@adeu/core 1.9.0 → 1.10.1

package/src/sanitize/core.ts

@@ -44,6 +44,7 @@ export async function finalize_document(doc: DocumentObject, options: FinalizeOp
     const commentsSummary = transforms.get_comments_summary(doc);
     report.comments_removed = commentsSummary.total;
     report.add_transform_lines(transforms.remove_all_comments(doc));
+    transforms.eject_comment_parts(doc);
   } else if (options.sanitize_mode === 'keep-markup') {
     // Basic support for keep-markup in TS
     const counts = transforms.count_tracked_changes(doc);

package/src/sanitize/sanitize.test.ts

@@ -1,9 +1,15 @@
 import { describe, it, expect, vi } from "vitest";
 import { DOMParser } from "@xmldom/xmldom";
+import { readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { DocumentObject, Part, DocxPackage } from "../docx/bridge.js";
 import * as transforms from "./transforms.js";
 import { finalize_document } from "./core.js";
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
 // --- Helper to build a lightweight in-memory DocumentObject ---
 function createMockDoc(bodyXml: string): DocumentObject {
   const fullXml = `<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml"><w:body>${bodyXml}</w:body></w:document>`;
@@ -14,7 +20,7 @@ function createMockDoc(bodyXml: string): DocumentObject {
   const part = new Part(
     "/word/document.xml",
     fullXml,
-    doc.documentElement,
+    doc.documentElement! as unknown as Element,
     "application/xml",
   );
   pkg.parts.push(part);
@@ -87,11 +93,11 @@ describe("Sanitize Transforms", () => {
     const appEl = new DOMParser().parseFromString(
       appXml,
       "text/xml",
-    ).documentElement;
+    ).documentElement!;
     const appPart = new Part(
       "/docProps/app.xml",
       appXml,
-      appEl,
+      appEl as unknown as Element,
       "application/xml",
     );
     doc.pkg.parts.push(appPart);
@@ -118,7 +124,7 @@ describe("Sanitize Transforms", () => {
     const customPart = new Part(
       "/customXml/item1.xml",
       "<t/>",
-      new DOMParser().parseFromString("<t/>", "text/xml").documentElement,
+      new DOMParser().parseFromString("<t/>", "text/xml").documentElement! as unknown as Element,
       "application/xml",
     );
     doc.pkg.parts.push(customPart);
@@ -170,11 +176,11 @@ describe("Finalize Document (Core)", () => {
     const settingsEl = new DOMParser().parseFromString(
       settingsXml,
       "text/xml",
-    ).documentElement;
+    ).documentElement!;
     const settingsPart = new Part(
       "/word/settings.xml",
       settingsXml,
-      settingsEl,
+      settingsEl as unknown as Element,
       "application/xml",
     );
     doc.pkg.parts.push(settingsPart);
@@ -263,5 +269,41 @@ describe("Finalize Document (Core)", () => {
       const xml = doc.part._element.toString();
       expect(xml).not.toContain("xmlns:w16du");
     });
+
+    it("BUG-REPRO: finalize_document leaks comment parts in full sanitize mode", async () => {
+      // 1. Load the golden DOCX which we know has comments and comment parts
+      const fixturePath = resolve(__dirname, "../../../../../shared/fixtures/golden.docx");
+      const buf = readFileSync(fixturePath);
+      const doc = await DocumentObject.load(buf);
+
+      // Verify pre-condition: comment parts exist in the loaded package
+      const original_comment_parts = doc.pkg.parts.filter(p => p.contentType.includes("comments"));
+      expect(original_comment_parts.length).toBeGreaterThan(0);
+
+      const original_xml = doc.element.toString();
+      expect(original_xml).toContain("w:commentRangeStart");
+      expect(original_xml).toContain("w:commentReference");
+
+      // Mock the doc.save buffer return
+      doc.save = vi.fn().mockResolvedValue(Buffer.from("mock"));
+
+      // 2. Act: Finalize the document in full sanitize mode with accept_all: true
+      await finalize_document(doc, {
+        filename: "golden.docx",
+        sanitize_mode: "full",
+        accept_all: true,
+      });
+
+      // 3. Assert: All comments and comment parts are completely removed
+      const final_xml = doc.element.toString();
+      
+      // Assert NO in-body comment anchors survive (anchors must be completely gone)
+      expect(final_xml).not.toContain("w:commentRangeStart");
+      expect(final_xml).not.toContain("w:commentRangeEnd");
+      expect(final_xml).not.toContain("w:commentReference");
+
+      const final_comment_parts = doc.pkg.parts.filter(p => p.contentType.includes("comments"));
+      expect(final_comment_parts.length).toBe(0);
+    });
   });
 });

package/src/sanitize/transforms.ts

@@ -271,17 +271,104 @@ export function remove_all_comments(doc: DocumentObject): string[] {
     cm.deleteComment(cId);
   }
 
