Wildcard origins + auth host configured per origin row (⋮ menu, 🔑 indicator)

tests/test_realms.py

@@ -212,6 +212,22 @@ class TestValidateConfig:
                 )
             )
 
+    def test_wildcard_related_origin_rejected(self):
+        """ROR entries are always individual origins; wildcards are meaningless."""
+        with pytest.raises(ValueError, match="wildcard"):
+            realms.validate_config(
+                Config(realms=[RealmConfig(rp_id="a.com", related_origins=["*.b.com"])])
+            )
+
+    def test_wildcard_origin_in_domain_accepted(self):
+        realms.validate_config(
+            Config(realms=[RealmConfig(rp_id="a.com", origins=["*.a.com"])])
+        )
+        with pytest.raises(ValueError, match="outside the rp-id domain"):
+            realms.validate_config(
+                Config(realms=[RealmConfig(rp_id="a.com", origins=["*.b.com"])])
+            )
+
     def test_auth_host_collision(self):
         with pytest.raises(ValueError, match="collides with a related origin"):
             realms.validate_config(
@@ -309,6 +325,14 @@ class TestSanitizeConfig:
         )
         assert config.realms[0].related_origins is None
 
+    def test_wildcard_related_origin_dropped(self):
+        config, warnings = realms.sanitize_config(
+            Config(realms=[RealmConfig(rp_id="a.com", related_origins=["*.b.com"])])
+        )
+        assert config.realms[0].related_origins is None
+        assert any("wildcard" in w for w in warnings)
+        realms.validate_config(config)  # sanitized config is strict-clean
+
     def test_cap_exceeded_truncated(self):
         config, warnings = realms.sanitize_config(
             Config(
@@ -400,6 +424,26 @@ class TestOriginValidation:
         with pytest.raises(ValueError, match="not allowed"):
             p.validate_origin("https://other.com")
 
+    def test_wildcard_entry_matches_subtree(self):
+        p = Passkey(rp_id="example.com", origins=["*.example.com"])
+        assert p.validate_origin("https://example.com")
+        assert p.validate_origin("https://app.example.com")
+        with pytest.raises(ValueError, match="not allowed"):
+            p.validate_origin("https://other.com")
+
+    def test_sub_wildcard_matches_only_its_subtree(self):
+        p = Passkey(rp_id="example.com", origins=["*.app.example.com"])
+        assert p.validate_origin("https://app.example.com")
+        assert p.validate_origin("https://www.app.example.com")
+        with pytest.raises(ValueError, match="not allowed"):
+            p.validate_origin("https://example.com")
+        with pytest.raises(ValueError, match="not allowed"):
+            p.validate_origin("https://other.example.com")
+
+    def test_wildcard_related_origin_rejected(self):
+        with pytest.raises(ValueError, match="wildcard"):
+            Passkey(rp_id="example.com", related_origins=["*.other.com"])
+
     def test_related_origins_combined_with_allow_list(self):
         p = Passkey(
             rp_id="example.com",