Security hardening: enforce secure URLs and transport safeguards

tests/ConfigSecurityTest.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Tests;
+
+use BlackWall\Auth\Config;
+use PHPUnit\Framework\TestCase;
+
+final class ConfigSecurityTest extends TestCase
+{
+    public function testRejectsInsecureHttpForNonLocalhostByDefault(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        Config::fromArray([
+            'clientId' => 'client-123',
+            'authorizeUrl' => 'http://provider.example/oauth/authorize',
+            'tokenUrl' => 'https://provider.example/oauth/token',
+            'userInfoUrl' => 'https://provider.example/oauth/userinfo',
+            'redirectUri' => 'https://app.example/callback.php',
+        ]);
+    }
+
+    public function testAllowsInsecureHttpForLocalhostWhenExplicitlyEnabled(): void
+    {
+        $config = Config::fromArray([
+            'clientId' => 'client-123',
+            'authorizeUrl' => 'http://localhost/oauth/authorize',
+            'tokenUrl' => 'http://127.0.0.1/oauth/token',
+            'userInfoUrl' => 'http://localhost/oauth/userinfo',
+            'redirectUri' => 'http://localhost/callback.php',
+            'allowInsecureHttp' => true,
+        ]);
+
+        self::assertTrue($config->allowInsecureHttp);
+        self::assertSame('http://localhost/oauth/authorize', $config->authorizeUrl);
+    }
+}
+

tests/CurlHttpClientSecurityTest.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace BlackWall\Auth\Tests;
+
+use BlackWall\Auth\Exception\TransportException;
+use BlackWall\Auth\Http\CurlHttpClient;
+use PHPUnit\Framework\TestCase;
+
+final class CurlHttpClientSecurityTest extends TestCase
+{
+    public function testRejectsUnsupportedUrlScheme(): void
+    {
+        $client = new CurlHttpClient();
+
+        $this->expectException(TransportException::class);
+        $client->get('file:///etc/passwd');
+    }
+
+    public function testRejectsHeaderInjectionAttempt(): void
+    {
+        $client = new CurlHttpClient();
+
+        $this->expectException(TransportException::class);
+        $client->get('https://example.com', [
+            'X-Test' => "ok\r\nInjected: yes",
+        ]);
+    }
+}
+