feat(schema): whiteSpace facet may only strengthen the base (Part 2 4.3.6)

A whiteSpace facet that relaxed its base type's effective whiteSpace was accepted; XSD Part 2 4.3.6 permits only strengthening, ordered preserve < replace < collapse. A base fixed to collapse admits only collapse, and a replace base admits replace or collapse; relaxing it (e.g. replace over a collapse base, or restricting xs:token to replace) is now rejected. The base's effective whiteSpace is its own facet falling back to its built-in intrinsic; the check is atomic-only and, when a base's own whiteSpace has not yet resolved, can only under-detect (an unresolved base defaults to preserve, the weakest), so it never rejects a valid restriction. XSTS: invalid schemas accepted 422 to 413, no other bucket raised.
2026-06-15 14:54:47 +02:00 · 2026-06-15 14:54:47 +02:00 · fbcfe758a5
commit fbcfe758a5
parent 44d37a1a5f
5 changed files with 94 additions and 2 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ### Fixed

+- A `whiteSpace` facet may only strengthen, never relax, its base type's effective whiteSpace (XSD Part 2 §4.3.6, #170). The order is `preserve` < `replace` < `collapse`, so a base fixed to `collapse` admits only `collapse`, and a `replace` base admits `replace` or `collapse`. A derivation that relaxes it (for example `whiteSpace="replace"` over a `collapse` base, or restricting `xs:token` to `replace`) was accepted and is now rejected. The base's effective whiteSpace is its own facet, falling back to its built-in intrinsic; the check is atomic-only and, when a base type's own whiteSpace has not yet resolved, can only under-detect, never reject a valid restriction. XSTS: invalid schemas accepted 422 to 413, no other bucket raised.
 - A top-level `xs:element` declaration may no longer carry `ref`, `form`, `minOccurs`, or `maxOccurs` (XSD 1.0 schema-for-schemas `topLevelElement`, #170). A global element is a declaration, never a particle or a reference, so those local-use attributes are invalid. The top-level-attribute applicability scan added earlier is generalized to cover both kinds; a local element particle inside a content model is unaffected. XSTS: invalid schemas accepted 424 to 422, no other bucket raised.
 - An element `ref` may no longer carry `nillable`, `default`, `fixed`, `form`, or `block`, and an element or attribute `ref` may no longer have an inline type definition (XSD 1.0 `src-element.2.2`, #170). A reference is a use of a global declaration, not a declaration, so beyond `ref` it carries only `minOccurs`, `maxOccurs`, and `id`; the applicability check already excluded `name` and `type` from a `ref`, and this extends the exclusion to the remaining declaration-only properties. A `group`/`attributeGroup` ref and an attribute ref's `use`/`default`/`fixed` (which override on the use) are unaffected. XSTS: invalid schemas accepted 439 to 424, no other bucket raised. Disclosed under-detection: a `key`/`unique`/`keyref` child under a ref is not yet flagged.
 - A top-level `xs:attribute` declaration may no longer carry `use`, `form`, or `ref` (XSD 1.0 schema-for-schemas `topLevelAttribute`, #170). Those belong to a local attribute use, not a global declaration; the per-component applicability table is the permissive global/local union and so could not draw the distinction, leaving such schemas accepted. A focused scan of the direct `attribute` children of `schema` (and of `redefine`) supplies the global-only constraint; a local attribute use inside a complex type or attribute group is unaffected. XSTS: invalid schemas accepted 454 to 439, no other bucket raised.
--- a/Sources/Schema/XSDSimpleParser.swift
+++ b/Sources/Schema/XSDSimpleParser.swift
@ -84,6 +84,45 @@ extension PureXML.Schema {
        /// so an inherited facet is never flagged here.
        static func facetDefinitionErrors(_ restriction: XSDTree, base: SimpleType) -> [String] {
            countFacetErrors(restriction) + boundFacetErrors(restriction, base: base)
+                + whiteSpaceRestrictionErrors(restriction, base: base)
+        }
+
+        /// The `whiteSpace` facet may only strengthen, never relax, the base type's
+        /// effective whiteSpace (XSD Part 2 §4.3.6, the facet's valid-restriction
+        /// rule): the order is `preserve` < `replace` < `collapse`, so a base fixed
+        /// to `collapse` admits only `collapse`, and a base of `replace` admits
+        /// `replace` or `collapse`. Checked for an atomic base only; the base's
+        /// effective whiteSpace is its own facet, falling back to its built-in
+        /// intrinsic. If the base type has not resolved its own whiteSpace the check
+        /// can only under-detect, never reject a valid restriction.
+        private static func whiteSpaceRestrictionErrors(_ restriction: XSDTree, base: SimpleType) -> [String] {
+            guard case .atomic = base.variety, let declared = declaredWhiteSpace(restriction) else { return [] }
+            let baseWhiteSpace = base.facets.whiteSpace ?? base.base.whiteSpace
+            guard whiteSpaceStrength(declared) < whiteSpaceStrength(baseWhiteSpace) else { return [] }
+            return ["whiteSpace '\(whiteSpaceName(declared))' may not relax the base type's whiteSpace '\(whiteSpaceName(baseWhiteSpace))'"]
+        }
+
+        private static func declaredWhiteSpace(_ restriction: XSDTree) -> WhiteSpace? {
+            for facet in XSDNode.elementChildren(restriction) where XSDNode.localName(facet) == "whiteSpace" {
+                return whiteSpace(XSDNode.attribute(facet, "value"))
+            }
+            return nil
+        }
+
+        private static func whiteSpaceStrength(_ whiteSpace: WhiteSpace) -> Int {
+            switch whiteSpace {
+            case .preserve: 0
+            case .replace: 1
+            case .collapse: 2
+            }
+        }
+
+        private static func whiteSpaceName(_ whiteSpace: WhiteSpace) -> String {
+            switch whiteSpace {
+            case .preserve: "preserve"
+            case .replace: "replace"
+            case .collapse: "collapse"
+            }
        }

