test: prove behavior through supported APIs instead of deprecated ones - #593
Conversation
The README tells consumers to stop using getReferences() and getOriginalXmlWithIds(), so the tests should not use them either. - Sign a detached document that already carries its ID and verify it alongside getSignatureXml(), as the deprecation advice describes. - Check ds:Object signatures with checkSignature() alone instead of collecting validation errors from getReferences(). - Assert the content of getSignedReferences() instead of the fields of the loaded references, and compare its length with the Reference elements in the signature. - Drop assertions on loaded references that the checkSignature() assertions next to them already cover. Reintroducing the digest comment bypass makes that test's checkSignature() return true. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…tern getValidatedNode() and ref.signedReference are only reachable through deprecated APIs, and tests should prove what the supported API does. Read signed data from getSignedReferences() instead, and drop the call to validateElementAgainstReferences(). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe test suite adds signed-reference content checks, separates detached-signature ID scenarios, and updates signature verification assertions to use direct boolean results. ChangesSignature Test Coverage
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Suggested reviewers: Merge Risk: ⚪ Minimal · up to The updated tests exercise supported signature APIs and detached-signature ID variants without an identified regression. The change is ready to merge. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #593 +/- ##
==========================================
+ Coverage 75.95% 79.78% +3.83%
==========================================
Files 9 9
Lines 1048 1118 +70
Branches 273 283 +10
==========================================
+ Hits 796 892 +96
+ Misses 144 129 -15
+ Partials 108 97 -11 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The method stays public until it is removed, so its one test call stays too, behind the same deprecation/deprecation suppression node-saml#592 adds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
getValidatedNode(), getReferences() and ref.signedReference stay public until they are removed, so the tests that can only reach them through those APIs stay too, behind deprecation/deprecation suppressions. Tests that prove the same behavior through the supported API keep their rewrite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The detached-signature test was the only one to call getOriginalXmlWithIds(), and replacing it with a document that already carries its ID stopped proving that the method exposes generated IDs. Keep that case behind its suppression and add the supported workflow beside it. Count the references of the signature the test loads rather than those of every element named Signature. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Summary
The README tells consumers to stop using
getReferences(),getOriginalXmlWithIds()andgetValidatedNode(), but the tests still used them behinddeprecation/deprecationsuppressions. Where the supported API can prove the same behavior, the tests now use it. Where only a deprecated API can express the behavior, the test stays behind its suppression until that API is removed. The test count goes from 312 to 315.Moved to the supported API, still proving the same behavior
ds:Objecttests:checkSignature()is asserted directly instead of collecting validation errors fromgetReferences().getSignedReferences()length is compared with theReferenceelements in the loaded signature.getSignedReferences()length check becomes an assertion on their exact content.Added
getSignedReferences()[0]and selects themailattribute, the supported counterpart of thegetValidatedNode()tests.getSignatureXml(), as thegetOriginalXmlWithIds()deprecation advice describes.Kept until removal
These can only be expressed through a deprecated API, so they stay until it is removed:
getOriginalXmlWithIds(): the detached signature test, which signs a document without IDs and verifies the XML the method returns.getValidatedNode(): its five tests.getReferences(): the reference fields checked while loading a signature, the reference count before verification, and theDigestValueread past a comment.ref.signedReference: stays unset aftercheckSignature()throws.validateElementAgainstReferences(): its test call, behind the same suppression chore: deprecate validateElementAgainstReferences() #592 adds.🤖 Generated with Claude Code
Summary by CodeRabbit