typo3-poppy — a website that recognises agents.
The Personal Agent Protocol for TYPO3 v14. A site set switches on /.well-known/poppy.json and one issuer per site. This website runs on it.
Signed out is already a complete deployment
Without a login page a site offers signed-out Sessions. The agent is then a known visitor, nothing more. It can send feedback, and its browser carries the Session along. That is enough for a blog or a company site.
A felogin page adds sign-in. The website user signs in as usual and approves the agent on a page of its own. With poppy:read the agent sees what the user sees. Writing needs poppy:write; otherwise its browser gets 403 on everything but GET and HEAD.
An issuer always stands for exactly one site. An installation often hosts sites of different owners, and an agent must not mix them up. Settings live in the site settings, agent feedback in a backend module. No TYPO3 session is ever created for the agent: it is signed in for the single request only.
Source code & documentation
Composer package
MIT · TYPO3 14 · PHP 8.3+
composer require koh/typo3-poppy
Built, tested and released under MIT. Available on Packagist, source on GitHub.
Built on the poppy core
MIT
The protocol itself lives in koh/poppy, the same core sylius-poppy uses. This extension adds middlewares, pages, a site set and storage for TYPO3.