pdfrb 0.7.1 → 0.7.11

data/lib/pdfrb/conformance/pdf_2_af.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PDF 2.0 Associated Files (AF) validation per Application Note
+    # 002 (sources at ~/src/pdfa/appnote-pdf20-002-af/). The AF
+    # mechanism attaches external files to PDF objects with a typed
+    # relationship (Source, Data, Alternative, Supplement,
+    # EncryptedPayload, Unspecified).
+    #
+    # This rule set checks:
+    #   * /AF arrays are present where required (PDF 2.0 catalog).
+    #   * Each /AF entry is a /Type /AssociatedFile or FileSpec dict
+    #     with an /AFRelationship.
+    #   * /AFRelationship is one of the six allowed values.
+    #   * FileSpec dicts carry /UF + /EF.
+    #   * EmbeddedFile streams carry /Subtype (MIME type).
+    module Pdf2AF
+      ALLOWED_RELATIONSHIPS = %i[Source Data Alternative Supplement
+                                 EncryptedPayload Unspecified].freeze
+
+      module_function
+
+      RULESET = RuleSet.new("PDF 2.0 AF").tap do |rs|
+        rs.register(Rule.new(
+                      id: "af-1",
+                      description: "/AF entries must declare AFRelationship",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 App Note 002 3.1",
+                      check: ->(doc) {
+                        violations = []
+                        each_af_entry(doc) do |container, entry|
+                          next if relationship_of(entry)
+
+                          violations << Violation.new(
+                            rule_id: "af-1",
+                            message: "/AF entry on #{container_label(container)} missing /AFRelationship",
+                            object: container_label(container),
+                            severity: :error,
+                            spec_clause: "PDF 2.0 App Note 002 3.1"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-2",
+                      description: "/AFRelationship must be one of the allowed values",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 App Note 002 3.2",
+                      check: ->(doc) {
+                        violations = []
+                        each_af_entry(doc) do |container, entry|
+                          rel = relationship_of(entry)
+                          next unless rel
+                          next if ALLOWED_RELATIONSHIPS.include?(rel.to_sym)
+
+                          violations << Violation.new(
+                            rule_id: "af-2",
+                            message: "/AFRelationship '#{rel}' is not one of #{ALLOWED_RELATIONSHIPS.join(', ')}",
+                            object: container_label(container),
+                            severity: :error,
+                            spec_clause: "PDF 2.0 App Note 002 3.2"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-3",
+                      description: "FileSpec dicts must carry /UF and /EF",
+                      severity: :error,
+                      spec_clause: "PDF 2.0 7.11.3",
+                      check: ->(doc) {
+                        violations = []
+                        each_filespec(doc) do |_container, fs|
+                          ok = fs[:UF] && fs[:EF]
+                          next if ok
+
+                          violations << Violation.new(
+                            rule_id: "af-3",
+                            message: "FileSpec missing /UF or /EF",
+                            object: "FileSpec",
+                            severity: :error,
+                            spec_clause: "PDF 2.0 7.11.3"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "af-4",
+                      description: "EmbeddedFile streams should declare /Subtype MIME",
+                      severity: :warning,
+                      spec_clause: "PDF 2.0 7.11.4",
+                      check: ->(doc) {
+                        violations = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :EmbeddedFile
+                          next if obj.value[:Subtype]
+
+                          violations << Violation.new(
+                            rule_id: "af-4",
+                            message: "EmbeddedFile missing /Subtype (MIME type)",
+                            object: "EmbeddedFile",
+                            severity: :warning,
+                            spec_clause: "PDF 2.0 7.11.4"
+                          )
+                        end
+                        violations
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+
+      # Walk every indirect object that has an /AF key, yielding
+      # (container_object, af_entry) for each entry in each /AF
+      # array. /AF entries may be References (resolves) or dicts.
+      def each_af_entry(document)
+        document.each_indirect_object do |container|
+          af = container.value[:AF]
+          next unless af
+
+          af_value = af.is_a?(Pdfrb::Model::PdfArray) ? af.value : af
+          entries = af_value.is_a?(::Array) ? af_value : [af_value]
+          entries.each do |e|
+            resolved = e.is_a?(Pdfrb::Model::Reference) ? document.object(e) : e
+            yield container, resolved if resolved
+          end
+        end
+      end
+
+      # Walk every FileSpec dict in the document.
+      def each_filespec(document)
+        document.each_indirect_object do |container|
+          fs = container.value[:Type] == :FileSpec ? container : nil
+          if fs
+            yield container, fs
+            next
+          end
+
+          # Also pick up FileSpecs referenced from /AF arrays.
