# Web authentication parser host tests

Run from the repository root:

```sh
python3 tests/web_auth_parse/run.py
```

Requires Python 3 (standard library only) and a host `cc` supporting shared
libraries. The runner compiles the actual `src/web_auth_parse.c` with
`-std=c11 -Wall -Wextra -Werror -shared -fPIC` into a temporary directory, loads
it with `ctypes`, and removes build artifacts on exit. No firmware dependencies,
parser substitutes, network access, or persistent build artifacts are used.
Compilation errors and test failures produce nonzero exit status.

Tables cover DNS/IPv4 origin canonicalization, case folding and optional `:443`,
malformed authorities/origins and unsupported IPv6; selected cookie presence,
uniqueness, exact lowercase 64-digit hex and surrounding cookie syntax; strict
login JSON, both field orders, escapes, Unicode/surrogate pairs, invalid UTF-8,
NUL, duplicate/unknown fields, truncation and byte limits (512-byte body,
16-byte username, 64-byte password). Boundary cases include canonical origin
capacity and the 1024-byte Cookie header limit.

Inputs use exact byte spans without implicit terminators and never alias
outputs. Each output is first filled with `0xA5`; every failed call must clear
**all** output bytes, including credential structure padding and unused array
bytes. Successful results check canonical/decoded bytes and termination.

## Limitations

- This is a focused parser contract suite, not HTTP integration, authorization,
  CSRF/session, duplicate HTTP header-line, TLS, credential-policy, or hardware
  testing. Empty credentials are syntactically valid; database policy is separate.
- IPv6 is intentionally rejected, not normalized or supported.
- Python mirrors the public C struct and capacities; interface changes must
  update these tests. Shared-library loading assumes a Unix-like host/compiler.
- Tables are not exhaustive fuzzing, memory-safety instrumentation, or proof of
  constant-time behavior. Output wiping is observed after return; this does not
  establish erasure of internal temporaries or successful credentials. Test
  credentials/tokens are synthetic, not secrets.
- NULL output pointers and overlapping buffers are not exercised: valid,
  disjoint output storage is provided for every call.