41 lines
4.9 KiB
Markdown
41 lines
4.9 KiB
Markdown
# Verification record — 2026-10-27, version 0.2.0
|
|
|
|
Target: upstream 2FAuth 8.0.3, commit `3516c776a1fcbd83d234efc007e3a49807d6ed91`.
|
|
|
|
Tested included Linux x86_64 GNU executable SHA-256:
|
|
|
|
`878d842c502f35dc1ec078a023dafe9dc23604fda0d01aa0703089bf116ba152`
|
|
|
|
| Check | Executed result | Scope and limits |
|
|
|---|---|---|
|
|
| Rust tests, `cargo test --locked --all-targets` | **101 passed, 0 failed** | Includes actual WebAuthn crypto/recovery, sharing, imports, mail, OAuth/OIDC, authentication, settings/encryption, middleware and subdirectory tests. Count is not total route/configuration coverage. |
|
|
| Formatting | Passed | `cargo fmt --all -- --check`; source formatted after final changes. |
|
|
| Strict Clippy | Passed | `cargo clippy --locked --all-targets -- -D warnings`. |
|
|
| Release build | Passed | Linux x86_64 GNU; bundled binary requires glibc 2.39 and libgcc_s. Vendored OpenSSL, optimized non-LTO release. |
|
|
| Release HTTP/CLI smoke | Passed | Fresh DB, refusal to re-init, test-user provisioning, HTML/CSP/cookies, login/CSRF, CRUD/secrets, independent HOTP calculations, permissions, logout and process shutdown. |
|
|
| Relocated executable/assets | Passed | Copied binary/public to an unrelated folder, ran from a different CWD, HTML and PNG assets loaded without RUST_PUBLIC_DIR. |
|
|
| Direct startup of a copied Laravel DB | Passed | No prepare command required; original application DDL, migration rows and user/password rows unchanged; only rust_-prefixed metadata tables added. |
|
|
| Real PHP reference | Runs | PHP 8.4.27, locked Laravel 13.29.0; all 42 upstream migrations applied. DDL retained in sqlite-reference-schema.sql. |
|
|
| Native Rust database HTTP comparisons | **102 executed**, all statuses/checks match | 91 exact responses; 11 expected dynamic/encoding body differences as detailed below. |
|
|
| Copied Laravel database HTTP comparisons | **102 executed**, all statuses/checks match | Same results on real migrated tables and PHP password hashes. |
|
|
| Default CORS HTTP comparisons | 3 exact matches in each mode | Preflight, request with Origin, request without Origin; wildcard/default no-credentials policy. |
|
|
| Supplemental semantic checks | Passed on both modes | Health differs only by render milliseconds; plain CSRF token followed by successful login; both SVG QR codes rendered and decoded with PHP's reader into the exact same fixture URI. |
|
|
| Real Passport interoperability | **11 checks passed** | PHP bearer/cookie accepted by Rust; Rust PAT accepted by actual PHP League ResourceServer; CSRF, tampering and revocation rejected; PHP browser upgraded, legacy cookie cleared, logout prevents subsequent use. |
|
|
| Python harness regression tests | **5 passed** | Stateful cookies, headers, captures, normalization, mismatches and sanitized failures. |
|
|
| Independent crypto | 6 fixtures passed PHP OpenSSL and Laravel Encrypter | AES-128/256-CBC/HMAC, empty/ASCII/Unicode; both independent Python generation and actual PHP decryptString verification. |
|
|
| Upstream PHPUnit reference suite | 1,518 tests, 4,573 assertions; 5 errors, 2 failures | All seven remaining failures involve unavailable real DNS before mocked icon HTTP. This is a reference-environment result, not a claim Rust passed the PHP test suite. |
|
|
| Docker / hosted CI / real browser acceptance | Not executed | Files provided; Docker tool/daemon unavailable. No physical authenticator or real external SSO provider acceptance was performed. |
|
|
| Production migration/cutover | Not performed | Only disposable synthetic data and copied fixtures were used. |
|
|
|
|
## Raw differential accounting
|
|
|
|
Each database mode executes 7 default/CORS probes, 12 basic stateful calls, 23 extended calls and 60 admin/sharing calls. Native and copied-Laravel modes each produce **91/102 exact matches**. All 102 statuses, content types, selected headers, expected statuses, explicit JSON assertions and CSRF shape checks pass. There are no skipped probes, transport errors or unexpected rate-limit responses.
|
|
|
|
The eleven remaining raw body differences are nine random CSRF tokens, one health render-time number and one SVG QR representation. They remain visible in the raw reports. Their relevant behavior is independently checked; QR pixels or random strings were not simply discarded to claim equality.
|
|
|
|
The synthetic fixture API quota is raised to 1000 on both instances so the expanded sequence fits one run. Default/API/import limits, expiry, concurrency, trusted proxies and spoofing are separately tested. Raw comparisons and all provenance/case hashes are retained in `reference-results.native.json` and `reference-results.laravel.json`. The old `reference-results.json` is preserved as a baseline.
|
|
|
|
## What this does not establish
|
|
|
|
**Full replacement has not been reached.** Other database drivers, full package OAuth endpoints, every Laravel session/remember-me mode, historic migration paths, configuration/localization edge cases and complete browser/provider acceptance still remain. See `CURRENT.md` for precise remaining scope.
|