entropy-auth 2026.7.31

//! SAML 2.0 Response parsing and validation.

use core::fmt;

use crate::util::log::{debug, info, warn};
use crate::util::timestamp::Timestamp;
use crate::xml::{XmlElement, XmlParseError, parse_xml};

use super::SAML_NS;
use super::assertion::{SamlAssertion, parse_assertion};
use super::config::SamlConfig;

/// SAML protocol namespace URI.
const SAMLP_NS: &str = "urn:oasis:names:tc:SAML:2.0:protocol";

/// Top-level status code URIs.
const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
const STATUS_REQUESTER: &str = "urn:oasis:names:tc:SAML:2.0:status:Requester";
const STATUS_RESPONDER: &str = "urn:oasis:names:tc:SAML:2.0:status:Responder";
const STATUS_VERSION_MISMATCH: &str = "urn:oasis:names:tc:SAML:2.0:status:VersionMismatch";

// ---------------------------------------------------------------------------
// Error type
// ---------------------------------------------------------------------------

/// The category of SAML response parse/validation failure.
#[derive(Debug, Clone, PartialEq, Eq)]
enum SamlResponseErrorKind {
    /// Base64 decoding failed.
    Base64Decode(String),
    /// The base64-decoded bytes are not valid UTF-8.
    InvalidUtf8,
    /// XML parsing failed.
    XmlParse(XmlParseError),
    /// The response structure is missing required elements.
    MissingElement(String),
    /// A `Response` or `Assertion` carried a `Version` attribute other than
    /// the mandatory `"2.0"` (SAML Core §3.2.2 / §2.3.3), or omitted it.
    InvalidVersion(String),
    /// A single-occurrence element (`Issuer`, `Subject`, `NameID`,
    /// `Conditions`) appeared more than once. First-match selection over a
    /// duplicated element is a signature-wrapping surface, so it is rejected.
    DuplicateElement(String),
    /// The response destination does not match the expected ACS URL.
    DestinationMismatch {
        /// The expected ACS URL.
        expected: String,
        /// The actual destination in the response.
        actual: String,
    },
    /// The assertion issuer does not match the expected `IdP` entity ID.
    IssuerMismatch {
        /// The expected `IdP` entity ID.
        expected: String,
        /// The actual issuer in the assertion.
        actual: String,
    },
    /// The audience restriction does not include the SP entity ID (this
    /// includes an assertion that omits `AudienceRestriction` entirely —
    /// absence is treated as failure, not "valid for everyone").
    AudienceMismatch {
        /// The SP entity ID that was expected.
        expected: String,
    },
    /// The response carried no usable assertion (none present, or the only
    /// assertion(s) failed to parse).
    NoAssertions,
    /// The subject confirmation `Recipient` does not match this SP's ACS URL.
    RecipientMismatch {
        /// The expected ACS URL.
        expected: String,
        /// The `Recipient` the assertion was actually addressed to.
        actual: String,
    },
    /// The SAML status indicates a non-success response.
    NonSuccessStatus(SamlStatus),
    /// The assertion is not yet valid (`NotBefore` is in the future).
    NotYetValid {
        /// The `NotBefore` timestamp from the assertion.
        not_before: String,
    },
    /// The assertion has expired (`NotOnOrAfter` is in the past).
    Expired {
        /// The `NotOnOrAfter` timestamp from the assertion.
        not_on_or_after: String,
    },
    /// A timestamp in the assertion could not be parsed.
    InvalidTimestamp {
        /// The field name (e.g. "`NotBefore`" or "`NotOnOrAfter`").
        field: String,
        /// The raw timestamp value that could not be parsed.
        value: String,
    },
}

/// Errors that can occur when parsing or validating a SAML response.
#[doc(alias = "saml_response_error")]
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SamlResponseError {
    kind: SamlResponseErrorKind,
}

impl SamlResponseError {
    /// Creates a new error from the given kind.
    fn new(kind: SamlResponseErrorKind) -> Self {
        Self { kind }
    }

    /// Creates a [`MissingElement`](SamlResponseErrorKind::MissingElement) error.
    ///
    /// This is a convenience constructor used by the assertion parser to
    /// report missing required child elements.
    pub(crate) fn missing_element(name: &str) -> Self {
        Self::new(SamlResponseErrorKind::MissingElement(name.to_string()))
    }

    /// Creates an [`InvalidVersion`](SamlResponseErrorKind::InvalidVersion)
    /// error for the named element (`"Response"` or `"Assertion"`).
    pub(crate) fn invalid_version(where_: &str) -> Self {
        Self::new(SamlResponseErrorKind::InvalidVersion(where_.to_string()))
    }

    /// Creates a [`DuplicateElement`](SamlResponseErrorKind::DuplicateElement)
    /// error for the named single-occurrence element.
    pub(crate) fn duplicate_element(name: &str) -> Self {
        Self::new(SamlResponseErrorKind::DuplicateElement(name.to_string()))
    }

    /// Returns `true` if this error is a base64 decoding failure.
    #[must_use]
    #[inline]
    pub fn is_base64_decode(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::Base64Decode(_))
    }

    /// Returns `true` if the base64-decoded bytes were not valid UTF-8.
    #[must_use]
    #[inline]
    pub fn is_invalid_utf8(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::InvalidUtf8)
    }

    /// Returns `true` if this error is an XML parsing failure.
    #[must_use]
    #[inline]
    pub fn is_xml_parse(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::XmlParse(_))
    }

    /// Returns `true` if this error is a missing required element.
    #[must_use]
    #[inline]
    pub fn is_missing_element(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::MissingElement(_))
    }

    /// Returns `true` if a `Response`/`Assertion` carried a `Version` other
    /// than the mandatory `"2.0"` (or omitted it).
    #[must_use]
    pub fn is_invalid_version(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::InvalidVersion(_))
    }

    /// Returns `true` if a single-occurrence assertion element (`Issuer`,
    /// `Subject`, `NameID`, `Conditions`) appeared more than once.
    #[must_use]
    pub fn is_duplicate_element(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::DuplicateElement(_))
    }

    /// Returns `true` if this error is a destination mismatch.
    #[must_use]
    #[inline]
    pub fn is_destination_mismatch(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::DestinationMismatch { .. })
    }

    /// Returns `true` if this error is an issuer mismatch.
    #[must_use]
    #[inline]
    pub fn is_issuer_mismatch(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::IssuerMismatch { .. })
    }

    /// Returns `true` if this error is an audience mismatch.
    #[must_use]
    #[inline]
    pub fn is_audience_mismatch(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::AudienceMismatch { .. })
    }

