войти
/vɐjˈtʲi/
verb

"to enter" or "to log in"

Voyti is a highly customizable user management, authentication, and authorization extension for Yii Framework 3, ported from 2amigos/yii2-usuario and rebuilt with PSR-15 middleware, PSR-11 DI, ActiveRecord entities, FormModel forms, and yiisoft/rbac.

Requirements

• PHP >= 8.3
• ext-intl
• Yii3 packages (yiisoft/db, yiisoft/rbac, yiisoft/view, yiisoft/validator, etc.)

Quick Start

1. Install

composer require yiirocks/voyti

For reCAPTCHA support (optional):

composer require yiirocks/recaptcha

For 2FA TOTP support (optional):

composer require chillerlan/php-authenticator chillerlan/php-qrcode

2. Run migrations

Voyti provides its migration path through config/params-console.php using the standard yiisoft/db-migration configuration keys. With yiisoft/db-migration enabled in your console app, run:

./yii migrate:up

One migration creates the user, user_profile, user_social_account, user_token, user_sessions, user_backup_code, user_password_history, and audit_log tables with all columns (2FA, GDPR, password expiration, last login IP, etc.) included. config/params-console.php also registers yiisoft/rbac-db's own item/assignment migrations, so ./yii migrate:up creates the RBAC tables too — no separate step needed.

If the user table is still empty after these migrations run, a default admin account is seeded automatically: username admin, email admin@example.com, and a random 20-character password printed to the console — copy it immediately, it isn't stored anywhere else. The account is assigned the administrator role, which is granted the administratorPermissionName permission (voyti-admin-dashboard by default) needed to reach the admin dashboard. Change this password immediately after first login. If the user table already has rows (e.g. re-running migrations on an existing database), seeding is skipped entirely.

3. Register routes

Routes are not auto-registered — you must add them to your router configuration.

Pull the voyti-routes config group into your router definition. The example below mounts them under a /user/ prefix as their own group, alongside your app's own routes — change the prefix as needed:

use Yiisoft\Config\Config;
use Yiisoft\Definitions\DynamicReference;
use Yiisoft\Router\Group;
use Yiisoft\Router\RouteCollection;
use Yiisoft\Router\RouteCollectionInterface;
use Yiisoft\Router\RouteCollector;
use Yiisoft\Session\SessionMiddleware;
use YiiRocks\Voyti\Middleware\VoytiMiddleware;

/** @var Config $config */

return [
    RouteCollectionInterface::class => [
        'class' => RouteCollection::class,
        '__construct()' => [
            'collector' => DynamicReference::to(
                static fn() => (new RouteCollector())
                    ->addRoute(
                        Group::create('/')
                            ->middleware(
                                SessionMiddleware::class,                 // required for site-wide session support
                                VoytiMiddleware::class,                   // see "Site-wide enforcement" below
                            )
                            ->routes(...$config->get('routes')),          // your own app routes
                        Group::create('/user/')
                            ->routes(...$config->get('voyti-routes')),
                    )
            ),
        ],
    ],
];

voyti-routes already wraps itself with its own required middleware (see config/routes.php), so the second group above doesn't repeat any of it, and adding VoytiMiddleware to your own group only extends that same coverage to your app's pages.

When enableRestApi is true, the API routes are mounted under adminRestPrefix . '/v1/' and expose user CRUD endpoints.

The privacy/GDPR routes (settings/privacy/, settings/privacy/gdpr-consent, settings/privacy/export, settings/privacy/anonymize, settings/privacy/delete) and the two-factor routes (settings/two-factor/, settings/two-factor/enable, settings/two-factor/disable/) are likewise only registered when their governing config flag (enableGdprCompliance, allowAccountDelete, and/or enableTwoFactorAuthentication) is true — see the route table below. When a flag is off, the corresponding route doesn't exist at all, so a request to it falls through to the host application's own router-level not-found handling.

4. Done

DI bindings, event listeners, and console commands are auto-registered via the Yii3 config plugin. No manual wiring needed.

Configuration

Override Voyti params in your app's config/params.php using the yiirocks/voyti key:

use YiiRocks\Voyti\Enum\RecaptchaVersion;

return [
    'yiirocks/voyti' => [
        'appName' => 'My Project',
        'recaptchaVersion' => RecaptchaVersion::V3,
    ],
];

Below are all top-level yiirocks/voyti options, followed by the nested socialNetworkClients options.

General

Authentication & Registration

Two-Factor Authentication

'yiirocks/voyti' => [
    'enableTwoFactorAuthentication' => true,
    'twoFactorAuthenticationForcedPermissions' => ['admin'],
],

GDPR

'yiirocks/voyti' => [
    'enableGdprCompliance' => true,
    'gdprAnonymizePrefix' => 'ANON-',
],

Session & Security

Views & Mail

REST API

The REST API authenticates via a Bearer token, not the web session/CSRF cookie — issue one with voyti:api-token:generate (see Console commands) and send it as Authorization: Bearer <token>. AccessRuleMiddleware still applies afterwards to enforce administratorPermissionName.

Social Authentication Providers

socialNetworkClients is a keyed array where each key is a provider name such as github, google, or keycloak.

Every provider accepts these options unless noted otherwise:

Only Keycloak adds recognized extra options:

Social Authentication

Various auth clients are included. Each implements the auth client interface and maps provider attributes to the SocialNetworkAccount entity:

• Facebook, GitHub, Google, Keycloak, LinkedIn, Microsoft365, VKontakte, X (formerly Twitter), Yandex

The SocialAuthProviderService handles the OAuth redirect/callback flow. The UserSocialAuthenticateService handles account lookup, creation, and user login. The UserSocialAccountConnectService links a social account to an existing user.

