1import { describe, expect, it } from "vitest";23import { isValidRpId } from "./passkey-utils";45describe("isValidRpId (Firefox passkey rpId↔origin validation, SEV-1-A)", () => {6 it("accepts rpId equal to the caller hostname", () => {7 expect(isValidRpId("google.com", "https://google.com")).toBe(true);8 });910 it("accepts rpId as a registrable suffix of the caller", () => {11 expect(isValidRpId("google.com", "https://accounts.google.com")).toBe(true);12 });1314 it("rejects rpId from an unrelated domain", () => {15 expect(isValidRpId("google.com", "https://evil.com")).toBe(false);16 });1718 it("rejects rpId spoofing via suffix confusion", () => {19 expect(isValidRpId("google.com", "https://evil.google.com.attacker.com")).toBe(false);20 });2122 it("rejects a public-suffix rpId for co.uk tenants", () => {23 expect(isValidRpId("co.uk", "https://evil.co.uk")).toBe(false);24 });2526 it("rejects a public-suffix rpId for github.io tenants", () => {27 expect(isValidRpId("github.io", "https://attacker.github.io")).toBe(false);28 });2930 it("rejects a bare-eTLD rpId", () => {31 expect(isValidRpId("com", "https://google.com")).toBe(false);32 });3334 it("rejects a dotless rpId such as localhost", () => {35 expect(isValidRpId("localhost", "https://localhost")).toBe(false);36 });3738 it("rejects an unparseable caller origin", () => {39 expect(isValidRpId("google.com", "not a url")).toBe(false);40 });4142 it("is case-insensitive on host and rpId", () => {43 expect(isValidRpId("Google.com", "https://ACCOUNTS.google.COM")).toBe(true);44 });45});