feat: run the item XSD's Schematron rules in validate_qti_item

The XSD's extensionAnyTypeLax.Attr wildcard admits any unrecognised
attribute, so the XSD alone could not catch the xml:lang bug. The
schema's own Schematron rules do enumerate the legal attributes, but
etree.XMLSchema never executes them.

Surfaced a second violation: srcset is not a QTI 3.0 img attribute, so
the assessmentitem viewset test's sample item now wraps it in
<picture><source>. The pydantic Img model still permits it — separate fix.

Author: rtibblesbot

contentcuration/contentcuration/tests/utils/qti/test_validation.py

@@ -5,6 +5,7 @@
 from lxml import etree
 
 from contentcuration.utils.assessment.qti.validation import _compiled_schema
+from contentcuration.utils.assessment.qti.validation import _compiled_schematron
 from contentcuration.utils.assessment.qti.validation import validate_qti_item
 
 
@@ -24,7 +25,7 @@ def _item_xml(identifier, title, response_declaration, item_body):
         'xsi:schemaLocation="http://www.imsglobal.org/xsd/imsqtiasi_v3p0 '
         'https://purl.imsglobal.org/spec/qti/v3p0/schema/xsd/imsqti_asiv3p0p1_v1p0.xsd" '
         'identifier="%s" title="%s" adaptive="false" time-dependent="false" '
-        'language="en-US" tool-name="kolibri" tool-version="0.1">'
+        'xml:lang="en-US" tool-name="kolibri" tool-version="0.1">'
         "%s"
         '<qti-outcome-declaration identifier="SCORE" cardinality="single" base-type="float" />'
         "<qti-item-body>%s</qti-item-body>"
@@ -77,6 +78,25 @@ def test_rejects_missing_required_attribute(self):
         self.assertFalse(result.is_valid)
         self.assertTrue(any("time-dependent" in e.message for e in result.errors))
 
+    def test_rejects_undeclared_root_attribute(self):
+        xml = VALID_CHOICE_ITEM.replace('xml:lang="en-US"', 'language="en-US"')
+        result = validate_qti_item(xml)
+        self.assertFalse(result.is_valid)
+        self.assertTrue(
+            any(
+                "Invalid XML attribute" in e.message and "language" in e.message
+                for e in result.errors
+            )
+        )
+
+    def test_accepts_data_prefixed_root_attribute(self):
+        xml = VALID_CHOICE_ITEM.replace(
+            'tool-name="kolibri"', 'data-foo="bar" tool-name="kolibri"'
+        )
+        result = validate_qti_item(xml)
+        self.assertTrue(result.is_valid)
+        self.assertEqual(result.errors, [])
+
     def test_rejects_malformed_xml_without_raising(self):
         result = validate_qti_item("<qti-assessment-item><unclosed>")
         self.assertFalse(result.is_valid)
@@ -161,3 +181,14 @@ def test_schema_compiled_once_across_multiple_validate_calls(self):
         validate_qti_item(ORDER_INTERACTION_ITEM)
         self.assertEqual(_compiled_schema.cache_info().misses, 1)
         self.assertEqual(_compiled_schema.cache_info().hits, 2)
+
+
+class SchematronReuseTests(unittest.TestCase):
+    def test_schematron_compiled_once_across_multiple_validate_calls(self):
+        _compiled_schematron.cache_clear()
+        self.addCleanup(_compiled_schematron.cache_clear)
+        validate_qti_item(VALID_CHOICE_ITEM)
+        validate_qti_item(MATCH_INTERACTION_ITEM)
+        validate_qti_item(ORDER_INTERACTION_ITEM)
+        self.assertEqual(_compiled_schematron.cache_info().misses, 1)
+        self.assertEqual(_compiled_schematron.cache_info().hits, 2)

contentcuration/contentcuration/tests/viewsets/test_assessmentitem.py

@@ -25,9 +25,12 @@
     "</qti-response-declaration>",
     '<qti-choice-interaction response-identifier="RESPONSE" max-choices="1" '
     'min-choices="0" orientation="vertical"><qti-prompt>Select the correct answer. '
-    '<img src="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.png" '
-    'srcset="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.png 1x, cccccccccccccccccccccccccccccccc.png 2x" '
-    'alt="diagram" /><object data="dddddddddddddddddddddddddddddddd.pdf" '
+    # srcset belongs on <source>, not <img> — QTI 3.0's ImgDType has no such attribute.
+    "<picture>"
+    '<source srcset="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.png 1x, cccccccccccccccccccccccccccccccc.png 2x" />'
+    '<img src="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.png" alt="diagram" />'
+    "</picture>"
+    '<object data="dddddddddddddddddddddddddddddddd.pdf" '
     'type="application/pdf"></object></qti-prompt>'
     '<qti-simple-choice identifier="choice_0" show-hide="show" fixed="false">Option A</qti-simple-choice>'
     '<qti-simple-choice identifier="choice_1" show-hide="show" fixed="false">'

contentcuration/contentcuration/utils/assessment/qti/schema/README.md

@@ -14,6 +14,10 @@ XSD files backing `contentcuration.utils.assessment.qti.validation`. Source: QTI
   SSML markup for text-to-speech hints).
   Source: https://purl.imsglobal.org/spec/ssml/v1p1/schema/xsd/
 
