feat: publish Toolbox 0.13.0 with Auth Tools 0.3.0

feat: publish Toolbox 0.12.0 with Auth Tools 0.2.0
feat: add OTP and Passkey Tools to Toolbox 0.11.0
2026-08-20 00:25:18 +02:00 · 2026-08-19 14:18:18 +02:00 · 2026-08-19 12:20:27 +02:00
20 changed files with 224 additions and 51 deletions
@@ -1,8 +1,9 @@
 # Optional overrides for compose.yaml. Its defaults already match production.
 TOOLBOX_HOST=toolbox.add-ideas.de
+AUTH_TOOLS_HOST=auth.toolbox.add-ideas.de
 TRAEFIK_NETWORK=internal
 TRAEFIK_CERT_RESOLVER=netcup

 # Keep these two values paired when deploying a newer published toolbox release.
-TOOLBOX_RELEASE_VERSION=0.10.0
-TOOLBOX_RELEASE_SHA256=de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019
+TOOLBOX_RELEASE_VERSION=0.13.0
+TOOLBOX_RELEASE_SHA256=ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891
@@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3

 FROM ${NGINX_IMAGE} AS release

-ARG TOOLBOX_RELEASE_VERSION=0.10.0
-ARG TOOLBOX_RELEASE_SHA256=de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019
+ARG TOOLBOX_RELEASE_VERSION=0.13.0
+ARG TOOLBOX_RELEASE_SHA256=ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891
 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download

 RUN set -eu; \
@@ -24,6 +24,7 @@ RUN set -eu; \
    test -f /tmp/toolbox/apps/av/toolbox-app.json; \
    test -f /tmp/toolbox/apps/regex/toolbox-app.json; \
    test -f /tmp/toolbox/apps/svg/toolbox-app.json; \
+    test -f /tmp/toolbox/apps/auth/toolbox-app.json; \
    rm "/tmp/${archive}"

 FROM ${NGINX_IMAGE}
@@ -1,7 +1,7 @@
 # add·ideas Toolbox Portal

 `toolbox-portal` is the static launcher and release assembler for the add·ideas
-browser toolbox. Version `0.2.12` reads one same-origin catalogue, shows each app
+browser toolbox. Version `0.2.15` reads one same-origin catalogue, shows each app
 as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
 visibility, and appearance in the current browser. Pinned tools have their own
 section; search, category, and clickable tag filters stay close to the tool
@@ -37,7 +37,7 @@ the SDK and portal together.
 Vite uses `base: './'`, so the built portal works at `/` or a nested static path.
 The development catalogue at `public/toolbox.catalog.json` points to assembled
 paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`,
-`./apps/regex/`, and `./apps/svg/`).
+`./apps/regex/`, `./apps/svg/`, and `./apps/auth/`).
 Those manifests will correctly appear as unavailable until an assembled release
 is being served.

@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
 ## Production deployment behind Traefik

 The committed `compose.yaml` is the shortest production path. Its release
-container downloads the immutable Toolbox 0.10.0 ZIP during the image build,
+container downloads the immutable Toolbox 0.13.0 ZIP during the image build,
 verifies SHA-256 before extracting it, and then copies only the verified static
 files into the pinned unprivileged nginx image. Node.js and a local portal
 assembly are not required on the deployment host.
@@ -80,7 +80,7 @@ Prerequisites:
 - Traefik attached to the existing external Docker network `internal`;
 - Traefik HTTP and HTTPS entrypoints named `web` and `websecure`;
 - a certificate resolver named `netcup`;
- DNS for `toolbox.add-ideas.de` pointing to that Traefik instance; and
+- DNS for `toolbox.add-ideas.de` and `auth.toolbox.add-ideas.de` pointing to that Traefik instance; and
 - outbound HTTPS access to `git.add-ideas.de` while the image is built.

 Deploy a fresh clone with:
@@ -100,6 +100,18 @@ release version, and matching checksum can be overridden through environment
 variables; copy `.env.example` to `.env` only when an override is needed. For
 example, set `TOOLBOX_HOST=staging.toolbox.add-ideas.de` for a staging host.

