Skip to content

Document FakeAuthenticator's deliberate leniencies #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JanTvrdik merged 1 commit into from
Jul 13, 2026
Merged

Document FakeAuthenticator's deliberate leniencies #37

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/Testing/FakeAuthenticator.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,12 @@
* Malformed or unacceptable options throw a {@see LogicException} — in a test, both indicate a
* bug, either in the relying party under test or in the test itself.
*
* Two deliberate simplifications, so you know what your tests do *not* cover: unlike a real
* client, it takes the RP ID from the options at face value instead of validating it against the
* origin — a mismatched `rpId`/`origins` configuration therefore passes here and only fails in a
* real browser; and it always reports itself as a platform authenticator
* (`authenticatorAttachment: "platform"`, `transports: ["internal"]`).
Comment thread
JanTvrdik marked this conversation as resolved.
*
* @api
*/
final class FakeAuthenticator
Expand Down Expand Up @@ -111,7 +117,8 @@ public function __construct(
*
* Mirroring a real client, it refuses (`InvalidStateError`) when `excludeCredentials` lists a
* passkey it already holds for the RP, and (`NotSupportedError`) when `pubKeyCredParams` does
* not offer the authenticator's algorithm.
* not offer the authenticator's algorithm. Unlike a real client, it does not check that the
* RP ID is a registrable suffix of the origin.
Comment thread
JanTvrdik marked this conversation as resolved.
*
* @param string $creationOptionsJson the JSON your registration-options endpoint returned
*/
Expand Down