#30074 React Interface: Signing In with Passkeys (WebAuthn) — passwordless or as a second factor alongside TOTP; managing your own passkeys in the settings

enhancement

major

#29993

Configuration: Each configured function can be implemented in either Java or TL-Script, using the same configuration syntax (including in the React configuration editor)

#30000

Design System UI pass, part 1: one selection form; surface-interactive-selected becomes surface-interactive-strong

#30006

Engine Extensions for the Tax Application: writable secret storage in the database, application context path in development mode (tl.contextPath), and instance search by attribute value

#30025

React UI: Hide commands and units for which the logged-in user does not have the required role on any object

#30031

The database does not enforce uniqueness of reference values without duplicates: a unique index on the link tables, separate link tables for bags

#30041

Self-service accounts: invitations expire and record their acceptance, invitations can be accepted and managed in the React UI, localized mail templates

#30045

View layer slots: report a <slot-content> that reaches no <slot>, empty fallback of a <slot>, slot positions in split panels and the sidebar

#30053

Agent runs: bound the pool of parallel tool calls (AgentLoop.TOOL_WORKERS) and tell a user whose chat message waits for a free worker

#30054

Agent screenshots belong to their chat: deleted with it, shown as thumbnails in the chat

#30057

Administration of the React UI: scheduler (task list, run now, stop, activate/deactivate, cluster lock, run history) with one unified active/inactive switch per task

#30058

Administration of the React UI: memory trend chart (memory use over time incl. garbage collection) and the remaining monitoring views of the classic UI

#30059

Administration of the React UI: maintenance functions of the classic maintenance pages (database export/import/history compaction, SQL console, reload, search index, security storage, encryption)

#30061

React UI: recent changes of the user with revert of a commit (user menu)

#30062

Model editor of the React UI: instance browser and instance import of the selected type

#30063

Administration of the React UI: people (contacts with optional login) in one form

#30064

Administration of the React UI: login messages (messages shown at login, with their validity)

#30065

React Interface: Workflow Administration with BPMN Editor, Step Views from the View Designer, and Task Editing (BPE)

#30066

React Administration: View and Explain an Account's Effective Permissions on an Object (Role Inspector)

#30074

React Interface: Signing In with Passkeys (WebAuthn) — passwordless or as a second factor alongside TOTP; managing your own passkeys in the settings

#30075

Log View (React UI): Display the details of an entry (stack trace) in a dialog in a readable format

#30076

React Interface: Password change with confirmation message and validation before the identity prompt; protection against brute-force attacks on passwords and one-time codes

#30081

TL Views: Change Authenticator App (New TOTP Secret), Reset Two-Factor Authentication by Administrator

#30086

XML import: <update> of <unless-known> must restate the structure of the descendants it updates

#30088

View layer: document how a ChannelSource keeps a monitor running while its view is hidden and ends it with the window

#30095

OpenAPI Client: Parameter Value from a Secret Source

#30096

Rights System: Remove the configurable group mapper from the ElementAccessManager

#30097

Generate JavaScript libraries (umljs, ace, require.js, bpmn-js) in the Maven build instead of checking them in; update bpmn-js to version 18

#30098

Design system as an engine module: built by Maven instead of a checked-in copy with seals

#30104

Nightly preview builds of the engine with a fixed Maven version and a changelog instead of a rolling SNAPSHOT

#30108

pac4j Registration: The account mapping receives the identity provider's full identity (subject, claims) rather than just a login name

#30116

CommonMark: Displaying Tables (GFM) as HTML Tables

#30117

Refetch timeout does not specify the thread holding the commit/refetch lock

#30120

View layer: options of a string attribute cannot have display labels

#30122

Remove TLDoclet exceptions in ext/javadoc/javadoc-ignores

#30126

tl-chat: Chat actions run as React commands within the window rather than via a separate ChatServlet; the chat's proxy workaround is no longer used in favor of engine polling

#30131

View layer: show the fallback of AttributeWithFallbackStorage as placeholder of a form field

#30132

View layer: value listeners of the model (<value-listeners>) react to field changes in the React form, through a UI-independent listener contract

#30148

RecollateStringColumnsProcessor: Run ANALYZE after changing the collation (PostgreSQL)

