redaxo-ycom
Customize and implement YCom user authentication in REDAXO PHP apps: configure login/registration/profile forms, integrate SSO with SAML/OAuth2/CAS, enable 2FA/OTP enforcement, protect articles/media via groups/permissions, manage sessions/tokens, and log activity.
npx claudepluginhub friendsofredaxo/claude-marketplace --plugin redaxo-ycomComponent Overview
Component Details
Skills (7)
YCom extension points (YCOM_CONFIG, YCOM_AUTH_INIT, YCOM_AUTH_LOGIN, YCOM_USER_CREATE, etc.), the injection system for intercepting the auth flow (OTP, password change, terms-of-use, custom injections), session management (rex_ycom_user_session), and user activity logging (rex_ycom_log). Use when the user customizes the auth flow, intercepts login/logout, adds custom auth steps (e.g. mandatory profile completion), manages sessions, or sets up activity logging.
External authentication for YCom – SAML, OAuth2, and CAS. Covers config files (data/addons/ycom/saml.php, oauth2.php, cas.php), the ycom_auth_saml/oauth2/cas value fields, default user data, allowed-domain restrictions, and field-mapping via YCOM_AUTH_*_MATCHING extension points. Use when the user integrates SSO, configures OAuth2 providers, maps SAML attributes to YCom user fields, or enables direct-link login.
Ready-to-use YCom form recipes – login, logout, registration with email confirmation, profile edit, password change (with and without old-password check), password reset, terms-of-use re-acceptance. Pipe and PHP syntax. Includes the YCom-specific value/validate/action fields (ycom_auth_password, ycom_auth_load_user, ycom_auth_logout, ycom_auth_returnto, ycom_auth_db, ycom_user_token, etc.). Use when the user builds any frontend form that interacts with YCom.
YCom OTP / two-factor authentication setup – TOTP and email-based OTP, the otp_article_id setup article, ycom_auth_otp setup field, OTP email template, enforcement modes, and the injection that gates unverified sessions. Use when the user enables 2FA, configures OTP enforcement levels, builds the OTP setup form, or troubleshoots the OTP flow.
YCom architecture for REDAXO – core classes, user model (rex_ycom_user), authentication API (rex_ycom_auth), status constants, config keys (article_id_login, session_duration, otp_*), brute-force rules, and the standard navigation/login-state integration. Use when the user works with YCom for the first time, looks up an auth API method, configures session timeouts or login redirects, builds a meta navigation that switches based on login state, or programmatically creates/logs in users.
Article and media permissions in YCom – the group plugin (group-based article/media access, group permission types) and the media_auth plugin (media-pool file protection, .htaccess rewrite rule, redirect rules). Use when the user gates articles by login state or group, sets up media file protection, configures redirects for unauthorized access, or queries group membership programmatically.
YCom's token system for direct login links, password reset links, and registration confirmation links. Covers ycom_user_token create/validate, the token types (login, password_reset, register), email template integration, and end-to-end flow patterns. Use when the user wants magic-link login, password-reset emails, registration-confirmation links, or any single-use token-based flow.
README
REDAXO Claude Code Marketplace
A collection of Claude Code plugins that turn Claude into a knowledgeable assistant for REDAXO – a flexible PHP-based content management system.
The marketplace is modular: install only the plugins for the addons you actually use in your project. Claude then loads the matching skills automatically when relevant.
Quick Start
In Claude Code, add this marketplace once:
/plugin marketplace add FriendsOfREDAXO/claude-marketplace
Then install the plugins you need. The core plugin is always recommended:
/plugin install redaxo-core@redaxo-marketplace
Add addon-specific plugins based on what your project uses:
/plugin install redaxo-yform@redaxo-marketplace
/plugin install redaxo-yrewrite@redaxo-marketplace
/plugin install redaxo-structure@redaxo-marketplace
/plugin install redaxo-mform@redaxo-marketplace
/plugin install redaxo-multiglossar@redaxo-marketplace
Available Plugins
| Plugin | What it covers | When to install |
|---|---|---|
redaxo-core | Architecture, modules, templates, rex_sql, extension points, addon development, console commands, rex_api_function, metainfo fields | Every REDAXO project |
redaxo-structure | Articles, categories, content editing, meta info | Almost always (Structure is part of core) |
redaxo-yform | YForm tables, datasets (YOrm), field/validate/action reference, frontend forms, email templates, REST API | If yform is installed |
redaxo-mform | Module input forms with MForm::factory(), flex repeaters, custom-link/imagelist/colorswatch widgets, output helpers, MForm-provided YForm value types | If mform is installed |
redaxo-yrewrite | Domains, pretty URLs, redirects, multi-language SEO | If yrewrite is installed |
redaxo-ycom | Frontend user auth, login/registration/password forms, groups, media protection, OTP/2FA, tokens, SAML/OAuth2/CAS | If ycom is installed |
redaxo-api-addon | FriendsOfRedaxo/api – Bearer-token REST API for articles/categories/slices/modules/templates/media | If you call (or extend) the api addon |
redaxo-multiglossar | MultiGlossar term management, multilingual glossary content, DOM-based frontend replacement, tooltip/link output, exclusion rules | If multiglossar is installed |
How it works
Each plugin contains Agent Skills – focused instruction packages that Claude loads on demand based on what you're working on. Edit a module file, and redaxo-modules activates. Ask about URL routing, and yrewrite-domains kicks in. Skills are namespaced per plugin, so redaxo-core skills won't collide with anything else.
Updating
When the marketplace is updated, refresh your local copy:
/plugin marketplace update redaxo-marketplace
Contributing
Found a missing pattern, an outdated example, or a bug? PRs welcome. See CLAUDE.md for plugin authoring conventions, the skill activation rule, and the local testing workflow.
License
MIT
Similar Plugins
ecc
Battle-tested Claude Code plugin for engineering teams — 50 agents, 188 skills, 68 legacy command shims, production-ready hooks, and selective install workflows evolved through continuous real-world use
affaan-mfullstack-dev-skills
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
reverse-engineering
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security
nextjs-expert
Next.js development expertise with skills for App Router, Server Components, Route Handlers, Server Actions, and authentication patterns
More by friendsofredaxo
Help us improve
Share bugs, ideas, or general feedback.