moxml 0.5.165 → 0.5.166

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8dae9d144ec375224efd389406ed2cdb06c5409ae91d985e95221a972a1158ac
-  data.tar.gz: 308da2c1430d4f7f6b195eeec3d4ba9f651c9664f30c2a6c1381923572409fbd
+  metadata.gz: 932f907222ac657e72e53b9e5ac2e514bb6aa07a51da815caa7ee31c0b0a02fa
+  data.tar.gz: 11c82e15a42a80adb5bb19b4b819e9b4cfa1e7e508c6088d383dfdd793a33956
 SHA512:
-  metadata.gz: 794455e01d1021344dd5f792802d10403cc35a57b4fd167dee967d59c8079f2e3467a392433dff45c9959919569d2e3fc68b4f0db8535257bb646ce9f48821ea
-  data.tar.gz: a2e777a2b636b71432ee8baa0610254cb2b464b33843f57063d31a6688974394cfc25e8c6e91851448c97f563acd80261833c5542d5b9b962aa2dae240c8aa27
+  metadata.gz: 2ef7a9115c29ad09a1b3cb91e3c1c7c8cae297529de98cc772b6939b1e3a893c9820889b85b61f82cfd52c6e9536f688b841551c6f125c09aea0fee61ae12d10
+  data.tar.gz: c2822eb479197ddf8151820c1c28e3ce61f49b2a1b3263d1fa4ffc7bc581e387aa52799faef3fba303fb9113bed5ac51cb5b93b5736ed1f03884b398c5a6df15

data/docs/_pages/model-coverage.adoc

@@ -43,6 +43,7 @@ Generated by `bundle exec rake docs:coverage` from the coverage matrix and the d
 | validation under-detections | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | validation version reporting | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | validation regex dismissal | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
+| validation substitution dismissal | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 | loud capability contracts | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent | equivalent
 |===
 

data/docs/_references/processing-model.adoc

@@ -255,7 +255,7 @@ semantics.
 
 === Validation
 
-Pins:: `spec/moxml/xsd_regex_spec.rb`, `spec/moxml/xsd_spec.rb`, `spec/moxml/xsd_underdetection_spec.rb`, `spec/moxml/xsd_version_spec.rb`
+Pins:: `spec/moxml/xsd_regex_spec.rb`, `spec/moxml/xsd_spec.rb`, `spec/moxml/xsd_substitution_spec.rb`, `spec/moxml/xsd_underdetection_spec.rb`, `spec/moxml/xsd_version_spec.rb`
 
 XSD validation through engines that ship a validator (libxml2;
 leptris tier-1: recognized roots, one-level content descent, lexical
@@ -278,7 +278,13 @@ single-character escapes; subtraction, `\i`, `\c` do not), an
 engine finding is dropped only when every same-named instance
 matches the facet, and anything untranslatable keeps the engine's
 answer, so a dismissal can only remove false rejections, never
-create false acceptances. A compiled schema reports the
+create false acceptances. Engine content-model findings that reject
+a substitution-group member are dismissed likewise: the parent's
+model must be a pure sequence, the child sequence must match it
+position-for-position with every particle exactly-once, and a
+registered member must realize a position — any choice/all,
+cardinality violation, or unknown name keeps the engine's answer.
+A compiled schema reports the
 version its source declares: root `vc:minVersion="1.1"` scopes the
 document to 1.1, anything else is 1.0 (consumers scope 1.0-only
 checks with it; applying 1.1 semantics is the engine-side program).

data/lib/moxml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Moxml
-  VERSION = "0.5.165"
+  VERSION = "0.5.166"
 end

data/lib/moxml/xsd/schema_rules.rb

@@ -105,7 +105,9 @@ module Moxml
             when "##defined" then :defined
             when "##definedSibling" then :sibling
             when /\A([^:]+):(.+)\z/
-              uri = prefix_uri(Regexp.last_match(1), element)
+              uri = ::Moxml::XSD::SchemaRules.prefix_uri(
+                Regexp.last_match(1), element
+              )
               "{#{uri}}#{Regexp.last_match(2)}" unless uri.empty?
             else
               "{}#{token}"
@@ -113,23 +115,6 @@ module Moxml
           end
         end
 
-        # node.namespaces is adapter-divergent (some engines return
-        # in-scope bindings, others own-node declarations only), so
-        # the in-scope map is walked out by hand — per-node
-        # definitions merged along the ancestor axis, deeper
-        # overriding shallower, identically on every adapter.
-        def prefix_uri(prefix, element)
-          bindings = {}
-          node = element
-          while node
-            node.namespaces.each do |namespace|
-              bindings[namespace.prefix] = namespace.uri
-            end
-            node = node.parent&.element? ? node.parent : nil
-          end
-          bindings[prefix].to_s
-        end
-
         def entry_covers?(entry, namespace)
           namespace == case entry
                        when "##targetNamespace" then :tns
@@ -140,11 +125,34 @@ module Moxml
       end
 
