@beyondwork/docx-react-component 1.0.41 → 1.0.43

package/src/io/ooxml/bw-xml.ts

@@ -0,0 +1,244 @@
+/**
+ * Minimal XML helpers shared by the `bw:` round-trip builders +
+ * parsers. Intentionally not a general-purpose parser — only covers
+ * the shapes the bw schema uses: elements with attributes, text +
+ * CDATA content, no processing instructions, no mixed namespaces.
+ *
+ * The canonicalizer in `canonicalize-payload.ts` has its own inline
+ * parser because its contract is stricter (attribute sort, sort-key
+ * tables). These helpers are for conventional build/parse work where
+ * we just need the tree.
+ */
+
+export interface BwElement {
+  kind: "element";
+  name: string;
+  attributes: Record<string, string>;
+  children: BwNode[];
+}
+
+export interface BwText {
+  kind: "text";
+  text: string;
+}
+
+export type BwNode = BwElement | BwText;
+
+export function parseBwXml(src: string): BwElement {
+  let i = 0;
+  skipPrologAndWs();
+  const root = readElement();
+  if (!root) throw new Error("bw-xml: no root element");
+  return root;
+
+  function skipPrologAndWs(): void {
+    while (i < src.length) {
+      if (src.startsWith("<?", i)) {
+        const end = src.indexOf("?>", i);
+        if (end < 0) throw new Error("bw-xml: unterminated prolog");
+        i = end + 2;
+        continue;
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+  }
+
+  function readElement(): BwElement | null {
+    while (i < src.length) {
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+    if (src[i] !== "<") return null;
+    if (src.startsWith("</", i)) return null;
+    i += 1;
+
+    const nameStart = i;
+    while (i < src.length && !/[\s/>]/.test(src[i]!)) i += 1;
+    const name = src.slice(nameStart, i);
+
+    const attrs: Record<string, string> = {};
+    while (i < src.length) {
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] === "/" || src[i] === ">") break;
+      const aStart = i;
+      while (i < src.length && src[i] !== "=" && !/\s/.test(src[i]!)) i += 1;
+      const aName = src.slice(aStart, i);
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] !== "=") {
+        attrs[aName] = "";
+        continue;
+      }
+      i += 1;
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      const quote = src[i];
+      if (quote !== '"' && quote !== "'") {
+        throw new Error(`bw-xml: unquoted attr at ${i}`);
+      }
+      i += 1;
+      const vStart = i;
+      while (i < src.length && src[i] !== quote) i += 1;
+      attrs[aName] = xmlDecode(src.slice(vStart, i));
+      i += 1;
+    }
+
+    if (src[i] === "/") {
+      i += 1;
+      if (src[i] !== ">") throw new Error("bw-xml: bad self-close");
+      i += 1;
+      return { kind: "element", name, attributes: attrs, children: [] };
+    }
+    if (src[i] !== ">") throw new Error("bw-xml: expected >");
+    i += 1;
+
+    const children: BwNode[] = [];
+    while (i < src.length) {
+      if (src.startsWith("</", i)) {
+        i += 2;
+        const endStart = i;
+        while (i < src.length && src[i] !== ">") i += 1;
+        const endName = src.slice(endStart, i).trim();
+        if (endName !== name) {
+          throw new Error(
+            `bw-xml: mismatched close: opened <${name}> got </${endName}>`,
+          );
+        }
+        i += 1;
+        return { kind: "element", name, attributes: attrs, children };
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("bw-xml: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (src.startsWith("<![CDATA[", i)) {
+        const end = src.indexOf("]]>", i);
+        if (end < 0) throw new Error("bw-xml: unterminated CDATA");
+        children.push({ kind: "text", text: src.slice(i + 9, end) });
+        i = end + 3;
+        continue;
+      }
+      if (src[i] === "<") {
+        const child = readElement();
+        if (child) children.push(child);
+        continue;
+      }
+      const textStart = i;
+      while (i < src.length && src[i] !== "<") i += 1;
+      const raw = src.slice(textStart, i);
+      if (raw.length > 0) {
+        children.push({ kind: "text", text: xmlDecode(raw) });
+      }
+    }
+    throw new Error(`bw-xml: unterminated <${name}>`);
+  }
+}
+
+// ----- build helpers --------------------------------------------------------
+
+export function renderElement(
+  name: string,
+  attrs: Record<string, string | undefined>,
+  children: readonly string[] = [],
+): string {
+  const pairs: string[] = [];
+  for (const [k, v] of Object.entries(attrs)) {
+    if (v === undefined || v === "") continue;
+    pairs.push(`${k}="${xmlEncode(v)}"`);
+  }
+  const head = pairs.length ? `${name} ${pairs.join(" ")}` : name;
+  const body = children.filter((c) => c.length > 0).join("");
+  if (body.length === 0) return `<${head}/>`;
+  return `<${head}>${body}</${name}>`;
+}
+
+export function renderText(text: string): string {
+  return xmlEncode(text);
+}
+
+export function renderCdata(text: string): string {
+  const safe = text.replace(/\]\]>/g, "]]]]><![CDATA[>");
+  return `<![CDATA[${safe}]]>`;
+}
+
+// ----- element traversal helpers -------------------------------------------
+
+export function childrenOf(el: BwElement, localName: string): BwElement[] {
+  const out: BwElement[] = [];
+  for (const child of el.children) {
+    if (child.kind === "element" && stripNs(child.name) === localName) {
+      out.push(child);
+    }
+  }
+  return out;
+}
+
+export function firstChild(
+  el: BwElement,
+  localName: string,
+): BwElement | undefined {
+  for (const child of el.children) {
+    if (child.kind === "element" && stripNs(child.name) === localName) {
+      return child;
+    }
+  }
+  return undefined;
+}
+
+export function textOf(el: BwElement): string {
+  return el.children
+    .map((c) => (c.kind === "text" ? c.text : ""))
+    .join("");
+}
+
+export function stripNs(qname: string): string {
+  const colon = qname.indexOf(":");
+  return colon < 0 ? qname : qname.slice(colon + 1);
+}
+
+export function attrNumber(
+  value: string | undefined,
+): number | undefined {
+  if (value === undefined || value === "") return undefined;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+// ----- encoding -------------------------------------------------------------
+
+export function xmlEncode(text: string): string {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+export function xmlDecode(text: string): string {
+  return text
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, "&");
+}

package/src/io/ooxml/canonicalize-payload.ts

@@ -0,0 +1,301 @@
+/**
+ * Canonical serialization of the `bw:workflowPayload` used as the signing
+ * surface for `bw:signature`. Called `bw-canon/1`.
+ *
+ * Rules (see bw-collab-schema-additions.md §bw:signature):
+ *   1. Remove any top-level `bw:signature` element from the tree before
+ *      serializing.
+ *   2. Sort attributes lexicographically by qualified name.
+ *   3. Normalize attribute-value whitespace: collapse runs of `\s` to a
+ *      single space, then trim.
+ *   4. Sort children of order-insensitive parents by a keyed tuple
+ *      (see `SORT_KEYED_CHILDREN`). Children of any parent not listed
+ *      retain document order.
+ *   5. Collapse empty elements to self-closing form.
+ *   6. Emit UTF-8 bytes, LF line endings (none in practice — output is
+ *      single-line), no XML declaration, no BOM.
+ *
+ * This canonicalizer is intentionally minimal — it parses only the
+ * element / attribute / text / CDATA subset the bw schema uses. It does
+ * NOT implement C14N; the contract is self-consistent (writer and
+ * reader use this same routine) and self-referential (the signature
+ * element is excluded from its own input).
