fix(schema): reject local-use attributes on top-level group and attributeGroup definitions

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- A top-level group or attributeGroup definition may no longer carry local-use attributes (XSD 1.0 Structures §3.6.1 / §3.6.2). A global group definition (including one defined inside `xs:redefine`) must only have name and id attributes, and local-use attributes like `ref`, `minOccurs`, or `maxOccurs` are rejected; a global attributeGroup definition may not carry a `ref` attribute. XSTS: invalid schemas accepted 354 to 350, no other bucket raised.
 - Support attribute inheritance and prohibition in complexContent restriction derivations (XSD 1.0 Structures §3.4.6 / Schema Component Constraint: Derivation Valid (Restriction, Complex)). When a complexType restricts a base type, the restricted type inherits all base attributes that are not explicitly overridden or prohibited by the restriction. A prohibited attribute is excluded from the final type's attributes, preventing its use in instance validation. Resolves referenced attributes namespace-aware using prefix bindings. XSTS: valid instances rejected 180 to 171, invalid instances accepted 158 to 155, no other bucket raised.
 - A complexContent restriction must keep a base attribute's required use and its fixed value constraint (XSD 1.0 `cos-ct-derived-ok` / `derivation-ok-restriction.2` / `derivation-ok-restriction.4`). A restriction redeclaring a base `required` attribute may not make it optional or prohibited, and if a base attribute use has a `fixed` value constraint, the restriction must also make it `fixed` with the same value. The fixed values are compared in the attribute type's value space (supporting lists and unions) to avoid over-rejecting valid schemas. A prohibited attribute is removed, so the fixed clause does not apply to it. XSTS: invalid schemas accepted 390 to 387, no other bucket raised.
 - Enforce top-level declaration naming, block xs:anySimpleType derivation, and restrict simpleType facets. Top-level definitions must specify a `name` attribute. Derivation by restriction or extension of `xs:anySimpleType` is disallowed. Restriction facets (`length`, `minLength`, `maxLength`, `totalDigits`, `fractionDigits`) must be tighter than or equal to the base type's facets. XSTS: invalid schemas accepted 387 to 383, no other bucket raised.

Sources/Schema/SchemaAttributeApplicability.swift

@@ -113,6 +113,8 @@ extension PureXML.Schema.XSDParser {
     private static let topLevelForbidden: [String: [String]] = [
         "attribute": ["use", "form", "ref"],
         "element": ["ref", "form", "minOccurs", "maxOccurs"],
+        "group": ["ref", "minOccurs", "maxOccurs"],
+        "attributeGroup": ["ref"],
     ]
 
     private static let namedTopLevelKinds: Set<String> = [

Tests/SchemaTopLevelAttributeGroupTests.swift

@@ -0,0 +1,31 @@
+@testable import PureXML
+import Testing
+
+@Suite("XSD top-level attributeGroup applicability (topLevelAttributeGroup)")
+struct SchemaTopLevelAttributeGroupTests {
+    private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
+
+    private func compiles(_ body: String) -> Bool {
+        (try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
+    }
+
+    @Test("A top-level attributeGroup with ref is rejected")
+    func test_topLevelForbiddenRejected() {
+        #expect(!compiles("<xs:attributeGroup ref=\"g\"/>"))
+    }
+
+    @Test("A plain top-level attributeGroup declaration compiles")
+    func test_plainTopLevelAccepted() {
+        #expect(compiles("<xs:attributeGroup name=\"g\"><xs:attribute name=\"a\" type=\"xs:string\"/></xs:attributeGroup>"))
+    }
+
+    @Test("A local attributeGroup reference compiles")
+    func test_localRefAccepted() {
+        #expect(compiles(
+            "<xs:attributeGroup name=\"g\"><xs:attribute name=\"a\" type=\"xs:string\"/></xs:attributeGroup>"
+                + "<xs:element name=\"e\"><xs:complexType>"
+                + "<xs:attributeGroup ref=\"g\"/>"
+                + "</xs:complexType></xs:element>",
+        ))
+    }
+}