+          af = container.value[:AF]
+          next unless af
+
+          af_value = af.is_a?(Pdfrb::Model::PdfArray) ? af.value : af
+          entries = af_value.is_a?(::Array) ? af_value : [af_value]
+          entries.each do |e|
+            resolved = e.is_a?(Pdfrb::Model::Reference) ? document.object(e) : e
+            next unless resolved && resolved.value[:Type] == :FileSpec
+
+            yield container, resolved
+          end
+        end
+      end
+
+      def relationship_of(entry)
+        return nil unless entry
+
+        value = entry.is_a?(Pdfrb::Model::Cos::Dictionary) ? entry.value : entry
+        return nil unless value.is_a?(::Hash)
+
+        # AssociatedFile dicts put the relationship on
+        # /AFRelationship; FileSpecs put it on the same key when
+        # they're AF-related.
+        value[:AFRelationship]
+      end
+
+      def container_label(obj)
+        type = obj.value[:Type]
+        return "Object/#{obj.oid}" unless type
+
+        "Object/#{type}/#{obj.oid}"
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pdf_a.rb

@@ -80,6 +80,122 @@ module Pdfrb
                     ))
       end
 
+      # Deep preflight rules common to all PDF/A levels. Each is a
+      # categorical ban: JavaScript, PS XObjects, non-A-3 embedded
+      # files, and unencoded text operators.
+      PREFLIGHT_DEEP = RuleSet.new("PDF/A-preflight").tap do |rs|
+        rs.register(Rule.new(
+                      id: "preflight-1",
+                      description: "JavaScript is forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.6",
+                      check: ->(doc) {
+                        vs = []
+                        catalog = doc.catalog
+                        names = catalog[:Names]
+                        names = doc.object(names) if names.is_a?(Pdfrb::Model::Reference)
+                        if names && (names[:JavaScript] || (names.is_a?(::Hash) && names[:JavaScript]))
+                          vs << Violation.new(
+                            rule_id: "preflight-1",
+                            message: "/Names /JavaScript is forbidden in PDF/A",
+                            object: "Catalog/Names/JavaScript",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.6"
+                          )
+                        end
+                        if catalog[:AA] || catalog[:OpenAction]
+                          vs << Violation.new(
+                            rule_id: "preflight-1",
+                            message: "Additional actions (/AA) and /OpenAction with JavaScript are restricted in PDF/A",
+                            object: "Catalog",
+                            severity: :warning,
+                            spec_clause: "ISO 19005-1 6.6"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-2",
+                      description: "PostScript XObjects are forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.2.3",
+                      check: ->(doc) {
+                        vs = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :XObject
+                          next unless obj.value[:Subtype] == :PS
+
+                          vs << Violation.new(
+                            rule_id: "preflight-2",
+                            message: "PostScript XObjects are forbidden in PDF/A",
+                            object: "XObject",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.2.3"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-3",
+                      description: "EmbeddedFile streams restricted",
+                      severity: :error,
+                      spec_clause: "ISO 19005-3 6.4",
+                      check: ->(_doc) {
+                        # Only PDF/A-3 allows EmbeddedFile. The rule
+                        # is permissive by default; the per-level
+                        # rule sets filter it down for A-1 and A-2.
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "preflight-4",
+                      description: "Encryption is forbidden",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.1",
+                      check: ->(doc) {
+                        next nil unless doc.trailer && doc.trailer[:Encrypt]
+
+                        Violation.new(
+                          rule_id: "preflight-4",
+                          message: "Encryption is forbidden in PDF/A",
+                          object: "Trailer/Encrypt",
+                          severity: :error,
+                          spec_clause: "ISO 19005-1 6.1"
+                        )
+                      }
+                    ))
+      end
+
+      # Embeds files forbidden in PDF/A-1 and PDF/A-2 (only A-3
+      # permits them).
