From 44cc1005982b0956119eab41ec5ac026faca78f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Tvrd=C3=ADk?= Date: Mon, 13 Jul 2026 19:39:23 +0200 Subject: [PATCH] Document FakeAuthenticator's deliberate leniencies Co-Authored-By: Claude Code --- src/Testing/FakeAuthenticator.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/Testing/FakeAuthenticator.php b/src/Testing/FakeAuthenticator.php index 5439f57..0674d76 100644 --- a/src/Testing/FakeAuthenticator.php +++ b/src/Testing/FakeAuthenticator.php @@ -74,6 +74,12 @@ * Malformed or unacceptable options throw a {@see LogicException} — in a test, both indicate a * bug, either in the relying party under test or in the test itself. * + * Two deliberate simplifications, so you know what your tests do *not* cover: unlike a real + * client, it takes the RP ID from the options at face value instead of validating it against the + * origin — a mismatched `rpId`/`origins` configuration therefore passes here and only fails in a + * real browser; and it always reports itself as a platform authenticator + * (`authenticatorAttachment: "platform"`, `transports: ["internal"]`). + * * @api */ final class FakeAuthenticator @@ -111,7 +117,8 @@ public function __construct( * * Mirroring a real client, it refuses (`InvalidStateError`) when `excludeCredentials` lists a * passkey it already holds for the RP, and (`NotSupportedError`) when `pubKeyCredParams` does - * not offer the authenticator's algorithm. + * not offer the authenticator's algorithm. Unlike a real client, it does not check that the + * RP ID is a registrable suffix of the origin. * * @param string $creationOptionsJson the JSON your registration-options endpoint returned */