moxml 0.6.3 → 0.6.4

data/lib/moxml/xsd.rb

@@ -97,9 +97,10 @@ module Moxml
       end
 
       def initialize(handle, context, schema_source = nil,
-                     self_contained: nil)
+                     self_contained: nil, path: nil)
         @handle = handle
         @context = context
+        @schema_path = path
         @rules_index =
           if schema_source
             SchemaRules.index(schema_source, context,
@@ -157,8 +158,9 @@ module Moxml
                 end
               end
         engine_errors = @context.config.adapter.xsd_validate(
-          @handle, doc.native
+          validation_handle(doc), doc.native
         )
+        engine_errors = dismiss_refuted_not_declared(engine_errors, doc)
         return engine_errors unless @rules_index
 
         # The #452 post-validation rules only ever add findings for
@@ -170,6 +172,438 @@ module Moxml
           SchemaRules.findings(doc, @rules_index)).uniq
       end
 
+      # Validations run against the compile-time handle. The
+      # composition fix (#522) is dismissal-side: the facade indexes
+      # every unit of the composition (the schema + the instance's
+      # xsi:schemaLocation hints) and drops engine strict-admission
+      # rows the index refutes — engines whose admission consults
+      # only the head unit's declarations never see the aux units,
+      # and recompiling a mixed-targetNamespace union would swap one
+      # false answer for another.
+      def validation_handle(_doc)
+        @handle
+      end
+
+      XSI_NS = "http://www.w3.org/2001/XMLSchema-instance"
+
+      # xsi:schemaLocation (namespace/path pairs) and
+      # xsi:noNamespaceSchemaLocation paths from the validated
+      # instance's root, resolved against this schema's directory
+      # and filtered to files that exist. Empty when this schema was
+      # compiled from a string (no base to resolve against).
+      def instance_schema_hints(doc)
+        return [].freeze unless @schema_path
+        return [].freeze unless doc&.root
+
+        base = File.dirname(@schema_path)
+        root = doc.root
+        hints = []
+        root.attributes.each do |attribute|
+          next unless attribute.namespace&.uri == XSI_NS
+
+          value = attribute.value.to_s
+          case attribute.name
+          when "noNamespaceSchemaLocation"
+            hints << value
+          when "schemaLocation"
+            hints.concat(value.split(/\s+/).reject(&:empty?)
+              .each_slice(2).map(&:last))
+          end
+        end
+        hints.uniq
+          .map { |hint| File.expand_path(hint, base) }
+          .select do |p|
+            File.file?(p) && p != File.expand_path(@schema_path)
+          end.freeze
+      end
+
+      # Engine strict-admission rows the composed unit set REFUTES:
+      # engines whose wildcard admission consults only the head
+      # unit's declaration table report "attribute 'x': not declared
+      # (strict)" for attributes declared in another unit of the
+      # same compiled composition, and the mixed-tns fresh union
+      # compile itself can mis-admit a root element the same way
+      # (leptris#1964 family, moxml#522). The facade owns the
+      # composition, so it can refute a row when the named item, as
+      # it appears in THIS instance, is a global declaration of any
+      # unit (namespace + local name). Only exact "not declared
+      # (strict)" rows are ever dropped; every other engine finding
+      # passes through untouched.
+      def dismiss_refuted_not_declared(engine_errors, doc)
+        return engine_errors if engine_errors.empty? || !@schema_path
+
+        hints = instance_schema_hints(doc)
+        units = composed_unit_set([@schema_path, *hints])
+        declared = composed_declarations(units)
+        admissible = element_admissibility(units)
+        return engine_errors if declared.empty? && admissible.empty?
