From 0fbd8ca80f43b595d8ee975a08e29b2a3804406b Mon Sep 17 00:00:00 2001
From: Harry Bragg <harry.bragg@poweredbypercent.com>
Date: Wed, 21 May 2025 10:00:27 +0100
Subject: [PATCH 1/2] chore: handle encrypt-then-sign assertion nodes

---
 src/flow.ts    | 2 +-
 src/libsaml.ts | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/flow.ts b/src/flow.ts
index f58a5360..a2ffb2bd 100644
--- a/src/flow.ts
+++ b/src/flow.ts
@@ -211,7 +211,7 @@ async function postFlow(options): Promise<FlowResult> {
     checkSignature &&
     from.entitySetting.messageSigningOrder === MessageSignatureOrder.ETS
   ) {
-    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions);
+    const [verified, verifiedAssertionNode] = libsaml.verifySignature(samlContent, verificationOptions, decryptRequired);
     if (!verified) {
       return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
     }
diff --git a/src/libsaml.ts b/src/libsaml.ts
index aa9691a4..6b5ef319 100644
--- a/src/libsaml.ts
+++ b/src/libsaml.ts
@@ -366,7 +366,7 @@ const libSaml = () => {
      *   - The first element is `true` if the signature is valid, `false` otherwise.
      *   - The second element is the cryptographically authenticated assertion node as a string, or `null` if not found.
      */
-    verifySignature(xml: string, opts: SignatureVerifierOptions) {
+    verifySignature(xml: string, opts: SignatureVerifierOptions, isAssertionEncrypted: boolean) {
       const { dom } = getContext();
       const doc = dom.parseFromString(xml);
 
@@ -485,6 +485,8 @@ const libSaml = () => {
           // now we can process the assertion as an assertion
           if (assertions.length === 1) {
             return [true, assertions[0].toString()];
+          } else if (isAssertionEncrypted) {
+            return [true, null];
           }
         } else if (rootNode.localName === 'Assertion') {
           return [true, rootNode.toString()];

From c61e20818c1e9e70443ce59cc754c95b94c2d545 Mon Sep 17 00:00:00 2001
From: Harry Bragg <harry.bragg@poweredbypercent.com>
Date: Wed, 21 May 2025 10:04:02 +0100
Subject: [PATCH 2/2] chore: default false, add comment

---
 src/libsaml.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libsaml.ts b/src/libsaml.ts
index 6b5ef319..9cf6ccf8 100644
--- a/src/libsaml.ts
+++ b/src/libsaml.ts
@@ -366,7 +366,7 @@ const libSaml = () => {
      *   - The first element is `true` if the signature is valid, `false` otherwise.
      *   - The second element is the cryptographically authenticated assertion node as a string, or `null` if not found.
      */
-    verifySignature(xml: string, opts: SignatureVerifierOptions, isAssertionEncrypted: boolean) {
+    verifySignature(xml: string, opts: SignatureVerifierOptions, isAssertionEncrypted: boolean = false) {
       const { dom } = getContext();
       const doc = dom.parseFromString(xml);
 
@@ -486,6 +486,7 @@ const libSaml = () => {
           if (assertions.length === 1) {
             return [true, assertions[0].toString()];
           } else if (isAssertionEncrypted) {
+            // if the assertions are encrypted there will be no 'Assertion' nodes
             return [true, null];
           }
         } else if (rootNode.localName === 'Assertion') {