        /// Length-family findings: `length`, `minLength`, `maxLength`,
--- a/Tests/SchemaWhiteSpaceRestrictionTests.swift
+++ b/Tests/SchemaWhiteSpaceRestrictionTests.swift
@ -0,0 +1,52 @@
+@testable import PureXML
+import Testing
+
+@Suite("XSD whiteSpace facet valid restriction (Part 2 §4.3.6)")
+struct SchemaWhiteSpaceRestrictionTests {
+    private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
+
+    private func compiles(_ body: String) -> Bool {
+        (try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
+    }
+
+    private func chain(_ baseWS: String, _ derivedWS: String) -> String {
+        "<xs:simpleType name=\"a\"><xs:restriction base=\"xs:string\">"
+            + "<xs:whiteSpace value=\"\(baseWS)\"/></xs:restriction></xs:simpleType>"
+            + "<xs:simpleType name=\"b\"><xs:restriction base=\"a\">"
+            + "<xs:whiteSpace value=\"\(derivedWS)\"/></xs:restriction></xs:simpleType>"
+    }
+
+    @Test("Relaxing the base whiteSpace is rejected")
+    func test_relaxRejected() {
+        #expect(!compiles(chain("collapse", "replace")))
+        #expect(!compiles(chain("collapse", "preserve")))
+        #expect(!compiles(chain("replace", "preserve")))
+    }
+
+    @Test("Keeping or strengthening the base whiteSpace compiles")
+    func test_strengthenAccepted() {
+        #expect(compiles(chain("collapse", "collapse")))
+        #expect(compiles(chain("replace", "collapse")))
+        #expect(compiles(chain("preserve", "collapse")))
+        #expect(compiles(chain("preserve", "replace")))
+    }
+
+    @Test("Relaxing a built-in's intrinsic whiteSpace is rejected")
+    func test_builtinIntrinsicRespected() {
+        // xs:token has intrinsic whiteSpace=collapse; a restriction may not relax it.
+        #expect(!compiles(
+            "<xs:simpleType name=\"t\"><xs:restriction base=\"xs:token\">"
+                + "<xs:whiteSpace value=\"replace\"/></xs:restriction></xs:simpleType>",
+        ))
+        // Restating collapse on a token is fine.
+        #expect(compiles(
+            "<xs:simpleType name=\"t\"><xs:restriction base=\"xs:token\">"
+                + "<xs:whiteSpace value=\"collapse\"/></xs:restriction></xs:simpleType>",
+        ))
+        // Strengthening xs:string (preserve) to collapse is fine.
+        #expect(compiles(
+            "<xs:simpleType name=\"t\"><xs:restriction base=\"xs:string\">"
+                + "<xs:whiteSpace value=\"collapse\"/></xs:restriction></xs:simpleType>",
+        ))
+    }
+}
--- a/Tests/XSTSSuiteTests.swift
+++ b/Tests/XSTSSuiteTests.swift
@ -29,7 +29,7 @@ struct XSTSSuiteTests {
    /// XSTS` (debug is far slower and the corpus is large). Per-case deviations
    /// are written to /tmp/xsts-failures.txt for the burn-down.
    private let knownSchemaValidRejected = 1
-    private let knownSchemaInvalidAccepted = 422
+    private let knownSchemaInvalidAccepted = 413
    private let knownInstanceValidRejected = 180
    private let knownInstanceInvalidAccepted = 158

--- a/docs/schema-validity-burndown.md
+++ b/docs/schema-validity-burndown.md
@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
 | Bucket | Count | Reading |
 |---|---|---|
 | valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
-| **invalid-schemas-accepted** | **2461 -> 422** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
+| **invalid-schemas-accepted** | **2461 -> 413** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
 | valid-instances-rejected | **233 -> 180** | (instance side; #164's element-ref namespace fix is shared with instance validation, -34) |
 | invalid-instances-accepted | **160 -> 158** | (instance side; resolving an inline `<simpleType>` restriction base preserves list/union variety, so a `length` facet counts items and two more invalid instances are caught) |