+      PREFLIGHT_NO_EMBED = RuleSet.new("PDF/A-no-embedded").tap do |rs|
+        rs.register(Rule.new(
+                      id: "preflight-3-a1a2",
+                      description: "EmbeddedFile streams are forbidden in PDF/A-1 and A-2",
+                      severity: :error,
+                      spec_clause: "ISO 19005-1 6.4",
+                      check: ->(doc) {
+                        vs = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :EmbeddedFile
+
+                          vs << Violation.new(
+                            rule_id: "preflight-3-a1a2",
+                            message: "EmbeddedFile streams are forbidden in PDF/A-1 and A-2",
+                            object: "EmbeddedFile",
+                            severity: :error,
+                            spec_clause: "ISO 19005-1 6.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
       A1_SPECIFIC = RuleSet.new("PDF/A-1-specific").tap do |rs|
         rs.register(Rule.new(
                       id: "a1-1", description: "JPEG2000 not allowed in A-1",
@@ -295,21 +411,28 @@ module Pdfrb
       A1 = RuleSet.new("PDF/A-1").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A1_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       A2 = RuleSet.new("PDF/A-2").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A2_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       A3 = RuleSet.new("PDF/A-3").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A3_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
       end
 
       A4 = RuleSet.new("PDF/A-4").tap do |rs|
         SHARED.rules.each { |r| rs.register(r) }
         A4_SPECIFIC.rules.each { |r| rs.register(r) }
+        PREFLIGHT_DEEP.rules.each { |r| rs.register(r) }
+        PREFLIGHT_NO_EMBED.rules.each { |r| rs.register(r) }
       end
 
       LEVEL_RULESETS = {

data/lib/pdfrb/conformance/pdf_a4_deep.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PDF/A-4 deep checks (ISO 19005-4). Builds on the SHARED + A4
+    # rules in Pdfrb::Conformance::PdfA by adding additional
+    # structural requirements specific to PDF/A-4: PDF 2.0 base,
+    # XMP metadata required (not just recommended), /AF entries
+    # valid per App Note 002.
+    module PdfA4Deep
+      module_function
+
+      RULESET = RuleSet.new("PDF/A-4-deep").tap do |rs|
+        rs.register(Rule.new(
+                      id: "a4deep-1",
+                      description: "PDF/A-4 requires XMP /Metadata stream",
+                      severity: :error,
+                      spec_clause: "ISO 19005-4 6.1",
+                      check: ->(doc) {
+                        next nil if doc.catalog[:Metadata]
+
+                        Violation.new(
+                          rule_id: "a4deep-1",
+                          message: "PDF/A-4 requires /Catalog/Metadata XMP stream",
+                          object: "Catalog/Metadata",
+                          severity: :error,
+                          spec_clause: "ISO 19005-4 6.1"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "a4deep-2",
+                      description: "PDF/A-4 should have valid /OutputIntents when colour-managed",
+                      severity: :warning,
+                      spec_clause: "ISO 19005-4 6.2.4",
+                      check: ->(doc) {
+                        next nil if doc.catalog[:OutputIntents]
+
+                        # Only flag when document has ICCBased color spaces
+                        has_icc = false
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:ColorSpace]
+
+                          cs = obj.value[:ColorSpace]
+                          cs_array = cs.is_a?(::Array) ? cs : [cs]
+                          if cs_array.any?(:ICCBased)
+                            has_icc = true
+                            break
+                          end
+                        end
+                        next nil unless has_icc
+
+                        Violation.new(
+                          rule_id: "a4deep-2",
+                          message: "ICC-based color spaces require /OutputIntents in PDF/A-4",
+                          object: "Catalog/OutputIntents",
+                          severity: :warning,
+                          spec_clause: "ISO 19005-4 6.2.4"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "a4deep-3",
+                      description: "PDF/A-4 forbids EmbeddedFile streams",
+                      severity: :error,
+                      spec_clause: "ISO 19005-4 6.4",
+                      check: ->(doc) {
+                        vs = []
+                        doc.each_indirect_object do |obj|
+                          next unless obj.value[:Type] == :EmbeddedFile
+
+                          vs << Violation.new(
+                            rule_id: "a4deep-3",
+                            message: "PDF/A-4 forbids EmbeddedFile streams",
+                            object: "EmbeddedFile",
+                            severity: :error,
+                            spec_clause: "ISO 19005-4 6.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pdf_ua2_deep.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PDF/UA-2 (ISO 14289-2) deep checks. PDF/UA-2 is rooted in
+    # PDF 2.0 and adds stricter requirements on top of PDF/UA-1:
+    #   * PDF version >= 2.0
+    #   * Structure tree with consistent /RoleMap
+    #   * Heading hierarchy (H1-H6) without skipping levels
+    #   * Every Figure, Formula, Table has /Alt or /ActualText
+    module PdfUA2Deep
+      module_function
+
+      RULESET = RuleSet.new("PDF/UA-2-deep").tap do |rs|
+        rs.register(Rule.new(
+                      id: "ua2-1",
+                      description: "PDF/UA-2 requires PDF 2.0",
+                      severity: :error,
+                      spec_clause: "ISO 14289-2 4.1",
+                      check: ->(doc) {
+                        v = doc.version.to_s
+                        next nil if v >= "2.0"
+
+                        Violation.new(
+                          rule_id: "ua2-1",
+                          message: "PDF/UA-2 requires PDF 2.0 (was #{v})",
+                          object: "Header",
+                          severity: :error,
+                          spec_clause: "ISO 14289-2 4.1"
+                        )
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "ua2-2",
+                      description: "Heading hierarchy must not skip levels",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-2 7.3",
+                      check: ->(doc) {
+                        vs = []
+                        prev_level = 0
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          s = elem[:S]&.to_s
+                          next unless s&.match?(/\AH([1-6])\z/)
+
+                          level = Regexp.last_match(1).to_i
+                          if level > prev_level + 1 && prev_level.positive?
