liquid_xlsx 0.1.0

data/lib/liquid_xlsx/package.rb

@@ -0,0 +1,599 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "digest"
+require "fileutils"
+require "zip"
+require "nokogiri"
+
+module LiquidXlsx
+  # Handles reading and writing .xlsx files as ZIP archives.
+  # rubocop:disable Metrics/ClassLength
+  class Package
+    attr_reader :template_path
+
+    # Relationship namespace (r: prefix).
+    R_NS = "http://schemas.openxmlformats.org/officeDocument/2006/relationships"
+
+    # rubyzip 3 removed the positional `create` argument of `Zip::File.open`
+    # along with the `Zip::File::CREATE` constant; rubyzip 2.4 introduced the
+    # `create:` keyword, and 2.3 only understands the positional form. Detect
+    # the supported form once at load time instead of rescuing per call.
+    ZIP_CREATE_KEYWORD = Zip::File.method(:open).parameters.any? do |type, name|
+      name == :create && %i[key keyreq].include?(type)
+    end
+
+    # Guard rails against zip bombs / resource exhaustion when unpacking.
+    MAX_ENTRIES = 10_000
+    MAX_ENTRY_UNCOMPRESSED = 512 * 1024 * 1024   # 512 MB per entry
+    MAX_TOTAL_UNCOMPRESSED = 1024 * 1024 * 1024  # 1 GB per archive
+
+    def initialize(template_path)
+      @template_path = template_path
+      @files = {}
+      @temp_dir = nil
+    end
+
+    # Unpack the .xlsx and read all internal files.
+    def read
+      raise InvalidXlsxError, "Template file not found: #{@template_path}" unless File.exist?(@template_path)
+
+      @files = {}
+      total_size = 0
+      Zip::File.open(@template_path) do |zip|
+        raise InvalidXlsxError, "Too many entries in archive (max #{MAX_ENTRIES})" if zip.size > MAX_ENTRIES
+
+        zip.each do |entry|
+          # Protection against zip slip
+          name = entry.name
+          raise InvalidXlsxError, "Zip slip detected: #{name}" if name.start_with?("/") || name.include?("..")
+
+          if entry.size > MAX_ENTRY_UNCOMPRESSED
+            raise InvalidXlsxError, "Archive entry too large: #{name} (#{entry.size} bytes)"
+          end
+
+          total_size += entry.size
+          if total_size > MAX_TOTAL_UNCOMPRESSED
+            raise InvalidXlsxError, "Archive too large when uncompressed (max #{MAX_TOTAL_UNCOMPRESSED} bytes)"
+          end
+
+          @files[name] = if entry.directory?
+                           nil
+                         else
+                           entry.get_input_stream.read
+                         end
+        end
+      end
+
+      validate_xlsx!
+      self
+    end
+
+    # Get raw content of a file inside the package.
+    # @param path [String] e.g. "xl/workbook.xml"
+    # @return [String, nil]
+    def [](path)
+      @files[path]
+    end
+
+    # Set raw content of a file inside the package.
+    # @param path [String]
+    # @param content [String]
+    def []=(path, content)
+      @files[path] = content
+      @workbook_xml = nil if path == "xl/workbook.xml"
+    end
+
+    # Delete a file from the package.
+    # @param path [String]
+    def delete(path)
+      @workbook_xml = nil if path == "xl/workbook.xml"
+      @files.delete(path)
+    end
+
+    # Get the list of file paths in the package.
+    # @return [Array<String>]
+    def entries
+      @files.keys
+    end
+
+    # Write modified content to a new .xlsx file.
+    # An existing file at the path is replaced entirely — otherwise stale
+    # entries of the previous archive would survive inside the new one.
+    # @param output_path [String]
+    def write(output_path)
+      FileUtils.rm_f(output_path)
+      open_new_zip(output_path) do |zip|
+        @files.each do |name, content|
+          next if content.nil? # directories
+
+          zip.get_output_stream(name) { |f| f.write(content) }
+        end
+      end
+    end
+
+    # Write modified content to a binary string.
+    # @return [String]
+    def to_binary
+      Dir.mktmpdir("liquid_xlsx") do |tmp|
+        tmp_path = File.join(tmp, "output.xlsx")
+        write(tmp_path)
+        File.binread(tmp_path)
+      end
+    end
+
+    # Get workbook XML parsed.
+    # @return [Nokogiri::XML::Document]
+    def workbook_xml
+      @workbook_xml ||= parse_xml(@files["xl/workbook.xml"])
+    end
+
+    # Get shared strings XML.
+    # @return [String, nil]
+    def shared_strings_xml
+      @files["xl/sharedStrings.xml"]
+    end
+
+    # Get the list of sheet references from workbook.xml.
+    # @return [Array<Hash>] each with :name, :sheet_id, :r_id
+    def sheets
+      workbook_xml.xpath("//xmlns:sheet").map do |sheet|
+        {
+          name: sheet["name"],
+          sheet_id: sheet["sheetId"],
+          r_id: sheet["r:id"]
+        }
+      end
+    end
+
+    # Get worksheet XML by r_id.
+    # @param r_id [String]
+    # @return [String, nil]
+    def worksheet_xml(r_id)
+      # Find relationship target in workbook.xml.rels
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      rel = rels.at_xpath("//xmlns:Relationship[@Id='#{r_id}']")
+      return nil unless rel
+
+      target = rel["Target"]
+      path = "xl/#{target}"
+
+      # Handle paths like xl/worksheets/sheet1.xml vs xl/../xl/worksheets/sheet1.xml
+      # Normalize the path
+      normalized = Pathname.new(path).cleanpath.to_s
+      normalized = normalized.sub(%r{\A/?}, "")
+      @files[normalized]
+    end
+
+    # Save worksheet XML back.
+    # @param r_id [String]
+    # @param xml [String]
+    def save_worksheet_xml(r_id, xml)
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      rel = rels.at_xpath("//xmlns:Relationship[@Id='#{r_id}']")
+      return unless rel
+
+      target = rel["Target"]
+      path = "xl/#{target}"
+      normalized = Pathname.new(path).cleanpath.to_s.sub(%r{\A/?}, "")
+      @files[normalized] = xml
+    end
+
+    # Get calc chain XML.
+    # @return [String, nil]
+    def calc_chain_xml
+      @files["xl/calcChain.xml"]
+    end
+
+    # Remove calc chain and its relationship.
+    def remove_calc_chain
+      @files.delete("xl/calcChain.xml")
+      # Remove relationship (Nokogiri does not support XPath ends-with)
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      rels.xpath("//xmlns:Relationship").each do |rel|
+        target = rel["Target"]
+        rel.remove if target&.end_with?("calcChain.xml")
+      end
+      @files["xl/_rels/workbook.xml.rels"] = rels.to_xml(indent: 0, encoding: "UTF-8")
+    end
+
+    # Set workbook recalculation flags.
+    def set_recalculation_flags
+      wb = workbook_xml
+      calc_pr = wb.at_xpath("//xmlns:calcPr")
+      if calc_pr
+        calc_pr["calcMode"] = "auto"
+        calc_pr["fullCalcOnLoad"] = "1"
+        calc_pr.remove_attribute("calcId")
+        calc_pr.remove_attribute("calcCompleted")
+      else
+        # Add calcPr element at its schema position (after sheets/definedNames)
+        root = wb.at_xpath("/xmlns:workbook")
+        if root
+          calc_pr_node = Nokogiri::XML::Node.new("calcPr", wb)
+          calc_pr_node["calcMode"] = "auto"
+          calc_pr_node["fullCalcOnLoad"] = "1"
+          anchor = wb.at_xpath("//xmlns:definedNames") || wb.at_xpath("//xmlns:sheets")
+          anchor ? anchor.add_next_sibling(calc_pr_node) : root.add_child(calc_pr_node)
+        end
+      end
+      @files["xl/workbook.xml"] = wb.to_xml(indent: 0, encoding: "UTF-8")
+      @workbook_xml = nil
+    end
+
+    # Find the next available worksheet number.
