test: pin the hoisted ancestor namespace behaviour #541 fixed

[cjbarth]

Refs #538, #541.

Three branches were open against defects in the ancestor-namespace path of non-exclusive C14N:

1. a hoisted ancestor default namespace not becoming the default its descendants were canonicalized against, so a child's own xmlns="" read as redundant and was dropped;
2. an ancestor declaration being appended alongside one the node made itself, producing two xmlns attributes on one element;
3. process() marking ancestor prefixes in scope before anything had been rendered, so the apex's own redeclaration of such a prefix was skipped as redundant and resolved to the outer binding.

All three are already fixed on master. #541 got there by a different route — localDefaultNs/nodeDefaultNs in renderNs, newDefaultNs seeded from the hoisted entry in the ancestor merge, and findSubsetNSPrefixes collecting every prefix the subset declares rather than the first. So the fixes those branches carried are obsolete and are dropped.

Their tests are not obsolete. master satisfies these spec requirements without asserting any of them, in an area that has now produced four separate defects.

These are guards, not documentation

Each of the six unit cases fails against src/c14n-canonicalization.ts as it stood before #541 and passes on master. Two spot checks confirm they bite against plausible regressions:

Perturbation of master	Failures
drop newDefaultNs = ancestorNamespace.namespaceURI from the ancestor merge	7 (4 without this PR)
revert findSubsetNSPrefixes to the first declaration only	12 (11 without this PR)

The cases are parameterized over both C14nCanonicalization and C14nCanonicalizationWithComments, which the original branches did not do.

The integration case

The one worth having. A hoisted default namespace leaking into a descendant leaves the signature verifying while getSignedReferences() — the API the README designates as the secure replacement for getValidatedNode() — reports the element in a namespace the sender never signed it in. A caller that dispatches on element namespace then acts on an identity that was never signed, and the sender picks it. Nothing else in the suite covers that.

Cited inline: C14N 1.0 §2.3, the §4.7 rationale for preserving xmlns="", and Namespaces in XML §2.2 for prefix scoping.

Milestone

v6.2, matching #541 — test-only, no behaviour change.

Verification

npm run build && npm test && npm run lint clean; 254 passing (241 + 13; 6 cases × 2 canonicalizers + 1 integration).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f34f01d7-7436-458e-9c9d-b6cef0e9dd64

📥 Commits

Reviewing files that changed from the base of the PR and between 0409418 and e9e3cbb.

📒 Files selected for processing (2)

• test/c14n-non-exclusive-unit-tests.spec.ts
• test/signature-integration-tests.spec.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.86%. Comparing base (f5c4d22) to head (e9e3cbb).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #572      +/-   ##
==========================================
+ Coverage   75.95%   76.86%   +0.91%     
==========================================
  Files           9        9              
  Lines        1048     1059      +11     
  Branches      273      275       +2     
==========================================
+ Hits          796      814      +18     
+ Misses        144      139       -5     
+ Partials      108      106       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.