       ContentModel = Struct.new(:declared_children, :any,
-                                :declared_attributes, :any_attribute)
+                                :declared_attributes, :any_attribute,
+                                :particles, :pure_sequence)
       SchemaIndex = Struct.new(:target_namespace, :element_default,
                                :attribute_default, :elements,
                                :attributes, :contents, :version,
-                               :element_patterns, :attribute_patterns)
+                               :element_patterns, :attribute_patterns,
+                               :substitution_members)
+
+      # Resolves a QName token against an element's in-scope
+      # bindings. node.namespaces is adapter-divergent (some
+      # engines return in-scope bindings, others own-node
+      # declarations only), so the in-scope map is walked out by
+      # hand — per-node definitions merged along the ancestor
+      # axis, deeper overriding shallower, identically on every
+      # adapter. Unresolvable prefixes yield "".
+      module_function
+
+      def prefix_uri(prefix, element)
+        bindings = {}
+        node = element
+        while node
+          node.namespaces.each do |namespace|
+            bindings[namespace.prefix] = namespace.uri
+          end
+          node = node.parent&.element? ? node.parent : nil
+        end
+        bindings[prefix].to_s
+      end
 
       # The XSD 1.1 version-tagging namespace (Structures §C.3):
       # vc:minVersion / vc:maxVersion gate 1.1 constructs.
@@ -243,7 +251,7 @@ module Moxml
             root["targetNamespace"].to_s,
             root["elementFormDefault"] == "qualified",
             root["attributeFormDefault"] == "qualified",
-            {}, {}, {}, schema_version(root), {}, {}
+            {}, {}, {}, schema_version(root), {}, {}, {}
           )
           child_elements(root).each do |decl|
             case decl.name
@@ -339,27 +347,36 @@ module Moxml
           sink[name] = sink.key?(name) ? nil : patterns
         end
 
-        # Dismisses engine lexical findings the source's own
-        # pattern facets refute (#464): an engine that cannot
-        # evaluate a dialect construct rejects every occurrence of
-        # the facet — including values the facet accepts. A
-        # finding is dropped only when every same-named instance
-        # in the document matches; one non-matching value keeps
-        # the engine's answer, so a dismissal can only remove
-        # false rejections, never create false acceptances.
+        # Dismisses engine findings the schema source refutes:
+        #
+        # * lexical findings pattern facets accept (#464) — dropped
+        #   only when every same-named instance matches the facet;
+        # * content-model findings that reject a substitution-group
+        #   member (#466 class 1) — dropped only when the parent's
+        #   content model is a pure sequence, the child sequence
+        #   matches it position-for-position with every particle
+        #   exactly-once, and a substitution member resolves a
+        #   position. One non-vouching instance — or any real
+        #   mismatch — keeps the engine's answer, so a dismissal
+        #   can only remove false rejections, never create false
+        #   acceptances.
         def dismiss(engine_errors, doc, index)
           return engine_errors unless index
 
           vouched = vouch_table(doc, index)
           engine_errors.reject do |error|
-            subject = lexical_subject(error.message)
-            subject && vouched[subject]
+            if (subject = lexical_subject(error.message))
+              vouched[subject]
+            elsif (sequence = content_model_subject(error.message))
+              sequence_vouched?(doc, index, *sequence)
+            end
           end
         end
 
         LEXICAL_MESSAGE = /\A(?:element|attribute) '([^']+)' @\d+:\d+: (element|attribute) '([^']+)': lexical value does not match its type\z/
+        CONTENT_MODEL_MESSAGE = /\Aelement '([^']+)' @\d+:\d+: element '([^']+)': children do not match the content model \(at '([^']+)'\)\z/
 
-        private_constant :LEXICAL_MESSAGE
+        private_constant :LEXICAL_MESSAGE, :CONTENT_MODEL_MESSAGE
 
         def lexical_subject(message)
           match = LEXICAL_MESSAGE.match(message.to_s)
@@ -368,6 +385,81 @@ module Moxml
           [match[2], match[3]]
         end
 