#30149

Let a chat agent run page commands that the page of the chat allows, e.g. open a dialog

#30150

Ship a provider with recorded model answers for the agent tests of applications

#30151

React View Layer: Commands Without HandlerResult - View commands report errors as exceptions; React command handlers return their response as a msgbuf message

#30157

React Interface: Insert images into the HTML editor using Ctrl+V and drag-and-drop; resize using handles; never wider than the content

#30158

TL Chat: Let a chat agent pass the input of a page command it runs

#30160

Adding Albert to an application: shipped React chat page, how-to article and archetype defaults

#30163

SQLFactory: Generate column changes (modifyColumnName/Type/Mandatory) only with a complete column definition

#30167

Remove database defaults for columns: Add required columns using "create, populate, set as required"

#30172

Create accounts at an external login and assign their groups from a claim

#30179

An application generated with useSSO=true offers the generic OpenID login, switched on by the tl_pac_* environment variables, also on the development server

#30183

Self-Service: Open self-registration without an invitation

#30190

Remove the control application tl-factory from the engine, it is developed in its own repository

#30200

Agent Access and Recording: Commands operate on stable object IDs; technical keys are used only for recording and playback

#30215

View layer: a value channel whose value is remembered per user

#30223

Self-service mails: texts editable in the service configuration, language of an invitation selectable

#30225

Model: handlers declared on an attribute (change) or a type (creation, deletion), run within the commit

#30227

Design System UI pass, part 1b: tables with depth and visible column boundaries

#30250

TL Views: <start-job> / <job-status> - close button for an ended job, point of no return, partial result of a cancelled job, closing the dialog from the follow-up, follow-up sees the job's commits

#30253

tl-ai-core pulls the Playwright browsers (driver-bundle, 200 MB) into every application: browser tools move into the optional module tl-ai-browser

#30266

React Configuration Editor: Multi-line text (HTML, Markdown, code, multi-line) uses the entire line by default

#30267

Setting and removing administrative secrets; writable directory storage

#30268

System Environment: Display the source of configuration variables and set variables from the administration interface

#30276

AI Agents: Meaningful commit messages for changes made by an agent instead of "Agent edit"

minor

#30139

TL Views: Unit and Custom Number Format for Number Fields

#30188

TL Script: Read a binary value as text; Read a web app resource as a binary value

#30209

React Table: Show and Hide Columns Based on Channel Values (exists-if)

#30218

ModificationListener: no supported way to report to the user what a Modification changed, once the commit succeeded

defect

critical

#30146

Data migration is not protected against parallel execution when multiple cluster nodes are started simultaneously

#30196

Canceling a background job (TL Views <start-job>, Scheduler Task, JMS Consumer) interrupts the thread in the middle of a database operation and closes an embedded H2 database (MVStore panic, application becomes unusable)

#30224

TestFlowSvgPortable does not compile: FlowFactory.chart() has the parameter fixedView

#30301

React-Views: TestTreeTableRowEdit no longer compiles on master (ExpandArguments.ROW_INDEX replaced with ROW_ID)

major

#29847

Scripted test TestTransactionMonitor-01_RevertRevision fails when a scheduled task commits concurrently

#30043

TL Views: a value the server sets while the React rich-text editor has the focus is never applied; the composer keeps its text after sending

#30067

React Interface: Logging in in one browser tab immediately logs you out if a second tab for the application is open

#30077

TL Views: Wizard—re-entering an "Auto-Next" step without a separate navigation path leaves the user with no way to return to the workflow

#30078

React Interface: When setting up two-factor authentication, the key for manual entry is not displayed; only the QR code is shown.

#30079

Configured SecurityParents do not work with StructuredElementWrapper

#30082

React UI: Tabs in a dialog change the page's address and remain in the URL after the dialog is closed

#30090

Scheduler: A task that is due at startup is detached during shutdown while it is still running (NullPointerException in TaskImpl.getLog())

#30099

Scheduler tests: testStartTaskImmediately and testPeriodically have occasionally timed out since the scheduler was revised

#30103

tl-maven-plugin: If merging the view overlays fails during application build, the build remains green

#30106

tl-chat: Commands at the top of a data-list do not display their status (hidden, disabled with reason); clicking on a locked command produces no response