+    # Scans xl/worksheets/ for sheetN.xml and returns N+1.
+    # @return [Integer]
+    def next_worksheet_number
+      nums = entries
+             .grep(%r{\Axl/worksheets/sheet\d+\.xml\z})
+             .map { |e| e[/\d+/].to_i }
+      (nums.max || 0) + 1
+    end
+
+    # Find the next available rId in workbook.xml.rels.
+    # @return [String] e.g. "rId5"
+    def next_r_id
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      existing = rels.xpath("//xmlns:Relationship").map { |r| r["Id"][/\d+/].to_i }
+      "rId#{existing.max.to_i + 1}"
+    end
+
+    # Find the next available sheetId in workbook.xml.
+    # @return [String]
+    def next_sheet_id
+      existing = workbook_xml.xpath("//xmlns:sheet").map { |s| s["sheetId"].to_i }
+      (existing.max || 0).to_i + 1
+    end
+
+    # Clone a worksheet and register it in the package.
+    # Creates new worksheet part and updates workbook.xml, rels, content types.
+    # @param source_sheet_name [String] name of existing template sheet
+    # @param new_sheet_name [String] name of the new sheet
+    # @return [Hash] with :r_id, :sheet_id, :path for the new sheet
+    def clone_worksheet(source_sheet_name:, new_sheet_name:)
+      source_sheet = find_sheet_by_name(source_sheet_name)
+      raise UnsupportedTemplateError, "Template sheet '#{source_sheet_name}' not found" unless source_sheet
+
+      # Check for worksheet rels (unsupported in MVP).
+      # Axlsx always creates empty rels files; only reject non-empty ones.
+      source_path = worksheet_path_for_r_id(source_sheet[:r_id])
+      source_num = source_path[/\d+/].to_i
+      rels_path = "xl/worksheets/_rels/sheet#{source_num}.xml.rels"
+      if @files.key?(rels_path) && non_empty_rels?(rels_path)
+        raise UnsupportedTemplateError,
+              "Template sheet '#{source_sheet_name}' has worksheet relationships and cannot be cloned in MVP."
+      end
+
+      new_num = next_worksheet_number
+      new_path = "xl/worksheets/sheet#{new_num}.xml"
+      new_r_id = next_r_id
+      new_sheet_id = next_sheet_id.to_s
+
+      # Copy worksheet XML
+      source_xml = @files[source_path]
+      @files[new_path] = source_xml&.dup
+
+      # Add sheet entry to workbook.xml
+      wb = workbook_xml
+      sheets_elem = wb.at_xpath("//xmlns:sheets")
+      new_sheet_node = Nokogiri::XML::Node.new("sheet", wb)
+      new_sheet_node["name"] = new_sheet_name
+      new_sheet_node["sheetId"] = new_sheet_id
+      new_sheet_node["r:id"] = new_r_id
+      sheets_elem << new_sheet_node
+      @files["xl/workbook.xml"] = wb.to_xml(indent: 0, encoding: "UTF-8")
+      @workbook_xml = nil
+
+      # Add relationship in workbook.xml.rels
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      rels_elem = rels.at_xpath("/xmlns:Relationships") || rels.root
+      new_rel = Nokogiri::XML::Node.new("Relationship", rels)
+      new_rel["Id"] = new_r_id
+      new_rel["Type"] = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet"
+      new_rel["Target"] = "worksheets/sheet#{new_num}.xml"
+      rels_elem << new_rel
+      @files["xl/_rels/workbook.xml.rels"] = rels.to_xml(indent: 0, encoding: "UTF-8")
+
+      # Add content type override
+      ct = parse_xml(@files["[Content_Types].xml"])
+      types_elem = ct.at_xpath("/xmlns:Types")
+      new_override = Nokogiri::XML::Node.new("Override", ct)
+      new_override["PartName"] = "/xl/worksheets/sheet#{new_num}.xml"
+      new_override["ContentType"] = "application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml"
+      types_elem << new_override
+      @files["[Content_Types].xml"] = ct.to_xml(indent: 0, encoding: "UTF-8")
+
+      { r_id: new_r_id, sheet_id: new_sheet_id.to_i, name: new_sheet_name, path: new_path }
+    end
+
+    # Set a sheet to hidden state in workbook.xml.
