pubid 2.0.0.pre.alpha.3 → 2.0.0.pre.alpha.4

data/lib/pubid/plateau/identifiers/technical_report.rb

@@ -10,10 +10,6 @@ module Pubid
         def type_string
           "Technical Report"
         end
-
-        def to_s
-          render(format: :human)
-        end
       end
     end
   end

data/lib/pubid/plateau/supplement_identifier.rb

@@ -19,10 +19,6 @@ module Pubid
         raise NotImplementedError, "Subclasses must implement supplement_string"
       end
 
-      def to_s
-        render(format: :human)
-      end
-
       # Override base_hash to extract edition, type, and annex from base_identifier
       def base_hash
         hash = super

data/lib/pubid/sae/identifier.rb

@@ -1,14 +1,6 @@
 # frozen_string_literal: true
 
-module Pubid
-  module Sae
-    class Identifier
-      def self.parse(input)
-        parsed = Parser.parse(input)
-        Builder.build(parsed)
-      rescue Parslet::ParseFailed => e
-        raise "Failed to parse SAE identifier: #{input}\n#{e.message}"
-      end
-    end
-  end
-end
+# Pubid::Sae::Identifier is the SAE base class (a real Pubid::Identifier
+# subclass); its body, `.parse`, and the Identifiers::Base back-compat alias
+# live in identifiers/base.rb. This file just ensures it is loaded.
+require_relative "identifiers/base"

data/lib/pubid/sae/identifiers/base.rb

@@ -2,27 +2,36 @@
 
 module Pubid
   module Sae
-    module Identifiers
-      # Base SAE Identifier
-      # Handles all SAE document types (AMS, AIR, ARP, AS, MA)
-      class Base < Pubid::Identifier
-        # Generate URN for this identifier
-        #
-        # @return [String] URN representation
+    # Base SAE Identifier. Canonical name Pubid::Sae::Identifier (Identifiers::Base
+    # is a back-compat alias). SAE has a single identifier class that IS the
+    # document type, so this class is both the base and the only concrete type.
+    # Handles all SAE document types (AMS, AIR, ARP, AS, MA).
+    class Identifier < ::Pubid::Identifier
+      def self.parse(input)
+        parsed = Parser.parse(input)
+        Builder.build(parsed)
+      rescue Parslet::ParseFailed => e
+        raise "Failed to parse SAE identifier: #{input}\n#{e.message}"
+      end
 
-        attribute :publisher, :string, default: -> { "SAE" }
-        attribute :type, Sae::Components::Type
-        attribute :number, Sae::Components::Code
-        attribute :date, Sae::Components::Date
+      attribute :publisher, :string, default: -> { "SAE" }
+      attribute :type, Sae::Components::Type
+      attribute :number, Sae::Components::Code
+      attribute :date, Sae::Components::Date
 
-        def self.type
-          { key: :base, web: :standard, title: "Standard", short: "SAE" }
-        end
+      def self.type
+        { key: :base, web: :standard, title: "Standard", short: "SAE" }
+      end
 
-        def year
-          date&.year
-        end
+      def year
+        date&.year
       end
     end
+
+    module Identifiers
+      # Backward-compatible alias: SAE's base class used to be
+      # Pubid::Sae::Identifiers::Base. It is now Pubid::Sae::Identifier.
+      Base = Pubid::Sae::Identifier
+    end
   end
 end

data/lib/pubid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pubid
-  VERSION = "2.0.0.pre.alpha.3"
+  VERSION = "2.0.0.pre.alpha.4"
 end

data/lib/pubid.rb

@@ -10,6 +10,21 @@ require "parslet"
 require "pubid/lutaml/no_store_registration"
 
 module Pubid
+  # Upper bound on the length of an identifier string accepted by any +parse+
+  # entry point. Real-world standards identifiers are well under 200 characters;
+  # this limit exists purely to keep pathological, attacker-controlled inputs
+  # away from the flavors' backtracking-capable normalization regexes
+  # (CodeQL rb/polynomial-redos). The inline `.length` checks in every public
+  # +parse+ method are recognized by CodeQL as a barrier that bounds the input
+  # before it can reach those regexes. Ruby 3.2+ already memoizes the flagged
+  # regexes to linear time, so this guard is defense-in-depth, not a fix for a
+  # live exploit; it must therefore never reject a legitimate identifier.
+  MAX_INPUT_LENGTH = 1000
+
+  # Raised (as an ArgumentError) when an input string exceeds MAX_INPUT_LENGTH.
+  INPUT_TOO_LONG_MESSAGE =
+    "identifier string exceeds maximum length of #{MAX_INPUT_LENGTH} characters"
+
   # Registry for tracking all loaded flavors
   class Registry
     @flavors = {}
@@ -50,7 +65,6 @@ module Pubid
   autoload :Components, "pubid/components"
   autoload :BundledIdentifier, "pubid/bundled_identifier"
   autoload :Identifier, "pubid/identifier"
-  autoload :IdentifierFacade, "pubid/identifier_facade"
   autoload :IdentifierMetadata, "pubid/identifier_metadata"
   autoload :Rendering, "pubid/rendering"
   autoload :Renderers, "pubid/renderers"
@@ -111,6 +125,8 @@ module Pubid
   # @param format [Symbol] :auto, :human, :mr_string, or :urn
   # @return [Identifier] The parsed identifier
   def self.parse(string, format: :auto)
+    raise ArgumentError, INPUT_TOO_LONG_MESSAGE if string.length > MAX_INPUT_LENGTH
+
     format = FormatDetector.detect(string) if format == :auto
 
     case format
@@ -126,7 +142,7 @@ module Pubid
       end
 
       urn_parser = flavor_module.const_get(:UrnParser)
-      urn_parser.parse(string)    else
+      urn_parser.parse(string) else
       # Default to MR string parser for MR format, human-readable otherwise
       # The MR string parser converts to human-readable and delegates to flavor.parse
       raise ArgumentError,

data/lib/tasks/export.rake

@@ -19,17 +19,18 @@ namespace :export do
   desc "Audit library data against website publishers"
   task :audit do
     require "pubid/export"
-    data = Pubid::Export::Exporter.export_all
 
-    # Parse website publishers to extract doc type keys
-    # For now, read the generated JSON and provide a summary
+    # Auditor compares string-keyed, JSON-shaped data (see Auditor.from_file and
+    # auditor_spec.rb), so roundtrip the export through JSON to convert the
+    # symbol keys (:identifier_types) into the string keys it expects.
+    data = JSON.parse(JSON.generate(Pubid::Export::Exporter.export_all))
     auditor = Pubid::Export::Auditor.new(data)
 
     # Build a minimal website representation from the generated data itself
     # (in production, this would parse the website's publishers.ts)
-    {}
     summary = data.transform_values do |fd|
-      { "doc_types" => fd[:identifier_types].map { |t| { "key" => t[:key] } } }
+      keys = fd["identifier_types"].map { |t| { "key" => t["key"] } }
+      { "doc_types" => keys }
     end
 
     results = auditor.audit(summary)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pubid
 version: !ruby/object:Gem::Version
-  version: 2.0.0.pre.alpha.3
+  version: 2.0.0.pre.alpha.4
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-26 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: lutaml-model
@@ -336,7 +336,6 @@ files:
 - lib/pubid/format_detector.rb
 - lib/pubid/format_registry.rb
 - lib/pubid/identifier.rb
-- lib/pubid/identifier_facade.rb
 - lib/pubid/identifier_metadata.rb
 - lib/pubid/idf.rb
 - lib/pubid/idf/builder.rb
@@ -609,9 +608,9 @@ files:
 - lib/pubid/oiml/identifiers.rb
 - lib/pubid/oiml/identifiers/amendment.rb
 - lib/pubid/oiml/identifiers/annex.rb
-- lib/pubid/oiml/identifiers/base.rb
 - lib/pubid/oiml/identifiers/basic_publication.rb
 - lib/pubid/oiml/identifiers/document.rb
+- lib/pubid/oiml/identifiers/errata.rb
 - lib/pubid/oiml/identifiers/expert_report.rb
 - lib/pubid/oiml/identifiers/guide.rb
 - lib/pubid/oiml/identifiers/recommendation.rb