#30107

tl-maven-plugin: If generating a layout fails during application build, the build remains green

#30109

tl-chat: After logging in, the chat in the same browser window remains at "Log in to use the chat"

#30110

An aborted external login (OIDC) leaves a logged-in session without tokens

#30115

delete-module / delete-class do not clean up hasWrapperAttValue data

#30118

Passkeys per application can be used either for password-less login or as a second factor, but not both at the same time

#30119

AlterColumnProcessor does not update stored schema for abstract types

#30123

The scheduler incorrectly reports "There is no thread to remove" when a task fails to start

#30124

OpenAPI Server: The error message for a failed script is unreadable and is generated outside the interaction context

#30125

Agent access: /agent-api answers a request without a valid credential with a redirect to the login page instead of 401

#30127

An application at the server root keeps its session: the session cookie is sent to all its paths, and the React page announces its icon

#30128

A run without provider credentials ends as an authentication failure, and HTTP 402 is a billing failure for every provider

#30133

View layer: a field mandatory by dynamic visibility loses its required marker on a validation change

#30141

TypeIndexer: Java 21 as a supported source version; Index records

#30143

TL Chat: While an agent is performing multiple steps, their last message remains visible, and the status bar displays the current step instead of just showing "…" and "Working on …"

#30144

Chat sessions are invisible to their owner in an application with model-based security

#30147

React Interface: The "More Actions" menu does not close when the Escape key is pressed if all items are disabled

#30159

React UI Script Recorder: Recordings of tree, multiple-selection, and dropdown assertions can be replayed in a different session

#30164

TL Chat: A run that fails with an exception leaves no error in the conversation; it is gone after a reload

#30165

React: A command with ignoreStaleUi to a control that left the display still fails with 404 "Control not found"

#30166

TL Chat: runPageCommand gives the model the refusal of a page command in English instead of the user's language

#30173

OIDC login button is offered although the client has neither discovery URI nor provider metadata

#30176

The development server stops on /admin/stop from any address

#30177

The development server ignores X-Forwarded-* headers, so a relative callback URL behind a proxy names the wrong origin

#30184

DeleteTableProcessor does not remove " <alternative>" elements from the stored schema

#30201

Commit veto of the model constraints: a failed job (and its log) shows only "Cannot store, constraints violated." without the problems

#30216

Background processing fails with the error "Session revision invalid" if the window saves data while it is running (jobs, AI runs)

#30231

HtmlResKey: Also read the value as an attribute (add format)

#30244

tl-archetype-deploy: Declare the archetype integration test's dependency on tl-demo

#30247

Migrating to PostgreSQL with `autosave=NEVER`: Expected SQL errors abort the transaction

#30251

tl-ai-core, Anthropic provider: Claude 5.5 models missing from the bundled model catalog, and claude-haiku-5-5 sent a thinking budget (HTTP 400)

#30252

tl-ai-mcp-server: tools/list is not filtered by the caller's tool access, and /mcp/ with a trailing slash answers 404

#30254

tl-chat: A missing API key is reported as a rejected key ("The model rejected the access key")

#30255

tl-ai-core: agent turn rolled back with "Create on objects of type ... without permission" when a tool creates a part in an object created in the same turn - remove the duplicate pre-commit guard, check initial values in TL-Script

minor

#29961

React applications include modules from the classic interface (self-service, WYSIWYG editor, code editor, search, monitoring, AI administration)

#30044

TL Views: a sidebar separator stays visible when every item after it is hidden; the anonymous session sees the system separator with nothing below it

#30085

Default values <country value="..."/> and <time-zone value="..."/> (CountryDefaultProvider, TimeZoneDefaultProvider) cannot be used

#30089

The TL script functions `binarySize()` and `modelHealthReset()` return integers instead of doubles and log an error on every call

#30121

Compile-Errors in Eclipse in TL 8 alpha12

#30134

View layer: <composition-table> ignores the visibility (dynamic-visibility, hidden, read-only) of its composite attribute

#30140

TL Views: TestViewsLoad does not detect an undefined variable in a computed-column's value expression

#30142

CommaSeparatedStringSet: Non-deterministic serialization creates duplicate key attributes in the schema baseline

#30180

Flowchart (Gantt): Clicking on an element does not select anything if frozenRows > 0

