
+      base_uri = parse_uri(configuration.base_url)
+      return unless base_uri&.host
+
+      invalid_urls = entries.map(&:loc).reject do |url|
+        uri = parse_uri(url)
+        uri&.host == base_uri.host && uri&.scheme == base_uri.scheme && uri&.port == base_uri.port
+      end
+      return if invalid_urls.empty?
+
+      raise ValidationError, "Sitemap URLs outside configured base URL detected: #{invalid_urls.first(5).join(", ")}"
+    end
+
+    def validate_lastmods!(entries)
+      invalid_entries = entries.select do |entry|
+        next false if entry.lastmod.nil?
+
+        Date.iso8601(entry.lastmod)
+        false
+      rescue ArgumentError
+        true
+      end
+      return if invalid_entries.empty?
+
+      raise ValidationError, "Invalid sitemap lastmod values detected: #{invalid_entries.first(5).map(&:loc).join(", ")}"
+    end
+
+    def parse_uri(url)
+      URI.parse(url.to_s)
+    rescue URI::InvalidURIError
+      nil
+    end
   end
 end

data/lib/indexmap/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Indexmap
-  VERSION = "0.4.1"
+  VERSION = "0.5.0"
 end

data/lib/indexmap/writer.rb

@@ -82,7 +82,8 @@ module Indexmap
       sitemap_sections.each do |section|
         lines << "  <sitemap>"
         lines << "    <loc>#{escape(index_loc(section.filename))}</loc>"
-        lines << "    <lastmod>#{format_lastmod(section_lastmod(section))}</lastmod>"
+        lastmod = section_lastmod(section)
+        lines << "    <lastmod>#{format_lastmod(lastmod)}</lastmod>" if lastmod
         lines << "  </sitemap>"
       end
 
@@ -102,7 +103,7 @@ module Indexmap
 
     def section_lastmod(section)
       timestamps = Array(section.entries).map { |entry| comparable_lastmod(normalize_entry(entry).lastmod) }.compact
-      timestamps.max || Time.now.utc
+      timestamps.max
     end
 
     def format_lastmod(value)

data/lib/tasks/indexmap_tasks.rake

@@ -1,35 +1,37 @@
-namespace :sitemap do
-  desc "Create sitemap files"
-  task create: :environment do
-    runner = Indexmap::TaskRunner.new
-    create_result = runner.create
-    runner.format
-    validated_files = runner.validate
-
-    puts "Created, formatted, and validated #{file_count(validated_files)} in #{public_directory(runner)}."
-    puts "IndexNow key file: #{create_result[:index_now_key_path]}" if create_result[:index_now_key_path]
-  end
+namespace :indexmap do
+  namespace :sitemap do
+    desc "Create sitemap files"
+    task create: :environment do
+      runner = Indexmap::TaskRunner.new
+      create_result = runner.create
+      runner.format
+      validated_files = runner.validate
+
+      puts "Created, formatted, and validated #{file_count(validated_files)} in #{public_directory(runner)}."
+      puts "IndexNow key file: #{create_result[:index_now_key_path]}" if create_result[:index_now_key_path]
+    end
 
-  desc "Format sitemap files for better readability"
-  task format: :environment do
-    runner = Indexmap::TaskRunner.new
-    formatted_files = runner.format
+    desc "Format sitemap files for better readability"
+    task format: :environment do
+      runner = Indexmap::TaskRunner.new
+      formatted_files = runner.format
 
-    puts "Formatted #{file_count(formatted_files)} in #{public_directory(runner)}."
-  end
+      puts "Formatted #{file_count(formatted_files)} in #{public_directory(runner)}."
+    end
 
-  desc "Validate sitemap shape and URL hygiene"
-  task validate: :environment do
-    runner = Indexmap::TaskRunner.new
-    validated_files = runner.validate
+    desc "Validate sitemap shape and URL hygiene"
+    task validate: :environment do
+      runner = Indexmap::TaskRunner.new
+      validated_files = runner.validate
 