+
+        attr_index = {}
+        element_ns = {}
+        stack = [doc.root]
+        while (element = stack.pop)
+          element_ns[(element.namespace&.uri || "")] ||= true
+          stack.concat(element.children.grep(Moxml::Element))
+          element.attributes.each do |attribute|
+            attr_uri = attribute.namespace&.uri || ""
+            ((attr_index[[attr_uri, attribute.name]] ||= []) <<
+              element.name)
+          end
+        end
+        engine_errors.reject do |finding|
+          match = NOT_DECLARED_ROW.match(finding.message)
+          next false unless match
+
+          element_name = match[1]
+          attribute_name = match[2]
+          if attribute_name
+            attr_index.any? do |(uri, attr_name), holders|
+              next false unless attr_name == attribute_name &&
+                holders.include?(element_name)
+
+              # A global declaration of some unit, or a group member
+              # the element's type admits (moxml#522 attgC class —
+              # exact (element, attribute, namespace) match).
+              declared.key?([uri, attribute_name]) ||
+                admissible.dig(element_name, attribute_name) == uri
+            end
+          else
+            declared.key?(["", element_name]) ||
+              (element_ns[element_name] &&
+                declared.key?([element_ns[element_name], element_name]))
+          end
+        end
+      end
+
+      # The composition closure of the unit set: every unit's
+      # xs:include / xs:import / xs:redefine schemaLocation targets
+      # (existing files), cycle-guarded, resolved relative to each
+      # unit. The engine compiles these documents as ONE composition;
+      # the facade's index must see the same set even when the
+      # instance carries no xsi hints (attgC035's redefined groups
+      # live in documents only the schema graph knows).
+      def composed_unit_set(units)
+        @composed_unit_set ||= {}
+        cached = @composed_unit_set[units]
+        return cached if cached
+
+        seen = {}
+        queue = units.dup
+        until queue.empty?
+          unit = queue.pop
+          next if seen.key?(unit)
+
+          seen[unit] = true
+          base = File.dirname(unit)
+          unit_schema_refs(unit).each do |ref|
+            target = File.expand_path(ref, base)
+            queue << target if File.file?(target) && !seen.key?(target)
+          end
+        end
+        closure = seen.keys.sort
+        @composed_unit_set[units] = closure
+        closure
+      end
+
+      # schemaLocation hrefs on the unit's own xs:include, xs:import
+      # and xs:redefine (poison-immune REXML read; the engine's
+      # component tables are process-global and a later parse can
+      # poison compiled handles, moxml#522).
+      def unit_schema_refs(unit)
+        require "rexml/document"
+        root = REXML::Document.new(File.read(unit)).root
+        return [].freeze unless root&.name == "schema"
+
+        refs = %w[include import redefine].map do |tag|
+          root.elements.each_with_object([]) do |node, out|
+            next unless node.name == tag
+
+            loc = node.attributes["schemaLocation"]
+            out << loc if loc.to_s.match?(/\S/)
+          end
+        end.flatten
+        refs.freeze
+      rescue StandardError
+        [].freeze
+      end
+
+      # {element name => {attribute name => namespace}}: every
+      # attribute the composition admits for each element — the
+      # element's type's attributeGroup members resolved transitively
+      # across units (import groups; an xs:redefine body's self-ref
+      # is the 4.2.2 hook to the ORIGINAL definition, so the
+      # effective group is body UNION original). Only exact members
+      # of the real composition land here, so a genuinely undeclared
+      # attribute never becomes refutable.
+      def element_admissibility(units)
+        @element_admissibility ||= {}
+        cached = @element_admissibility[units]
+        return cached if cached
+
+        facts = {}
+        units.each do |unit|
+          unit_facts = schema_unit_facts(unit)
+          facts[unit] = unit_facts if unit_facts
+        end
+
+        # Effective group definitions: redefining bodies merge the
+        # target unit's original when (and only when) the body hooks
+        # it with a self-ref. Keys: bare name AND {uri}name (refs
+        # resolve with the referencing unit's xmlns, bare-name
+        # fallback — same-name groups are composition-unique).
+        plain = {}
+        bodies = {}
+        facts.each_value do |unit|
+          unit[:redefines].each do |name, target_path|
+            body = unit[:groups][name]
+            original = facts[target_path]&.dig(:groups, name)
+            bodies[name] = merge_group_def(body, original, name)
+          end
+          unit[:groups].each do |name, defn|
+            plain[name] = defn unless unit[:redefines].key?(name)
+          end
+        end
+        # Redefine bodies are the EFFECTIVE definitions — they win
+        # over the plain originals.