Tests/SchemaTopLevelGroupTests.swift

@@ -0,0 +1,48 @@
+@testable import PureXML
+import Testing
+
+@Suite("XSD top-level group applicability (topLevelGroup)")
+struct SchemaTopLevelGroupTests {
+    private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
+
+    private func compiles(_ body: String) -> Bool {
+        (try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
+    }
+
+    @Test("A top-level group with ref/minOccurs/maxOccurs is rejected")
+    func test_topLevelForbiddenRejected() {
+        #expect(!compiles("<xs:group ref=\"g\"/>"))
+        #expect(!compiles("<xs:group name=\"g\" minOccurs=\"1\"><xs:sequence><xs:element name=\"a\" type=\"xs:string\"/></xs:sequence></xs:group>"))
+        #expect(!compiles("<xs:group name=\"g\" maxOccurs=\"5\"><xs:sequence><xs:element name=\"a\" type=\"xs:string\"/></xs:sequence></xs:group>"))
+    }
+
+    @Test("A top-level group in redefine with minOccurs/maxOccurs is rejected")
+    func test_redefineForbiddenRejected() {
+        let baseRed = "<xs:group name=\"X\"><xs:sequence><xs:element name=\"a\"/></xs:sequence></xs:group>"
+        let loader: (String) -> String? = { $0 == "base.xsd" ? "<xs:schema \(xsd)>\(baseRed)</xs:schema>" : nil }
+
+        let redefineMin = """
+        <xs:redefine schemaLocation="base.xsd">
+          <xs:group name="X" minOccurs="1">
+            <xs:sequence><xs:group ref="X"/><xs:element name="b"/></xs:sequence>
+          </xs:group>
+        </xs:redefine>
+        """
+        #expect((try? PureXML.Schema.Document("<xs:schema \(xsd)>\(redefineMin)</xs:schema>", schemaLoader: loader)) == nil)
+    }
+
+    @Test("A plain top-level group declaration compiles")
+    func test_plainTopLevelAccepted() {
+        #expect(compiles("<xs:group name=\"g\"><xs:sequence><xs:element name=\"a\" type=\"xs:string\"/></xs:sequence></xs:group>"))
+    }
+
+    @Test("A local group ref with occurrence compiles")
+    func test_localParticleAccepted() {
+        #expect(compiles(
+            "<xs:group name=\"g\"><xs:sequence><xs:element name=\"a\" type=\"xs:string\"/></xs:sequence></xs:group>"
+                + "<xs:element name=\"e\"><xs:complexType><xs:sequence>"
+                + "<xs:group ref=\"g\" minOccurs=\"0\" maxOccurs=\"3\"/>"
+                + "</xs:sequence></xs:complexType></xs:element>",
+        ))
+    }
+}

Tests/XSTSSuiteTests.swift

@@ -29,7 +29,7 @@ struct XSTSSuiteTests {
     /// XSTS` (debug is far slower and the corpus is large). Per-case deviations
     /// are written to /tmp/xsts-failures.txt for the burn-down.
     private let knownSchemaValidRejected = 1
-    private let knownSchemaInvalidAccepted = 354
+    private let knownSchemaInvalidAccepted = 350
     private let knownInstanceValidRejected = 171
     private let knownInstanceInvalidAccepted = 155
 

docs/schema-validity-burndown.md

@@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
 | Bucket | Count | Reading |
 |---|---|---|
 | valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
-| **invalid-schemas-accepted** | **2461 -> 354** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion, elementTypeRestrictionOK NameAndTypeOK union checks, prohibited attribute type-check bypass, keyref arity verification landed). |
+| **invalid-schemas-accepted** | **2461 -> 350** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion, elementTypeRestrictionOK NameAndTypeOK union checks, prohibited attribute type-check bypass, keyref arity verification, top-level group/attributeGroup local-attribute checks landed). |
 | valid-instances-rejected | **233 -> 171** | (instance side; #164's element-ref namespace fix is shared with instance validation, complexContent restriction attributes inheritance and namespace fixes) |
 | invalid-instances-accepted | **160 -> 155** | (instance side; resolving inline `<simpleType>` restriction base, complexContent restriction attributes prohibition) |