    /// Returns `true` if this error is a non-success SAML status.
    #[must_use]
    #[inline]
    pub fn is_non_success_status(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::NonSuccessStatus(_))
    }

    /// Returns `true` if the response carried no usable assertion.
    #[must_use]
    #[inline]
    pub fn is_no_assertions(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::NoAssertions)
    }

    /// Returns `true` if the subject-confirmation `Recipient` did not match
    /// this SP's ACS URL.
    #[must_use]
    #[inline]
    pub fn is_recipient_mismatch(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::RecipientMismatch { .. })
    }

    /// Returns `true` if this error indicates the assertion is not yet valid.
    #[must_use]
    #[inline]
    pub fn is_not_yet_valid(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::NotYetValid { .. })
    }

    /// Returns `true` if this error indicates the assertion has expired.
    #[must_use]
    #[inline]
    pub fn is_expired(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::Expired { .. })
    }

    /// Returns `true` if this error indicates an unparseable timestamp.
    #[must_use]
    #[inline]
    pub fn is_invalid_timestamp(&self) -> bool {
        matches!(self.kind, SamlResponseErrorKind::InvalidTimestamp { .. })
    }
}

impl fmt::Display for SamlResponseError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match &self.kind {
            SamlResponseErrorKind::Base64Decode(msg) => {
                write!(f, "SAML response base64 decode error: {msg}")
            }
            SamlResponseErrorKind::InvalidUtf8 => f.write_str("SAML response is not valid UTF-8"),
            SamlResponseErrorKind::XmlParse(err) => {
                write!(f, "SAML response XML error: {err}")
            }
            SamlResponseErrorKind::MissingElement(name) => {
                write!(f, "SAML response missing required element: {name}")
            }
            SamlResponseErrorKind::InvalidVersion(where_) => {
                write!(f, "SAML {where_} has a Version other than \"2.0\"")
            }
            SamlResponseErrorKind::DuplicateElement(name) => {
                write!(f, "SAML assertion has a duplicate {name} element")
            }
            SamlResponseErrorKind::DestinationMismatch { expected, actual } => {
                write!(
                    f,
                    "SAML response destination mismatch: expected {expected}, got {actual}"
                )
            }
            SamlResponseErrorKind::IssuerMismatch { expected, actual } => {
                write!(
                    f,
                    "SAML assertion issuer mismatch: expected {expected}, got {actual}"
                )
            }
            SamlResponseErrorKind::AudienceMismatch { expected } => {
                write!(
                    f,
                    "SAML assertion audience restriction does not include {expected}"
                )
            }
            SamlResponseErrorKind::NonSuccessStatus(status) => {
                write!(f, "SAML response non-success status: {status}")
            }
            SamlResponseErrorKind::NoAssertions => {
                f.write_str("SAML response contained no usable assertion")
            }
            SamlResponseErrorKind::RecipientMismatch { expected, actual } => {
                write!(
                    f,
                    "SAML subject confirmation recipient mismatch: expected {expected}, got {actual}"
                )
            }
            SamlResponseErrorKind::NotYetValid { not_before } => {
                write!(f, "SAML assertion not yet valid (NotBefore={not_before})")
            }
            SamlResponseErrorKind::Expired { not_on_or_after } => {
                write!(f, "SAML assertion expired (NotOnOrAfter={not_on_or_after})")
            }
            SamlResponseErrorKind::InvalidTimestamp { field, value } => {
                write!(
                    f,
                    "SAML assertion contains unparseable timestamp: {field}={value}"
                )
            }
        }
    }
}

impl std::error::Error for SamlResponseError {
    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
        match &self.kind {
            SamlResponseErrorKind::XmlParse(err) => Some(err),
            SamlResponseErrorKind::Base64Decode(_)
            | SamlResponseErrorKind::InvalidUtf8
            | SamlResponseErrorKind::MissingElement(_)
            | SamlResponseErrorKind::InvalidVersion(_)
            | SamlResponseErrorKind::DuplicateElement(_)
            | SamlResponseErrorKind::DestinationMismatch { .. }
            | SamlResponseErrorKind::IssuerMismatch { .. }
            | SamlResponseErrorKind::AudienceMismatch { .. }
            | SamlResponseErrorKind::NonSuccessStatus(_)
            | SamlResponseErrorKind::NoAssertions
            | SamlResponseErrorKind::RecipientMismatch { .. }
            | SamlResponseErrorKind::NotYetValid { .. }
            | SamlResponseErrorKind::Expired { .. }
            | SamlResponseErrorKind::InvalidTimestamp { .. } => None,
        }
    }
}

impl From<XmlParseError> for SamlResponseError {
    fn from(err: XmlParseError) -> Self {
        Self::new(SamlResponseErrorKind::XmlParse(err))
    }
}

// ---------------------------------------------------------------------------
// SamlStatus
// ---------------------------------------------------------------------------

/// SAML 2.0 top-level status codes.
#[doc(alias = "saml_status")]
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub enum SamlStatus {
    /// The request succeeded.
    Success,
    /// The request could not be performed due to an error by the requester.
    Requester,
    /// The request could not be performed due to an error at the responder.
    Responder,
    /// The responder could not process the request because the version was wrong.
    VersionMismatch,
    /// An unrecognized status code.
    Unknown(String),
}

impl fmt::Display for SamlStatus {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Success => f.write_str("Success"),
            Self::Requester => f.write_str("Requester"),
            Self::Responder => f.write_str("Responder"),
            Self::VersionMismatch => f.write_str("VersionMismatch"),
            Self::Unknown(uri) => {
                write!(f, "Unknown({uri})")
            }
        }
    }
}

// ---------------------------------------------------------------------------
// SamlResponse
// ---------------------------------------------------------------------------

/// A parsed SAML 2.0 `<samlp:Response>`.
#[doc(alias = "saml_response")]
#[derive(Debug, Clone)]
pub struct SamlResponse {
    /// Unique identifier for this response.
    id: String,
    /// Timestamp when the response was issued.
    issue_instant: String,
    /// The intended destination URL (ACS URL).
    destination: Option<String>,
    /// The Response-level `<Issuer>`, if present (distinct from the
    /// assertion's own Issuer).
    issuer: Option<String>,
    /// The response status.
    status: SamlStatus,
    /// Assertions contained in the response.
    assertions: Vec<SamlAssertion>,
}

impl SamlResponse {
    /// Returns the unique identifier for this response.
    #[must_use]
    #[inline]
    pub fn id(&self) -> &str {
        &self.id
    }

    /// Returns the timestamp when the response was issued.
    #[must_use]
    #[inline]
    pub fn issue_instant(&self) -> &str {
        &self.issue_instant
    }

    /// Returns the intended destination URL (ACS URL), if present.
    #[must_use]
    #[inline]
    pub fn destination(&self) -> Option<&str> {
        self.destination.as_deref()
    }

    /// Returns the Response-level `<Issuer>`, if present.
    ///
    /// This is the issuer of the protocol `<Response>` envelope, which is
    /// distinct from each assertion's own `<Issuer>`. It is optional in SAML;
    /// when present, [`validate_conditions_only`](Self::validate_conditions_only)
    /// checks it equals the configured `IdP` entity ID.
    #[must_use]
    #[inline]
    pub fn issuer(&self) -> Option<&str> {
        self.issuer.as_deref()
    }

    /// Returns the response status.
    #[must_use]
    #[inline]
    pub fn status(&self) -> &SamlStatus {
        &self.status
    }

    /// Returns the assertions contained in the response.
    #[must_use]
    #[inline]
    pub fn assertions(&self) -> &[SamlAssertion] {
        &self.assertions
    }
}

/// Which end of a temporal validity window a [`check_window`] call enforces.
///
/// Selects both the comparison direction and the [`SamlResponseErrorKind`]
/// returned when the window is violated. Clock skew is always applied in the
/// direction that *widens* the acceptance window (subtracted from a lower
/// bound, added to an upper bound) so minor IdP/SP drift never causes a
/// spurious rejection.
#[derive(Clone, Copy)]
enum WindowBound {
    /// Lower bound (`NotBefore`): the assertion is invalid *before* the value.
    NotBefore,
    /// Upper bound (`NotOnOrAfter`): the assertion is invalid *at or after*
    /// the value.
    NotOnOrAfter,
}

/// Enforces a single SAML temporal validity bound against `now`, allowing the
/// configured clock skew.
///
/// `field_name` names the attribute for diagnostics (it appears in the
/// [`SamlResponseErrorKind::InvalidTimestamp`] error on a parse failure).
/// `value` is the raw timestamp string; when absent the check is skipped
/// (every SAML temporal attribute here is optional). `warn_msg` is the log
/// line emitted on a window violation.
///
/// # Security
///
/// An unparseable timestamp is a hard failure ([`InvalidTimestamp`]) — never
/// a silent skip, which would grant an unbounded validity window. The skew is
/// applied with `saturating_add` so it cannot overflow.
///
/// [`InvalidTimestamp`]: SamlResponseErrorKind::InvalidTimestamp
fn check_window(
    field_name: &str,
    value: Option<&str>,
    skew: u64,
    now: &Timestamp,
    bound: WindowBound,
    warn_msg: &str,
) -> Result<(), SamlResponseError> {
    let Some(value) = value else {
        return Ok(());
    };

    // SECURITY: An unparseable timestamp MUST be treated as a validation
    // failure — silently skipping the check would grant the assertion an
    // effectively unlimited validity window.
    let value_ts = Timestamp::parse_iso8601(value).ok_or_else(|| {
        SamlResponseError::new(SamlResponseErrorKind::InvalidTimestamp {
            field: field_name.to_string(),
            value: value.to_string(),
        })
    })?;

    match bound {
        WindowBound::NotBefore => {
            // Allow clock skew: fail only when now + skew < NotBefore.
            let adjusted_now =
                Timestamp::from_unix_secs(now.unix_epoch_secs().saturating_add(skew));
            if adjusted_now.is_before(&value_ts) {
                warn!(not_before = %value, "{warn_msg}");
                return Err(SamlResponseError::new(SamlResponseErrorKind::NotYetValid {
                    not_before: value.to_string(),
                }));
            }
        }
        WindowBound::NotOnOrAfter => {
            // Allow clock skew: fail only when NotOnOrAfter + skew <= now.
            let adjusted =
                Timestamp::from_unix_secs(value_ts.unix_epoch_secs().saturating_add(skew));
            if adjusted.is_expired(now) {
                warn!(not_on_or_after = %value, "{warn_msg}");
                return Err(SamlResponseError::new(SamlResponseErrorKind::Expired {
                    not_on_or_after: value.to_string(),
                }));
            }
        }
    }

    Ok(())
}

impl SamlResponse {
    /// Parse a Base64-encoded SAML Response (as typically received via the
    /// HTTP-POST binding) **without verifying its XML signature**.
    ///
    /// # Security — the result is UNVERIFIED
    ///
    /// The returned [`SamlResponse`] is parsed only; its `IdP` digital
    /// signature is **not** checked (this crate does not implement XML-DSig).
    /// Every field — issuer, audience, `NameID`, attributes — is therefore
    /// attacker-controlled. The `_unverified` suffix is deliberate: a caller
    /// MUST verify the XML signature against the `IdP` certificate (e.g. via an
    /// external XML-DSig layer) before trusting anything in the result. See
    /// the [`saml` module docs](super).
    ///
    /// # Errors
    ///
    /// Returns [`SamlResponseError`] if base64 decoding or XML parsing fails.
    pub fn parse_base64_unverified(encoded: &str) -> Result<Self, SamlResponseError> {
        // SECURITY: bound the input *before* decoding so an attacker cannot
        // force a large heap allocation up front. base64 expands ~4/3, so an
        // input under this ceiling can never decode to more than the
        // `parse_xml` `MAX_XML_SIZE` limit applied afterwards. This bound
        // relies on `base64_decode` rejecting embedded whitespace/newlines
        // (it does); a future switch to a whitespace-tolerant decoder, where
        // encoded length no longer tracks decoded length, must revisit it.
        const MAX_ENCODED_LEN: usize = crate::xml::MAX_XML_SIZE / 3 * 4 + 4;
        debug!("saml: decoding base64 response");
        if encoded.len() > MAX_ENCODED_LEN {
            return Err(SamlResponseError::new(SamlResponseErrorKind::XmlParse(
                XmlParseError::InputTooLarge,
            )));
        }
        let decoded = crate::encoding::base64_decode(encoded).map_err(|e| {
            SamlResponseError::new(SamlResponseErrorKind::Base64Decode(e.to_string()))
        })?;
        let xml_str = String::from_utf8(decoded)
            .map_err(|_| SamlResponseError::new(SamlResponseErrorKind::InvalidUtf8))?;
        Self::parse_xml_unverified(&xml_str)
    }

    /// Parse raw SAML Response XML **without verifying its XML signature**.
    ///
    /// # Security — the result is UNVERIFIED
    ///
    /// See [`parse_base64_unverified`](Self::parse_base64_unverified): the
    /// signature is not checked, so the result is fully attacker-controlled
    /// until the caller verifies the `IdP` signature externally.
    ///
    /// # Errors
    ///
    /// Returns [`SamlResponseError`] if parsing or required-element
    /// extraction fails.
    pub fn parse_xml_unverified(xml: &str) -> Result<Self, SamlResponseError> {
        let root = parse_xml(xml)?;
        let response = Self::from_element(&root)?;
        // SECURITY: Log response ID and status only — never log raw XML.
        debug!(
            id = %response.id,
            status = ?response.status,
            "saml: response parsed"
        );
        Ok(response)
    }

    /// Validate the response's **conditions** against the given SP/IdP
    /// configuration. This is NOT a full SAML validation — it does not, and
    /// cannot, verify the XML signature or prevent replay.
    ///
    /// Checks:
    /// - At least one assertion is present (an empty/zero-assertion response
    ///   is rejected)
    /// - Status is `Success`
    /// - Destination matches the ACS URL (if present)
    /// - Response-level issuer matches the `IdP` entity ID (if present)
    /// - Assertion issuer matches the `IdP` entity ID
    /// - An `AudienceRestriction` is present **and** includes the SP entity
    ///   ID (an assertion with no audience restriction is rejected)
    /// - Subject confirmation `Recipient` (when present) matches the ACS URL,
    ///   and its `NotOnOrAfter` has not passed
    /// - Temporal conditions (`NotBefore`, `NotOnOrAfter`) against the
    ///   current wall-clock time
    ///
    /// # Security — signature & replay are the CALLER's responsibility
    ///
    /// The method name carries `_conditions_only` because this is **not** a
    /// trust decision:
    ///
    /// 1. **No signature check.** The XML digital signature is not verified
    ///    (this crate has no XML-DSig). An attacker who can deliver XML to
    ///    the ACS can satisfy every check here with a forged assertion. The
    ///    caller MUST verify the `IdP` signature externally first.
    /// 2. **No replay protection.** The crate is storage-free, so it cannot
    ///    track consumed assertion IDs. The caller MUST keep a replay cache
    ///    keyed on the assertion ID (TTL ≥ the validity window) and reject
    ///    re-presentation.
    /// 3. **No `InResponseTo` matching.** For SP-initiated SSO the caller
    ///    MUST confirm `subject().in_response_to()` equals an outstanding
    ///    `AuthnRequest` ID it issued (and reject unsolicited assertions
    ///    unless IdP-initiated SSO is explicitly supported).
    /// 4. **Bearer confirmation is not required.** The `Recipient` /
    ///    `NotOnOrAfter` binding is checked only when a bearer
    ///    `SubjectConfirmationData` is present. An assertion with no bearer
    ///    confirmation passes these checks vacuously, so a caller relying on
    ///    the recipient binding MUST confirm `subject().recipient().is_some()`.
    ///
    /// # Errors
    ///
    /// Returns [`SamlResponseError`] describing the first validation failure.
    pub fn validate_conditions_only(&self, config: &SamlConfig) -> Result<(), SamlResponseError> {
        // Status must be Success.
        if self.status != SamlStatus::Success {
            warn!(status = ?self.status, "saml: non-success status");
            return Err(SamlResponseError::new(
                SamlResponseErrorKind::NonSuccessStatus(self.status.clone()),
            ));
        }

        self.validate_destination(config)?;

        // Response-level Issuer, when present, must be the configured IdP
        // (SAML Core §3.2.2). Absent is allowed (the element is optional and
        // the assertion Issuer is independently checked per assertion).
        if let Some(resp_issuer) = self.issuer.as_deref() {
            if resp_issuer != config.idp_entity_id() {
                warn!(
                    expected = %config.idp_entity_id(),
                    "saml: response issuer mismatch"
                );
                return Err(SamlResponseError::new(
                    SamlResponseErrorKind::IssuerMismatch {
                        expected: config.idp_entity_id().to_string(),
                        actual: resp_issuer.to_string(),
                    },
                ));
            }
        }

        // SECURITY: a response with no usable assertion must NOT validate —
        // otherwise a caller that treats Ok as "authenticated" would accept
        // an empty (or all-malformed) response. `from_element` fails closed
        // on malformed assertions, so an empty vec means "nothing usable".
        if self.assertions.is_empty() {
            warn!("saml: response carried no usable assertion");
            return Err(SamlResponseError::new(SamlResponseErrorKind::NoAssertions));
        }

        for assertion in &self.assertions {
            Self::validate_assertion(assertion, config)?;
        }

        info!(
            assertions = self.assertions.len(),
            "saml: conditions validated"
        );
        Ok(())
    }

    /// Validates destination matches ACS URL.
    fn validate_destination(&self, config: &SamlConfig) -> Result<(), SamlResponseError> {
        if let Some(ref dest) = self.destination {
            if dest != config.acs_url() {
                // SECURITY: Log expected and actual destinations — these are
                // endpoint URLs, not secrets.
                warn!(
                    expected = %config.acs_url(),
                    actual = %dest,
                    "saml: destination mismatch"
                );
                return Err(SamlResponseError::new(
                    SamlResponseErrorKind::DestinationMismatch {
                        expected: config.acs_url().to_string(),
                        actual: dest.clone(),
                    },
                ));
            }
        }
        Ok(())
    }

    /// Validates a single assertion against the configuration.
    fn validate_assertion(
        assertion: &SamlAssertion,
        config: &SamlConfig,
    ) -> Result<(), SamlResponseError> {
        // Issuer must match IdP entity ID.
        if assertion.issuer() != config.idp_entity_id() {
            warn!(
                expected = %config.idp_entity_id(),
                actual = %assertion.issuer(),
                "saml: issuer mismatch"
            );
            return Err(SamlResponseError::new(
                SamlResponseErrorKind::IssuerMismatch {
                    expected: config.idp_entity_id().to_string(),
                    actual: assertion.issuer().to_string(),
                },
            ));
        }

        // Audience restrictions must be PRESENT and admit this SP.
        // SECURITY: an assertion with no AudienceRestriction is rejected —
        // treating "absent" as "valid for every SP" would let an assertion
        // minted for another SP be replayed here (confused deputy). Per SAML
        // Core §2.5.1.4 the SP must appear in EVERY restriction (AND across,
        // OR within): an issuer that scopes an assertion to the intersection
        // of two restrictions must not have it accepted on one alone.
        let entity_id = config.entity_id();
        let restrictions = assertion.conditions().audience_restrictions();
        let audience_ok = !restrictions.is_empty()
            && restrictions
                .iter()
                .all(|restriction| restriction.iter().any(|a| a == entity_id));
        if !audience_ok {
            warn!(expected = %entity_id, "saml: audience missing or mismatched");
            return Err(SamlResponseError::new(
                SamlResponseErrorKind::AudienceMismatch {
                    expected: entity_id.to_string(),
                },
            ));
        }

        // Subject confirmation Recipient (when present) must address this SP's
        // ACS URL — prevents an assertion captured for one endpoint being
        // redirected to another (SAML Web Browser SSO §4.1.4.3).
        if let Some(recipient) = assertion.subject().recipient() {
            if recipient != config.acs_url() {
                warn!(
                    expected = %config.acs_url(),
                    actual = %recipient,
                    "saml: subject confirmation recipient mismatch"
                );
                return Err(SamlResponseError::new(
                    SamlResponseErrorKind::RecipientMismatch {
                        expected: config.acs_url().to_string(),
                        actual: recipient.to_string(),
                    },
                ));
            }
        }

        // Temporal conditions: parse SAML timestamps into `Timestamp`
        // values and compare numerically via epoch seconds. This avoids
        // relying on lexicographic string ordering which is fragile for
        // non-UTC timezone offsets.
        //
        // Clock skew tolerance: IdP and SP clocks may be slightly out of
        // sync. We allow a configurable tolerance (default 60 s) so that
        // minor drift does not cause spurious validation failures.
        let now_ts = Timestamp::now();
        let skew = config.clock_skew_secs();

        // SECURITY: require SOME upper bound. `check_window` returns Ok for an
        // absent timestamp (correct in isolation — each bound is optional in
        // the schema), and no caller required any of the three, so an assertion
        // whose `<Conditions>` carried only an `AudienceRestriction` was valid
        // forever. A captured bearer assertion with no deadline is replayable
        // indefinitely.
        if assertion.conditions().not_on_or_after().is_none()
            && assertion.subject().confirmation_not_on_or_after().is_none()
        {
            return Err(SamlResponseError::missing_element(
                "Assertion NotOnOrAfter (Conditions or SubjectConfirmationData)",
            ));
        }

        check_window(
            "NotBefore",
            assertion.conditions().not_before(),
            skew,
            &now_ts,
            WindowBound::NotBefore,
            "saml: assertion not yet valid",
        )?;

        check_window(
            "NotOnOrAfter",
            assertion.conditions().not_on_or_after(),
            skew,
            &now_ts,
            WindowBound::NotOnOrAfter,
            "saml: assertion expired",
        )?;

        // SubjectConfirmationData/@NotOnOrAfter is the (usually tighter)
        // delivery deadline for the assertion. Enforce it the same way as the
        // Conditions deadline so a captured assertion can't be delivered late.
        check_window(
            "SubjectConfirmationData/NotOnOrAfter",
            assertion.subject().confirmation_not_on_or_after(),
            skew,
            &now_ts,
            WindowBound::NotOnOrAfter,
            "saml: subject confirmation expired",
        )?;

        Ok(())
    }

    /// Build a `SamlResponse` from a parsed XML element tree.
    fn from_element(root: &XmlElement) -> Result<Self, SamlResponseError> {
        // SECURITY: the root must actually BE a samlp:Response. Version, ID,
        // IssueInstant and a Status child were all validated while the element
        // name and namespace were not, so any same-shaped document was
        // accepted as a Response. Mirrors the root check in `idp.rs`.
        if root.name() != "Response" || root.namespace().is_some_and(|ns| ns != SAMLP_NS) {
            return Err(SamlResponseError::missing_element("Response"));
        }

        // SECURITY: `Version="2.0"` is mandatory (SAML Core §3.2.2). Reject a
        // missing or mismatched version rather than processing a document of
        // an unknown SAML version, consistent with the crate's fail-closed
        // posture on every other structurally-required attribute.
        if root.attribute("Version") != Some("2.0") {
            return Err(SamlResponseError::new(
                SamlResponseErrorKind::InvalidVersion("Response".to_string()),
            ));
        }

        // Response attributes.
        let id = root
            .attribute("ID")
            .ok_or_else(|| {
                SamlResponseError::new(SamlResponseErrorKind::MissingElement(
                    "Response/@ID".to_string(),
                ))
            })?
            .to_string();

        let issue_instant = root
            .attribute("IssueInstant")
            .ok_or_else(|| {
                SamlResponseError::new(SamlResponseErrorKind::MissingElement(
                    "Response/@IssueInstant".to_string(),
                ))
            })?
            .to_string();

        let destination = root.attribute("Destination").map(String::from);

        // Response-level Issuer (optional; SAML Core §3.2.2). Distinct from the
        // assertion Issuer. Parsed and exposed so the caller — and
        // `validate_conditions_only` — can cross-check it; an attacker shaping
        // the unsigned envelope can set it arbitrarily, so validating it when
        // present is defense-in-depth alongside the (caller-verified) signature.
        let issuer = find_response_issuer(root).and_then(|el| el.text_content().map(String::from));

        // Status
        let status_el = find_protocol_child(root, "Status").ok_or_else(|| {
            SamlResponseError::new(SamlResponseErrorKind::MissingElement("Status".to_string()))
        })?;
        let status_code_el = find_protocol_child(status_el, "StatusCode").ok_or_else(|| {
            SamlResponseError::new(SamlResponseErrorKind::MissingElement(
                "StatusCode".to_string(),
            ))
        })?;
        let status_value = status_code_el.attribute("Value").ok_or_else(|| {
            SamlResponseError::new(SamlResponseErrorKind::MissingElement(
                "StatusCode/@Value".to_string(),
            ))
        })?;

        let status = match status_value {
            STATUS_SUCCESS => SamlStatus::Success,
            STATUS_REQUESTER => SamlStatus::Requester,
            STATUS_RESPONDER => SamlStatus::Responder,
            STATUS_VERSION_MISMATCH => SamlStatus::VersionMismatch,
            other => SamlStatus::Unknown(other.to_string()),
        };

        // Assertions. SECURITY: fail closed — a malformed assertion is a
        // hard error, not a silently-dropped one. Dropping it could leave a
        // response that parsed structurally but carries no usable subject,
        // which a caller might misread as a benign empty result.
        let mut assertions = Vec::new();
        // SECURITY: match `Assertion` only in the SAML namespace (or no
        // namespace) — never a foreign namespace — so an injected
        // `<evil:Assertion>` decoy cannot be smuggled into the set.
        let assertion_els: Vec<_> = root
            .children()
            .iter()
            .filter(|c| c.name() == "Assertion" && c.namespace().is_none_or(|ns| ns == SAML_NS))
            .collect();
        for a_el in assertion_els {
            assertions.push(parse_assertion(a_el)?);
        }

        Ok(Self {
            id,
            issue_instant,
            destination,
            issuer,
            status,
            assertions,
        })
    }
}

/// Find a child in the SAML protocol namespace (or `SAML_NS`, or no
/// namespace), never a foreign namespace — see [`find_response_issuer`] for
/// the rationale behind rejecting foreign-namespaced decoys.
fn find_protocol_child<'a>(parent: &'a XmlElement, local_name: &str) -> Option<&'a XmlElement> {
    parent.children().iter().find(|c| {
        c.name() == local_name
            && c.namespace()
                .is_none_or(|ns| ns == SAMLP_NS || ns == SAML_NS)
    })
}

/// Find the Response-level `<Issuer>` (SAML assertion namespace, or no
/// namespace). A foreign namespace is not matched, mirroring the
/// signature-wrapping defense applied to the assertion-level lookups.
fn find_response_issuer(parent: &XmlElement) -> Option<&XmlElement> {
    parent
        .children()
        .iter()
        .find(|c| c.name() == "Issuer" && c.namespace().is_none_or(|ns| ns == SAML_NS))
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;

    fn sample_response_xml() -> String {
        // NOTE: Temporal conditions use a far-past NotBefore and far-future
        // NotOnOrAfter so that validation passes regardless of wall-clock time.
        r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_resp123"
                         IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
            <samlp:Status>
                <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
            </samlp:Status>
            <saml:Assertion Version="2.0" ID="_assert456" IssueInstant="2025-01-15T12:00:00Z">
                <saml:Issuer>https://idp.example.com</saml:Issuer>
                <saml:Subject>
                    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@example.com</saml:NameID>
                </saml:Subject>
                <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                    <saml:AudienceRestriction>
                        <saml:Audience>https://sp.example.com</saml:Audience>
                    </saml:AudienceRestriction>
                </saml:Conditions>
                <saml:AttributeStatement>
                    <saml:Attribute Name="email">
                        <saml:AttributeValue>user@example.com</saml:AttributeValue>
                    </saml:Attribute>
                </saml:AttributeStatement>
            </saml:Assertion>
        </samlp:Response>"#.to_string()
    }

    fn test_config() -> SamlConfig {
        SamlConfig::new(
            "https://sp.example.com",
            "https://sp.example.com/acs",
            "https://idp.example.com/sso",
            "https://idp.example.com",
        )
        .unwrap()
    }

    // -- Response parsing -------------------------------------------------

    #[test]
    fn parse_valid_response() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        assert_eq!(resp.id(), "_resp123");
        assert_eq!(resp.issue_instant(), "2025-01-15T12:00:00Z");
        assert_eq!(resp.destination(), Some("https://sp.example.com/acs"));
        assert_eq!(*resp.status(), SamlStatus::Success);
    }

    #[test]
    fn parse_response_assertions() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        assert_eq!(resp.assertions().len(), 1);
        let assertion = &resp.assertions()[0];
        assert_eq!(assertion.issuer(), "https://idp.example.com");
        assert_eq!(assertion.subject().name_id(), "user@example.com");
    }

    #[test]
    fn parse_response_status_codes() {
        let make_response = |status: &str| {
            format!(
                r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     ID="_r1" IssueInstant="2025-01-01T00:00:00Z">
                    <samlp:Status>
                        <samlp:StatusCode Value="{status}"/>
                    </samlp:Status>
                </samlp:Response>"#
            )
        };

        let resp = SamlResponse::parse_xml_unverified(&make_response(STATUS_SUCCESS)).unwrap();
        assert_eq!(*resp.status(), SamlStatus::Success);

        let resp = SamlResponse::parse_xml_unverified(&make_response(STATUS_REQUESTER)).unwrap();
        assert_eq!(*resp.status(), SamlStatus::Requester);

        let resp = SamlResponse::parse_xml_unverified(&make_response(STATUS_RESPONDER)).unwrap();
        assert_eq!(*resp.status(), SamlStatus::Responder);

        let resp =
            SamlResponse::parse_xml_unverified(&make_response(STATUS_VERSION_MISMATCH)).unwrap();
        assert_eq!(*resp.status(), SamlStatus::VersionMismatch);
    }

    // -- Base64 decoding --------------------------------------------------

    #[test]
    fn parse_base64_response() {
        let xml = sample_response_xml();
        let encoded = crate::encoding::base64_encode(xml.as_bytes());
        let resp = SamlResponse::parse_base64_unverified(&encoded).unwrap();
        assert_eq!(resp.id(), "_resp123");
        assert_eq!(*resp.status(), SamlStatus::Success);
    }

    #[test]
    fn parse_base64_invalid() {
        let err = SamlResponse::parse_base64_unverified("not-valid-base64!!!").unwrap_err();
        assert!(err.is_base64_decode());
    }

    #[test]
    fn parse_base64_rejects_embedded_whitespace() {
        // The pre-decode size bound (MAX_ENCODED_LEN) relies on the decoder
        // rejecting embedded whitespace so encoded length tracks decoded
        // length. Pin that invariant: base64 with interior whitespace/newlines
        // must be rejected, not silently accepted (which a future
        // whitespace-tolerant decoder would do, breaking the bound).
        let xml = sample_response_xml();
        let encoded = crate::encoding::base64_encode(xml.as_bytes());
        let with_ws = format!("{}\n{}", &encoded[..8], &encoded[8..]);
        let err = SamlResponse::parse_base64_unverified(&with_ws).unwrap_err();
        assert!(err.is_base64_decode());
    }

    #[test]
    fn parse_base64_oversized_input_rejected_before_decode() {
        // An input larger than the base64 expansion of MAX_XML_SIZE must be
        // rejected up front, without allocating the decoded buffer.
        let oversized = "A".repeat(crate::xml::MAX_XML_SIZE / 3 * 4 + 8);
        let err = SamlResponse::parse_base64_unverified(&oversized).unwrap_err();
        assert!(err.is_xml_parse());
    }

    #[test]
    fn parse_base64_invalid_utf8_is_distinct_error() {
        // Valid base64 that decodes to non-UTF-8 bytes reports InvalidUtf8,
        // not a (misleading) base64 decode error.
        let encoded = crate::encoding::base64_encode(&[0xff, 0xfe, 0xfd]);
        let err = SamlResponse::parse_base64_unverified(&encoded).unwrap_err();
        assert!(err.is_invalid_utf8());
        assert!(!err.is_base64_decode());
    }

    // -- Validation -------------------------------------------------------

    #[test]
    fn validate_success() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn validate_rejects_response_issuer_mismatch() {
        // A Response-level <Issuer> that is not the configured IdP is rejected.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <saml:Issuer>https://evil.example.com</saml:Issuer>
                    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject><saml:NameID>user@example.com</saml:NameID></saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction><saml:Audience>https://sp.example.com</saml:Audience></saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        assert_eq!(resp.issuer(), Some("https://evil.example.com"));
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_issuer_mismatch(), "got: {err}");
    }

    #[test]
    fn validate_accepts_matching_response_issuer() {
        let xml = sample_response_xml().replace(
            "<saml:Assertion",
            "<saml:Issuer>https://idp.example.com</saml:Issuer><saml:Assertion",
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        assert_eq!(resp.issuer(), Some("https://idp.example.com"));
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn non_bearer_subject_confirmation_is_ignored() {
        // A holder-of-key confirmation (explicitly non-bearer) carrying a
        // mismatched Recipient must NOT be treated as the bearer binding —
        // its Recipient is skipped, so validation does not fail on it.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                                <saml:SubjectConfirmationData Recipient="https://evil.example.com/acs"/>
                            </saml:SubjectConfirmation>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction><saml:Audience>https://sp.example.com</saml:Audience></saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        // The non-bearer confirmation's Recipient was ignored (None), so no
        // recipient-mismatch failure.
        assert_eq!(resp.assertions()[0].subject().recipient(), None);
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn foreign_namespace_assertion_is_not_collected() {
        // An <evil:Assertion> in a non-SAML namespace must not be picked up as
        // a real assertion (signature-wrapping decoy).
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:evil="urn:evil"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z">
                    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
                    <evil:Assertion ID="_a1"><evil:Issuer>x</evil:Issuer></evil:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        assert_eq!(resp.assertions().len(), 0);
        // With no usable assertion, validation fails closed.
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_no_assertions(), "got: {err}");
    }

    #[test]
    fn validate_requires_sp_in_every_audience_restriction() {
        // Two AudienceRestrictions: the SP is in the first but not the second.
        // SAML Core §2.5.1.4 requires the SP in EVERY restriction, so this is
        // rejected (the issuer scoped the assertion to the intersection).
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject><saml:NameID>user@example.com</saml:NameID></saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction><saml:Audience>https://sp.example.com</saml:Audience></saml:AudienceRestriction>
                            <saml:AudienceRestriction><saml:Audience>https://other.example.com</saml:Audience></saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_audience_mismatch(), "got: {err}");
    }

    #[test]
    fn validate_accepts_sp_in_all_restrictions_with_multiple_audiences() {
        // SP present in every restriction (OR within each) → accepted.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject><saml:NameID>user@example.com</saml:NameID></saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://other.example.com</saml:Audience>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                            <saml:AudienceRestriction><saml:Audience>https://sp.example.com</saml:Audience></saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn validate_destination_mismatch() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        let cfg = SamlConfig::new(
            "https://sp.example.com",
            "https://other.example.com/acs",
            "https://idp.example.com/sso",
            "https://idp.example.com",
        )
        .unwrap();
        let err = resp.validate_conditions_only(&cfg).unwrap_err();
        assert!(err.is_destination_mismatch());
    }

    #[test]
    fn validate_issuer_mismatch() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        let cfg = SamlConfig::new(
            "https://sp.example.com",
            "https://sp.example.com/acs",
            "https://idp.example.com/sso",
            "https://other-idp.example.com",
        )
        .unwrap();
        let err = resp.validate_conditions_only(&cfg).unwrap_err();
        assert!(err.is_issuer_mismatch());
    }

    #[test]
    fn validate_audience_mismatch() {
        let resp = SamlResponse::parse_xml_unverified(&sample_response_xml()).unwrap();
        let cfg = SamlConfig::new(
            "https://wrong-sp.example.com",
            "https://sp.example.com/acs",
            "https://idp.example.com/sso",
            "https://idp.example.com",
        )
        .unwrap();
        let err = resp.validate_conditions_only(&cfg).unwrap_err();
        assert!(err.is_audience_mismatch());
    }

    #[test]
    fn validate_non_success_status() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         ID="_r1" IssueInstant="2025-01-01T00:00:00Z">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>
                    </samlp:Status>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_non_success_status());
        assert!(
            err.to_string().contains("Responder"),
            "expected Responder in message, got: {err}",
        );
    }

    // -- Hardening: no assertions / absent audience / recipient (H6/H7/H8) -

    #[test]
    fn validate_rejects_zero_assertion_success_response() {
        // A Success response with no assertion must NOT validate.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         ID="_r1" IssueInstant="2025-01-01T00:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_no_assertions(), "expected NoAssertions, got: {err}");
    }

    #[test]
    fn validate_rejects_absent_audience_restriction() {
        // An assertion with NO AudienceRestriction must be rejected, not
        // treated as valid for every SP.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z"/>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(
            err.is_audience_mismatch(),
            "expected AudienceMismatch, got: {err}"
        );
    }

    #[test]
    fn validate_rejects_recipient_mismatch() {
        // A SubjectConfirmationData Recipient that is not our ACS URL fails.
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                            <saml:SubjectConfirmation>
                                <saml:SubjectConfirmationData Recipient="https://evil.example.com/acs"/>
                            </saml:SubjectConfirmation>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(
            err.is_recipient_mismatch(),
            "expected RecipientMismatch, got: {err}"
        );
    }

    #[test]
    fn validate_accepts_matching_recipient_and_exposes_in_response_to() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                            <saml:SubjectConfirmation>
                                <saml:SubjectConfirmationData Recipient="https://sp.example.com/acs" InResponseTo="_req42" NotOnOrAfter="2099-12-31T23:59:59Z"/>
                            </saml:SubjectConfirmation>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        resp.validate_conditions_only(&test_config()).unwrap();
        assert_eq!(
            resp.assertions()[0].subject().in_response_to(),
            Some("_req42"),
        );
    }

    // -- XML parse errors -------------------------------------------------

    #[test]
    fn parse_invalid_xml_returns_xml_parse_error() {
        let err = SamlResponse::parse_xml_unverified("<<<not xml>>>").unwrap_err();
        assert!(err.is_xml_parse());
    }

    // -- Missing elements -------------------------------------------------

    #[test]
    fn parse_missing_id() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         IssueInstant="2025-01-01T00:00:00Z">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                </samlp:Response>"#;
        let err = SamlResponse::parse_xml_unverified(xml).unwrap_err();
        assert!(err.is_missing_element());
    }

    // -- Temporal validation -----------------------------------------------

    #[test]
    fn validate_expired_assertion() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="2020-01-01T00:00:01Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_expired(), "expected Expired, got: {err}");
    }