+        groups = plain.merge(bodies)
+
+        resolved = {}
+        facts.each_value do |unit|
+          unit[:elements].each do |element_name, element|
+            attrs = {}
+            element[:groups].each do |qref|
+              resolve_group_ref(qref, unit, groups, attrs, {})
+            end
+            element[:attrs].each do |name, uri|
+              attrs[name] = uri
+            end
+            resolved[element_name] = attrs unless attrs.empty?
+          end
+        end
+        @element_admissibility[units] = resolved.freeze
+      end
+
+      # body UNION original when the body hooks the original with a
+      # self-ref; the body alone otherwise.
+      def merge_group_def(body, original, name)
+        return body unless body && original.is_a?(Hash) &&
+          body[:refs].include?(name)
+
+        {
+          attrs: body[:attrs] + original[:attrs],
+          refs: body[:refs] + original[:refs],
+        }
+      end
+
+      # Resolve one attributeGroup ref (raw QName string) into attrs
+      # {name => uri}, transitively; cycle-guarded by +seen+. Keys
+      # are bare names with qualified "{uri}name" fallbacks.
+      def resolve_group_ref(qref, from_unit, groups, attrs, seen)
+        return if seen.key?(qref)
+
+        seen[qref] = true
+        prefix, _, local = qref.rpartition(":")
+        xmlns = from_unit[:xmlns]
+        uri = if prefix.empty?
+                xmlns["xmlns"].to_s
+              else
+                xmlns["xmlns:#{prefix}"].to_s
+              end
+        defn = groups["{#{uri}}#{local}"] || groups[local]
+        return unless defn.is_a?(Hash)
+
+        defn[:attrs].each do |name, attr_uri|
+          attrs[name] = attr_uri
+        end
+        defn[:refs].each do |ref|
+          resolve_group_ref(ref, from_unit, groups, attrs, seen)
+        end
+      end
+
+      # Per-unit schema facts for the admissibility index:
+      # {tns, afd (attributeFormDefault qualified?), xmlns,
+      #  groups: {name => {attrs, refs}}, redefines: {name => target},
+      #  elements: {name => {groups, attrs}}} — poison-immune REXML.
+      # Attribute member URIs use the DEFINING unit's form rules;
+      # group refs stay raw QNames (resolved at chase time).
+      def schema_unit_facts(unit)
+        require "rexml/document"
+        root = REXML::Document.new(File.read(unit)).root
+        return nil unless root&.name == "schema"
+
+        xmlns = {}
+        root.attributes.each do |name, value|
+          xmlns[name] = value.to_s if name.start_with?("xmlns")
+        end
+        tns = root.attributes["targetNamespace"].to_s
+        afd = root.attributes["attributeFormDefault"] == "qualified"
+
+        member_uri = lambda do |node|
+          qualified = node.attributes["form"] == "qualified" || afd
+          qualified ? tns : ""
+        end
+
+        groups = {}
+        redefines = {}
+        root.elements.each do |node|
+          case node.name
+          when "attributeGroup"
+            name = node.attributes["name"]
+            next unless name
+
+            groups[name] = walk_group_members(node, member_uri)
+          when "redefine"
+            loc = node.attributes["schemaLocation"]
+            node.elements.each do |body|
+              next unless body.name == "attributeGroup"
+
+              name = body.attributes["name"]
+              next unless name
+
+              groups[name] = walk_group_members(body, member_uri)
+              redefines[name] = File.expand_path(loc, File.dirname(unit)) if
+                loc.to_s.match?(/\S/)
+            end
+          end
+        end
+
+        elements = {}
+        root.elements.each do |node|
+          next unless node.name == "element"
+          next unless (name = node.attributes["name"])
+
+          container = node.elements.find { |child| child.name == "complexType" }
+          type_name = node.attributes["type"].to_s
+          container ||= root.elements.find do |child|
+            child.name == "complexType" && child.attributes["name"] == type_name
+          end
+          next unless container.is_a?(REXML::Element)
+
+          groups_seen, attrs = walk_type_attributes(container, member_uri)
+          elements[name] = { groups: groups_seen, attrs: attrs }
+        end
+
+        {
+          tns: tns, afd: afd, xmlns: xmlns, groups: groups,
+          redefines: redefines, elements: elements
+        }
+      rescue StandardError
+        nil
+      end
+
+      # Refs and attribute members of one attributeGroup definition.
