.. include:: /Includes.rst.txt

.. _standalone-access:

=================
Standalone access
=================

The standalone app at :file:`/t3vault/` can be opened without TYPO3. This is
intended for disaster recovery when the CMS is broken.

.. _enable-file:

Enable marker
=============

Standalone password login is locked until a marker file exists (same idea as
TYPO3's :file:`ENABLE_INSTALL_TOOL`). Like TYPO3, the marker lives **outside**
the web root:

.. code-block:: text

   var/t3vault/ENABLE_T3VAULT

Rules:

* File missing → login locked
* File contains ``KEEP_FILE`` → permanently enabled
* Otherwise → enabled for one hour after the file's modification time; the
  window is extended on every authenticated request (sliding window)
* Ten failed login attempts consume the marker (logged in
  :file:`var/t3vault/state/auth.log`)

After a successful standalone login the marker is removed (unless it contains
``KEEP_FILE``).

.. warning::

   ``KEEP_FILE`` keeps the password login endpoint permanently reachable from the
   internet. Use it for local development only — never on a production or
   staging system. Without it, the marker is consumed on login and the exposure
   window stays minimal.

.. figure:: /Images/screenshot-enable-marker.png
   :alt: T3Vault lock screen asking the operator to create var/t3vault/ENABLE_T3VAULT
   :class: with-shadow
   :zoom: lightbox

   Standalone login stays locked until the enable marker exists.

.. note::

   A marker in the old location :file:`public/t3vault/ENABLE_T3VAULT` is
   deliberately ignored: the web server user can write there, so any file-write
   flaw in the web context could open the login window. The lock screen points
   this out when it finds such a leftover file.

.. tip::

   Create the file via SSH or SFTP, then open :file:`/t3vault/` in the browser
   and log in with the standalone password set in the backend module.

.. figure:: /Images/screenshot-login.png
   :alt: T3Vault standalone login form for the standalone password
   :class: with-shadow
   :zoom: lightbox

   Password login used for disaster recovery outside the TYPO3 backend.

.. _backend-sso:

Backend SSO
===========

When you open the module while logged in as a TYPO3 administrator, T3Vault
issues a short-lived one-time claim ticket (``?sso=…`` on the iframe URL). The
embedded app redeems it via ``/auth/backend-claim`` and receives a backend
session — without ``ENABLE_T3VAULT`` or the standalone password. The ticket is
opaque, single-use and TTL-bound (not the former HMAC ``bt`` in the URL).