#30181

Flowchart (Gantt): The chart is always displayed in full—no vertical scrolling, but it becomes unreadable when there are many rows

#30185

Flowchart (Gantt): LineDeco labels (e.g., “Today”) are cut off beneath fixed headers; edges without arrowheads

#30187

Exporting diagrams as SVG (reactFlowToSvg, flowToSvg) is not suitable for Batik or printing

#30191

Module shutdown stops no module at all if the class of its InContext job cannot be loaded (database stays open in the container's JVM)

#30197

React Table: Date cell in in-place edit accepts any partial keyboard input (e.g., year 0002)

#30198

React Views: Tree Table ({{{<tree-table>}}}) without row editing ({{{row-edit}}}) – not a replacement for the classic tree grid

#30199

React-Views: When a constraint is violated, the editable table displays only a red border, not an error message

#30204

React Table: When there are multiple row types, attribute columns are resolved only for the first type (label, sorting, filter)

#30205

React Table with Row Edit: A column based on a derived attribute is editable, but saving fails

#30206

React: A disabled `upload-command` does not display a reason; `null-input-disabled` always disables it

#30207

React: Button with an upload action does not open the file dialog

#30208

React Table: No cell display for external links (URL)

#30211

React: The built-in rules for `delete-object` and similar take precedence over the configured ones (making `visible-if` ineffective)

#30212

React: `null-input-disabled` only checks the first input

#30213

Binary attribute: Querying the content type loads the entire content; BLOB columns in object tables are loaded only for small values

#30214

View layer: tooltips drop the line breaks of their text (.tl-tooltip__body has white-space: normal)

#30226

React Table: Commands are unaware of the displayed rows or their order

#30237

React-UI: No display while a command is running on the server

#30256

React-UI: Set the color role of a row, cell, or view as a separate script (row-role, cell-role, role) instead of the ineffective status classes tl-status-*

#30257

React-UI: Commands from a window in a detached session generate two WARN lines per command

#30258

React-UI: The only way to display tabs for a single type is by using a type deviation in `access-control`, and that is logged as a WARN.

#30259

KB: Committable.rollback() is called after a successful database commit if the changes or caches fail to be published

#30265

TL Script: When `throw()` is used or a `TopLogicException` occurs, `try()` passes only the message text to the `catch` block instead of the `ResKey`.

#30269

ModelAccessRights.isAllowed(Person, ...): Checks whether another person is granted bypass or admin status in the current context

task

major

#30046

Remove the unused service ReactComponentRegistry

update

critical

#30111

Update dependency requirejs to ^2.3.7 [SECURITY]

enhancement (User-visible)

major

#30074

React Interface: Signing In with Passkeys (WebAuthn) — passwordless or as a second factor alongside TOTP; managing your own passkeys in the settings

ReactUI

Context

TopLogic's multi-factor authentication (#29092) previously only supported a time-based one-time password (TOTP, RFC 6238) from an authenticator app as the second factor (tl.accounts:Person#mfaSecret, #mfaRequirement). Passkeys (FIDO2/WebAuthn)—key pairs tied to a device, a security key, or a password manager, which the browser unlocks using a PIN or biometrics—were not supported.

Using the tl-security-passkey module, a user logs in to the React interface (.view.xml level) with a passkey. The classic interface continues to use a password and TOTP.

Behavior

Intended use per application: The application uses the `usage` option of the `PasskeyService` to specify the purpose of passkeys and offers only the appropriate setup: `login ` (default)—logging in without a password—or `second-factor `—a passkey as a second factor after the password. Never both at the same time (#30118).
Password-free login (login): The login form displays “Log in with Passkey” below the single sign-on buttons, with the same width as those buttons. The browser prompts for a passkey registered for the application (access credentials that can be retrieved; no username required); after authorization on the device, the user is logged in. Passkeys are created to be discoverable and always require user verification (PIN/biometrics); the login is therefore considered two-factor and meets the mfaRequirement required. A passkey is not a second factor here: After logging in with a password, no passkey is required.
Second factor (second-factor): The login form does not offer login via passkey. Passkeys are created as non-discoverable. An account with a passkey confirms the login with the passkey after entering the password; an account with a passkey and an authenticator app selects the method in a selection dialog. An account with “required” but no second factor allows the user to choose during sign-in whether to set up an authenticator app or a passkey; creating the passkey completes the sign-in process.
The service rejects any authentication method that does not match the intended use. Saved passkeys are retained when switching; a passkey set up as a second factor will not allow login without a password after switching to “login,” so the user must then create a new one.
Application address: Passkeys are bound to the application’s public address (%HOST%, set via the tl_host variable, e.g., https://apps.example.com); the address of an individual HTTP request is irrelevant, so passkeys also work behind a reverse proxy that terminates TLS. If the address is not set, the application reports this as an error at startup and does not offer passkeys.
Incorrect or insecure page: If the user opens the application at an address other than the one configured, the passkey buttons are disabled from the start and display the address where passkeys work in a tooltip; no passkey is created that the application does not recognize. On a page opened via HTTP using a computer name, the tooltip explains: “Passkeys require a secure connection. Open the application via HTTPS (or on localhost).”
Messages: A rejected registration or login will specify the reason: incorrect address, passkey unknown to the application (“This passkey is not registered with this application. It may not have been fully set up, may have been deleted, or may belong to a different installation. …”), a passkey from another account, user not verified, signature counter, or expired request. Errors reported by browsers or authenticators appear with the browser’s text. Each rejection is logged as a warning with the reason, credential ID, account, and page address.
Cleaning Up the Password Manager: If registration fails after the browser has already saved the passkey, or if the browser presents a passkey unknown to the application during login (e.g., a deleted one), the application notifies the browser (via the WebAuthn Signal API), and the password manager removes it. After logging in with a passkey, the browser receives the list of valid passkeys for the account. Browsers without the Signal API ignore this.
Settings → Security is divided into sections, each with a heading, current status, and actions: Password (Change Password), Proxies (Proxies, Represented Persons, Appoint Proxy), and Two-Factor Authentication with the status “Active: Authenticator App, Passkey" or "Not active" and the sub-section Authenticator App (Set up?, Set up/Turn off). Your own passkeys (Name, Created, Last Used; Add, Rename, Delete) appear in a separate section titled “Sign In with Passkey” after “Password” upon login, and as the “Passkeys” sub-section under “Two-Factor Authentication” when used as a second factor. Adding and deleting a passkey requires the password (<verify-identity>). The last second factor for an account marked as “required” cannot be deleted; the Delete button is then disabled and displays the reason.
Disabling the Authenticator App: An account marked as “required” may disable the Authenticator App as long as another method remains configured; the requirement remains “required.”
Administration by the administrator: The account management interface (admin/access-control/accounts.view.xml) displays an account’s passkeys and can delete them (without the “last factor” rule: the account will set up a new factor upon the next login).
An account with the "disabled" setting cannot create passkeys when "second-factor" is enabled; existing passkeys remain usable (like a saved TOTP secret). When "login" is set, the passkey is a login method like a password and is also permitted for an account with the "disabled" setting.