-    puts "Validated #{file_count(validated_files)} for sitemap shape and URL hygiene."
+      puts "Validated #{file_count(validated_files)} for sitemap shape and URL hygiene."
+    end
   end
 
   desc "Ping all configured search engines"
   task ping: :environment do
-    Rake::Task["sitemap:index_now:ping"].invoke
-    Rake::Task["sitemap:google:ping"].invoke
+    Rake::Task["indexmap:index_now:ping"].invoke
+    Rake::Task["indexmap:google:ping"].invoke
   end
 
   namespace :google do

data/test/indexmap/configuration_test.rb

@@ -8,30 +8,41 @@ class IndexmapConfigurationTest < Minitest::Test
   end
 
   def test_writer_builds_from_configured_callables
-    Indexmap.configure do |config|
-      config.base_url = -> { "https://example.com" }
-      config.public_path = -> { Pathname("tmp/public") }
-      config.sections = -> do
-        [Indexmap::Section.new(filename: "sitemap-pages.xml", entries: [Indexmap::Entry.new(loc: "https://example.com/")])]
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+
+      Indexmap.configure do |config|
+        config.base_url = -> { "https://example.com" }
+        config.public_path = -> { public_path }
+        config.sections = -> do
+          [Indexmap::Section.new(filename: "sitemap-pages.xml", entries: [Indexmap::Entry.new(loc: "https://example.com/")])]
+        end
       end
-    end
 
-    writer = Indexmap.configuration.writer
+      Indexmap.configuration.writer.write
 
-    assert_equal Pathname("tmp/public"), writer.instance_variable_get(:@public_path)
+      assert_includes public_path.join("sitemap.xml").read, "<loc>https://example.com/sitemap-pages.xml</loc>"
+      assert_includes public_path.join("sitemap-pages.xml").read, "<loc>https://example.com/</loc>"
+    end
   end
 
   def test_writer_builds_single_file_writer_from_configured_entries
-    Indexmap.configure do |config|
-      config.base_url = "https://example.com"
-      config.format = :single_file
-      config.entries = -> { [Indexmap::Entry.new(loc: "https://example.com/")] }
-    end
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+
+      Indexmap.configure do |config|
+        config.base_url = "https://example.com"
+        config.public_path = public_path
+        config.format = :single_file
+        config.entries = -> { [Indexmap::Entry.new(loc: "https://example.com/")] }
+      end
 
-    writer = Indexmap.configuration.writer
+      Indexmap.configuration.writer.write
 
-    assert_equal :single_file, writer.instance_variable_get(:@format)
-    assert_equal [Indexmap::Entry.new(loc: "https://example.com/")], writer.instance_variable_get(:@entries)
+      assert_includes public_path.join("sitemap.xml").read, "<urlset"
+      assert_includes public_path.join("sitemap.xml").read, "<loc>https://example.com/</loc>"
+      refute public_path.join("sitemap-pages.xml").exist?
+    end
   end
 
   def test_writer_raises_without_base_url

data/test/indexmap/pinger/google_test.rb

@@ -8,13 +8,15 @@ class IndexmapPingerGoogleTest < Minitest::Test
 
   class FakeWebmastersService
     attr_accessor :authorization
-    attr_reader :submitted
+    attr_reader :submitted, :list_sites_calls
 
     def initialize(site_urls:)
       @site_urls = site_urls
+      @list_sites_calls = 0
     end
 
     def list_sites
+      @list_sites_calls += 1
       SiteList.new(@site_urls.map { |site_url| SiteEntry.new(site_url) })
     end
 
@@ -51,6 +53,7 @@ class IndexmapPingerGoogleTest < Minitest::Test
       assert_equal ["sc-domain:example.com", "https://www.example.com/sitemap.xml"], service.submitted
       assert_equal :submitted, result[:status]
       assert_equal 1, result[:sitemap_count]
+      assert_equal 1, service.list_sites_calls
     end
   end
 
@@ -114,4 +117,27 @@ class IndexmapPingerGoogleTest < Minitest::Test
       assert_nil service.submitted
     end
   end
+
+  def test_google_authorization_requires_exact_property_match
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      public_path.join("sitemap.xml").write("<sitemapindex/>")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+      configuration.google.credentials = "{\"type\":\"service_account\"}"
+
+      service = FakeWebmastersService.new(site_urls: ["sc-domain:myexample.com"])
+      result = Indexmap::Pinger::Google.new(
+        configuration: configuration,
+        service: service,
+        credentials_builder: ->(**) { :fake_authorizer }
+      ).ping
+
+      assert_equal :failed, result[:status]
+      assert_equal :unauthorized, result[:failures].first[:reason]
+      assert_nil service.submitted
+    end
+  end
 end

data/test/indexmap/pinger/index_now_test.rb

@@ -3,17 +3,19 @@
 require "test_helper"
 
 class IndexmapPingerIndexNowTest < Minitest::Test
+  VALID_KEY = "1234567890abcdef1234567890abcdef"
+
   def test_writes_key_file_from_configuration
     Dir.mktmpdir do |dir|
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = Pathname(dir)
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       path = Indexmap::Pinger::IndexNow.new(configuration: configuration).write_key_file
 
