Skip to content

test: prove behavior through supported APIs instead of deprecated ones - #593

Merged
cjbarth merged 6 commits into
node-saml:masterfrom
cjbarth:test/stop-using-deprecated-apis
Sep 15, 2026
Merged

cjbarth merged 6 commits into
node-saml:masterfrom
cjbarth:test/stop-using-deprecated-apis

Conversation

@cjbarth

@cjbarth cjbarth commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Summary

The README tells consumers to stop using getReferences(), getOriginalXmlWithIds() and getValidatedNode(), but the tests still used them behind deprecation/deprecation suppressions. Where the supported API can prove the same behavior, the tests now use it. Where only a deprecated API can express the behavior, the test stays behind its suppression until that API is removed. The test count goes from 312 to 315.

Moved to the supported API, still proving the same behavior

  • ds:Object tests: checkSignature() is asserted directly instead of collecting validation errors from getReferences().
  • Every fixture passing verification: the getSignedReferences() length is compared with the Reference elements in the loaded signature.
  • Signature loading: the getSignedReferences() length check becomes an assertion on their exact content.

Added

  • Reading signed data: a test that parses getSignedReferences()[0] and selects the mail attribute, the supported counterpart of the getValidatedNode() tests.
  • Detached signature over elements that carry their IDs: the document already carries its ID and is verified alongside getSignatureXml(), as the getOriginalXmlWithIds() deprecation advice describes.

Kept until removal

These can only be expressed through a deprecated API, so they stay until it is removed:

  • getOriginalXmlWithIds(): the detached signature test, which signs a document without IDs and verifies the XML the method returns.
  • getValidatedNode(): its five tests.
  • getReferences(): the reference fields checked while loading a signature, the reference count before verification, and the DigestValue read past a comment.
  • ref.signedReference: stays unset after checkSignature() throws.
  • validateElementAgainstReferences(): its test call, behind the same suppression chore: deprecate validateElementAgainstReferences() #592 adds.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Tests
    • Expanded coverage for signed XML references, including validation of serialized reference content and XPath parsing.
    • Added verification scenarios for detached signatures with both generated and pre-existing document identifiers.
    • Strengthened signature validation checks to confirm the expected number and content of signed references.
    • Simplified test assertions for clearer reporting of signature verification results.

cjbarth and others added 2 commits September 14, 2026 14:59
The README tells consumers to stop using getReferences() and
getOriginalXmlWithIds(), so the tests should not use them either.

- Sign a detached document that already carries its ID and verify it
  alongside getSignatureXml(), as the deprecation advice describes.
- Check ds:Object signatures with checkSignature() alone instead of
  collecting validation errors from getReferences().
- Assert the content of getSignedReferences() instead of the fields of
  the loaded references, and compare its length with the Reference
  elements in the signature.
- Drop assertions on loaded references that the checkSignature()
  assertions next to them already cover. Reintroducing the digest
  comment bypass makes that test's checkSignature() return true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…tern

getValidatedNode() and ref.signedReference are only reachable through
deprecated APIs, and tests should prove what the supported API does.
Read signed data from getSignedReferences() instead, and drop the call
to validateElementAgainstReferences().

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@cjbarth cjbarth added this to the v6.2 milestone Sep 14, 2026
@cjbarth cjbarth added the chore label Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 64dfc4c0-34f7-412d-a90a-4caa57423f2b

📥 Commits

Reviewing files that changed from the base of the PR and between 5f7da8f and 00e6ad9.

📒 Files selected for processing (4)
  • test/document-tests.spec.ts
  • test/signature-integration-tests.spec.ts
  • test/signature-object-tests.spec.ts
  • test/signature-unit-tests.spec.ts

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The test suite adds signed-reference content checks, separates detached-signature ID scenarios, and updates signature verification assertions to use direct boolean results.

Changes

Signature Test Coverage

Layer / File(s) Summary
Signed-reference validation
test/document-tests.spec.ts, test/signature-unit-tests.spec.ts
Tests validate signed-reference XML content, mail attribute extraction, exact serialized references, and reference counts from parsed signature data.
Detached-signature ID cases
test/signature-integration-tests.spec.ts
Detached-signature tests distinguish generated IDs from input XML containing Id="_0" and select the corresponding XML for verification.
Signature verification assertions
test/signature-object-tests.spec.ts
The test helper returns the verification boolean directly, and all call sites assert that boolean.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: shunkica

Merge Risk: ⚪ Minimal · up to 00e6a

The updated tests exercise supported signature APIs and detached-signature ID variants without an identified regression. The change is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 4 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely summarizes the main change: updating tests to verify behavior through supported APIs instead of deprecated APIs.
  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Sep 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.78%. Comparing base (f5c4d22) to head (00e6ad9).
⚠️ Report is 19 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #593      +/-   ##
==========================================
+ Coverage   75.95%   79.78%   +3.83%     
==========================================
  Files           9        9              
  Lines        1048     1118      +70     
  Branches      273      283      +10     
==========================================
+ Hits          796      892      +96     
+ Misses        144      129      -15     
+ Partials      108       97      -11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cjbarth and others added 4 commits September 14, 2026 18:50
The method stays public until it is removed, so its one test call stays
too, behind the same deprecation/deprecation suppression node-saml#592 adds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
getValidatedNode(), getReferences() and ref.signedReference stay public
until they are removed, so the tests that can only reach them through
those APIs stay too, behind deprecation/deprecation suppressions. Tests
that prove the same behavior through the supported API keep their
rewrite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The detached-signature test was the only one to call
getOriginalXmlWithIds(), and replacing it with a document that already
carries its ID stopped proving that the method exposes generated IDs.
Keep that case behind its suppression and add the supported workflow
beside it.

Count the references of the signature the test loads rather than those
of every element named Signature.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@cjbarth
cjbarth merged commit fb8e7c6 into node-saml:master Sep 15, 2026
13 checks passed
@cjbarth
cjbarth deleted the test/stop-using-deprecated-apis branch September 15, 2026 00:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant