Cover a PHP signature that pins inclusive namespace prefixes

A PHP round trip cannot prove this half: our own reader honours whatever
PrefixList it is handed, so only a conformant peer re-canonicalizing from the
declaration can tell us the pinned list and the digests agree. Emitting a wrong
PrefixList makes WSS4J answer valid:false, so the row fails for its own reason.

Author: veewee

tests/Support/Wsse.php

@@ -38,6 +38,7 @@ public static function sign(
         ?array $parts = null,
         ?string $inputXml = null,
         int $timestampTtl = 300,
+        bool $inclusivePrefixes = false,
     ): string {
         $soapVersion ??= SoapVersion::Soap12;
         $document = Document::fromXmlString($inputXml ?? Oracle::sampleEnvelope());
@@ -56,6 +57,9 @@ public static function sign(
         if ($parts !== null) {
             $signature = $signature->withParts($parts);
         }
+        if ($inclusivePrefixes) {
+            $signature = $signature->withInclusivePrefixes();
+        }
         $signature($context);
 
         return $document->toXmlString();

tests/Wsse/CanonicalizationInteropTest.php

@@ -37,6 +37,24 @@ public function test_php_inclusive_c14n_signature_is_accepted_by_wss4j(): void
         self::assertJsonStringEqualsJsonString('{"valid":true}', $response['body']);
     }
 
+    /**
+     * The outbound half of the InclusiveNamespaces feature. A PHP round trip cannot prove this: our own reader
+     * honours whatever PrefixList it is handed, so only a conformant peer re-canonicalizing from the
+     * declaration can tell us the pinned list and the digests actually agree.
+     */
+    public function test_php_signature_pinning_inclusive_prefixes_is_accepted_by_wss4j(): void
+    {
+        $signed = Wsse::sign(inclusivePrefixes: true);
+
+        self::assertStringContainsString('InclusiveNamespaces', $signed);
+        self::assertStringContainsString('PrefixList=', $signed);
+
+        $response = Oracle::post('/verify', $signed);
+
+        self::assertSame(200, $response['status']);
+        self::assertJsonStringEqualsJsonString('{"valid":true}', $response['body']);
+    }
+
     public function test_wss4j_inclusive_c14n_signature_is_accepted_by_php(): void
     {
         $javaSigned = Oracle::post('/sign?c14n=INCLUSIVE&disableBsp=true', Oracle::sampleEnvelope())['body'];