data/lib/pubid/identifier_facade.rb

@@ -1,114 +0,0 @@
-# frozen_string_literal: true
-
-module Pubid
-  # Mixin for the per-flavor `Identifier` *module* facades (NIST, IHO, BSI,
-  # CEN/CENELEC, ASHRAE). The class-pattern flavors (ISO, IEC, JIS, …) expose
-  # their root identifier as a real class, so `id.is_a?(Pubid::Iso::Identifier)`
-  # and `Pubid::Iso::Identifier.from_hash` already work natively. The
-  # module-pattern flavors keep `Identifier` as a thin parse/factory module;
-  # this mixin gives that module the same two capabilities a consumer relies on
-  # when it is handed the module as its identifier class (e.g. relaton-index's
-  # `pubid_class`):
-  #
-  #   * `from_hash` — polymorphic deserialization that dispatches on the
-  #     `_type` discriminator to the correct concrete `Identifiers::*` class,
-  #     reusing the flavor's own `identifier_types` registry rather than a
-  #     hand-maintained map.
-  #   * identity — `extend`ing this mixin into the `Identifier` module is paired
-  #     with `include`-ing that module into the flavor's `Identifiers::Base`, so
-  #     every concrete identifier descends from it. That makes
-  #     `id.is_a?(Pubid::Nist::Identifier)` and `Pubid::Nist::Identifier === id`
-  #     both true (`Module#===` delegates to `is_a?`) — the test a consumer
-  #     holding the module needs to ask "is this one of my identifiers?".
-  #
-  # The flavor namespace, the `Identifiers` namespace, and the fallback `Base`
-  # class are all derived from the extending module's own name by convention
-  # (`Pubid::<Flavor>::Identifier`), so a flavor opts in with a single
-  # `extend Pubid::IdentifierFacade`.
-  #
-  # Opt-in is deliberately GATED to flavors whose `to_hash`/`from_hash`
-  # round-trips cleanly. Some module-pattern flavors (AMCA, ITU, PLATEAU, IEEE)
-  # have a broken `to_hash` (publisher stored as a String) or a lossy
-  # `from_hash`; for those the facade's identity check would route ids through a
-  # consumer's `to_hash` and crash or silently corrupt them, so they
-  # intentionally do not opt in (see the NOTE in each of their identifier.rb).
-  module IdentifierFacade
-    # Reconstruct a concrete identifier from its serialized key_value hash by
-    # dispatching on the `_type` discriminator. Falls back to the flavor's
-    # `Identifiers::Base` for an absent/unknown type, matching lutaml's own
-    # non-polymorphic default.
-    #
-    # @param data [Hash] the serialized identifier hash (string or symbol keys)
-    # @return [Pubid::Identifier] the concrete identifier instance
-    def from_hash(data, options = {})
-      type = data && (data["_type"] || data[:_type])
-      klass = polymorphic_type_map[type] || identifier_base_class
-      klass.from_hash(data, options)
-    end
-
-    # Map of polymorphic_name ("pubid:nist:interagency-report") => concrete
-    # class, built once from the flavor's identifier-type registry so it tracks
-    # newly registered types automatically.
-    # @return [Hash{String => Class}]
-    def polymorphic_type_map
-      @polymorphic_type_map ||=
-        (identifier_registry_classes + [identifier_base_class]).uniq
-          .each_with_object({}) do |klass, map|
-            poly_name = klass.polymorphic_name
-            map[poly_name] = klass if poly_name
-          end
-    end
-
-    private
-
-    # The flavor module that namespaces this facade, e.g. Pubid::Nist for
-    # Pubid::Nist::Identifier.
-    def facade_flavor_module
-      @facade_flavor_module ||=
-        Object.const_get(name.split("::")[0...-1].join("::"))
-    end
-
-    def facade_identifiers_namespace
-      @facade_identifiers_namespace ||=
-        facade_flavor_module.const_get(:Identifiers)
-    end
-
-    # Fallback class for an absent/unknown `_type`. Most flavors expose a
-    # concrete `Identifiers::Base`; flavors without one (e.g. BSI, whose common
-    # ancestor is SingleIdentifier) fall back to the shared root, which is only
-    # ever reached for an unrecognized `_type`.
-    def identifier_base_class
-      if facade_identifiers_namespace.const_defined?(:Base, false)
-        facade_identifiers_namespace.const_get(:Base)
-      else
-        ::Pubid::Identifier
-      end
-    end
-
-    # Every concrete identifier class whose `_type` may appear in a serialized
-    # hash. Scans the `Identifiers` namespace for descendants of
-    # Pubid::Identifier (the complete set, independent of whatever filtering the
-    # flavor's `identifier_types` applies) and unions in `identifier_types`,
-    # which may register classes living outside that namespace.
-    def identifier_registry_classes
-      (scanned_identifier_classes + registered_identifier_classes).uniq
-    end
-
-    # Concrete identifier classes found directly in the `Identifiers` namespace.
-    def scanned_identifier_classes
-      facade_identifiers_namespace.constants.filter_map do |const|
-        klass = facade_identifiers_namespace.const_get(const)
-        klass if klass.is_a?(Class) && klass < ::Pubid::Identifier
-      rescue NameError
-        nil
-      end
-    end
-
-    # Classes the flavor explicitly registers via `identifier_types`, if any.
-    def registered_identifier_classes
-      return [] unless facade_flavor_module.respond_to?(:identifier_types)
-
-      Array(facade_flavor_module.identifier_types)
-    end
-  end
-end

data/lib/pubid/oiml/identifiers/base.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Pubid
-  module Oiml
-    module Identifiers
-      class Base < Pubid::Identifier
-        attribute :publisher, :string
-        attribute :type, :string
-        attribute :code, Oiml::Components::Code
-        attribute :date, Pubid::Components::Date
-        attribute :stage, :string
-        attribute :iteration, :string
-        attribute :language, :string
-
-        def to_s(**opts)
-          render(format: :human, **opts)
-        end
-      end
-    end
-  end
-end