+      # Refs stay raw QNames — the chase resolves prefixes through
+      # the referencing unit's xmlns.
+      def walk_group_members(node, member_uri)
+        refs = []
+        attrs = []
+        node.elements.each do |child|
+          case child.name
+          when "attribute"
+            name = child.attributes["name"]
+            attrs << [name, member_uri.call(child)] if name
+          when "attributeGroup"
+            ref = child.attributes["ref"]
+            refs << ref if ref.to_s.match?(/\S/)
+          end
+        end
+        { attrs: attrs, refs: refs }
+      end
+
+      # attributeGroup refs + own attribute members of a complexType
+      # (one level; nested group-through-group chains resolve at
+      # chase time). Returns [raw refs, attrs].
+      def walk_type_attributes(container, member_uri)
+        refs = []
+        attrs = []
+        container.elements.each do |child|
+          case child.name
+          when "attributeGroup"
+            ref = child.attributes["ref"]
+            refs << ref if ref.to_s.match?(/\S/)
+          when "attribute"
+            name = child.attributes["name"]
+            attrs << [name, member_uri.call(child)] if name
+          end
+        end
+        [refs, attrs]
+      end
+
+      # {uri, local} => true for every global xs:attribute and
+      # xs:element declared across the unit set: a global
+      # declaration always takes its unit's targetNamespace.
+      # Parsed with REXML when available: the engine's component
+      # tables are process-global and can be poisoned by later
+      # parses between compile and validate (moxml#522) — a
+      # declaration index must be poison-immune. Falls back to the
+      # context parse when REXML is unavailable.
+      def composed_declarations(units)
+        @composed_declarations ||= {}
+        cached = @composed_declarations[units]
+        return cached if cached
+
+        declared = {}
+        parser = begin
+          require "rexml"
+          :rexml
+        rescue LoadError
+          :context
+        end
+        units.each do |unit|
+          tns, decls = unit_declarations(unit, parser)
+          next unless decls
+
+          decls.each do |name|
+            declared[[tns, name]] = true
+          end
+        end
+        @composed_declarations[units] = declared
+      end
+
+      # [targetNamespace, [global attribute/element names]] for one
+      # schema unit, per the parser flavor. REXML's read is
+      # poison-immune; the context parse is the fallback.
+      def unit_declarations(unit, parser)
+        text = File.read(unit)
+        if parser == :rexml
+          require "rexml/document"
+          root = REXML::Document.new(text).root
+          return nil unless root&.name == "schema"
+
+          tns = root.attributes["targetNamespace"].to_s
+          names = %w[attribute element].freeze
+          decls = root.elements.filter_map do |decl|
+            next unless names.include?(decl.name)
+
+            decl.attributes["name"]
+          end
+        else
+          root = @context.parse(text).root
+          return nil unless root&.name == "schema"
+
+          tns = root.attributes.find { |a| a.name == "targetNamespace" }
+            &.value.to_s
+          names = %w[attribute element].freeze
+          decls = root.children
+            .grep(Moxml::Element)
+            .filter_map do |decl|
+              next unless names.include?(decl.name)
+
+              decl.attributes.find { |a| a.name == "name" }&.value
+            end
+        end
+        [tns, decls]
+      rescue StandardError
+        nil
+      end
+
+      # Matches both row shapes the strict admission emits — with and
+      # without the attribute segment:
+      #   element 'doc' @2:144: element 'doc': not declared (strict)
+      #   element 'elem' @3:46: attribute 'foo': not declared (strict)
+      NOT_DECLARED_ROW =
+        /\Aelement '([^']+)'(?: @\S+)? (?:(?:element|attribute) '([^']+)': )?not declared \(strict\)\z/
+
       def valid?(node_or_xml)
         check_released!
         validate(node_or_xml).empty?