Technical Implementation

Library: The WebAuthn ceremonies (challenge, Origin and RP-ID verification, signature, signature counter) are handled by Yubico’s java-webauthn-server (com.yubico:webauthn-server-core 2.10.1, Apache-2.0), version listed in tl-bom (along with com.upokecenter:cbor, which declares the library as a version range). The supported signature algorithms are ES256, EdDSA, ES384, ES512, and RS256.
Generic client element in com.top_logic.layout.react: ReactWebAuthnControl / TLWebAuthn is a standard button that executes `navigator.credentials.create ` / `get` with the server’s options directly within the click handler (Safari requires user interaction) and reports the result to a ` WebAuthnListener `. Before the options expire, it automatically retrieves new ones (refresh); an insecure page or a browser without WebAuthn is reported upon display (unavailable), as is the page’s origin (origin, WebAuthnListener#onPageOrigin). A hidden button does not draw anything or initiate any actions. `signalUnknownCredential ` and ` signalAllAcceptedCredentials` call the functions of the same name in the browser’s WebAuthn Signal API (a one-time `FunctionCall` event to `TLReact.webAuthnSignal`). The owner reports errors via ViewMessages.
Configurable second factor in com.top_logic.layout.view: SecondFactor (set up? / configurable? / confirm / set up), SecondFactorsConfig (list; modules contribute via autoconf ), SecondFactorStep (decision and selection dialog second-factor-choice.view.xml), TotpSecondFactor. LoginAction does not recognize passkeys. TL script secondFactorEnrolled(account) for the status bar; DisableMfaAction checks the remaining configured methods.
TypeObservingRule (com.top_logic.layout.view): an intrinsic executability rule that reads additional objects and re-evaluates when they change (counterpart to observed-types). Used by <delete-passkey/>.
Empty elements take up no space: A <switch> without a matching case (and <visible-if> in the hidden state) remains hidden; an empty <object-list> displays only its placeholder text; TLStack, TLGrid, and TLDeckPane respect the hidden flag; <login-commands> and <login-methods> are hidden when empty. Previously, they left behind empty elements that created additional spacing in their container.
Extension points: login-form.view.xml contains the IDs credentials and login-methods; the “Security” tab in settings-tabs.view.xml contains the IDs security-sections, password-section, deputies-section, two-factor-section, two-factor-methods, and authenticator-app; tl-security-passkey extends both views via an overlay.
tl-security-passkey module: Type tl.security.passkey:Passkey (credential ID with unique index, COSE public key, signature counter, transports, backup flags, name, creation date, and usage date) as a composition of tl.accounts:Person#passkeys; Permissions via the account (access-parent). PasskeyService with RelyingParty and CredentialRepository. The Relying Party is determined once at startup from %HOST% (RelyingPartyAddress: Origin = %HOST% normalized, RP-ID = its hostname), never from a request; Override rp-id (e.g., parent domain) and origins (replacing the Origin from %HOST%); an RP-ID must be the computer name or parent domain of each Origin. Additional configuration options: usage (PasskeyUsage: login / second-factor; determines the residentKey and user verification for registration and accepted logins), rp-name, user-verification (for second-factor), timeout. Rejections are handled as ` PasskeyRefusedException ` with a category and credential ID; the service determines the category through its own checks prior to the library. The user handle is the object ID of the account. View elements : <passkey-login> (hidden if the intended use does not permit this type of login), <passkey-registration> (complete-login, <on-success>), and <if-passkey-usage usage="…"> (displays its content only for the specified use case), PasskeyCeremony (verification of the page’s origin, signals to the browser), PasskeySecondFactor (only for second-factor), <delete-passkey/>, TL script passkeyMayUse(account), overlays for the login form, settings, and account management. tl-demo-react integrates the module.
Fixed: Person.setMFASecret was writing the secret to the mfaRequirement attribute instead of mfaSecret.
Documentation: Developer articles on authentication/passkeys (tl-security-passkey), revised authentication/mfa, authentication, view-layer/commands, and view-layer/overlays.

Not part of this ticket: Passkey suggestions in the username field’s autofill (autocomplete="username webauthn"), attestation checks / device allowlists, recovery codes, and the classic interface.

Verification

Tests: TestReactWebAuthnControl, webauthn-json.test.ts, webauthn-signals.test.ts, options-expiry.test.ts, hidden-containers.test.tsx, TLWebAuthn.test.tsx, TestSecondFactorStep, TestDisableMfaAction, TestSecondFactorFunctions, TestSwitchElement, TestObjectListItems, TestRelyingPartyAddress, TestPasskeyService (registration and sign-in with a software authenticator for each use case; Relying Party from %HOST%, missing address, incorrect Origin, unknown passkey, repeated response, third-party account, missing user verification, counter rollback, sign-in for the wrong use case), TestPasskeyCeremony (including page origin, signals, button per use case), TestPasskeyUsageElement, TestDeletePasskeyAction, TestPasskeyFunctions, TestPerson#testSetMFASecret. Tested in tl-demo-react (/view/, root / root1234) using Chrome’s virtual authenticator, for both use cases: Setup during login, second factor, passwordless login, cancellation, login after the form has been open for over 5 minutes, disabled button on an HTTP page and at a different address (127.0.0.1 instead of localhost), Login with a passkey deleted on the server (message, warning in the log, passkey removed from the authenticator), Adding/renaming/deleting in Settings, the “Last Factor” rule, deletion by the administrator, and intervals in the sign-in form and the “Security” tab.