---
title: "Controllers and services"
manual: "Passkeys Backend Authentication"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:developer-controllers-services@1.0"
source: "DeveloperGuide/ControllersAndServices.rst"
rendered: "2026-09-20T16:07:13+00:00"
---

# Controllers and services {#developer-controllers-services}

## Controllers {#controllers}

The extension registers backend routes for three controller
groups. All controllers use the `JsonBodyTrait` for parsing
JSON request bodies. Login routes use `Routes.php`
(public access). Management and admin routes use
`AjaxRoutes.php` (AJAX, with Sudo Mode on write
operations). All paths below are relative to `/typo3/`.

**LoginController (public)**

Handles the passkey login flow. Routes have
`access: public` (via `Routes.php`).

-   `POST /passkeys/login/options`
-   `POST /passkeys/login/verify`

**ManagementController (AJAX)**

Passkey lifecycle for the current user
(via `AjaxRoutes.php`). Write operations
require Sudo Mode re-authentication.

-   `POST /ajax/passkeys/manage/registration/options`
    \*
-   `POST /ajax/passkeys/manage/registration/verify`
    \*
-   `GET /ajax/passkeys/manage/list`
-   `POST /ajax/passkeys/manage/rename` \*
-   `POST /ajax/passkeys/manage/remove` \*

**AdminController (AJAX, admin)**

Administrative operations for any user
(via `AjaxRoutes.php`). Write operations
require Sudo Mode re-authentication.

-   `GET /ajax/passkeys/admin/list`
-   `POST /ajax/passkeys/admin/remove` \*
-   `POST /ajax/passkeys/admin/revoke-all` \*
-   `POST /ajax/passkeys/admin/unlock` \*
-   `POST /ajax/passkeys/admin/update-enforcement`
    \*
-   `POST /ajax/passkeys/admin/send-reminder` \*
-   `POST /ajax/passkeys/admin/clear-nudge` \*

**AdminModuleController (Backend module)**

Renders the Admin Tools > Passkey Management
backend module with Dashboard and Help tabs
(via `Modules.php`).

**Enforcement status (AJAX)**

Provides enforcement status for the banner.

-   `GET /ajax/passkeys/enforcement/status`

Routes marked with `*` are protected by TYPO3's Sudo Mode.
When accessed without a recent password verification, they
return HTTP 422 with `sudoModeInitialization` data. The
JavaScript handles this transparently by showing a password
dialog and retrying the request.

## Service classes {#service-classes}

**WebAuthnService**

Orchestrates WebAuthn ceremonies using
`web-auth/webauthn-lib` v5.x. Handles registration
options, attestation verification, assertion options,
and assertion verification.

**ChallengeService**

Generates and verifies HMAC-signed challenge tokens
with nonce replay protection.

**CredentialRepository**

Database access layer for
`tx_nrpasskeysbe_credential`. Uses
`ConnectionPool` directly (no Extbase).

**RateLimiterService**

Per-endpoint rate limiting by IP and account lockout
after configurable failed attempts. Uses TYPO3
caching framework.

**ExtensionConfigurationService**

Reads extension configuration and computes effective
values for `rpId` and `origin` (auto-detection
from request).

**EnforcementService**

Determines the effective enforcement level for a
user by resolving their group memberships (strictest
level wins, shortest grace period wins).

**AdoptionStatsService**

Provides adoption statistics for the admin dashboard:
overall counts, per-group breakdowns, users without
passkeys, and grace period status.

## JavaScript modules {#javascript-modules}

-   `PasskeyLogin.js` -- Login form passkey button and
    WebAuthn flow
-   `PasskeyManagement.js` -- User Settings passkey
    management panel
-   `PasskeyBanner.js` -- Encourage-stage onboarding
    banner
-   `PasskeyDashboard.js` -- Admin dashboard enforcement
    controls
-   `PasskeyAdminInfo.js` -- Admin passkey info in user
    records