4.9 KiB
Verification record — 2026-10-27, version 0.2.0
Target: upstream 2FAuth 8.0.3, commit 3516c776a1fcbd83d234efc007e3a49807d6ed91.
Tested included Linux x86_64 GNU executable SHA-256:
878d842c502f35dc1ec078a023dafe9dc23604fda0d01aa0703089bf116ba152
| Check | Executed result | Scope and limits |
|---|---|---|
Rust tests, cargo test --locked --all-targets |
101 passed, 0 failed | Includes actual WebAuthn crypto/recovery, sharing, imports, mail, OAuth/OIDC, authentication, settings/encryption, middleware and subdirectory tests. Count is not total route/configuration coverage. |
| Formatting | Passed | cargo fmt --all -- --check; source formatted after final changes. |
| Strict Clippy | Passed | cargo clippy --locked --all-targets -- -D warnings. |
| Release build | Passed | Linux x86_64 GNU; bundled binary requires glibc 2.39 and libgcc_s. Vendored OpenSSL, optimized non-LTO release. |
| Release HTTP/CLI smoke | Passed | Fresh DB, refusal to re-init, test-user provisioning, HTML/CSP/cookies, login/CSRF, CRUD/secrets, independent HOTP calculations, permissions, logout and process shutdown. |
| Relocated executable/assets | Passed | Copied binary/public to an unrelated folder, ran from a different CWD, HTML and PNG assets loaded without RUST_PUBLIC_DIR. |
| Direct startup of a copied Laravel DB | Passed | No prepare command required; original application DDL, migration rows and user/password rows unchanged; only rust_-prefixed metadata tables added. |
| Real PHP reference | Runs | PHP 8.4.27, locked Laravel 13.29.0; all 42 upstream migrations applied. DDL retained in sqlite-reference-schema.sql. |
| Native Rust database HTTP comparisons | 102 executed, all statuses/checks match | 91 exact responses; 11 expected dynamic/encoding body differences as detailed below. |
| Copied Laravel database HTTP comparisons | 102 executed, all statuses/checks match | Same results on real migrated tables and PHP password hashes. |
| Default CORS HTTP comparisons | 3 exact matches in each mode | Preflight, request with Origin, request without Origin; wildcard/default no-credentials policy. |
| Supplemental semantic checks | Passed on both modes | Health differs only by render milliseconds; plain CSRF token followed by successful login; both SVG QR codes rendered and decoded with PHP's reader into the exact same fixture URI. |
| Real Passport interoperability | 11 checks passed | PHP bearer/cookie accepted by Rust; Rust PAT accepted by actual PHP League ResourceServer; CSRF, tampering and revocation rejected; PHP browser upgraded, legacy cookie cleared, logout prevents subsequent use. |
| Python harness regression tests | 5 passed | Stateful cookies, headers, captures, normalization, mismatches and sanitized failures. |
| Independent crypto | 6 fixtures passed PHP OpenSSL and Laravel Encrypter | AES-128/256-CBC/HMAC, empty/ASCII/Unicode; both independent Python generation and actual PHP decryptString verification. |
| Upstream PHPUnit reference suite | 1,518 tests, 4,573 assertions; 5 errors, 2 failures | All seven remaining failures involve unavailable real DNS before mocked icon HTTP. This is a reference-environment result, not a claim Rust passed the PHP test suite. |
| Docker / hosted CI / real browser acceptance | Not executed | Files provided; Docker tool/daemon unavailable. No physical authenticator or real external SSO provider acceptance was performed. |
| Production migration/cutover | Not performed | Only disposable synthetic data and copied fixtures were used. |
Raw differential accounting
Each database mode executes 7 default/CORS probes, 12 basic stateful calls, 23 extended calls and 60 admin/sharing calls. Native and copied-Laravel modes each produce 91/102 exact matches. All 102 statuses, content types, selected headers, expected statuses, explicit JSON assertions and CSRF shape checks pass. There are no skipped probes, transport errors or unexpected rate-limit responses.
The eleven remaining raw body differences are nine random CSRF tokens, one health render-time number and one SVG QR representation. They remain visible in the raw reports. Their relevant behavior is independently checked; QR pixels or random strings were not simply discarded to claim equality.
The synthetic fixture API quota is raised to 1000 on both instances so the expanded sequence fits one run. Default/API/import limits, expiry, concurrency, trusted proxies and spoofing are separately tested. Raw comparisons and all provenance/case hashes are retained in reference-results.native.json and reference-results.laravel.json. The old reference-results.json is preserved as a baseline.
What this does not establish
Full replacement has not been reached. Other database drivers, full package OAuth endpoints, every Laravel session/remember-me mode, historic migration paths, configuration/localization edge cases and complete browser/provider acceptance still remain. See CURRENT.md for precise remaining scope.