test: cover implicitTransforms and idAttribute

[cjbarth]

Fixes #573.

Tests the documented idAttribute and implicitTransforms constructor options through the public signing and verification APIs. This is item 1 of #573, which #599 left open. Tests only; no runtime change. The existing 6.x idAttribute behavior is kept.

• idAttribute: with idAttribute: "AssertionID", signing references the element's existing AssertionID and adds no ID of its own. A verifier given the same option resolves it and returns the element as signed.
• implicitTransforms: the case from the README's Caring for Implicit transform section. A reference declares only enveloped-signature, and the signed element is then placed in a parent that declares an unused namespace. Verification fails without implicitTransforms and passes with implicitTransforms: ["http://www.w3.org/2001/10/xml-exc-c14n#"], returning the element as signed.

Neither test asserts the name of the ID attribute signing adds to an element without one, which #508 changes in 7.0. Disabling either option in src/ fails its test.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added coverage for XML signatures configured to use a custom identifier attribute, including validation of the signed reference.
  • Added verification tests for modified XML with exclusive canonicalization configured, and for verification without that transform. These tests check that verification succeeds with the configured options and fails without the required transform.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0f08bd63-c51e-4dc5-9ceb-58ca741fba82

📥 Commits

Reviewing files that changed from the base of the PR and between ed1b601 and 85eb9d8.

📒 Files selected for processing (1)

• test/constructor-options.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

This change adds tests for the idAttribute and implicitTransforms constructor options during XML signature signing and verification.

Changes

Constructor option verification

Layer / File(s)	Summary
Constructor option signing and verification test/constructor-options.spec.ts	Signing and verification helpers support tests for idAttribute and implicitTransforms. The tests check reference identification with AssertionID and compare verification results with and without an implicit transform.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 85eb9

This change adds regression coverage for custom ID lookup and implicit canonicalization. No merge-blocking risk is evident; it is ready for normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding tests for the documented implicitTransforms and idAttribute constructor options.
Linked Issues check	✅ Passed	The PR meets the applicable objective in directly linked issue #573. test/constructor-options.spec.ts tests idAttribute: "AssertionID" through public signing and verification APIs. It also tests t…
Out of Scope Changes check	✅ Passed	The PR adds only test/constructor-options.spec.ts. The tests directly support the two constructor-option objectives in #573. The PR makes no runtime, API, or documentation changes. The remaining cov…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.22%. Comparing base (88f15c1) to head (85eb9d8).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #635      +/-   ##
==========================================
+ Coverage   83.89%   84.22%   +0.32%     
==========================================
  Files           9        9              
  Lines        1217     1217              
  Branches      308      308              
==========================================
+ Hits         1021     1025       +4     
+ Misses        118      115       -3     
+ Partials       78       77       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.