Document FakeAuthenticator's deliberate leniencies

[JanTvrdik]

Follow-up to the pre-1.0 review (item E): FakeAuthenticator has two deliberate simplifications a test author should know their tests do not cover, and neither was documented:

• it takes the RP ID from the options at face value instead of validating it against the origin, so a mismatched rpId/origins configuration passes in tests and only fails in a real browser;
• it always reports itself as a platform authenticator (authenticatorAttachment: "platform", transports: ["internal"]).

Docs-only: a paragraph on the class docblock plus a sentence on createPasskey(). (The third previously-flagged leniency — backedUp coupling BE+BS — was already documented on the constructor param.)

Co-Authored-By: Claude Code

[Copilot]

Pull request overview

Documents two intentional limitations of FakeAuthenticator so test authors understand what their tests may not cover compared to real browser/WebAuthn behavior.

Changes:

• Expanded FakeAuthenticator class docblock to describe the two deliberate simplifications (RP ID validation leniency; always “platform”/internal attachment).
• Added a clarifying note to createPasskey() docs about RP ID validation not being enforced like a real client.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.