v0.2.0

v0.2.0 — First Beta Release

Passkey-first frontend authentication for TYPO3 fe_users via WebAuthn/FIDO2. This is the first fully functional beta with working passkey login, recovery code login, and complete DDEV demo environment.

Highlights

• Working passkey login via token-based session establishment (eID verifies assertion → cache token → felogin form → auth service → FE session)
• Recovery code login using the same token mechanism
• Password login with felogin integration (passkey button injected via template override)
• DDEV demo environment with 4 provisioned pages, demo user (demo/demo), and both TYPO3 v13 + v14

Quality

• 568 tests (323 unit + 168 fuzz + 77 JS), zero notices/deprecations
• PHPStan level 10, zero errors
• 7 PSR-14 events, all dispatched
• 8 services with SRP (FrontendUserLookupService extracted)
• 8 JS modules with shared PasskeyUtils.js (URL builder, base64url, DOM helpers)
• Full i18n: 62+ XLIFF keys, all templates localized
• WCAG 2.1 AA: focus indicators, keyboard tab navigation, ARIA, contrast

Security

• Token-based auth: one-time cache tokens with 120s TTL
• HMAC-signed challenges with nonce replay protection
• Per-IP rate limiting and account lockout
• WebAuthn UV=REQUIRED for both registration and authentication
• No secrets: inherit in any workflow

Breaking Changes from v0.1.x

• MagicLinkRequestedEvent removed (deferred to future release per ADR-011)
• ext_tables.sql now explicitly declares fe_users/fe_groups columns
• PasskeyUtils.js must be loaded before other JS modules (priority loading)

For Integrators

composer require netresearch/nr-passkeys-fe:^0.2

Requires netresearch/nr-passkeys-be ^0.6. See Documentation for configuration.