+ */
+export function canonicalizePayload(xml: string): Uint8Array {
+  const tree = parseXml(xml);
+  const filtered = stripSignature(tree);
+  const out = serialize(filtered);
+  return new TextEncoder().encode(out);
+}
+
+// ----- AST ------------------------------------------------------------------
+
+export interface XmlElement {
+  kind: "element";
+  name: string;
+  attributes: Record<string, string>;
+  children: XmlNode[];
+}
+
+interface XmlText {
+  kind: "text";
+  text: string;
+}
+
+type XmlNode = XmlElement | XmlText;
+
+// ----- Parse ----------------------------------------------------------------
+
+function parseXml(src: string): XmlElement {
+  let i = 0;
+  skipProlog();
+
+  const root = readElement();
+  if (!root) throw new Error("canonicalize: no root element");
+  return root;
+
+  function skipProlog(): void {
+    while (i < src.length) {
+      if (src.startsWith("<?", i)) {
+        const end = src.indexOf("?>", i);
+        if (end < 0) throw new Error("canonicalize: unterminated prolog");
+        i = end + 2;
+        continue;
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("canonicalize: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+  }
+
+  function readElement(): XmlElement | null {
+    // Skip whitespace + comments between siblings.
+    while (i < src.length) {
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("canonicalize: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (/\s/.test(src[i]!)) {
+        i += 1;
+        continue;
+      }
+      break;
+    }
+    if (src[i] !== "<") return null;
+    if (src.startsWith("</", i)) return null;
+    i += 1;
+
+    const nameStart = i;
+    while (i < src.length && !/[\s/>]/.test(src[i]!)) i += 1;
+    const name = src.slice(nameStart, i);
+
+    const attrs: Record<string, string> = {};
+    while (i < src.length) {
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] === "/" || src[i] === ">") break;
+      const aNameStart = i;
+      while (i < src.length && src[i] !== "=" && !/\s/.test(src[i]!)) i += 1;
+      const attrName = src.slice(aNameStart, i);
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      if (src[i] !== "=") {
+        attrs[attrName] = "";
+        continue;
+      }
+      i += 1;
+      while (i < src.length && /\s/.test(src[i]!)) i += 1;
+      const quote = src[i];
+      if (quote !== '"' && quote !== "'") {
+        throw new Error(`canonicalize: unquoted attr at ${i}`);
+      }
+      i += 1;
+      const vStart = i;
+      while (i < src.length && src[i] !== quote) i += 1;
+      attrs[attrName] = xmlDecode(src.slice(vStart, i));
+      i += 1;
+    }
+
+    if (src[i] === "/") {
+      i += 1;
+      if (src[i] !== ">") throw new Error("canonicalize: bad self-close");
+      i += 1;
+      return { kind: "element", name, attributes: attrs, children: [] };
+    }
+    if (src[i] !== ">") throw new Error("canonicalize: expected >");
+    i += 1;
+
+    const children: XmlNode[] = [];
+    while (i < src.length) {
+      if (src.startsWith("</", i)) {
+        i += 2;
+        const endNameStart = i;
+        while (i < src.length && src[i] !== ">") i += 1;
+        const endName = src.slice(endNameStart, i).trim();
+        if (endName !== name) {
+          throw new Error(
+            `canonicalize: mismatched close: opened <${name}> got </${endName}>`,
+          );
+        }
+        i += 1;
+        return { kind: "element", name, attributes: attrs, children };
+      }
+      if (src.startsWith("<!--", i)) {
+        const end = src.indexOf("-->", i);
+        if (end < 0) throw new Error("canonicalize: unterminated comment");
+        i = end + 3;
+        continue;
+      }
+      if (src.startsWith("<![CDATA[", i)) {
+        const end = src.indexOf("]]>", i);
+        if (end < 0) throw new Error("canonicalize: unterminated CDATA");
+        children.push({ kind: "text", text: src.slice(i + 9, end) });
+        i = end + 3;
+        continue;
+      }
+      if (src[i] === "<") {
+        const child = readElement();
