feat(schema): a nested simpleType or attributeGroup may not be named (localSimpleType)

A simpleType nested inside a restriction/list/union/element/attribute is the
anonymous localSimpleType (no name), and a nested attributeGroup is always a
reference; named simpleType and attributeGroup definitions are top-level only (a
direct child of schema or redefine). A nested definition declaring a name was
accepted; it is now rejected. A nested anonymous simpleType, an attributeGroup
reference, and a top-level named definition are unaffected.

XSTS: invalid schemas accepted 403 to 394, no other bucket raised.

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- A nested `simpleType` or `attributeGroup` may no longer declare a `name` (XSD 1.0 schema-for-schemas `localSimpleType` / nested `attributeGroup`, #170). A `simpleType` inside a `restriction`/`list`/`union`/`element`/`attribute` is anonymous (the local form carries no `name`), and a nested `attributeGroup` is always a reference, never a named definition; named definitions are top-level only (a direct child of `schema` or `redefine`). Such schemas were accepted. A nested anonymous `simpleType`, an `attributeGroup` reference, and a top-level named definition are unaffected. XSTS: invalid schemas accepted 403 to 394, no other bucket raised.
 - An `xs:all` group may no longer appear in a `complexContent` extension of a base that already has element content (XSD 1.0 `cos-all-limited.1.2`, #170). The effective content model of such an extension is `sequence(base content, extension content)`, which nests the `all` and violates the rule that an `all` must be the whole content model. Detected from the compiled base type: rejected only when the base resolves (in the schema's own target namespace) to a complex type with element-only or mixed content. An explicitly-empty base (an empty model group with `mixed="false"`, whose content is effectively empty) may still be extended by an `all`, since the `all` becomes the whole content; a simple-content, empty, foreign, or unresolved base is left alone. Checked for a self-contained schema. XSTS: invalid schemas accepted 411 to 403, no other bucket raised.
 - A simple type whose `final` contains `list` (or `#all`) may no longer be used as a list `itemType`, and one whose `final` contains `union` (or `#all`) may no longer be a union `memberType` (XSD 1.0 simple-type `final`, #170). The restriction and extension directions were already enforced by `finalRespected`; the list and union directions were unchecked because `final="list"`/`"union"` is not modelled by the derivation-method set, so the `final` attribute is read directly. The reference is matched only when it resolves to the schema's own target namespace, so a list or union of a built-in (whose final is empty) is not confused with a user type of the same local name. Checked for a self-contained schema. XSTS: invalid schemas accepted 413 to 411, no other bucket raised.
 - A `whiteSpace` facet may only strengthen, never relax, its base type's effective whiteSpace (XSD Part 2 §4.3.6, #170). The order is `preserve` < `replace` < `collapse`, so a base fixed to `collapse` admits only `collapse`, and a `replace` base admits `replace` or `collapse`. A derivation that relaxes it (for example `whiteSpace="replace"` over a `collapse` base, or restricting `xs:token` to `replace`) was accepted and is now rejected. The base's effective whiteSpace is its own facet, falling back to its built-in intrinsic; the check is atomic-only and, when a base type's own whiteSpace has not yet resolved, can only under-detect, never reject a valid restriction. XSTS: invalid schemas accepted 422 to 413, no other bucket raised.

Sources/Schema/SchemaNestedDefinition.swift

@@ -0,0 +1,47 @@
+private typealias NestedNode = PureXML.Schema.XSDNode
+
+extension PureXML.Schema.XSDParser {
+    /// A named `simpleType` or `attributeGroup` definition is a top-level component:
+    /// the schema-for-schemas `localSimpleType` and the nested `attributeGroup`
+    /// (a reference) forms carry no `name`. A `simpleType` nested inside a
+    /// `restriction`/`list`/`union`/`element`/`attribute`, or an `attributeGroup`
+    /// nested inside a `complexType`/`attributeGroup`, that declares a `name` was
+    /// accepted; it is now rejected. A nested anonymous `simpleType` and an
+    /// `attributeGroup` reference (which carry no `name`) are unaffected.
+    ///
+    /// "Top-level" means a direct child of `schema` or of a `redefine`; everything
+    /// deeper is nested.
+    static func nestedNamedDefinitionErrors(_ schema: XSDTree) -> [String] {
+        var errors: [String] = []
+        collectNestedNamed(schema, parentIsTopLevel: false, into: &errors)
+        return errors
+    }
+
+    private static func collectNestedNamed(_ node: XSDTree, parentIsTopLevel: Bool, into errors: inout [String]) {
+        let kind = NestedNode.localName(node)
+        // Foreign content inside an annotation is not the schema's own and is not
+        // structurally checked.
+        if kind == "appinfo" || kind == "documentation" { return }
+        if isNestedNamedDefinition(node, kind, parentIsTopLevel: parentIsTopLevel) {
+            errors.append("a nested '\(kind ?? "")' definition may not have a 'name'; only a top-level definition is named")
+        }
+        let childrenAreTopLevel = kind == "schema" || kind == "redefine"
+        for child in NestedNode.elementChildren(node) {
+            collectNestedNamed(child, parentIsTopLevel: childrenAreTopLevel, into: &errors)
+        }
+    }
+
+    /// Whether `node` is a nested (non-top-level) `simpleType`/`attributeGroup` in
+    /// the XSD namespace that declares a `name` (which only a top-level definition
+    /// may carry).
+    private static func isNestedNamedDefinition(_ node: XSDTree, _ kind: String?, parentIsTopLevel: Bool) -> Bool {
+        !parentIsTopLevel
+            && node.name?.namespaceURI == xsdNamespace
+            && (kind == "simpleType" || kind == "attributeGroup")
+            && hasUnprefixedName(node)
+    }
+
+    private static func hasUnprefixedName(_ node: XSDTree) -> Bool {
+        node.attributes.contains { $0.name.prefix == nil && $0.name.localName == "name" }
+    }
+}