+The same container also exposes only the packaged authentication app at
+`https://auth.toolbox.add-ideas.de/`. Traefik adds the internal `/apps/auth`
+prefix while the public URL remains `/`, so assets remain relative and the browser
+binds WebAuthn credentials to the dedicated `auth.toolbox.add-ideas.de` RP ID.
+The main Toolbox copy at `/apps/auth/` remains useful for offline inspection but
+disables live ceremonies because all Portal apps share that origin. The router
+hostname can be overridden with `AUTH_TOOLS_HOST`, but the bundled Auth Tools
+release enables live ceremonies only on its pinned production host (or
+localhost); other hosts remain inspect-only. A different production host
+therefore also requires rebuilding Auth Tools with the new exact host. Never
+widen the RP ID to `add-ideas.de`.
+
 The external network is deliberately not created by this project. Creating a
 private project-local network would prevent an independently managed Traefik
 container from reaching the service.
@@ -121,9 +133,10 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
 must declare the pinned reverse-DNS id and version. Application and portal
 versions are independent.

-`release/toolbox.lock.json` is the reviewed v0.10.0 lock. Its URLs and checksums
+`release/toolbox.lock.json` is the reviewed v0.13.0 lock. Its URLs and checksums
 pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
-Audio & Video Tools 0.3.0, Regex Tools 0.4.2, and SVG Tools 0.1.0 release bytes. Use
+Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, and OTP & Passkey
+Tools 0.3.0 release bytes. Use
 `release/toolbox.lock.example.json` as the template for a future release and
 verify every downloaded asset before committing updated values. Artifacts may be:

@@ -144,7 +157,7 @@ npm run assemble -- \
  --lock release/toolbox.lock.json \
  --portal-dist dist \
  --output build/toolbox \
-  --archive build/add-ideas-toolbox-0.10.0.zip
+  --archive build/add-ideas-toolbox-0.13.0.zip
 ```

 Existing output is refused. Pass `--force` only when replacing those exact
@@ -165,10 +178,11 @@ build/toolbox/
    ├── onenote/
    ├── av/
    ├── regex/
-    └── svg/
+    ├── svg/
+    └── auth/

-build/add-ideas-toolbox-0.10.0.zip
-build/add-ideas-toolbox-0.10.0.zip.sha256
+build/add-ideas-toolbox-0.13.0.zip
+build/add-ideas-toolbox-0.13.0.zip.sha256
 ```

 The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -189,7 +203,7 @@ directory separately:
 ```sh
 npm run package:static -- \
  --input build/toolbox \
-  --output artifacts/add-ideas-toolbox-0.10.0.zip
+  --output artifacts/add-ideas-toolbox-0.13.0.zip
 ```

 This also emits a `.sha256` sidecar.
@@ -202,7 +216,14 @@ immutable caching only for Vite-hashed assets and narrowly matched
 semver-versioned FFmpeg core files, and revalidation for all other files. The
 opaque-origin SVG preview iframe loads its packaged controller with a URI-exact
 CORS and cross-origin resource-policy exception; all other files retain the
-same-origin policy and every normal security header. Assemble first, then:
+same-origin policy and every normal security header. Camera access is denied on
+the shared Toolbox host and granted only to the dedicated
+`auth.toolbox.add-ideas.de` origin, where Auth Tools still requests it only
+after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the
+exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host at
+the same time; the default-deny fallback deliberately does not infer camera
+grants from request paths.
+Assemble first, then:

 The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
 `ixsl:eval()` extension is therefore unsupported in this deployment profile;
@@ -210,9 +231,9 @@ normal local XML/XSLT transformations do not require that permission.

 ```sh
 podman build -f Containerfile \
-  -t git.add-ideas.de/lotobo/toolbox:0.10.0 .
+  -t git.add-ideas.de/lotobo/toolbox:0.13.0 .
 podman run --rm -p 8080:8080 \
-  git.add-ideas.de/lotobo/toolbox:0.10.0
+  git.add-ideas.de/lotobo/toolbox:0.13.0
 ```

 For a direct-port local deployment after assembly, use the separate example:
@@ -229,8 +250,8 @@ docker login git.add-ideas.de
 docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --file Containerfile.release \
-  --tag git.add-ideas.de/lotobo/toolbox:0.10.0 \
-  --tag git.add-ideas.de/lotobo/toolbox:0.10 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.13.0 \
+  --tag git.add-ideas.de/lotobo/toolbox:0.13 \
  --push .
 ```

@@ -252,11 +273,11 @@ needs permission to push code, releases, and container packages to
 3. Verify downloaded app assets with `sha256sum -c <asset>.sha256`; copy those
   exact values into a reviewed toolbox lock.
 4. Run the assembler and serve `build/toolbox` from a nested test path. Open
-   all six apps, switch between them, and confirm the encoded `toolbox`
+   all seven apps, switch between them, and confirm the encoded `toolbox`
   context.
 5. Verify the distribution with
-   `(cd build && sha256sum -c add-ideas-toolbox-0.10.0.zip.sha256)`.
-6. Commit the reviewed lock, tag the toolbox release (for example `v0.10.0`), and
+   `(cd build && sha256sum -c add-ideas-toolbox-0.13.0.zip.sha256)`.
+6. Commit the reviewed lock, tag the toolbox release (for example `v0.13.0`), and
   push the branch and tag to Gitea.
 7. In Gitea, open **Releases → New release**, select the tag, and upload the
   static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -271,14 +292,15 @@ must not re-resolve app versions or substitute a newer release.

 ## Existing tools

-| Tool                | State and boundary                                        | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                                                                   | Critical considerations and integrations                                                                                                                                                                                                                                                 |
-| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                              |
-| **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                               |
-| **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                      |
-| **`av-tools`**      | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                       | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                           |
-| **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
-| **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository  | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                          |
+| Tool                | State and boundary                                        | Principal workflows                                                                                                                                 | Important concrete scope                                                                                                                                                                                                                                                                                                                                   | Critical considerations and integrations                                                                                                                                                                                                                                                                                   |
+| ------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`pdf-tools`**     | Existing; dedicated repository                            | Merge, split, reorder, rotate and export PDF pages                                                                                                  | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace                                                                                                                                                                                                                                                                  | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools`                                                                                                                                                                |
+| **`xslt-tools`**    | Existing; dedicated repository                            | Develop, test and run XSLT transformations                                                                                                          | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics                                                                                                                                                                                                                                                          | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools`                                                                                                                                                                                                                 |
+| **`onenote-tools`** | Existing rich-reader release; dedicated repository        | Open, browse, inspect and export OneNote sections and packages locally                                                                              | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export                                                                                                                                                                                         | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity                                                                                                                                                                        |
+| **`av-tools`**      | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser                                                                                     | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export                                                                       | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable                                                                                             |
+| **`regex-tools`**   | Current local-first v0.4.2 release; dedicated repository  | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics                                   |
+| **`svg-tools`**     | Initial local-first v0.1.0 release; dedicated repository  | Inspect and edit SVG source, structure, geometry, references and accessibility locally                                                              | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export                                                                                                                                                                                  | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository                                                                            |
+| **`auth-tools`**    | Current local-first v0.3.0 release; dedicated repository  | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally                                    | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation                                                                                             | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration |

 ## Planned tools

@@ -3,7 +3,7 @@ services:
    build:
      context: .
      dockerfile: Containerfile
-    image: git.add-ideas.de/lotobo/toolbox:0.10.0
+    image: git.add-ideas.de/lotobo/toolbox:0.13.0
    restart: unless-stopped
    read_only: true
    ports:
@@ -6,9 +6,9 @@ services:
      context: .
      dockerfile: Containerfile.release
      args:
-        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.10.0}"
-        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-de6f1afc3f0ec08ee1a8afd80d874832cbf905d0d50f62060e6985be9f5e0019}"
-    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.10.0}"
+        TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.13.0}"
+        TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891}"
+    image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.13.0}"
    restart: unless-stopped
    read_only: true
    tmpfs:
@@ -38,6 +38,19 @@ services:
      traefik.http.middlewares.addideas-toolbox-https-redirect.redirectscheme.scheme: https
      traefik.http.middlewares.addideas-toolbox-https-redirect.redirectscheme.permanent: "true"
      traefik.http.services.addideas-toolbox.loadbalancer.server.port: "8080"
+      traefik.http.routers.addideas-auth.rule: "Host(`${AUTH_TOOLS_HOST:-auth.toolbox.add-ideas.de}`)"
+      traefik.http.routers.addideas-auth.priority: 1000
+      traefik.http.routers.addideas-auth.entrypoints: websecure
+      traefik.http.routers.addideas-auth.tls: "true"
+      traefik.http.routers.addideas-auth.tls.certresolver: "${TRAEFIK_CERT_RESOLVER:-netcup}"
+      traefik.http.routers.addideas-auth.middlewares: addideas-auth-prefix
+      traefik.http.routers.addideas-auth.service: addideas-toolbox
+      traefik.http.routers.addideas-auth-http.rule: "Host(`${AUTH_TOOLS_HOST:-auth.toolbox.add-ideas.de}`)"
+      traefik.http.routers.addideas-auth-http.priority: 1000
+      traefik.http.routers.addideas-auth-http.entrypoints: web
+      traefik.http.routers.addideas-auth-http.middlewares: addideas-toolbox-https-redirect
+      traefik.http.routers.addideas-auth-http.service: addideas-toolbox
+      traefik.http.middlewares.addideas-auth-prefix.addprefix.prefix: /apps/auth

 networks:
  internal:
@@ -14,6 +14,11 @@ map $uri $toolbox_access_control_allow_origin {
  "/apps/svg/canvas-frame-controller.js" "*";
 }

+map $host $toolbox_permissions_policy {
+  default "camera=(), microphone=(), geolocation=(), payment=(), usb=()";
+  "auth.toolbox.add-ideas.de" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()";
+}
+
 server {
  listen 8080;
  listen [::]:8080;
@@ -31,7 +36,7 @@ server {
  add_header Cross-Origin-Embedder-Policy "require-corp" always;
  add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always;
  add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always;
-  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
+  add_header Permissions-Policy $toolbox_permissions_policy always;
  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always;
  add_header Cache-Control $toolbox_cache_control always;

@@ -1,12 +1,12 @@
 {
  "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.12",
+  "version": "0.2.15",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@add-ideas/toolbox-portal",
-      "version": "0.2.12",
+      "version": "0.2.15",
      "license": "AGPL-3.0-only",
      "dependencies": {
        "@add-ideas/toolbox-contract": "^0.2.3",
@@ -1,6 +1,6 @@
 {
  "name": "@add-ideas/toolbox-portal",
-  "version": "0.2.12",
+  "version": "0.2.15",
  "license": "AGPL-3.0-only",
  "private": true,
  "type": "module",
@@ -1,8 +1,8 @@
 # Corresponding source

-The source code corresponding to add·ideas Toolbox Portal 0.2.12 is available at:
+The source code corresponding to add·ideas Toolbox Portal 0.2.15 is available at:

-https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.10.0
+https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.13.0

 Each bundled application contains its own `SOURCE.md`, license, and third-party
 license materials. The application sources are also linked from the portal.
@@ -32,6 +32,10 @@
    {
      "manifest": "./apps/svg/toolbox-app.json",
      "enabled": true
+    },
+    {
+      "manifest": "./apps/auth/toolbox-app.json",
+      "enabled": true
    }
  ]
 }
@@ -1,8 +1,8 @@
 {
  "$schema": "./toolbox-release-lock.schema.json",
  "schemaVersion": 1,
-  "releaseVersion": "0.10.0",
-  "portalVersion": "0.2.12",
+  "releaseVersion": "0.13.0",
+  "portalVersion": "0.2.15",
  "catalogue": {
    "id": "de.add-ideas.toolbox",
    "name": "add·ideas Toolbox",
@@ -54,6 +54,13 @@
      "artifact": "https://git.add-ideas.de/lotobo/svg-tools/releases/download/v0.1.0/svg-tools-0.1.0.zip",
      "sha256": "364f14c88c4934d9c847bf76de70b89dcf564a405afd58c6703363a95fbfb6ae",
      "target": "svg"
+    },
+    {
+      "id": "de.add-ideas.auth-tools",
+      "version": "0.3.0",
+      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.0/auth-tools-0.3.0.zip",
+      "sha256": "ac80a711a0fc00d554505e6278aa3557eca4248b6da2ac9e2bae74bc0b26e58e",
+      "target": "auth"
    }
  ]
 }
@@ -1,8 +1,8 @@
 {
  "$schema": "./toolbox-release-lock.schema.json",
  "schemaVersion": 1,
-  "releaseVersion": "0.10.0",
-  "portalVersion": "0.2.12",
+  "releaseVersion": "0.13.0",
+  "portalVersion": "0.2.15",
  "catalogue": {
    "id": "de.add-ideas.toolbox",
    "name": "add·ideas Toolbox",
@@ -54,6 +54,13 @@
      "artifact": "https://git.add-ideas.de/lotobo/svg-tools/releases/download/v0.1.0/svg-tools-0.1.0.zip",
      "sha256": "364f14c88c4934d9c847bf76de70b89dcf564a405afd58c6703363a95fbfb6ae",
      "target": "svg"
+    },
+    {
+      "id": "de.add-ideas.auth-tools",
+      "version": "0.3.0",
+      "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.0/auth-tools-0.3.0.zip",
+      "sha256": "ac80a711a0fc00d554505e6278aa3557eca4248b6da2ac9e2bae74bc0b26e58e",
+      "target": "auth"
    }
  ]
 }
@@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) {
  return {
    schemaVersion: 1,
    releaseVersion: '0.1.0',
-    portalVersion: '0.2.12',
+    portalVersion: '0.2.15',
    catalogue: {
      id: 'de.add-ideas.toolbox',
      name: 'Test Toolbox',
@@ -85,7 +85,15 @@ describe('production deployment', () => {
    expect(containerfile).toContain(
      'COPY --from=release --chown=101:101 /tmp/toolbox/'
    );
-    for (const app of ['pdf', 'xslt', 'onenote', 'av', 'regex', 'svg']) {
+    for (const app of [
+      'pdf',
+      'xslt',
+      'onenote',
+      'av',
+      'regex',
+      'svg',
+      'auth',
+    ]) {
      expect(containerfile).toContain(
        `test -f /tmp/toolbox/apps/${app}/toolbox-app.json`
      );
@@ -133,6 +141,43 @@ describe('production deployment', () => {
    expect(compose).not.toMatch(/^\s+ports:/mu);
  });

+  it('isolates live WebAuthn behind a dedicated hostname and path prefix', () => {
+    expect(environmentExample).toContain(
+      'AUTH_TOOLS_HOST=auth.toolbox.add-ideas.de'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-auth.rule: "Host(`${AUTH_TOOLS_HOST:-auth.toolbox.add-ideas.de}`)"'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-auth.entrypoints: websecure'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-auth.tls.certresolver: "${TRAEFIK_CERT_RESOLVER:-netcup}"'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-auth.middlewares: addideas-auth-prefix'
+    );
+    expect(compose).toContain(
+      'traefik.http.middlewares.addideas-auth-prefix.addprefix.prefix: /apps/auth'
+    );
+    expect(compose).toContain(
+      'traefik.http.routers.addideas-auth-http.middlewares: addideas-toolbox-https-redirect'
+    );
+    expect(compose).not.toContain('addideas-auth-stripprefix');
+  });
+
+  it('grants camera capture only to the isolated authentication hostname', () => {
+    expect(nginxConfig).toMatch(
+      /map \$host \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"auth\.toolbox\.add-ideas\.de" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu
+    );
+    expect(nginxConfig).toContain(
+      'add_header Permissions-Policy $toolbox_permissions_policy always;'
+    );
+    expect(
+      nginxConfig.match(/^\s*add_header Permissions-Policy /gmu)
+    ).toHaveLength(1);
+  });
+
  it('quotes nginx regular expressions that contain brace quantifiers', () => {
    expect(nginxConfig).toContain(
      '"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\\.[^/]+$"'
@@ -45,6 +45,9 @@ describe('portal UI', () => {
    expect(
      screen.getByTestId('app-card-de.add-ideas.svg-tools')
    ).toHaveTextContent('SVG');
+    expect(
+      screen.getByTestId('app-card-de.add-ideas.auth-tools')
+    ).toHaveTextContent('OTP & Passkeys');
    expect(
      screen.queryByText(
        'Page-level PDF operations performed locally in the browser.'
@@ -411,6 +414,7 @@ describe('portal UI', () => {
            'de.add-ideas.xslt-tools',
            'de.add-ideas.onenote-tools',
            'de.add-ideas.svg-tools',
+            'de.add-ideas.auth-tools',
          ],
          hidden: [],
          theme: 'light',
@@ -429,6 +433,7 @@ describe('portal UI', () => {
      screen.getByTestId('app-card-de.add-ideas.xslt-tools'),
      screen.getByTestId('app-card-de.add-ideas.onenote-tools'),
      screen.getByTestId('app-card-de.add-ideas.svg-tools'),
+      screen.getByTestId('app-card-de.add-ideas.auth-tools'),
    ];
    cards.forEach((card, index) => {
      const rect = {
@@ -459,7 +464,7 @@ describe('portal UI', () => {
        within(tools)
          .getAllByRole('heading', { level: 3 })
          .map((heading) => heading.textContent)
-      ).toEqual(['XSLT', 'PDF', 'OneNote', 'SVG']);
+      ).toEqual(['XSLT', 'PDF', 'OneNote', 'SVG', 'OTP & Passkeys']);
    });
    expect(
      JSON.parse(localStorage.getItem(PREFERENCES_KEY) ?? '{}').order
@@ -468,6 +473,7 @@ describe('portal UI', () => {
      'de.add-ideas.pdf-tools',
      'de.add-ideas.onenote-tools',
      'de.add-ideas.svg-tools',
+      'de.add-ideas.auth-tools',
    ]);
  });

@@ -489,9 +489,9 @@ export default function App() {
            </span>
          </p>
