TestSAMLDecryptionFallback_RetryCondition verifies that the guard condition is true when both AllowEncryptedAssertions is true AND RSAPrivateKeyNext is set — i.e., that the code will attempt the retry path.
(t *tst.T)
| 72 | // is true when both AllowEncryptedAssertions is true AND RSAPrivateKeyNext is |
| 73 | // set — i.e., that the code will attempt the retry path. |
| 74 | func TestSAMLDecryptionFallback_RetryCondition(t *tst.T) { |
| 75 | api, err := newSAMLTestAPI(t, samlTestPrimaryKey, samlTestNextKey, true) |
| 76 | require.NoError(t, err) |
| 77 | |
| 78 | cfg := api.config.SAML |
| 79 | require.True(t, cfg.AllowEncryptedAssertions) |
| 80 | require.NotNil(t, cfg.RSAPrivateKeyNext) |
| 81 | |
| 82 | retryEligible := cfg.AllowEncryptedAssertions && cfg.RSAPrivateKeyNext != nil |
| 83 | require.True(t, retryEligible, |
| 84 | "retry should be eligible when AllowEncryptedAssertions=true and RSAPrivateKeyNext is set") |
| 85 | } |
| 86 | |
| 87 | // TestNewSAMLServiceProvider_SameURLBase verifies that both key pairs produce |
| 88 | // a ServiceProvider with the same ACS URL — wrong ACS URL would prevent |
nothing calls this directly
no test coverage detected