getAuthUri implementation with HTTP/S localhost

Author: Greg Bowler

src/Authenticator.php

@@ -6,16 +6,33 @@
 
 class Authenticator {
 	private Cipher $cipher;
-	private string $hostname;
+	private string $httpsScheme = "https";
+	private string $httpHost;
 
 	public function __construct(Token $token, string $hostname) {
 		$this->cipher = $token->generateCipher();
-		$this->hostname = $hostname;
+		$this->httpHost = $hostname;
+	}
+
+	public function useLocalhostHttps(bool $useHttps = true) {
+		if(!$useHttps) {
+			if($this->httpHost !== "localhost") {
+				throw new InsecureProtocolException();
+			}
+
+			$this->httpsScheme = "http";
+		}
 	}
 
 	public function getAuthUri():UriInterface {
-		return (new Uri())
+		$uri = (new Uri())
 			->withScheme("https")
-			->withHost($this->hostname);
+			->withHost($this->httpHost);
+
+		if($this->httpHost === "localhost") {
+			$uri = $uri->withScheme($this->httpsScheme);
+		}
+
+		return $uri;
 	}
 }

src/AuthwaveException.php

@@ -0,0 +1,6 @@
+<?php
+namespace Authwave;
+
+use RuntimeException;
+
+class AuthwaveException extends RuntimeException {}

src/InsecureProtocolException.php

@@ -0,0 +1,4 @@
+<?php
+namespace Authwave;
+
+class InsecureProtocolException extends AuthwaveException {}

test/phpunit/AuthenticatorTest.php

@@ -3,7 +3,9 @@
 
 use Authwave\Authenticator;
 use Authwave\Cipher;
+use Authwave\InsecureProtocolException;
 use Authwave\Token;
+use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 
 class AuthenticatorTest extends TestCase {
@@ -20,4 +22,48 @@ public function testGetAuthUriHostname() {
 			$authUri
 		);
 	}
+
+// All AuthUris MUST be served over HTTPS, with the one exception of localhost.
+// But it should still default to HTTPS on localhost.
+	public function testGetAuthUriHostnameLocalhostHttpsByDefault() {
+		$cipher = self::createMock(Cipher::class);
+		$token = self::createMock(Token::class);
+		$token->method("generateCipher")
+			->willReturn($cipher);
+
+		$sut = new Authenticator($token, "localhost");
+		$authUri = $sut->getAuthUri();
+		self::assertStringStartsWith(
+			"https://localhost",
+			$authUri
+		);
+	}
+
+// We should be able to set the scheme to HTTP for localhost hostname only.
+	public function testGetAuthUriHostnameLocalhostHttpAllowed() {
+		$cipher = self::createMock(Cipher::class);
+		$token = self::createMock(Token::class);
+		$token->method("generateCipher")
+			->willReturn($cipher);
+
+		$sut = new Authenticator($token, "localhost");
+		$sut->useLocalhostHttps(false);
+		$authUri = $sut->getAuthUri();
+		self::assertStringStartsWith(
+			"http://localhost",
+			$authUri
+		);
+	}
+
+// We should NOT be able to set the scheme to HTTP for other hostnames.
+	public function testGetAuthUriHostnameNotLocalhostHttpNotAllowed() {
+		$cipher = self::createMock(Cipher::class);
+		$token = self::createMock(Token::class);
+		$token->method("generateCipher")
+			->willReturn($cipher);
+
+		$sut = new Authenticator($token, "localhost.com");
+		self::expectException(InsecureProtocolException::class);
+		$sut->useLocalhostHttps(false);
+	}
 }