data/spec/moxml/adapter/leptris_children_address_spec.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+begin
+  require "leptris"
+rescue LoadError
+  # Leptris gem not available - skip all specs in this file
+  return
+end
+return unless Leptris::XML::Document.respond_to?(:create)
+# The address-native lane rides the binding's shadow faces
+# (children_addrs / walk_addresses, leptris-ruby#587/#589/#591);
+# older bindings keep the columnar per-subtree crossing, so the
+# routing cannot be pinned there.
+return unless defined?(Leptris::XML::Native) &&
+  Leptris::XML::Native.respond_to?(:children_addrs)
+
+require "moxml/adapter/leptris"
+
+RSpec.describe "Moxml::Adapter::Leptris address-native children (shadow lane)" do
+  around do |example|
+    Moxml.with_config(:leptris, true, "UTF-8") do
+      example.run
+    end
+  end
+
+  let(:xml) do
+    <<~XML
+      <?xml version="1.0"?><r><a x="1">t</a><b/><c><d/></c><tail>z</tail></r>
+    XML
+  end
+
+  let(:doc) { Moxml.parse(xml) }
+  let(:root) { doc.root }
+  let(:root_native) { root.native }
+
+  # Counts real Native.children_addrs C crossings inside the block —
+  # no stubs, the actual boundary traffic the address lane pays.
+  def with_crossing_count(method_id = :children_addrs)
+    calls = 0
+    tp = TracePoint.new(:c_call) do |t|
+      calls += 1 if t.method_id == method_id
+    end
+    result = nil
+    tp.enable { result = yield }
+    [calls, result]
+  end
+
+  describe "the address gate" do
+    it "face-probes the shadow faces on the binding" do
+      expect(Moxml::Adapter::Leptris::ADDRESS_NATIVE).to be(true)
+      expect(Leptris::XML::Native.respond_to?(:children_addrs)).to be(true)
+    end
+  end
+
+  describe "plain children reads" do
+    it "answer address tokens matching the native children face" do
+      got = Moxml::Adapter::Leptris.children(root_native)
+      expected = Leptris::XML::NativeNode
+        .instance_method(:children).bind_call(root_native).to_a
+      expect(got).to all(be_a(Moxml::Adapter::Leptris::AddressNode))
+      expect(got.size).to eq(expected.size)
+      expect(got.map { |n| Moxml::Adapter::Leptris.node_name(n) })
+        .to eq(expected.map(&:name))
+      got.each_with_index do |token, i|
+        # Address equality: the token stands for the same C node.
+        expect(token.address).to eq(expected[i].address)
+        expect(Moxml::Adapter::Leptris.node_type(token))
+          .to eq(Moxml::Adapter::Leptris.node_type(expected[i]))
+      end
+    end
+
+    it "hand back the SAME token per address across traversals" do
+      first = Moxml::Adapter::Leptris.children(root_native)
+      second = Moxml::Adapter::Leptris.children(root_native)
+      expect(second).to eq(first)
+      expect(second.first).to equal(first.first)
+    end
+
+    # Parsed-document wrappers mint with Identity::ChildReads above
+    # Moxml::Node, so consumer iteration on those wrappers dispatches
+    # to the binding's C read layer. The address face pays one
+    # children_addrs crossing per element receiver — the token mint
+    # replaces the TypedData wrap + identity-cache write the columnar
+    # lane pays per node in C.
+    it "pay one crossing per element receiver, none on repeat reads" do
+      calls, = with_crossing_count do
+        walk_face = lambda do |token|
+          Moxml::Adapter::Leptris.children(token).each do |child|
+            walk_face.call(child)
+          end
+        end
+        walk_face.call(root_native)
+      end
+      # The subtree has 6 elements (r, a, b, c, d, tail): one crossing
+      # each, no walk_columnar at all.