    #[test]
    fn validate_not_yet_valid_assertion() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2099-12-31T23:59:59Z" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_not_yet_valid(), "expected NotYetValid, got: {err}");
    }

    #[test]
    fn parse_response_unknown_status_code() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     ID="_r1" IssueInstant="2025-01-01T00:00:00Z">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:CustomError"/>
                    </samlp:Status>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        assert!(matches!(resp.status(), SamlStatus::Unknown(_)));
    }

    // -- SamlStatus Display ------------------------------------------------

    #[test]
    fn status_display_success() {
        assert_eq!(SamlStatus::Success.to_string(), "Success");
    }

    #[test]
    fn status_display_requester() {
        assert_eq!(SamlStatus::Requester.to_string(), "Requester");
    }

    #[test]
    fn status_display_responder() {
        assert_eq!(SamlStatus::Responder.to_string(), "Responder");
    }

    #[test]
    fn status_display_version_mismatch() {
        assert_eq!(SamlStatus::VersionMismatch.to_string(), "VersionMismatch");
    }

    // -- Invalid timestamp (H3) --------------------------------------------

    #[test]
    fn validate_invalid_not_before_timestamp() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="not-a-timestamp" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(
            err.is_invalid_timestamp(),
            "expected InvalidTimestamp, got: {err}",
        );
        assert!(err.to_string().contains("NotBefore"), "got: {err}");
        assert!(err.to_string().contains("not-a-timestamp"), "got: {err}");
    }

    #[test]
    fn validate_invalid_not_on_or_after_timestamp() {
        let xml = r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="garbage">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#;
        let resp = SamlResponse::parse_xml_unverified(xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(
            err.is_invalid_timestamp(),
            "expected InvalidTimestamp, got: {err}",
        );
        assert!(err.to_string().contains("NotOnOrAfter"), "got: {err}");
        assert!(err.to_string().contains("garbage"), "got: {err}");
    }

    // -- Clock skew tolerance (M4) -----------------------------------------

    #[test]
    fn validate_expired_within_skew_tolerance_passes() {
        // An assertion whose NotOnOrAfter is 30 seconds in the past should
        // still validate with the default 60-second skew tolerance.

        let now = Timestamp::now();
        let expired_30s_ago = now.unix_epoch_secs().saturating_sub(30);
        let ts = Timestamp::from_unix_secs(expired_30s_ago);
        let not_on_or_after = format!(
            "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
            ts.year(),
            ts.month(),
            ts.day(),
            ts.hour(),
            ts.minute(),
            ts.second(),
        );

        let xml = format!(
            r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="{not_on_or_after}">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        // Default clock_skew_secs=60 should tolerate 30s of drift.
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn validate_expired_beyond_skew_tolerance_fails() {
        // An assertion whose NotOnOrAfter is 120 seconds in the past should
        // fail even with the default 60-second skew tolerance.

        let now = Timestamp::now();
        let expired_120s_ago = now.unix_epoch_secs().saturating_sub(120);
        let ts = Timestamp::from_unix_secs(expired_120s_ago);
        let not_on_or_after = format!(
            "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
            ts.year(),
            ts.month(),
            ts.day(),
            ts.hour(),
            ts.minute(),
            ts.second(),
        );

        let xml = format!(
            r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="{not_on_or_after}">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_expired(), "expected Expired, got: {err}");
    }

    #[test]
    fn validate_zero_skew_rejects_any_drift() {
        // With clock_skew_secs=0, even 1 second past NotOnOrAfter should fail.

        let now = Timestamp::now();
        let expired_2s_ago = now.unix_epoch_secs().saturating_sub(2);
        let ts = Timestamp::from_unix_secs(expired_2s_ago);
        let not_on_or_after = format!(
            "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
            ts.year(),
            ts.month(),
            ts.day(),
            ts.hour(),
            ts.minute(),
            ts.second(),
        );

        let xml = format!(
            r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="2020-01-01T00:00:00Z" NotOnOrAfter="{not_on_or_after}">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        let cfg = test_config().with_clock_skew_secs(0);
        let err = resp.validate_conditions_only(&cfg).unwrap_err();
        assert!(err.is_expired(), "expected Expired, got: {err}");
    }

    #[test]
    fn validate_not_before_within_skew_tolerance_passes() {
        // An assertion whose NotBefore is 30 seconds in the future should
        // still validate with the default 60-second skew tolerance.

        let now = Timestamp::now();
        let future_30s = now.unix_epoch_secs().saturating_add(30);
        let ts = Timestamp::from_unix_secs(future_30s);
        let not_before = format!(
            "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
            ts.year(),
            ts.month(),
            ts.day(),
            ts.hour(),
            ts.minute(),
            ts.second(),
        );

        let xml = format!(
            r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="{not_before}" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        // Default clock_skew_secs=60 should tolerate 30s of drift.
        resp.validate_conditions_only(&test_config()).unwrap();
    }

    #[test]
    fn validate_not_before_beyond_skew_tolerance_fails() {
        // An assertion whose NotBefore is 120 seconds in the future should
        // fail even with the default 60-second skew tolerance.

        let now = Timestamp::now();
        let future_120s = now.unix_epoch_secs().saturating_add(120);
        let ts = Timestamp::from_unix_secs(future_120s);
        let not_before = format!(
            "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
            ts.year(),
            ts.month(),
            ts.day(),
            ts.hour(),
            ts.minute(),
            ts.second(),
        );

        let xml = format!(
            r#"<samlp:Response Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                         ID="_r1" IssueInstant="2025-01-15T12:00:00Z"
                         Destination="https://sp.example.com/acs">
                    <samlp:Status>
                        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                    </samlp:Status>
                    <saml:Assertion Version="2.0" ID="_a1" IssueInstant="2025-01-15T12:00:00Z">
                        <saml:Issuer>https://idp.example.com</saml:Issuer>
                        <saml:Subject>
                            <saml:NameID>user@example.com</saml:NameID>
                        </saml:Subject>
                        <saml:Conditions NotBefore="{not_before}" NotOnOrAfter="2099-12-31T23:59:59Z">
                            <saml:AudienceRestriction>
                                <saml:Audience>https://sp.example.com</saml:Audience>
                            </saml:AudienceRestriction>
                        </saml:Conditions>
                    </saml:Assertion>
                </samlp:Response>"#
        );
        let resp = SamlResponse::parse_xml_unverified(&xml).unwrap();
        let err = resp.validate_conditions_only(&test_config()).unwrap_err();
        assert!(err.is_not_yet_valid(), "expected NotYetValid, got: {err}");
    }
}