+    # @param sheet_name [String]
+    def hide_sheet(sheet_name)
+      sheet = find_sheet_by_name(sheet_name)
+      return unless sheet
+
+      wb = workbook_xml
+      # Compare names in Ruby: interpolating them into XPath would allow
+      # injection via quotes/apostrophes in user-provided sheet names.
+      sheet_node = wb.xpath("//xmlns:sheet").find { |s| s["name"] == sheet_name }
+      sheet_node["state"] = "hidden" if sheet_node
+      @files["xl/workbook.xml"] = wb.to_xml(indent: 0, encoding: "UTF-8")
+      @workbook_xml = nil
+    end
+
+    # Add a media file to the package. Deduplicates by SHA-256.
+    # @param binary [String] raw bytes
+    # @param ext [String] file extension (e.g. "png")
+    # @return [String] path e.g. "xl/media/image1.png"
+    def add_media(binary, ext)
+      sha = Digest::SHA256.hexdigest(binary)
+      filename = "image_#{sha[0..11]}.#{ext}"
+      path = "xl/media/#{filename}"
+
+      # Dedup: return existing path if already present
+      return path if @files.key?(path)
+
+      @files[path] = binary
+
+      # Add/ensure Default content type for this extension
+      ct = parse_xml(@files["[Content_Types].xml"])
+      ns = { "xmlns" => "http://schemas.openxmlformats.org/package/2006/content-types" }
+      ext_node = ct.at_xpath("//xmlns:Default[@Extension='#{ext}']", ns)
+      unless ext_node
+        default = Nokogiri::XML::Node.new("Default", ct)
+        default["Extension"] = ext
+        media_ct = case ext
+                   when "png" then "image/png"
+                   when "jpeg", "jpg" then "image/jpeg"
+                   when "gif" then "image/gif"
+                   else "application/octet-stream"
+                   end
+        default["ContentType"] = media_ct
+        # OPC schema requires all Default elements before any Override
+        first_override = ct.at_xpath("//xmlns:Override", ns)
+        first_override ? first_override.add_previous_sibling(default) : ct.root.add_child(default)
+        @files["[Content_Types].xml"] = ct.to_xml(indent: 0, encoding: "UTF-8")
+      end
+
+      path
+    end
+
+    # Attach a drawing to a worksheet.
+    # - Creates xl/drawings/drawingM.xml and _rels/drawingM.xml.rels
+    # - Creates/updates worksheet rels and inserts <drawing> element
+    # - Adds content type override
+    # @param sheet_r_id [String] workbook rels rId for the worksheet
+    # @param drawing_xml [String] the <xdr:wsDr> XML
+    # @param drawing_rels_xml [String] the drawing relationships XML
+    # @return [String] the drawing rId in worksheet rels (e.g. "rId1")
+    def attach_drawing(sheet_r_id:, drawing_xml:, drawing_rels_xml:)
+      sheet_num = sheet_number_for_r_id(sheet_r_id)
+      ws_rels_path = "xl/worksheets/_rels/sheet#{sheet_num}.xml.rels"
+      ws_rels = parse_rels(ws_rels_path)
+
+      # A worksheet may contain at most ONE <drawing> element. If the sheet
+      # already has a drawing part, merge the new anchors into it.
