{"id":49084552,"url":"https://github.com/dirnbauer/workos","last_synced_at":"2026-04-20T14:15:54.180Z","repository":{"id":351761497,"uuid":"1207326562","full_name":"dirnbauer/workos","owner":"dirnbauer","description":"TYPO3 v14 extension for WorkOS-powered frontend and backend login.","archived":false,"fork":false,"pushed_at":"2026-04-16T12:27:46.000Z","size":121,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-16T12:32:51.834Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dirnbauer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-10T20:22:59.000Z","updated_at":"2026-04-16T12:27:50.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/dirnbauer/workos","commit_stats":null,"previous_names":["dirnbauer/workos"],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/dirnbauer/workos","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dirnbauer%2Fworkos","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dirnbauer%2Fworkos/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dirnbauer%2Fworkos/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dirnbauer%2Fworkos/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dirnbauer","download_url":"https://codeload.github.com/dirnbauer/workos/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dirnbauer%2Fworkos/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32050577,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-20T11:35:06.609Z","status":"ssl_error","status_checked_at":"2026-04-20T11:34:48.899Z","response_time":94,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-20T14:15:53.065Z","updated_at":"2026-04-20T14:15:54.168Z","avatar_url":"https://github.com/dirnbauer.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WorkOS Auth for TYPO3 14\n\n`workos_auth` adds [WorkOS](https://workos.com) authentication to both the\nTYPO3 **frontend** and the TYPO3 **backend**. It supports the full WorkOS\nAuthKit feature set: email + password, passwordless magic auth, and\nsocial sign-in with Google, Microsoft, GitHub, and Apple.\n\nRequirements: TYPO3 `^14.0`, PHP `^8.2`. Current release: **0.25.0**.\n\n---\n\n## What you get\n\n| Area | Feature |\n|---|---|\n| **WorkOS Login** plugin | Email + password form, magic-auth form, social buttons, self sign-up |\n| **WorkOS Login** plugin | Shows the current WorkOS profile (including custom metadata) when signed in |\n| **WorkOS Account Center** plugin | Self-service profile, password, MFA, sessions and organizations for signed-in users |\n| **WorkOS Team** plugin | Send/resend/revoke teammate invitations and launch one-time WorkOS Admin Portal sessions (SSO, SCIM, audit logs, …) |\n| Backend login | \"Continue with WorkOS\" button, email-code login, social sign-in |\n| Backend module | Setup assistant at `System \u003e WorkOS Auth` (no PHP editing required) |\n| Provisioning | Create or link TYPO3 users from WorkOS identities (frontend \u0026 backend) |\n| Storage | Identity mapping table `tx_workosauth_identity` (with full WorkOS profile JSON) |\n| Localization | English and German out of the box, XLIFF 1.2 with ICU MessageFormat |\n\n## Quick install\n\n```bash\ncomposer require webconsulting/workos-auth\n```\n\n1. Activate the extension in TYPO3.\n2. Open **System \u003e WorkOS Auth** in the backend.\n3. Enter your **API key**, **Client ID**, and a **cookie password** (≥ 32 characters).\n4. Copy all **Redirect URIs** from the setup assistant into the WorkOS Dashboard.\n5. In the WorkOS Dashboard, enable the authentication methods you need (Magic Auth, Email + Password, Social providers).\n6. Add the **WorkOS Login** content element to a frontend page.\n\nA detailed walk-through is in [`Documentation/Configuration.rst`](Documentation/Configuration.rst).\n\n## Frontend login\n\nPlace the **WorkOS Login** plugin on a page and users get a ready-to-go card:\n\n- Email + password form\n- \"Email me a login code\" (magic auth, six-digit code)\n- One-tap social buttons (Google, Microsoft, GitHub, Apple)\n- Link to the native sign-up form\n\nSigned-in users see their WorkOS profile, including any **custom metadata**\nstored on the WorkOS user record.\n\nDetailed feature guide: [`Documentation/Features.rst`](Documentation/Features.rst).