+        if (child) children.push(child);
+        continue;
+      }
+      const textStart = i;
+      while (i < src.length && src[i] !== "<") i += 1;
+      const raw = src.slice(textStart, i);
+      if (raw.length > 0) {
+        children.push({ kind: "text", text: xmlDecode(raw) });
+      }
+    }
+    throw new Error(`canonicalize: unterminated <${name}>`);
+  }
+}
+
+// ----- Transform ------------------------------------------------------------
+
+function stripSignature(el: XmlElement): XmlElement {
+  return {
+    ...el,
+    children: el.children.filter(
+      (c) => !(c.kind === "element" && localName(c.name) === "signature"),
+    ),
+  };
+}
+
+const SORT_KEYED_CHILDREN: Record<string, (el: XmlElement) => string> = {
+  participants: (el) => el.attributes["userId"] ?? "",
+  votes: (el) => el.attributes["authorId"] ?? "",
+  requiredApprovers: (el) => el.attributes["id"] ?? "",
+  reactions: (el) =>
+    `${el.attributes["emoji"] ?? ""}\u0000${el.attributes["authorId"] ?? ""}`,
+  mentions: (el) =>
+    `${el.attributes["entryId"] ?? ""}\u0000${el.attributes["offsetInBody"] ?? ""}`,
+  counterProposals: (el) => el.attributes["id"] ?? "",
+  strippedComments: (el) => el.attributes["commentId"] ?? "",
+  strippedParticipants: (el) => el.attributes["id"] ?? "",
+};
+
+const CONTAINER_WITH_SORTED_ELEMENTS: Record<string, true> = {
+  commentNegotiation: true, // children keyed by commentId
+  commentPresentation: true, // children keyed by commentId
+  attachments: true, // children keyed by id
+};
+
+const CONTAINER_CHILD_KEY: Record<string, (el: XmlElement) => string> = {
+  commentNegotiation: (el) => el.attributes["commentId"] ?? "",
+  commentPresentation: (el) => el.attributes["commentId"] ?? "",
+  attachments: (el) => el.attributes["id"] ?? "",
+};
+
+function sortChildren(el: XmlElement): XmlElement {
+  const parentLocal = localName(el.name);
+  const keyFn =
+    SORT_KEYED_CHILDREN[parentLocal] ??
+    (CONTAINER_WITH_SORTED_ELEMENTS[parentLocal]
+      ? CONTAINER_CHILD_KEY[parentLocal]
+      : undefined);
+
+  const recursed = el.children.map((child) =>
+    child.kind === "element" ? sortChildren(child) : child,
+  );
+
+  if (!keyFn) {
+    return { ...el, children: recursed };
+  }
+
+  const elements = recursed.filter(
+    (c): c is XmlElement => c.kind === "element",
+  );
+  const others = recursed.filter((c) => c.kind !== "element");
+  const sorted = [...elements].sort((a, b) => {
+    const ka = keyFn(a);
+    const kb = keyFn(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+  return { ...el, children: [...others, ...sorted] };
+}
+
+// ----- Serialize ------------------------------------------------------------
+
+function serialize(el: XmlElement): string {
+  const tree = sortChildren(el);
+  return emit(tree);
+}
+
+function emit(node: XmlNode): string {
+  if (node.kind === "text") return xmlEncode(node.text);
+  const attrPairs = Object.entries(node.attributes)
+    .map(([k, v]) => [k, normalizeWhitespace(v)] as const)
+    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+  const attrStr = attrPairs
+    .map(([k, v]) => ` ${k}="${xmlEncode(v)}"`)
+    .join("");
+
+  const content = node.children
+    .map(emit)
+    .filter((s) => s.length > 0 || preservesSpace())
+    .join("");
+  if (content.length === 0) {
+    return `<${node.name}${attrStr}/>`;
+  }
+  return `<${node.name}${attrStr}>${content}</${node.name}>`;
+}
+
+function preservesSpace(): boolean {
+  return false;
+}
+
+// ----- Helpers --------------------------------------------------------------
+
+function localName(qname: string): string {
+  const colon = qname.indexOf(":");
+  return colon < 0 ? qname : qname.slice(colon + 1);
+}
+
+function normalizeWhitespace(value: string): string {
+  return value.replace(/\s+/g, " ").trim();
+}
+
+function xmlEncode(text: string): string {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+function xmlDecode(text: string): string {
+  return text
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, "&");
+}