+      existing_rel = ws_rels.xpath("//xmlns:Relationship").find do |r|
+        r["Type"]&.end_with?("/drawing")
+      end
+      if existing_rel
+        merge_into_existing_drawing(existing_rel, drawing_xml, drawing_rels_xml)
+        return existing_rel["Id"]
+      end
+
+      # Determine next drawing number
+      drawing_num = next_drawing_number
+      drawing_path = "xl/drawings/drawing#{drawing_num}.xml"
+      drawing_rels_path = "xl/drawings/_rels/drawing#{drawing_num}.xml.rels"
+
+      # Write drawing files
+      @files[drawing_path] = drawing_xml
+
+      # Write drawing rels
+      if drawing_rels_xml
+        @files[drawing_rels_path] = drawing_rels_xml
+      end
+
+      # Add worksheet rels: worksheet → drawing
+      next_wr_id = next_rels_id(ws_rels)
+
+      new_rel = Nokogiri::XML::Node.new("Relationship", ws_rels)
+      new_rel["Id"] = next_wr_id
+      new_rel["Type"] = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing"
+      new_rel["Target"] = "../drawings/drawing#{drawing_num}.xml"
+      ws_rels.root.add_child(new_rel)
+      @files[ws_rels_path] = ws_rels.to_xml(indent: 0, encoding: "UTF-8")
+
+      # Insert <drawing> element into worksheet XML
+      ws_path = worksheet_path_for_r_id(sheet_r_id)
+      insert_drawing_into_worksheet(ws_path, next_wr_id)
+
+      # Add content type override
+      add_content_type_override(drawing_path,
+                                "application/vnd.openxmlformats-officedocument.drawing+xml")
+
+      next_wr_id
+    end
+
+    # Find a sheet by name in workbook.xml.
+    # @param name [String]
+    # @return [Hash, nil]
+    def find_sheet_by_name(sheet_name)
+      sheets.find { |s| s[:name] == sheet_name }
+    end
+
+    # Get the worksheet file path for a given r_id.
+    # @param r_id [String]
+    # @return [String, nil]
+    def worksheet_path_for_r_id(r_id)
+      rels = parse_xml(@files["xl/_rels/workbook.xml.rels"])
+      rel = rels.at_xpath("//xmlns:Relationship[@Id='#{r_id}']")
+      return nil unless rel
+
+      target = rel["Target"]
+      Pathname.new("xl/#{target}").cleanpath.to_s.sub(%r{\A/?}, "")
+    end
+
+    # Get all sheet names from workbook.xml.
+    # @return [Array<String>]
+    def sheet_names
+      sheets.map { |s| s[:name] }
+    end
+
+    private
+
+    # Open a brand-new archive for writing across rubyzip 2.x and 3.x.
+    # See ZIP_CREATE_KEYWORD for why the call has to be spelled two ways.
+    def open_new_zip(output_path, &)
+      if ZIP_CREATE_KEYWORD
+        Zip::File.open(output_path, create: true, &)
+      else
+        Zip::File.open(output_path, Zip::File::CREATE, &)
+      end
+    end
+
+    # Check if a worksheet rels file contains actual relationships (not just empty <Relationships/>).
+    def non_empty_rels?(rels_path)
+      xml = @files[rels_path]
+      return false unless xml
+
+      doc = parse_xml(xml)
+      doc.xpath("//xmlns:Relationship").any?
+    end
+
+    def parse_xml(content)
+      return nil unless content
+
+      Nokogiri::XML(content) { |config| config.strict.noblanks }
+    end
+
+    def validate_xlsx!
+      unless @files.key?("[Content_Types].xml") && @files.key?("xl/workbook.xml")
+        raise InvalidXlsxError, "Not a valid .xlsx file: missing required entries"
+      end
+    end
+
+    # ---------- private drawing helpers ----------
+
+    def next_drawing_number
+      nums = entries
+             .grep(%r{\Axl/drawings/drawing\d+\.xml\z})
+             .map { |e| e[/\d+/].to_i }
+      (nums.max || 0) + 1
+    end
+
+    def sheet_number_for_r_id(r_id)
+      path = worksheet_path_for_r_id(r_id)
+      path[/\d+/].to_i
+    end
+
+    def parse_rels(rels_path)
+      if @files.key?(rels_path)
+        parse_xml(@files[rels_path])
+      else
+        empty_rels_xml
+      end
+    end
+
+    def empty_rels_xml
+      Nokogiri::XML('<?xml version="1.0" encoding="UTF-8"?>' \
+                    "<Relationships " \
+                    'xmlns="http://schemas.openxmlformats.org/package/2006/relationships"/>')
+    end
+
+    def next_rels_id(rels_doc)
+      existing = rels_doc.xpath("//xmlns:Relationship").map do |r|
+        r["Id"][/\d+/].to_i
+      end
+      "rId#{existing.max.to_i + 1}"
+    end
+
+    # Merge freshly built drawing anchors and their relationships into the
+    # drawing part already attached to the worksheet, remapping rIds.
+    def merge_into_existing_drawing(ws_drawing_rel, new_drawing_xml, new_rels_xml)
+      target = ws_drawing_rel["Target"]
+      drawing_path = Pathname.new("xl/worksheets/#{target}").cleanpath.to_s.sub(%r{\A/?}, "")
+      drawing_rels_path = "#{drawing_path.sub('xl/drawings/', 'xl/drawings/_rels/')}.rels"
+
+      existing_doc = parse_xml(@files[drawing_path])
+      existing_rels = parse_rels(drawing_rels_path)
+
+      # Remap new relationship ids to avoid collisions with existing ones
+      id_map = {}
+      if new_rels_xml
+        new_rels = parse_xml(new_rels_xml)
+        new_rels.xpath("//xmlns:Relationship").each do |rel|
+          old_id = rel["Id"]
+          new_id = next_rels_id(existing_rels)
+          id_map[old_id] = new_id
+          rel["Id"] = new_id
+          existing_rels.root.add_child(rel)
+        end
+      end
+
+      new_doc = parse_xml(new_drawing_xml)
+      new_doc.root.element_children.each do |anchor|
+        remap_relationship_ids(anchor, id_map)
+        existing_doc.root.add_child(anchor)
+      end
+
+      @files[drawing_path] = existing_doc.to_xml(indent: 0, encoding: "UTF-8")
+      @files[drawing_rels_path] = existing_rels.to_xml(indent: 0, encoding: "UTF-8")
+      add_content_type_override(drawing_path,
+                                "application/vnd.openxmlformats-officedocument.drawing+xml")
+    end
+
+    # Rewrite r:embed / r:link style attributes according to an rId map.
+    def remap_relationship_ids(node, id_map)
+      return if id_map.empty?
+
+      node.xpath("descendant-or-self::*/@*").each do |attr|
+        next unless attr.namespace&.href == R_NS
+        next unless id_map.key?(attr.value)
+
+        attr.value = id_map[attr.value]
+      end
+    end
+
+    def insert_drawing_into_worksheet(ws_path, drawing_r_id)
+      xml = @files[ws_path]
+      return unless xml
+
+      doc = parse_xml(xml)
+      root = doc.root
+
+      # Ensure the r: namespace is declared before writing an r:id attribute
+      unless root.namespace_definitions.any? { |ns| ns.prefix == "r" }
+        root.add_namespace_definition("r", R_NS)
+      end
+
+      drawing = Nokogiri::XML::Node.new("drawing", doc)
+      drawing["r:id"] = drawing_r_id
+
+      # Insert at the schema-mandated CT_Worksheet position
+      Worksheet.insert_child_in_order(root, drawing)
+
+      @files[ws_path] = doc.to_xml(indent: 0, encoding: "UTF-8")
+    end
+
+    def add_content_type_override(part_name, content_type)
+      ct = parse_xml(@files["[Content_Types].xml"])
+      ns = { "xmlns" => "http://schemas.openxmlformats.org/package/2006/content-types" }
+
+      # Normalize part name to start with /
+      part_name = "/#{part_name}" unless part_name.start_with?("/")
+
+      # Don't add duplicate
+      existing = ct.at_xpath("//xmlns:Override[@PartName='#{part_name}']", ns)
+      return if existing
+
+      override = Nokogiri::XML::Node.new("Override", ct)
+      override["PartName"] = part_name
+      override["ContentType"] = content_type
+      ct.root.add_child(override)
+      @files["[Content_Types].xml"] = ct.to_xml(indent: 0, encoding: "UTF-8")
+    end
+  end
+  # rubocop:enable Metrics/ClassLength
+end