+        def content_model_subject(message)
+          match = CONTENT_MODEL_MESSAGE.match(message.to_s)
+          return unless match
+
+          [match[2], match[3]]
+        end
+
+        # Every same-named element in the document must vouch: a
+        # sequence the finding names could be valid while another
+        # same-named one is not. The root is included — the
+        # engine's finding can name it.
+        def sequence_vouched?(doc, index, name, offender)
+          root = doc.root
+          return false unless root
+
+          witnesses = []
+          yield_self = root.name == name
+          witnesses << sequence_valid?(root, index, offender) if yield_self
+          each_named_element(root, name) do |element|
+            witnesses << sequence_valid?(element, index, offender)
+          end
+          !witnesses.empty? && witnesses.all?
+        end
+
+        def each_named_element(node, name, &block)
+          child_elements(node).each do |child|
+            yield child if child.name == name
+            each_named_element(child, name, &block)
+          end
+        end
+
+        # The airtight witness: child count equals particle count,
+        # every position resolves to its particle's name or a
+        # registered member of it, every particle occurs exactly
+        # once, and the reported offender is a substitution member
+        # realized at some position. Anything else leaves the
+        # engine's answer standing.
+        def sequence_valid?(element, index, offender)
+          model = index.contents[qname(element)]
+          return false unless model&.pure_sequence
+
+          particles = model.particles
+          children = child_elements(element)
+          return false if children.empty? || children.size != particles.size
+
+          resolved = false
+          children.each_with_index do |child, position|
+            particle_name, min, max = particles[position]
+            child_qname = qname(child)
+            return false unless exactly_once?(min, max)
+
+            if child_qname == particle_name
+              next
+            elsif index.substitution_members.fetch(particle_name, [])
+                .include?(child_qname)
+              resolved = true
+            else
+              return false
+            end
+          end
+          resolved && offender_realized?(children, offender, index)
+        end
+
+        def exactly_once?(min, max)
+          min <= 1 && (max == :unbounded || max >= 1)
+        end
+
+        def offender_realized?(children, offender, index)
+          members = index.substitution_members.values.flatten
+          children.any? do |child|
+            child.name == offender &&
+              members.include?(qname(child))
+          end
+        end
+
         def vouch_table(doc, index)
           root = doc.root
           return {} unless root
@@ -434,6 +526,9 @@ module Moxml
           name = decl["name"] or return
           qname = "{#{index.target_namespace}}#{name}"
           index.elements[qname] = { nillable: decl["nillable"] == "true" }
+          if (head = decl["substitutionGroup"])
+            register_substitution(head, decl, qname, index)
+          end
           type_attr = decl.attribute("type")
           model = if type_attr.nil? || type_attr.value.empty?
                     inline_model(decl, index)
@@ -443,6 +538,23 @@ module Moxml
           index.contents[qname] = model if model
         end
 
+        # substitutionGroup is a QName resolved against the global
+        # declaration's in-scope bindings (#466 class 1); the
+        # member's own qname is target-namespace-qualified — global
+        # declarations always are.
+        def register_substitution(head, decl, member_qname, index)
+          if head.include?(":")
+            prefix, _, local = head.partition(":")
+            uri = prefix_uri(prefix, decl)
+            return if uri.empty?
+
+            head_qname = "{#{uri}}#{local}"
+          else
+            head_qname = "{}#{head}"
+          end
+          (index.substitution_members[head_qname] ||= []) << member_qname
+        end
+
         def index_global_attribute(decl, index)
           name = decl["name"] or return
           index.attributes["{#{index.target_namespace}}#{name}"] = true
@@ -468,7 +580,7 @@ module Moxml
         end
 
         def content_model(type_node, index)
-          model = ContentModel.new([], nil, [], nil)
+          model = ContentModel.new([], nil, [], nil, [], true)
           collect_model(type_node, index, model)
           model
         end
@@ -477,36 +589,58 @@ module Moxml
         # choice / all / complexContent wrappers flattened): we only
         # ADD findings for strict-wildcard matches, so flattening
         # can only under-report, never over-report. Cardinality and
-        # order stay the engine's job.
+        # order stay the engine's job — EXCEPT for the substitution
+        # dismissal (#466 class 1), which vouches only for pure
+        # sequences: any choice/all marks the model impure and the
+        # flattened order is then not a validity witness.
         def collect_model(node, index, model)
           child_elements(node).each do |child|
             case child.name
             when "element"
-              add_particle(child, index, model,
-                           model.declared_children)
+              if (qname = particle_qname(child, index))
+                model.declared_children << qname
+                model.particles << [
+                  qname,
+                  occur_value(child, "minOccurs", 1),
+                  occur_value(child, "maxOccurs", 1),
+                ]
+              end
             when "attribute"
-              add_particle(child, index, model,
-                           model.declared_attributes)
+              if (qname = particle_qname(child, index))
+                model.declared_attributes << qname
+              end
             when "any"
               model.any ||= wildcard_from(child)
             when "anyAttribute"
               model.any_attribute ||= wildcard_from(child)
+            when "choice", "all"
+              model.pure_sequence = false
+              collect_model(child, index, model)
             else
               collect_model(child, index, model)
             end
           end
         end
 