+      expect(calls).to eq(6)
+      calls2, = with_crossing_count do
+        Moxml::Adapter::Leptris.children(root_native)
+      end
+      expect(calls2).to eq(1)
+    end
+
+    it "serve element reads through the address-keyed faces" do
+      target = Moxml::Adapter::Leptris.children(root_native)
+        .find { |t| Moxml::Adapter::Leptris.node_name(t) == "a" }
+      expect(Moxml::Adapter::Leptris.bare_attr_value(target, "x")).to eq("1")
+      expect(Moxml::Adapter::Leptris.text_content(target)).to eq("t")
+      expect(Moxml::Adapter::Leptris.attributes(target).map(&:value))
+        .to eq(["1"])
+    end
+
+    it "keep the document assembly path on document receivers" do
+      calls, doc_children = with_crossing_count do
+        Moxml::Adapter::Leptris.children(doc.native)
+      end
+      # No token crossings: the document's child list rides the
+      # assembly path (declaration/doctype kinds are outside the
+      # address lane's WS enum).
+      expect(calls).to eq(0)
+      expect(doc_children.map do |n|
+        Moxml::Adapter::Leptris.node_name(n)
+      end).to include("r")
+    end
+  end
+
+  describe "mutation invalidation" do
+    # Read back through the adapter face: the token map must never
+    # serve a list a mutation has invalidated.
+    def face_children_names
+      Moxml::Adapter::Leptris.children(root_native)
+        .map { |n| Moxml::Adapter::Leptris.node_name(n) }
+    end
+
+    it "sees children added after the map was primed" do
+      face_children_names # prime the map
+      root.add_child(doc.create_element("late"))
+      expect(face_children_names).to include("late")
+    end
+
+    it "sees children removed after the map was primed" do
+      face_children_names # prime the map
+      root.children.to_a.first.remove
+      expect(face_children_names).not_to include("a")
+    end
+
+    it "sees sibling insertions after the map was primed" do
+      face_children_names # prime the map
+      anchor = root.children.to_a.first
+      anchor.add_previous_sibling(doc.create_element("before2"))
+      expect(face_children_names).to include("before2")
+    end
+
+    it "sees replace after the map was primed" do
+      face_children_names # prime the map
+      victim = root.children.to_a.find { |n| n.name == "b" }
+      victim.replace(doc.create_element("swapped"))
+      expect(face_children_names).to include("swapped")
+      expect(face_children_names).not_to include("b")
+    end
+
+    it "sees content rewrites after the map was primed" do
+      face_children_names # prime the map
+      target = root.children.to_a.find { |n| n.name == "a" }
+      target.content = "rewritten"
+      names = face_children_names
+      expect(names).to include("a")
+      expect(root.children.to_a.find { |n| n.name == "a" }.text)
+        .to eq("rewritten")
+    end
+  end
+end

data/spec/moxml/adapter/leptris_spec.rb

@@ -53,10 +53,6 @@ RSpec.describe Moxml::Adapter::Leptris do
     end
 
     it "evaluates attribute-node queries with proper wrappers" do
-      # Native since 1.9.105 (leptris-ruby#153: ResultAttr with
-      # name/value); earlier bindings returned generic nodes whose
-      # #name raised, so the Ruby engine owned them.
-      skip "requires native attr results (leptris 1.9.105+)" unless described_class::ATTR_RESULT_NATIVE
       attrs = doc.xpath("//item/@id")
       expect(attrs.map(&:name)).to eq(%w[id id])
       expect(attrs.map(&:value)).to eq(%w[1 2])
@@ -759,8 +755,6 @@ RSpec.describe Moxml::Adapter::Leptris do
     let(:ctx) { Moxml.new(:leptris) }
 
     it "answers engine source positions for parsed nodes" do
-      skip "requires leptris 1.9.181" unless described_class::NATIVE_SOURCE_POSITION
-
       doc = ctx.parse("<root>\n  <child>text</child>\n</root>")
       expect(doc.root.source_position).to include(line: 1)
       expect(doc.root.source_position).to be_a(Hash)