+                            vs << Violation.new(
+                              rule_id: "ua2-2",
+                              message: "Heading H#{level} jumps from H#{prev_level}",
+                              object: "StructElem/#{s}",
+                              severity: :warning,
+                              spec_clause: "ISO 14289-2 7.3"
+                            )
+                          end
+                          prev_level = level
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "ua2-3",
+                      description: "Formula elements require /Alt or /ActualText",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-2 7.9",
+                      check: ->(doc) {
+                        vs = []
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          next unless elem[:S] == :Formula
+                          next if elem[:Alt] || elem[:ActualText]
+
+                          vs << Violation.new(
+                            rule_id: "ua2-3",
+                            message: "Formula without /Alt or /ActualText",
+                            object: "StructElem/Formula",
+                            severity: :warning,
+                            spec_clause: "ISO 14289-2 7.9"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/lib/pdfrb/conformance/pdf_ua_tagging_deep.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+# rubocop:disable Metrics/BlockLength
+module Pdfrb
+  module Conformance
+    # PDF/UA-1 deep tagging checks (ISO 14289-1 §7). Extends the
+    # baseline PDF/UA rule set with structural-tree traversal rules:
+    #   * Every /L (list) must contain /LI children
+    #   * Every /LI must contain /LBody
+    #   * Every /Table must contain /TR rows
+    #   * Every /TH and /TD must have /Scope or headers linkage
+    #   * Every /Figure, /Formula, /Table has /Alt or /ActualText
+    module PdfUATaggingDeep
+      module_function
+
+      RULESET = RuleSet.new("PDF/UA-tagging-deep").tap do |rs|
+        rs.register(Rule.new(
+                      id: "tag-deep-1",
+                      description: "List /L must have /LI children",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-1 7.4",
+                      check: ->(doc) {
+                        vs = []
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          next unless elem[:S] == :L
+
+                          kids = TaggedPdf.structure_kids(elem, doc)
+                          has_li = kids.any? { |k| k[:S] == :LI }
+                          next if has_li
+
+                          vs << Violation.new(
+                            rule_id: "tag-deep-1",
+                            message: "/L without /LI child",
+                            object: "StructElem/L",
+                            severity: :warning,
+                            spec_clause: "ISO 14289-1 7.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "tag-deep-2",
+                      description: "/LI must have /LBody",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-1 7.4",
+                      check: ->(doc) {
+                        vs = []
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          next unless elem[:S] == :LI
+
+                          kids = TaggedPdf.structure_kids(elem, doc)
+                          has_body = kids.any? { |k| k[:S] == :LBody }
+                          next if has_body
+
+                          vs << Violation.new(
+                            rule_id: "tag-deep-2",
+                            message: "/LI without /LBody",
+                            object: "StructElem/LI",
+                            severity: :warning,
+                            spec_clause: "ISO 14289-1 7.4"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "tag-deep-3",
+                      description: "/Table must have /TR rows",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-1 7.5",
+                      check: ->(doc) {
+                        vs = []
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          next unless elem[:S] == :Table
+
+                          kids = TaggedPdf.structure_kids(elem, doc)
+                          has_tr = kids.any? { |k| k[:S] == :TR }
+                          next if has_tr
+
+                          vs << Violation.new(
+                            rule_id: "tag-deep-3",
+                            message: "/Table without /TR child rows",
+                            object: "StructElem/Table",
+                            severity: :warning,
+                            spec_clause: "ISO 14289-1 7.5"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+
+        rs.register(Rule.new(
+                      id: "tag-deep-4",
+                      description: "/TH cells should declare /Scope",
+                      severity: :warning,
+                      spec_clause: "ISO 14289-1 7.5",
+                      check: ->(doc) {
+                        vs = []
+                        TaggedPdf.walk_structure(doc) do |elem|
+                          next unless elem[:S] == :TH
+                          next if elem[:Scope] || elem[:Headers]
+
+                          vs << Violation.new(
+                            rule_id: "tag-deep-4",
+                            message: "/TH without /Scope or /Headers",
+                            object: "StructElem/TH",
+                            severity: :warning,
+                            spec_clause: "ISO 14289-1 7.5"
+                          )
+                        end
+                        vs.empty? ? nil : vs
+                      }
+                    ))
+      end
+
+      def validate(document)
+        RULESET.validate(document)
+      end
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength