README

4ALLPORTAL TYPO3 Extension

Share media from your 4ALLPORTAL DAM directly with your TYPO3 website: this extension is the TYPO3-side counterpart of the 4ALLPORTAL TYPO3 Connector. Assets shared in 4ALLPORTAL are pushed into the TYPO3 file abstraction layer (FAL) and kept in sync - including renames, moves, metadata updates and deletions.

What it does

The extension exposes a small JSON REST API under /api that the 4ALLPORTAL connector uses to:

upload files into a configurable storage and folder path
read file information
rename, move and delete files (including cleanup of emptied folders)
update file metadata (title, description, alternative, keywords, copyright)

Access is restricted to authenticated TYPO3 frontend users via short-lived bearer tokens.

API

Method	Route	Purpose
POST	`/api/auth`	Authenticate a frontend user, returns a bearer token
POST	`/api/files`	Upload a file (multipart)
GET	`/api/files/{uid}`	Get file information
PUT	`/api/files/{uid}`	Update file metadata
DELETE	`/api/files/{uid}`	Delete a file
POST	`/api/files/{uid}/rename`	Rename a file
POST	`/api/files/{uid}/move`	Move a file

All routes except /api/auth require an Authorization: Bearer <token> header.

Installation

composer require fourallportal/fourallportal-typo3-extension

Also available in the TYPO3 Extension Repository as fourallportal_typo3_extension.

The API requires at least one frontend user (fe_users record) whose credentials are configured in the 4ALLPORTAL connector.

Every active frontend user can authenticate against the API. If the site has other frontend logins (customer areas, communities, ...), put the connector account into a dedicated frontend user group and enter its uid under Admin Tools > Settings > Extension Configuration > fourallportal_typo3_extension > Allowed frontend user groups (comma-separated for several groups). Only direct members of these groups can then use the API.

Documentation

Full installation and configuration guides (including the 4ALLPORTAL side: connector setup, field mapping, download profiles and sharing triggers) are available in the official 4ALLPORTAL TYPO3 Connector documentation.

Compatibility

Extension	TYPO3	PHP
2.x	13.4 / 14	>= 8.2
1.x	13	per TYPO3 requirements

Version 1.x relied on the third-party extension nng/nnrestapi; since 2.0 the extension is dependency-free apart from TYPO3 itself.

Releasing

Releases are driven by git tags following semantic versioning. Bump the version in both composer.json and ext_emconf.php (they must match), commit, then tag.

Packagist picks up the new tag automatically via its GitHub webhook and publishes the version - no manual step. Consumers then get it through composer require.
GitHub release + TER: publishing a GitHub release for the tag triggers the Release workflow. It fails if the tag does not match the composer.json version, otherwise it
1. builds the TER archive from the tag and a CycloneDX SBOM (*.cdx.json, runtime dependencies as locked and tested for the release),
2. attaches both to the release together with signed SBOM and build provenance attestations and a SLSA Build Level 3 provenance (*.intoto.jsonl),
3. uploads exactly this archive to the TER (skipped for pre-releases). The upload runs in the ter environment, which holds the TYPO3_API_TOKEN secret.
See SECURITY.md for verification. The SBOM is not committed to the repository, since it would only duplicate composer.lock and drift from it.

For local testing, composer ter:zip [git-ref] builds the same archive into Build/dist/. Never upload a locally built archive to the TER: it carries no provenance.

License

Licensed under the GNU General Public License, version 2 or (at your option) any later version. See LICENSE for the full text.

SPDX-License-Identifier: GPL-2.0-or-later

fourallportal / fourallportal-typo3-extension

Package info

Security

Statistics