4.5 KiB
Verification record — 2026-10-28, version 0.3.0
Target: upstream 2FAuth 8.0.3, commit 3516c776a1fcbd83d234efc007e3a49807d6ed91.
Historical 0.2.0 results, including its upstream PHPUnit run, are retained in VERIFICATION-0.2.0.md; they are not rerun claims for this binary.
Executed checks
Included Linux x86_64 GNU executable SHA-256: 0e03e978721bf4fcfc65e18e4a98f47b26b71a151c792b380d18996ae467813d.
| Check | Executed result |
|---|---|
| Rust: cargo test --locked --all-targets | 137 passed, 0 failed |
| Formatting and strict Clippy | Passed; cargo fmt --all -- --check; cargo clippy --locked --all-targets -- -D warnings |
| Optimized release and CLI/HTTP smoke | Passed; Linux x86_64 GNU, glibc >=2.39; libc/libm/libgcc_s runtime dependencies |
| Native SQLite HTTP comparison | 140 executed: 129 exact, 11 expected raw body differences |
| Copied migrated Laravel SQLite comparison | 140 executed: 129 exact, 11 expected raw body differences |
| Additional OAuth/device HTTP cases | 38 exact per database mode; error/status/hint/cache/challenge and default web CSRF contracts |
| Semantic health, CSRF/login and rendered QR checks | Passed in both database modes |
| Actual PHP Passport interoperability | 11 checks passed in each database mode |
| PHP authorization-code/refresh/RSA wire checks | 5 passed; actual PHP Defuse decrypt/encrypt and OpenSSL verification |
| Laravel session process combinations | 8 passed: file/database × JSON/PHP × plain/encrypted |
| Device grant interoperability | 8 passed: PHP-issued code, PHP approval, Rust tokens checked by actual PHP ResourceServer; pending/backoff, deny, expiry and replay |
| Python comparison harness | 6 passed, 0 failed |
| Independent Python/PHP OpenSSL CBC fixtures | 6 passed |
All 140 statuses, content types, selected headers, explicit JSON assertions and scenario checks match in both database modes. The 11 raw differences are confined to the original core sequence; all 38 new OAuth/device cases are exact. Both runs retain THROTTLE_API=1000 only for the large API fixture sequence. OAuth/default web quotas are not increased. Supplemental login/QR semantics run before the OAuth error burst so the PHP shared unnamed throttle does not invalidate their setup.
Full reports and provenance are in reference-results.native.json, reference-results.laravel.json, interop-results.json, passport-interop-results.json and device-interop.json. Actual PHP protocol observations are retained separately in oauth-php-reference.json, oauth-php-body-reference.json and oauth-device-php-reference.json.
What this establishes
The original 102-case HTTP sequence runs against both a native Rust SQLite database and an actual migrated PHP database copied with SQLite backup. Eleven raw response body differences are retained: nine random CSRF tokens, the health render duration and SVG QR representation. Supplemental checks verify login after CSRF, health apart from its numeric rendering time, and both rendered QR images decoded with PHP into the expected fixture URI. No random-value or QR exclusions are used to claim byte equality.
Additional OAuth cases compare the actual errors, descriptions, hints, statuses and selected cache/challenge headers. The standard token endpoint accepts form and JSON payloads as Laravel does. Success, PKCE, cryptographic interoperability, refresh replay rejection and client-credential scopes are checked separately using actual PHP Defuse and OpenSSL.
Laravel session HTTP tests cover file/database × JSON/PHP scalar-array serialization × encrypted/plain storage. They verify encrypted XSRF, Passport refresh, source store destruction on HTML bootstrap, native requests after refresh, remember-token rotation, and replay through HTML import after logout. Unit tests also require import to rotate an anonymous native SID and logout to revoke both identities when stale cookies name different users.
Limits
Full replacement has not been reached. Only SQLite is supported. Redis/cookie/other session drivers, the complete configuration/localization/middleware matrix, historical migration paths and full real-browser/provider acceptance remain unverified or unimplemented. Fixed optional OAuth management/consent behavior is explicitly opt-in because the pinned PHP source has broken/disabled routes. See CURRENT.md and database-portability.md.
Docker, physical authenticators, production cutover and live GitHub/OpenID providers were not tested in this pass. All process tests use disposable synthetic users, keys, databases and ports.