+`validation.py` also runs the Schematron rules `imsqti_itemv3p0p1_v1p0.xsd` carries inline
+in `xs:appinfo` — without them the XSD's `extensionAnyTypeLax.Attr` wildcard admits any
+attribute. Do not strip `xs:appinfo`.
+
 All `schemaLocation` attributes that originally pointed at `https://purl.imsglobal.org/...`
 have been rewritten to local relative filenames so the schema compiles with no network
 access at runtime — required since bulk publish and ricecooker upload validate many items

contentcuration/contentcuration/utils/assessment/qti/validation.py

@@ -8,15 +8,20 @@
 from typing import Union
 
 from lxml import etree
+from lxml import isoschematron
 
 
 SCHEMA_DIR = Path(__file__).parent / "schema" / "xsd"
 ITEM_SCHEMA_PATH = SCHEMA_DIR / "imsqti_itemv3p0p1_v1p0.xsd"
 
+_SCHEMATRON_NS = "http://purl.oclc.org/dsdl/schematron"
+_SVRL_NS = "http://purl.oclc.org/dsdl/svrl"
+
 # lxml's XMLSchema.validate() writes results to the schema object's shared
-# error_log, so concurrent validate() calls on the same cached schema instance
-# (reused across items per the module's design) can read each other's errors.
-# Serialize validate + error_log read to keep results correctly attributed.
+# error_log, and Schematron.validate() likewise to its validation_report, so
+# concurrent validate() calls on the same cached instance (reused across items
+# per the module's design) can read each other's errors. Serialize validate +
+# report read to keep results correctly attributed.
 _VALIDATION_LOCK = threading.Lock()
 
 
@@ -26,6 +31,20 @@ def _compiled_schema() -> etree.XMLSchema:
     return etree.XMLSchema(schema_doc)
 
 
+@lru_cache(maxsize=1)
+def _compiled_schematron() -> isoschematron.Schematron:
+    # The item XSD's Schematron rules sit inline in xs:appinfo and
+    # etree.XMLSchema never runs them, so its extensionAnyTypeLax.Attr wildcard
+    # admits attributes the Schematron's allow-list rejects. lxml takes only a
+    # standalone sch:schema, whose sch:ns bindings must precede its patterns.
+    xsd = etree.parse(str(ITEM_SCHEMA_PATH))
+    schema = etree.Element(f"{{{_SCHEMATRON_NS}}}schema", nsmap={"sch": _SCHEMATRON_NS})
+    # list() first — extend reparents each node out of the tree being iterated.
+    rules = list(xsd.iter(f"{{{_SCHEMATRON_NS}}}ns", f"{{{_SCHEMATRON_NS}}}pattern"))
+    schema.extend(rules)
+    return isoschematron.Schematron(schema, store_report=True)
+
+
 @dataclass(frozen=True)
 class QTIValidationError:
     message: str
@@ -39,6 +58,26 @@ class QTIValidationResult:
     errors: List[QTIValidationError] = field(default_factory=list)
 
 
+def _schematron_errors(
+    schematron: isoschematron.Schematron, doc: etree._ElementTree
+) -> List[QTIValidationError]:
+    if schematron.validate(doc):
+        return []
+    errors = []
+    for failure in schematron.validation_report.iter(f"{{{_SVRL_NS}}}failed-assert"):
+        text = failure.findtext(f"{{{_SVRL_NS}}}text") or ""
+        # SVRL reports a location XPath, not a line number.
+        located = doc.xpath(failure.get("location"))
+        errors.append(
+            QTIValidationError(
+                message=" ".join(text.split()),
+                line=located[0].sourceline if located else 0,
+                column=0,
+            )
+        )
+    return errors
+
+
 def secure_parser() -> etree.XMLParser:
     # resolve_entities=False + load_dtd=False blocks XXE/entity-expansion attacks;
     # no_network=True blocks remote schemaLocation/entity fetches. QTI reaches this
@@ -75,10 +114,15 @@ def validate_qti_item(xml: Union[str, bytes]) -> QTIValidationResult:
         )
 
     schema = _compiled_schema()
+    schematron = _compiled_schematron()
     with _VALIDATION_LOCK:
-        is_valid = schema.validate(doc)
-        errors = [
+        xsd_valid = schema.validate(doc)
+        xsd_errors = [
             QTIValidationError(message=err.message, line=err.line, column=err.column)
             for err in schema.error_log
         ]
-    return QTIValidationResult(is_valid=is_valid, errors=errors)
+        schematron_errors = _schematron_errors(schematron, doc)
+    return QTIValidationResult(
+        is_valid=xsd_valid and not schematron_errors,
+        errors=xsd_errors + schematron_errors,
+    )