# Current compatibility status — 0.3.0

Target: 2FAuth 8.0.3, source commit `3516c776a1fcbd83d234efc007e3a49807d6ed91`.

This supersedes the implementation-status statements in the original 0.1.0 audit. The static PHP source inventories remain valid. This project is still **not a verified complete replacement**.

## Evidence

The reference really runs PHP 8.4.27 and locked Laravel 13.29.0 dependencies. All 42 PHP migrations succeeded on disposable SQLite. `sqlite-reference-schema.sql` records the resulting application DDL, without fixture rows or deployment secrets.

The differential runner exercises separate synthetic instances with both a native Rust database and a copy of the real migrated PHP database. The fixtures preserve the ordinary user at id 1 and add an administrator and recipient. It raises the generic API fixture throttle to 1000 on both sides to fit the expanded sequence; ordinary deployment defaults are covered separately by limiter tests. No production configuration or database was accessed.

The core raw suites comprise 99 HTTP comparisons: 4 public probes, 12 account/authentication calls, 23 extended account/group/validation calls, and 60 administration/sharing/role-switch calls. Three additional CORS probes bring the core total to 102. Version 0.3.0 adds 29 OAuth and 9 device/default-web probes: 140 comparisons per database mode, of which 129 are exact. Count is not route or configuration coverage. Additional checks assert absent borrowed secrets, RFC HOTP output and counter state, per-user group independence, share counts, encryption transitions and denied operations.

Exact comparisons retain random CSRF values, health-render milliseconds and SVG QR bytes as differences. Supplemental checks require plain CSRF tokens followed by successful login; compare the health page excluding only its numeric rendering time; and render both SVGs and decode them using the PHP QR reader, requiring the same expected otpauth URI. These are explicit semantic checks, not indiscriminate exclusions.

`tools/passport_interop.py` additionally tests actual PHP-created RSA bearer tokens and encrypted browser cookies against Rust, Rust-created PATs against PHP's League ResourceServer, expiry/signature/revocation/CSRF rejection, PHP-browser upgrade at the HTML bootstrap, cookie clearing and logout. Test keys are generated for disposable fixtures.

Rust tests exercise actual WebAuthn signatures and credential migration, not acceptance stubs: PHP-encrypted P-256 PEM, RSA/Ed25519 PEM imports, fresh P-256/Ed25519 registration, origin/handle/signature checks, expiry, replay, device management and password/token recovery. Local fake SSO providers exercise PKCE/state/OIDC verification. Local SMTP tests cover delivery and TLS downgrade rejection.

See `VERIFICATION.md` and the final `reference-results.*.json` files for executed results and binary/case hashes. The earlier `reference-results.json` is retained as a baseline from the old binary.

## Additions in 0.3.0

Real PHP session fixtures cover eight process-level combinations: file/database × JSON/PHP serialization × encrypted/plain storage. They exercise original session CSRF, Passport refresh, HTML bootstrap import, native API use, source-store destruction, logout token rotation and replay through the actual HTML import path.

The device grant uses the pinned `oauth_device_codes` schema, 10-minute device codes, 8-character user codes and the original 5-second polling interval. Its default browser view remains broken like the source binding.

The OAuth wire test uses a PHP-issued encrypted authorization code with S256 PKCE, verifies the Rust JWT signature in PHP, decrypts and re-encrypts Rust refresh tokens in PHP, and checks exchange/replay plus client-credential wildcard scopes. OAuth error contracts are compared separately rather than inferred from successful exchanges. Optional consent stores approval challenges server-side and binds them to one browser session; prompt=login markers are single-use and expire.

Existing SQLite databases are checked read-only for required columns/types, primary and non-partial unique keys, and foreign-key delete actions against the pinned migration DDL. Laravel sessions are required only when the database session driver is configured. Other engine support requires the driver/value/SQL work documented in database-portability.md.

## Remaining gaps before a complete-replacement claim

- **Database engines:** only SQLite is implemented. PostgreSQL, MySQL and SQL Server remain unsupported. `prepare-sqlite` validates an already migrated pinned schema; it does not reproduce all historic Laravel migration paths.
- **Other Laravel session modes:** file and SQLite database stores, JSON/PHP scalar-array serialization, SESSION_ENCRYPT and remember-me import/revocation are implemented and tested. Redis, cookie, Memcached and other backends remain unsupported. Non-ASCII APP_NAME slug defaults, separate session connections and every cookie/multi-process configuration are not certified.
- **OAuth surface:** authorization-code/PKCE, refresh rotation, client credentials, device authorization/polling and the Defuse encrypted format are implemented alongside bearer/PAT/cookies. The pinned source has disabled JSON management routes and a broken consent view binding. Defaults preserve those observed defects; explicit opt-ins enable repaired management and authorization-code consent. Device browser consent retains the original broken view binding; this build does not add a repaired device UI. Other package grant modes and every authorization/configuration edge case are not certified.
- **Validation/localization/configuration:** selected error/status contracts have been compared and corrected. All request validation combinations, translations, guard ordering, proxy chains, cookie settings and the complete environment matrix have not been exhaustively compared. Some date and user-agent formatting is approximate. OAuth/device limiting is checked at 60/minute; all interactions with the PHP unnamed login quota and authenticated-user key switching are not certified.
- **Icons/QR:** SVG encoding differs by QR library while decoded content is checked. SVG sanitization intentionally strips unsupported/executable content; uncommon safe SVG features may change. Remote fetching, proxies, retries, DNS edge cases and checksum-specific QR error messages are not fully identical.
- **Mail:** SMTP, TLS/STARTTLS, sendmail and log are implemented. Every Laravel cloud transport and exact HTML mail layout is not reproduced. Notifications are localized but were not checked through real production mail/providers.
- **Operational surface:** Rust diagnostics identify the actual native runtime; Laravel cache/optimization commands have native equivalents because no PHP template/config cache exists. The complete Artisan command/scheduler/queue operational interface is not reproduced.
- **Acceptance:** no full real-browser UI acceptance, production cutover, physical authenticator matrix or actual GitHub/OpenID provider acceptance was performed. Docker/hosted CI were not executed here.

Keep the PHP deployment available until the remaining requirements relevant to that deployment are implemented and tested. Successful limited fixtures are not a certification of all original functionality.