complianty / typo3-connector

v0.1.0 2026-11-03 10:59 UTC

Requires

• php: >=8.2
• ext-sodium: *
• ezyang/htmlpurifier: ^4.17
• typo3/cms-backend: ^13.4 || ^14.3
• typo3/cms-core: ^13.4 || ^14.3
• typo3/cms-fluid-styled-content: ^13.4 || ^14.3
• typo3/cms-frontend: ^13.4 || ^14.3

Requires (Dev)

• phpstan/phpstan: ^2.3
• phpunit/phpunit: ^11.5 || ^12.0
• typo3/cms-scheduler: ^13.4 || ^14.3
• typo3/coding-standards: ^0.9.0

Suggests

• typo3/cms-scheduler: Runs complianty:sync-dse every 6 hours so that visitors never trigger a request.

GPL-2.0-or-later

• Complianty

• typo3
• privacy
• gdpr
• dsgvo
• typo3-extension

Published on Packagist.org on 2026-11-03 11:04 UTC

README

TYPO3 extension that connects a site to a Complianty account. It shows the scan status in the backend, can start a scan, and outputs the approved privacy policy from the account as a content element.

TYPO3 13.4 and 14.3, PHP 8.2 or newer, GPL-2.0-or-later. Composer mode only.

What it does

• Status. Traffic light, open findings and the last scan, in Admin Tools > Complianty.
• Scan. A user with administrator rights can start a scan. The service enforces cooldown and daily budget, the extension shows the result.
• Privacy policy. The content element "Privacy policy (Complianty)" outputs the version that was approved in Complianty. Visitors never trigger a request while a local copy exists.

One installation holds one connection. A multi-site installation can show the privacy policy of one website only.

Install

composer require complianty/typo3-connector
vendor/bin/typo3 extension:setup

Then:

1. In Complianty, create a connection token for the website and the TYPO3 integration.
2. Open Admin Tools > Complianty, paste the token and click Connect.
3. Add the site set "Complianty Connector" to your site (Sites > Edit site configuration > Sets), or require complianty/connector in the dependencies of your site's config.yaml.
4. Add the content element "Privacy policy (Complianty)" to your privacy page.
5. In the Scheduler, create a task "Execute console commands" for complianty:sync-dse and run it every 6 hours. The module warns when the copy is older than 12 hours.

Without the backend, for deployments: COMPLIANTY_TOKEN=clp_site_... vendor/bin/typo3 complianty:connect. Before removing the extension run vendor/bin/typo3 complianty:disconnect, TYPO3 has no uninstall hook for Composer installations.

The full documentation is in Documentation/ and is rendered on docs.typo3.org once the extension is in the TER.

How it works

Part	Where
Only place that talks to the service	Classes/Api/Client.php
Response validation, whitelist per endpoint, error code whitelist	Classes/Api/Client.php, Classes/Api/Result.php
Token storage (encrypted, sys_registry)	Classes/Service/TokenStore.php
Privacy policy filtering (HTMLPurifier, narrow whitelist)	Classes/Service/DseSanitizer.php
Local copy of the policy and its sync	Classes/Service/DseStore.php, Classes/Service/DseSync.php, Classes/Command/SyncDseCommand.php
Content element	Configuration/TCA/Overrides/tt_content.php, Configuration/Sets/Connector/, Classes/DataProcessing/DseProcessor.php
Backend module	Classes/Controller/ModuleController.php, Resources/Private/Templates/Backend/

Rules that the code and the tests hold to:

• Nothing is sent before a token is entered.
• The token travels only in the Authorization header. It is never logged, shown, stored in plain text or sent to the browser. The UI only gets a short hint.
• Everything from the service is untrusted: validated against a schema, unknown fields dropped, length capped, error codes checked against a whitelist. The privacy policy HTML is filtered with a narrow whitelist when it is stored and again when it is output.
• Visitors do not trigger requests while a local copy exists. Only a page view without any copy makes one request with a 3 second timeout.
• Scans are started only by a click of an administrator.
• Redirects are never followed. COMPLIANTY_API_BASE is ignored in the Production context.
• TYPO3's HTTP settings (proxy, certificate verification) apply to every request.

Development

composer install
composer qa        # coding standard, PHPStan level 8, unit tests
bin/ci-local.sh    # the CI matrix (PHP 8.2/8.4 x TYPO3 13.4/14.3) in Docker

Fixed test installations of TYPO3 13.4 and 14.3 (Apache, MariaDB, a fake of the Complianty API) run in Docker: bin/dev.sh up, see dev/README.md.

Release

1. Set the version in ext_emconf.php and add an entry to CHANGELOG.md and CHANGELOG_de-DE.md.
2. Commit, tag vX.Y.Z, push the tag. The Release workflow runs the checks, builds the ZIP and publishes a GitHub release with its SHA-256.
3. Packagist picks up new tags by itself once the repository is registered at packagist.org/packages/submit with the GitHub hook enabled.
4. TER: upload the version with tailor (tailor ter:publish), see the TYPO3 documentation for the credentials.

Security

See SECURITY.md.

License

GPL-2.0-or-later, see LICENSE.