-        def add_particle(particle, index, _model, sink)
+        def particle_qname(particle, index)
           ref = particle["ref"]
           name = ref&.split(":")&.last || particle["name"]
           return unless name
 
-          sink << if ref
-                    "{#{index.target_namespace}}#{name}"
-                  else
-                    "{#{form_namespace(particle, index)}}#{name}"
-                  end
+          if ref
+            "{#{index.target_namespace}}#{name}"
+          else
+            "{#{form_namespace(particle, index)}}#{name}"
+          end
+        end
+
+        def occur_value(particle, attribute, default)
+          value = particle[attribute]
+          return :unbounded if value == "unbounded"
+
+          Integer(value || default)
+        rescue ArgumentError
+          default
         end
 
         # Particles declare with form="qualified"/"unqualified",

data/spec/moxml/xsd_substitution_spec.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Processing model §Validation (normative): pinned here.
+# #466 class 1: the engine's content-model matcher matches
+# particles by exact name only, so a valid substitution-group
+# member is rejected with "children do not match the content
+# model". The Ruby-side dismissal drops such a finding only when
+# the parent's content model is a pure sequence, the child
+# sequence matches it position-for-position with every particle
+# exactly-once, and a registered member realizes a position —
+# any choice/all, cardinality violation, or unknown name keeps
+# the engine's answer, so the dismissal can only remove false
+# rejections, never create false acceptances.
+RSpec.describe "Moxml::XSD substitution-group dismissal (#466)" do
+  %i[nokogiri leptris].each do |adapter_name|
+    describe "on #{adapter_name}" do
+      let(:ctx) { Moxml.new(adapter_name) }
+
+      before do
+        skip "#{adapter_name} requires an XSD-capable engine" unless
+          Moxml::XSD.supported?(ctx)
+      end
+
+      describe "member of a referenced head particle" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "accepts the member where the head is declared" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem2/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "accepts the head itself" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem1/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+
+        it "rejects a stray non-member child" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:unknown/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "member inside a nested sequence" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:mid"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="mid">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "accepts the member at the inner position" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting">' \
+            "<x:mid><x:elem2/></x:mid></x:doc>",
+          )
+          expect(schema.valid?(doc)).to be(true)
+        end
+      end
+
+      describe "models the dismissal refuses" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:choice>
+                    <xsd:element ref="x:elem1"/>
+                    <xsd:element name="other"/>
+                  </xsd:choice>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "keeps the engine's answer for a two-child choice match" do
+          # A choice takes one item; two children cannot be valid
+          # even though both names resolve — the flattened particle
+          # list is not a validity witness for non-sequences.
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting">' \
+            "<x:elem2/><x:other/></x:doc>",
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+
+      describe "cardinality the dismissal refuses" do
+        let(:schema) do
+          ctx.xsd(<<~XSD)
+            <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                xmlns:x="http://xsdtesting"
+                targetNamespace="http://xsdtesting"
+                elementFormDefault="qualified">
+              <xsd:element name="doc">
+                <xsd:complexType>
+                  <xsd:sequence>
+                    <xsd:element ref="x:elem1" minOccurs="2" maxOccurs="2"/>
+                  </xsd:sequence>
+                </xsd:complexType>
+              </xsd:element>
+              <xsd:element name="elem1" abstract="false"/>
+              <xsd:element name="elem2" substitutionGroup="x:elem1"/>
+            </xsd:schema>
+          XSD
+        end
+
+        it "keeps the engine's answer below minOccurs" do
+          doc = ctx.parse(
+            '<x:doc xmlns:x="http://xsdtesting"><x:elem2/></x:doc>',
+          )
+          expect(schema.valid?(doc)).to be(false)
+        end
+      end
+    end
+  end
+end

data/spec/support/model_coverage.rb

@@ -93,6 +93,10 @@ module ModelCoverage
       section: "Validation",
       pin: "spec/moxml/xsd_regex_spec.rb",
     },
+    "validation substitution dismissal" => {
+      section: "Validation",
+      pin: "spec/moxml/xsd_substitution_spec.rb",
+    },
     "loud capability contracts" => {
       section: "Errors and loud degradation",
       pin: "spec/consistency/loud_degradation_spec.rb",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: moxml
 version: !ruby/object:Gem::Version
-  version: 0.5.165
+  version: 0.5.166
 platform: ruby
 authors:
 - Ribose Inc.
@@ -634,6 +634,7 @@ files:
 - spec/moxml/xsd_regex_spec.rb
 - spec/moxml/xsd_release_spec.rb
 - spec/moxml/xsd_spec.rb
+- spec/moxml/xsd_substitution_spec.rb
 - spec/moxml/xsd_underdetection_spec.rb
 - spec/moxml/xsd_version_spec.rb
 - spec/moxml/xslt/stylesheet_spec.rb