Upgrade fast-xml-parser to 5.9.3

package.json

@@ -59,7 +59,7 @@
     "@fontsource/roboto": "^5.2.10",
     "@mui/icons-material": "^9.0.1",
     "@mui/material": "^9.0.1",
-    "fast-xml-parser": "^5.6.0",
+    "fast-xml-parser": "^5.9.3",
     "js-base64": "^3.7.8",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"

src/common/services/saml-parser.test.ts

@@ -3,7 +3,7 @@
  * @license BSD-3-Clause
  */
 
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { parseSamlpAuthnRequest, parseSamlpResponse } from "./saml-parser.ts";
 
 describe("parseSamlpAuthnRequest", () => {
@@ -242,6 +242,54 @@ describe("parseSamlpAuthnRequest", () => {
   });
 });
 
+describe("warnUnhandledKeys #text handling", () => {
+  it("does not warn about the empty #text artifact on an attribute-only element", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const xml = `
+      <samlp:AuthnRequest
+        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+        ID="_abc123"
+        Version="2.0"
+        IssueInstant="2026-01-01T00:00:00Z">
+        <samlp:NameIDPolicy
+          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          AllowCreate="true"/>
+      </samlp:AuthnRequest>
+    `;
+
+    const result = parseSamlpAuthnRequest(xml);
+    expect(result).not.toBeInstanceOf(Error);
+
+    expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining("NameIDPolicy"), ["#text"]);
+
+    warnSpy.mockRestore();
+  });
+
+  it("still warns when an unhandled element has meaningful #text content", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const xml = `
+      <samlp:AuthnRequest
+        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+        ID="_abc123"
+        Version="2.0"
+        IssueInstant="2026-01-01T00:00:00Z">
+        <samlp:NameIDPolicy
+          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+          AllowCreate="true">unexpected</samlp:NameIDPolicy>
+      </samlp:AuthnRequest>
+    `;
+
+    const result = parseSamlpAuthnRequest(xml);
+    expect(result).not.toBeInstanceOf(Error);
+
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("NameIDPolicy"), ["#text"]);
+
+    warnSpy.mockRestore();
+  });
+});
+
 describe("parseSamlpResponse", () => {
   it("parses valid Response with namespace prefix", () => {
     const xml = `

src/common/services/saml-parser.ts

@@ -1130,8 +1130,22 @@ function getStringProperty(obj: Record<string, unknown>, key: string): string |
 
 function warnUnhandledKeys(context: string, elem: Record<string, unknown>, handledKeys: string[]) {
   const handled = new Set(handledKeys);
-  const unhandled = Object.keys(elem).filter((k) => !handled.has(k) && !k.startsWith("@_xmlns"));
+  const unhandled = Object.keys(elem).filter((k) => !handled.has(k) && !isIgnorableKey(elem, k));
   if (0 < unhandled.length) {
     console.warn(`Unhandled keys in ${context}:`, unhandled);
   }
 }
+
+function isIgnorableKey(elem: Record<string, unknown>, key: string): boolean {
+  return (
+    key.startsWith("@_xmlns") ||
+    // fast-xml-parser's alwaysCreateTextNode option keeps text-only elements (e.g. Audience)
+    // as objects rather than plain strings, so every element builder can treat elem
+    // uniformly. As a side effect, it also adds an empty #text to attribute-only elements
+    // (e.g. self-closing tags); that's a parsing artifact, not real SAML data.
+    // If a builder forgets to list "#text" in handledKeys for an element that the schema
+    // says does carry text, and the real data happens to be empty, this mistake will not
+    // be detected. This is unavoidable as long as alwaysCreateTextNode is used.
+    (key === "#text" && getStringContent(elem) === "")
+  );
+}