-      assert_equal Pathname(dir).join("test-key.txt"), path
-      assert_equal "test-key\n", path.read
+      assert_equal Pathname(dir).join("#{VALID_KEY}.txt"), path
+      assert_equal VALID_KEY, path.read
     end
   end
 
@@ -25,16 +27,16 @@ class IndexmapPingerIndexNowTest < Minitest::Test
 
       path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
 
-      assert_match(/\A[a-z0-9-]{8,128}\.txt\z/, path.basename.to_s)
-      assert_equal "#{path.basename(".txt")}\n", path.read
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, path.basename.to_s)
+      assert_equal path.basename(".txt").to_s, path.read
     end
   end
 
   def test_pings_using_existing_key_file_when_key_is_not_configured
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
-      key_path = public_path.join("test-key-123.txt")
-      key_path.write("test-key-123\n")
+      key_path = public_path.join("#{VALID_KEY}.txt")
+      key_path.write(VALID_KEY)
       write_sitemap_files(
         public_path,
         marketing_lastmod: "2026-04-18T00:00:00Z",
@@ -52,7 +54,8 @@ class IndexmapPingerIndexNowTest < Minitest::Test
 
       assert_requested(:post, indexnow_url, times: 1) do |request|
         payload = JSON.parse(request.body)
-        assert_equal "test-key-123", payload.fetch("key")
+        assert_equal VALID_KEY, payload.fetch("key")
+        assert_equal "https://www.example.com/#{VALID_KEY}.txt", payload.fetch("keyLocation")
       end
       assert_equal :submitted, result[:status]
       assert_equal 2, result[:url_count]
@@ -60,6 +63,24 @@ class IndexmapPingerIndexNowTest < Minitest::Test
     end
   end
 
+  def test_ignores_existing_key_file_with_trailing_newline
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      invalid_key_path = public_path.join("1234567890abcdef1234567890abcdef.txt")
+      invalid_key_path.write("#{VALID_KEY}\n")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+
+      path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
+
+      refute_equal invalid_key_path, path
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, path.basename.to_s)
+      assert_equal path.basename(".txt").to_s, path.read
+    end
+  end
+
   def test_pings_all_sitemap_urls_when_no_cutoff_is_provided
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
@@ -72,7 +93,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 200, body: "", headers: {})
@@ -85,6 +106,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
           "https://www.example.com/pages/features",
           "https://www.example.com/insights/us/restaurants/overview"
         ].sort, payload.fetch("urlList").sort
+        assert_equal "https://www.example.com/#{VALID_KEY}.txt", payload.fetch("keyLocation")
       end
       assert_equal :submitted, result[:status]
       assert_equal 2, result[:url_count]
@@ -104,7 +126,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 200, body: "", headers: {})
@@ -155,7 +177,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       with_env("INDEXNOW_DRY_RUN" => "1") do
         result = Indexmap::Pinger::IndexNow.new(configuration: configuration).ping
@@ -179,7 +201,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 500, body: "boom", headers: {})
@@ -192,6 +214,37 @@ class IndexmapPingerIndexNowTest < Minitest::Test
     end
   end
 
+  def test_rejects_invalid_configured_key
+    Dir.mktmpdir do |dir|
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = Pathname(dir)
+      configuration.index_now.key = "test-key"
+
+      error = assert_raises(Indexmap::ConfigurationError) do
+        Indexmap::Pinger::IndexNow.new(configuration: configuration).ping
+      end
+
+      assert_equal "IndexNow key must be a 32-character lowercase hexadecimal string", error.message
+    end
+  end
+
+  def test_reuses_existing_key_file_deterministically
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      public_path.join("ffffffffffffffffffffffffffffffff.txt").write("ffffffffffffffffffffffffffffffff")
+      public_path.join("00000000000000000000000000000000.txt").write("00000000000000000000000000000000")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+
+      path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
+
+      assert_equal public_path.join("00000000000000000000000000000000.txt"), path
+    end
+  end
+
   private
 
   def with_env(overrides)

data/test/indexmap/task_runner_test.rb

@@ -3,6 +3,8 @@
 require "test_helper"
 
 class IndexmapTaskRunnerTest < Minitest::Test
+  VALID_KEY = "1234567890abcdef1234567890abcdef"
+
   def test_create_removes_existing_sitemap_files_writes_new_sitemap_and_key_file
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
@@ -18,15 +20,15 @@ class IndexmapTaskRunnerTest < Minitest::Test
           entries: [Indexmap::Entry.new(loc: "https://example.com/about")]
         )
       ]
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       result = Indexmap::TaskRunner.new(configuration: configuration).create
 
       assert_equal false, public_path.join("sitemap-pages.xml.gz").exist?
       assert_includes public_path.join("sitemap.xml").read, "<sitemapindex"
-      assert_equal "test-key\n", public_path.join("test-key.txt").read
+      assert_equal VALID_KEY, public_path.join("#{VALID_KEY}.txt").read
       assert_equal [public_path.join("sitemap-pages.xml").to_s, public_path.join("sitemap.xml").to_s], result[:files]
-      assert_equal public_path.join("test-key.txt"), result[:index_now_key_path]
+      assert_equal public_path.join("#{VALID_KEY}.txt"), result[:index_now_key_path]
     end
   end
 
@@ -56,8 +58,8 @@ class IndexmapTaskRunnerTest < Minitest::Test
 
       result = Indexmap::TaskRunner.new(configuration: configuration).write_index_now_key(generate_if_missing: true)
 
-      assert_match(/\A[a-z0-9-]{8,128}\.txt\z/, result.basename.to_s)
-      assert_equal "#{result.basename(".txt")}\n", result.read
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, result.basename.to_s)
+      assert_equal result.basename(".txt").to_s, result.read
     end
   end
 end

data/test/indexmap/validator_test.rb

@@ -52,6 +52,120 @@ class IndexmapValidatorTest < Minitest::Test
     end
   end
 
+  def test_validate_raises_for_fragment_urls
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+          <url><loc>https://example.com/about#team</loc></url>
+        </urlset>
+      XML
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(path: path).validate!
+      end
+
+      assert_equal "Fragment sitemap URLs detected: https://example.com/about#team", error.message
+    end
+  end
+
+  def test_validate_raises_for_relative_urls
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+          <url><loc>/about</loc></url>
+        </urlset>
+      XML
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(path: path).validate!
+      end
+
+      assert_equal "Invalid sitemap URLs detected: /about", error.message
+    end
+  end
+
+  def test_validate_raises_for_urls_outside_configured_base_url
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+          <url><loc>https://other.example.com/about</loc></url>
+        </urlset>
+      XML
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://example.com"
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(configuration: configuration, path: path).validate!
+      end
+
+      assert_equal "Sitemap URLs outside configured base URL detected: https://other.example.com/about", error.message
+    end
+  end
+
+  def test_validate_raises_for_invalid_lastmod_values
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+          <url>
+            <loc>https://example.com/about</loc>
+            <lastmod>not-a-date</lastmod>
+          </url>
+        </urlset>
+      XML
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(path: path).validate!
+      end
+
+      assert_equal "Invalid sitemap lastmod values detected: https://example.com/about", error.message
+    end
+  end
+
+  def test_validate_raises_for_empty_sitemaps
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+        </urlset>
+      XML
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(path: path).validate!
+      end
+
+      assert_equal "Sitemap has no URLs: #{path}", error.message
+    end
+  end
+
+  def test_validate_raises_for_missing_child_sitemap_files
+    Dir.mktmpdir do |directory|
+      path = Pathname(directory).join("sitemap.xml")
+      child_path = Pathname(directory).join("sitemap-pages.xml")
+      path.write(<<~XML)
+        <?xml version="1.0" encoding="UTF-8"?>
+        <sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+          <sitemap><loc>https://example.com/sitemap-pages.xml</loc></sitemap>
+        </sitemapindex>
+      XML
+
+      error = assert_raises(Indexmap::ValidationError) do
+        Indexmap::Validator.new(path: path).validate!
+      end
+
+      assert_equal "Missing child sitemap file: #{child_path}", error.message
+    end
+  end
+
   def test_validate_passes_for_valid_sitemap
     Dir.mktmpdir do |directory|
       path = Pathname(directory).join("sitemap.xml")

data/test/indexmap/writer_test.rb

@@ -77,4 +77,23 @@ class IndexmapWriterTest < Minitest::Test
       refute File.exist?(File.join(directory, "sitemap-pages.xml"))
     end
   end
+
+  def test_omits_sitemap_index_lastmod_when_sections_have_no_lastmod
+    Dir.mktmpdir do |directory|
+      Indexmap::Writer.new(
+        sections: [
+          Indexmap::Section.new(
+            filename: "sitemap-pages.xml",
+            entries: [Indexmap::Entry.new(loc: "https://example.com/about")]
+          )
+        ],
+        public_path: directory,
+        base_url: "https://example.com"
+      ).write
+
+      index_xml = File.read(File.join(directory, "sitemap.xml"))
+
+      refute_includes index_xml, "<lastmod>"
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: indexmap
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Paulo Fidalgo