\n\n## Account Center (frontend)\n\nDrop the **WorkOS Account Center** plugin on any page that signed-in\nusers can reach (typically a \"My account\" page) and they get a\nself-service hub backed by the WorkOS API:\n\n- **Profile** — update first and last name (synced back to WorkOS via\n  `UserManagement::updateUser`)\n- **Password** — change the WorkOS password without leaving the site,\n  with friendly errors for too-short, too-weak and breached passwords\n- **Two-factor authentication** — enroll an authenticator app (TOTP).\n  The QR code is generated by WorkOS and rendered inline; a fallback\n  manual secret is shown for users who can't scan\n- **Active sessions** — list every WorkOS session for the user with\n  IP, browser/OS summary and expiry, plus a one-click \"Sign out\" to\n  revoke any individual session (\"sign me out of other devices\")\n- **Organizations** — list every organization (and role) the user\n  belongs to, including a \"Directory sync\" badge for memberships\n  managed by an external IdP\n\nEach section degrades gracefully: a failure of one WorkOS call only\ndisables that single card and shows a friendly message.\n\n## Team workspace (frontend)\n\nDrop the **WorkOS Team** plugin on a page reserved for organization\nadmins (typically a \"Team\" or \"Workspace\" page). It turns any TYPO3\nfrontend into a thin wrapper around the WorkOS B2B feature set:\n\n- **Organization switcher** — if the signed-in user belongs to more\n  than one active WorkOS organization, they pick which one to manage\n  (the choice is sticky for the session).\n- **Admin Portal launchers** — one-click buttons that mint a signed,\n  organization-scoped link into the WorkOS Admin Portal for every\n  supported intent: **SSO**, **Directory Sync (SCIM)**, **Audit Logs**,\n  **Log Streams**, **Domain Verification** and **Certificate Renewal**.\n  This is the same flow WorkOS recommends so customer IT admins can\n  self-serve enterprise setup without you ever exchanging credentials.\n- **Send invitations** — invite teammates by email with an optional\n  role slug; WorkOS dispatches the email and tracks acceptance.\n- **Pending invitations list** — see every recent invitation with its\n  state badge (Pending / Accepted / Expired / Revoked), expiry date\n  and accept-link, plus inline **Resend** and **Revoke** actions.\n\nThe plugin requires a frontend user that is linked to a WorkOS\nidentity (i.e. signed in via the WorkOS Login plugin). If that user\nisn't a member of any active organization, a friendly empty-state\ncard explains what to do.\n\n## Backend login\n\nTYPO3's backend login gains a WorkOS section with:\n\n- \"Continue with WorkOS\" (full AuthKit experience)\n- Social sign-in buttons\n- An email field that sends a six-digit magic-auth code\n- A visible code-entry step for verification\n\nStandard TYPO3 username + password login keeps working in parallel via\nthe \"Login with username and password\" switcher.\n\n\u003e **Heads-up — \"This WorkOS account is not linked to a TYPO3 user\":**\n\u003e If a user authenticates successfully with WorkOS but no matching\n\u003e `be_users` record exists and `backendAutoCreateUsers` is off, the\n\u003e backend login shows that error card together with the WorkOS e-mail\n\u003e and id. Either set the e-mail on an existing backend user, or enable\n\u003e auto-create with a domain allowlist in the setup assistant. Full\n\u003e walk-through:\n\u003e [Troubleshooting → \"This WorkOS account is not linked to a TYPO3 user\"](Documentation/Troubleshooting.rst).\n\n## WorkOS Dashboard setup\n\nAll authentication methods (AuthKit, Magic Auth, Email + Password, Social\nproviders) are **enabled in the WorkOS Dashboard**, not in TYPO3.