          <span>
-            Portal v0.2.12 ·{' '}
+            Portal v0.2.15 ·{' '}
            <a
-              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.10.0"
+              href="https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.13.0"
              target="_blank"
              rel="noopener noreferrer"
            >
@@ -10,7 +10,7 @@ describe('catalogue loading', () => {
    const loaded = await loadCatalogue('/toolbox.catalog.json');
    expect(loaded.catalogue.name).toBe('add·ideas Toolbox');
    expect(loaded.homeUrl).toBe('http://localhost:3000/');
-    expect(loaded.apps).toHaveLength(4);
+    expect(loaded.apps).toHaveLength(5);
    expect(loaded.apps[0]).toMatchObject({
      id: 'de.add-ideas.pdf-tools',
      name: 'PDF Workbench',
@@ -41,6 +41,7 @@ describe('catalogue loading', () => {
      'de.add-ideas.xslt-tools',
      'de.add-ideas.onenote-tools',
      'de.add-ideas.svg-tools',
+      'de.add-ideas.auth-tools',
    ]);
    expect(loaded.unavailable).toHaveLength(1);
    expect(loaded.unavailable[0]?.reason).toMatch(/HTTP 404/);
@@ -119,6 +119,47 @@ export const svgManifest: ToolboxAppManifest = {
  assets: ['./canvas-frame-controller.js'],
 };

+export const authManifest: ToolboxAppManifest = {
+  ...pdfManifest,
+  id: 'de.add-ideas.auth-tools',
+  name: 'OTP & Passkey Tools',
+  version: '0.1.0',
+  description:
+    'Generate, inspect and verify OTP credentials and test WebAuthn/passkey ceremonies locally in the browser.',
+  icon: './favicon.svg',
+  categories: ['security', 'authentication', 'developer'],
+  tags: [
+    'otp',
+    'hotp',
+    'totp',
+    'ocra',
+    'oath',
+    'webauthn',
+    'fido2',
+    'passkey',
+    'attestation',
+    'assertion',
+  ],
+  requirements: {
+    secureContext: true,
+    workers: false,
+    indexedDb: false,
+    crossOriginIsolated: false,
+    topLevelContext: true,
+  },
+  privacy: {
+    processing: 'local',
+    fileUploads: false,
+    telemetry: false,
+    label:
+      'Authentication material stays in this tab; nothing is uploaded or saved unless you explicitly export it.',
+  },
+  source: {
+    repository: 'https://git.add-ideas.de/lotobo/auth-tools',
+    license: 'GPL-3.0-or-later',
+  },
+};
+
 export const catalogue: ToolboxCatalog = {
  schemaVersion: 1,
  id: 'de.add-ideas.toolbox',
@@ -130,6 +171,7 @@ export const catalogue: ToolboxCatalog = {
    { manifest: './apps/xslt/toolbox-app.json', enabled: true },
    { manifest: './apps/onenote/toolbox-app.json', enabled: true },
    { manifest: './apps/svg/toolbox-app.json', enabled: true },
+    { manifest: './apps/auth/toolbox-app.json', enabled: true },
  ],
 };

@@ -153,6 +195,8 @@ export function catalogueFetch(overrides: Record<string, Response> = {}) {
      return Response.json(regexManifest);
    if (url.pathname.endsWith('/apps/svg/toolbox-app.json'))
      return Response.json(svgManifest);
+    if (url.pathname.endsWith('/apps/auth/toolbox-app.json'))
+      return Response.json(authManifest);
    return new Response('Not found', { status: 404 });
  };
 }
@@ -39,4 +39,17 @@ describe('compact tool presentation', () => {
    expect(shortToolTitle(svg)).toBe('SVG');
    expect(shortToolDescription(svg)).toBe('Inspect and edit vectors locally.');
  });
+
+  it('uses the compact authentication tile copy', () => {
+    const auth = app(
+      'de.add-ideas.auth-tools',
+      'OTP & Passkey Tools',
+      'Generate, inspect and verify OTP credentials and test WebAuthn/passkey ceremonies locally in the browser.'
+    );
+
+    expect(shortToolTitle(auth)).toBe('OTP & Passkeys');
+    expect(shortToolDescription(auth)).toBe(
+      'Inspect and test authentication locally.'
+    );
+  });
 });
@@ -25,6 +25,10 @@ const PRESENTATION: Record<string, { title: string; description: string }> = {
    title: 'SVG',
    description: 'Inspect and edit vectors locally.',
  },
+  'de.add-ideas.auth-tools': {
+    title: 'OTP & Passkeys',
+    description: 'Inspect and test authentication locally.',
+  },
 };

 export function shortToolTitle(app: ResolvedApp): string {
Author	SHA1	Message	Date
zemion	8d68557d5e	feat: publish Toolbox 0.13.0 with Auth Tools 0.3.0	2026-08-20 00:25:18 +02:00
zemion	7ba733d9f2	feat: publish Toolbox 0.12.0 with Auth Tools 0.2.0	2026-08-19 14:18:18 +02:00
zemion	0baeda8be8	feat: add OTP and Passkey Tools to Toolbox 0.11.0	2026-08-19 12:20:27 +02:00