Sources/Schema/SchemaStructure.swift

@@ -59,6 +59,7 @@ extension PureXML.Schema.XSDParser {
         errors += simpleTypeVarietyFacetErrors(schema)
         errors += valueConstraintErrors(schema)
         errors += topLevelDeclarationErrors(schema)
+        errors += nestedNamedDefinitionErrors(schema)
         return errors
     }
 

Tests/SchemaNestedDefinitionTests.swift

@@ -0,0 +1,48 @@
+@testable import PureXML
+import Testing
+
+@Suite("XSD nested definitions may not be named (localSimpleType / attributeGroup ref)")
+struct SchemaNestedDefinitionTests {
+    private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
+
+    private func compiles(_ body: String) -> Bool {
+        (try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
+    }
+
+    @Test("A nested simpleType with a name is rejected")
+    func test_nestedNamedSimpleTypeRejected() {
+        #expect(!compiles(
+            "<xs:simpleType name=\"parent\"><xs:restriction>"
+                + "<xs:simpleType name=\"foo\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"
+                + "</xs:restriction></xs:simpleType>",
+        ))
+    }
+
+    @Test("A nested attributeGroup definition with a name is rejected")
+    func test_nestedNamedAttributeGroupRejected() {
+        #expect(!compiles(
+            "<xs:attributeGroup name=\"G\">"
+                + "<xs:attributeGroup name=\"abc\"><xs:attribute name=\"a\" type=\"xs:string\"/></xs:attributeGroup>"
+                + "</xs:attributeGroup>",
+        ))
+    }
+
+    @Test("A nested anonymous simpleType compiles")
+    func test_nestedAnonymousSimpleTypeAccepted() {
+        #expect(compiles(
+            "<xs:element name=\"e\"><xs:simpleType><xs:restriction base=\"xs:string\"/></xs:simpleType></xs:element>",
+        ))
+        #expect(compiles(
+            "<xs:simpleType name=\"L\"><xs:list><xs:simpleType><xs:restriction base=\"xs:string\"/></xs:simpleType></xs:list></xs:simpleType>",
+        ))
+    }
+
+    @Test("A nested attributeGroup reference and top-level named definitions compile")
+    func test_refAndTopLevelAccepted() {
+        #expect(compiles(
+            "<xs:attributeGroup name=\"G\"><xs:attribute name=\"a\" type=\"xs:string\"/></xs:attributeGroup>"
+                + "<xs:complexType name=\"T\"><xs:attributeGroup ref=\"G\"/></xs:complexType>",
+        ))
+        #expect(compiles("<xs:simpleType name=\"S\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"))
+    }
+}

Tests/XSTSSuiteTests.swift

@@ -29,7 +29,7 @@ struct XSTSSuiteTests {
     /// XSTS` (debug is far slower and the corpus is large). Per-case deviations
     /// are written to /tmp/xsts-failures.txt for the burn-down.
     private let knownSchemaValidRejected = 1
-    private let knownSchemaInvalidAccepted = 403
+    private let knownSchemaInvalidAccepted = 394
     private let knownInstanceValidRejected = 180
     private let knownInstanceInvalidAccepted = 158
 

docs/schema-validity-burndown.md

@@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
 | Bucket | Count | Reading |
 |---|---|---|
 | valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
-| **invalid-schemas-accepted** | **2461 -> 403** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
+| **invalid-schemas-accepted** | **2461 -> 394** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
 | valid-instances-rejected | **233 -> 180** | (instance side; #164's element-ref namespace fix is shared with instance validation, -34) |
 | invalid-instances-accepted | **160 -> 158** | (instance side; resolving an inline `<simpleType>` restriction base preserves list/union variety, so a `length` facet counts items and two more invalid instances are caught) |