\n\nSee [`Documentation/WorkosDashboard.rst`](Documentation/WorkosDashboard.rst)\nfor step-by-step screenshots of:\n\n- Adding Redirect URIs\n- Enabling Magic Auth\n- Enabling social providers\n\n## Dynamic AuthKit parameters\n\nThe frontend login URL accepts optional query parameters that customise\nthe AuthKit experience without changing any TYPO3 configuration:\n\n| Query param | Value | Effect |\n|---|---|---|\n| `screen` | `sign-in` or `sign-up` | Open AuthKit on the given screen |\n| `provider` | `GoogleOAuth`, `MicrosoftOAuth`, `GitHubOAuth`, `AppleOAuth` | Jump directly to one social provider |\n| `login_hint` | Any email | Pre-fill the email field |\n| `organization` | WorkOS organization id | Scope the login to an organization |\n| `returnTo` | Target URL | Where to land after login |\n\nExample — open the hosted sign-up screen pre-filled with an email:\n\n```\n/workos-auth/frontend/login?screen=sign-up\u0026login_hint=jane@example.com\n```\n\n## Configuration location\n\nSettings live in TYPO3 extension configuration under\n`EXTENSIONS.workos_auth`. In a Composer-based TYPO3 14 project they are\npersisted to `config/system/settings.php`, which is the right place for\ninstallation-wide auth secrets.\n\nThe full list of keys is in\n[`Documentation/Configuration.rst`](Documentation/Configuration.rst).\n\n## Documentation\n\n- [Configuration](Documentation/Configuration.rst) – Setup assistant, every config key, workspaces behaviour\n- [Features](Documentation/Features.rst) – Frontend/backend flows, profile display, dynamic parameters\n- [WorkOS Dashboard](Documentation/WorkosDashboard.rst) – Redirect URIs and enabling auth methods\n- [Troubleshooting](Documentation/Troubleshooting.rst) – Common errors and fixes\n- [Changelog](Documentation/Changelog.rst) – Release notes\n- [Audit reports](Documentation/Reports/) – Workspaces, upgrade, conformance, security, testing, docs\n\n## Security\n\nThe extension takes an auth-first stance. Notable guarantees:\n\n- **Authorization on Team actions**: every Team plugin action\n  verifies the signed-in WorkOS user is an active member of the\n  organization the POST references before calling the SDK. Stops\n  cross-tenant invite / revoke / Admin-Portal-link mints via crafted\n  POST bodies.\n- **CSRF tokens** are enforced on every state-changing action of the\n  Account Center and Team plugins (password change, MFA, session\n  revoke, invitations, Admin Portal launch) and on the backend\n  User Management module's widget-token, join, and\n  create-organization routes.\n- **Admin guard** is asserted inside the backend\n  `UserManagementController` in addition to the module's\n  `access =\u003e 'admin'` gate — defence in depth if the module is ever\n  re-registered outside admin access.\n- **No open-redirects**: `returnTo` parameters only accept strict\n  relative paths or absolute URLs on the same scheme+host+port as the\n  request. Protocol-relative (`//evil.example`) and backslash variants\n  fall back to the configured default redirect.\n- **Secrets never hit logs**: all log entries run through a\n  `SecretRedactor` that strips WorkOS API keys, client ids, bearer\n  tokens, and JWTs. Unknown WorkOS error bodies fall back to a\n  translated `error.generic` instead of leaking into redirect URLs.\n- **Workspaces-safe**: the identity mapping table is `adminOnly`,\n  `hideTable`, and pinned to `versioningWS=false` so workspace\n  drafts can never mutate live authentication state. The three\n  WorkOS backend modules are registered with `workspaces =\u003e 'live'`\n  and only appear in the LIVE workspace.\n\nAll third-sweep audit reports live under\n[`Documentation/Reports/`](Documentation/Reports/).\n\n## Quality\n\n- PHPStan **level max** (10 on 2.x) with\n  `saschaegerer/phpstan-typo3 ^3.0` — run `composer phpstan`.\n- **82 unit tests** (151 assertions), including regressions for\n  every security fix, a TCA contract guard on the identity table,\n  and XLIFF parity between English and German — run\n  `composer test:unit`.\n- Functional tests cover `IdentityService` round-trips (including\n  under a workspace aspect) and `UserProvisioningService`\n  create-or-link flows via `typo3/testing-framework ^9.2`.\n- Uniform entry point: `Build/Scripts/runTests.sh -s ci` runs\n  PHPStan + unit tests with the same flags locally and in CI.\n\n## Licence\n\nGPL-2.0-or-later\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdirnbauer%2Fworkos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdirnbauer%2Fworkos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdirnbauer%2Fworkos/lists"}