-  for (const tag of ['w:commentRangeStart', 'w:commentRangeEnd', 'w:commentReference']) {
+  for (const tag of ['w:commentRangeStart', 'w:commentRangeEnd']) {
     for (const el of findAllDescendants(doc.element, tag)) {
       el.parentNode?.removeChild(el);
     }
   }
 
+  const refs = findAllDescendants(doc.element, 'w:commentReference');
+  for (const ref of refs) {
+    const parent = ref.parentNode as Element | null;
+    if (parent) {
+      if (parent.tagName === 'w:r' || parent.tagName.endsWith(':r')) {
+        const nonRprChildren = Array.from(parent.childNodes).filter(
+          (c) => c.nodeType === 1 && (c as Element).tagName !== 'w:rPr' && (c as Element).tagName !== 'rPr'
+        );
+        if (nonRprChildren.length <= 1) {
+          parent.parentNode?.removeChild(parent);
+        } else {
+          parent.removeChild(ref);
+        }
+      } else {
+        parent.removeChild(ref);
+      }
+    }
+  }
+
   const resolvedCount = Object.values(data).filter(c => c.resolved).length;
   const openCount = Object.values(data).filter(c => !c.resolved).length;
   return [`Comments removed: ${keys.length} (${resolvedCount} resolved, ${openCount} open)`].concat(lines);
 }
 
+export function eject_comment_parts(doc: DocumentObject) {
+  const pkg = doc.pkg;
+  
+  // 1. Find all comment-related partnames
+  const comment_partnames = new Set<string>();
+  for (const part of pkg.parts) {
+    if (part.partname.toLowerCase().includes("comments")) {
+      comment_partnames.add(part.partname);
+      const withSlash = part.partname.startsWith("/") ? part.partname : "/" + part.partname;
+      const withoutSlash = part.partname.startsWith("/") ? part.partname.substring(1) : part.partname;
+      comment_partnames.add(withSlash);
+      comment_partnames.add(withoutSlash);
+    }
+  }
+
+  if (comment_partnames.size === 0) return;
+
+  // 2. Sever relationships referencing these parts from all parts in the package
+  for (const part of pkg.parts) {
+    if (part.partname.endsWith(".rels")) {
+      const rels = findAllDescendants(part._element, "Relationship");
+      const toRemove: Element[] = [];
+      for (const rel of rels) {
+        const target = rel.getAttribute("Target") || "";
+        if (target.toLowerCase().includes("comments")) {
+          toRemove.push(rel);
+          
+          const sourcePath = part.partname.replace("/_rels/", "/").replace(".rels", "");
+          const sourcePart = pkg.getPartByPath(sourcePath);
+          if (sourcePart) {
+            const relId = rel.getAttribute("Id");
+            if (relId) sourcePart.rels.delete(relId);
+          }
+        }
+      }
+      for (const relEl of toRemove) {
+        relEl.parentNode?.removeChild(relEl);
+      }
+    }
+  }
+
+  // 3. Remove overrides from [Content_Types].xml
+  const ctPart = pkg.getPartByPath("[Content_Types].xml");
+  if (ctPart) {
+    const overrides = findAllDescendants(ctPart._element, "Override");
+    const toRemove: Element[] = [];
+    for (const override of overrides) {
+      const partName = override.getAttribute("PartName") || "";
+      if (comment_partnames.has(partName) || partName.toLowerCase().includes("comments")) {
+        toRemove.push(override);
+      }
+    }
+    for (const overrideEl of toRemove) {
+      overrideEl.parentNode?.removeChild(overrideEl);
+    }
+  }
+
+  // 4. Remove comment parts from pkg.parts
+  pkg.parts = pkg.parts.filter(p => !p.partname.toLowerCase().includes("comments"));
+
+  // 5. Remove comment files from pkg.unzipped as well
+  for (const key of Object.keys(pkg.unzipped)) {
+    if (key.toLowerCase().includes("comments")) {
+      delete pkg.unzipped[key];
+    }
+  }
+}
+
 export function replace_comment_authors(doc: DocumentObject, newAuthor: string): string[] {
   const cm = new CommentsManager(doc);
   if (!cm.commentsPart) return [];