v0.14.0

Highlights

Fifty-eight pull requests since v0.13.0, most of them one hardening programme carried out in four rounds of adversarial review. Several changes are breaking, and several close paths that produced successful-looking audit entries for operations that were never authorised — in an extension whose promise is auditability, that is the part to read first. Read the 0.14.0 changelog end to end before upgrading; its Migration section lists everything an operator has to do by hand.

Access control is no longer admin-or-nothing

Ten grantable operation permissions replace the coarse admin-only model: secret.use, secret.reveal, secret.create, secret.rotate, secret.delete, secret.manage_policy, audit.view, audit.export, master_key.rotate and vault.configure. They are granted per backend group and compose with — never replace — the per-secret owner/group ACL tiers; both must hold. The operationally important split is use ≠ reveal: an application or technical actor can consume a credential no human is allowed to look at, and audit viewing is separated from secret access entirely.

The admin bypass itself can now be switched off. disableAdminOverride removes it from both layers and can be pinned out of admin reach in config/system/additional.php. The way back in is vault:break-glass --activate --reason "…", a time-boxed window (1–60 minutes, default 15) whose audit row is written before the power is granted, so an open window without evidence is impossible. PSR-14 events fire for SIEM consumption and the backend modules carry a danger banner while a window is open.

A security profile the code enforces

securityProfile (standard | hardened) is policy, not a documentation label. Under hardened, masterKeyProvider = typo3 is a configuration error — vault secrets must not be protected by the same key TYPO3 uses for everything else — and provider selection stops auto-detecting, so a missing provider fails loudly instead of silently degrading down the old typo3 → env → file chain. An unknown profile value throws rather than falling back, because a typo must never weaken the effective policy.

New in this release: a HashiCorp Vault Transit master key provider, and vault:doctor, a readiness command with stable exit codes (0 clean, 1 warnings, 2 critical) that an operator or a pipeline can gate on. vault:doctor --profile=hardened reports what would fail before you change any configuration; --active-probes is the only check that proves audit records actually arrive rather than that a URL parses.

Tamper evidence that survives a truncated table

The audit chain tip is now anchored both inside the database and outside it, so deleting the audit table no longer leaves a chain that verifies as valid. A truncated log verifies as INVALID and blocks vault:rotate-master-key and both HMAC re-seal paths, which would otherwise launder it. Audit sinks gained active verification and per-sink delivery state. vault:audit --reset-anchor is the deliberate way to re-arm the anchor after a wipe you performed on purpose, and it writes the reset into the chain so it cannot be done invisibly.

Breaking changes

• The plaintext secret cache is gone, and with it VaultServiceInterface::clearCache() and the cacheEnabled setting. Every read is now one SELECT, one decrypt and one audit row — which is the point.
• VaultServiceInterface, SecretRepositoryInterface, VaultAdapterInterface and VaultDoctorServiceInterface gained members. Third-party implementations need updating; the two new parameters are optional, so only the new methods are a hard break.
• undelete is gone for tx_nrvault_secret, for everyone including administrators. Restoring a soft-deleted secret is now a database operation, where the change is visible as what it is. Update any runbook that promised the delete was reversible.
• Frontend %vault()% resolution only serves published identifiers. Every documented TypoScript and site-configuration form keeps working; an identifier used only in a Fluid file, a userFunc or a DataProcessor must be published once per site via plugin.tx_nrvault.frontendResolvableIdentifiers. Scheduled render jobs are covered by the same allow-set — check them before upgrading.
• CLI access is narrowed to an explicit operation allowlist (cliAllowedOperations, default secret.use,secret.create,secret.rotate). Anything that reveals, deletes, exports, rotates the master key or touches the audit log needs allowCliAccess = 1 and the operation added to that list. Prefer a named technical actor via TechnicalActorContext::runAs() so the audit trail names an identity rather than an unattributable shell.
• Grant secret.use before you upgrade, not after. Non-admin editors working with vault-backed FormEngine or FlexForm fields need it, and that is the one that bites quietly.

Fixes worth naming

• Master-key rotation skipped disabled secrets, leaving their DEK wrapped under the key the command then tells you to destroy — a permanently undecryptable ciphertext on re-enable. With only disabled secrets present it even reported "No secrets found" and exited 0. Reported by @CybotTM in #286, fixed by @CybotTM in #287.
• reseal() skipped its anti-truncation guard on the rotation path, because it authenticated the stored anchor under the key it was about to sign with; rotation is the one path that passes a different key. Reported by @CybotTM in #283, fixed by @CybotTM in #284.
• store() carried version and crdate forward but reset last_rotated_at, read_count and last_read_at on every update, so a rotated secret read as never rotated — fixed by @CybotTM in #281.
• Record copy and delete now fail closed across vault fields (#259), and FormEngine mutations are audit-atomic (#252) — a write that cannot be audited does not land, including the MM ACL tiers written alongside it. Both by @CybotTM.

Every issue in this release was reported by @CybotTM and every pull request authored by @CybotTM; #283 and #286 are the two that were filed as issues first.

Full Changelog: v0.13.0...v0.14.0

Installation

composer require netresearch/nr-vault

Publication status

• TER: extensions.typo3.org/extension/nr_vault — 0.14.0 verified
• Packagist: packagist.org/packages/netresearch/nr-vault — 0.14.0 verified
• Documentation: docs.typo3.org/p/netresearch/nr-vault/0.14/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-vault-0.14.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-vault-0.14.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.