Built-in defaults by provider

The following table shows Voyti's built-in endpoints and scopes. These are used unless you override scope or redirectUri.

Provider-specific built-in request behavior

Voyti also applies a few provider-specific defaults during the user-info step:

Example

return [
    'yiirocks/voyti' => [
        'socialNetworkClients' => [
            'github' => [
                'clientId' => $_ENV['GITHUB_CLIENT_ID'] ?? '',
                'clientSecret' => $_ENV['GITHUB_CLIENT_SECRET'] ?? '',
            ],
            'google' => [
                'clientId' => $_ENV['GOOGLE_CLIENT_ID'] ?? '',
                'clientSecret' => $_ENV['GOOGLE_CLIENT_SECRET'] ?? '',
            ],
        ],
    ],
];

With credentials configured:

1. The login page shows social login buttons for configured providers.
2. settings/networks lists connected providers and renders connect buttons for the remaining configured providers.
3. New social identities redirect to the registration connect screen, where users can log in to an existing account or register a new one before the identity is linked.

Console Commands

Command	Description
voyti:create	Create a new user
voyti:delete	Delete a user
voyti:confirm	Confirm a user's email
voyti:password	Change a user's password
voyti:api-token:generate	Generate a REST API access token for a user (printed once)
voyti:api-token:revoke	Revoke all REST API access tokens for a user

Middleware

The extension ships eight PSR-15 middleware classes for session handling and access control:

Middleware	Description	Auto-registered on the extension's own routes?
AccessRuleMiddleware	Redirects guests to the login page (voyti/session-login); checks administratorPermissionName for admin access	Yes — on admin/* (users and RBAC management) and the REST API group
RequireLoginMiddleware	Redirects guests to the login page (voyti/session-login); unlike AccessRuleMiddleware, only requires an authenticated user, not an admin permission. Returns a JSON 401 instead of a redirect for the one AJAX-only route, voyti/user-two-factor-renew	Yes — on settings/* (profile, account, social networks, sessions, privacy, two-factor)
ApiTokenAuthenticationMiddleware	Resolves the Authorization: Bearer <token> header to a user for that request only (no session); returns 401 if missing/invalid	Yes — on the REST API group, ahead of AccessRuleMiddleware, in place of the session cookie
RememberMeMiddleware	Logs a guest back in from the autoLogin remember-me cookie, then writes the cookie back onto the response — either the immediate reissue after a session rotation or the periodic sliding-expiration refresh. Must run after session middleware and before the enforcement middleware below, since those need CurrentUser already resolved	Yes
SessionRevocationEnforceMiddleware	Logs out and redirects to the login page (voyti/session-login) when the current session's user_sessions row is gone — i.e. it was terminated from the sessions list (self-service or admin) on another request. Without this, terminating a session only removed the row; the browser that owned it stayed logged in until its PHP session expired on its own. Otherwise touches the row's updated_at on every request, so the sessions list can show "last seen" activity per device.	Yes
PasswordAgeEnforceMiddleware	Redirects to the account settings page (voyti/user-account) when maxPasswordAge is exceeded	Yes, when enablePasswordExpiration is true — on the extension's whole web route group
TwoFactorAuthenticationEnforceMiddleware	Redirects to the account settings page (voyti/user-account) when required permissions are assigned but 2FA isn't enabled	No
VoytiMiddleware	Convenience wrapper that chains RememberMeMiddleware, SessionRevocationEnforceMiddleware, PasswordAgeEnforceMiddleware, and TwoFactorAuthenticationEnforceMiddleware in a single middleware entry — add this to your app's route group instead of the four individual ones (see Site-wide enforcement)	No

Site-wide enforcement

The auto-registration above only covers routes this extension defines — config/routes.php can't attach middleware to routes your host app defines itself. Without it, a user with an expired password, missing 2FA, or a revoked session can still browse your app's own dashboard, home page, or any other route outside this extension — and a guest with a valid remember-me cookie won't be logged back in there either.

Add VoytiMiddleware to the Group wrapping your app's own routes — see the Register routes example above — or to a global middleware pipeline above routing if your app has one; make sure to place it after SessionMiddleware so CurrentUser is resolvable. Each sub-middleware checks its own feature flag, so disabled features are no-ops. Keep it scoped to your own routes, not the voyti-routes group.

RBAC Management

Built on yiisoft/rbac. The extension provides:

• Admin UI for managing permissions, roles, and rules (create, update, delete, filter)
• Assignment management — assign/revoke roles and permissions per user from the admin panel
• Parent-child hierarchy — roles can have child permissions/roles
• Rule management — register and manage custom RuleInterface classes

Available Routes

The library does not provide a menu model or navigation contract. It only exposes named routes that the host application can use in its own menu, sidebar, or access rules.

Every settings/* route below requires an authenticated user — RequireLoginMiddleware redirects a guest to voyti/session-login (or returns a JSON 401 for the AJAX-only voyti/user-two-factor-renew) before the request reaches the controller; see Middleware.

The REST API routes below live in a separate route group mounted at adminRestPrefix and are only registered when enableRestApi is true — see REST API.

Events & Listeners

Voyti dispatches events at key points in the user lifecycle, allowing your application to react, log, or extend behaviour. Each event carries a const string name to distinguish before/after variants. Attach your own listeners through the Yii3 event dispatcher configuration.

Events with default listeners

Event	Trigger	Default behavior
AfterLoginEvent	User logs in	Triggers password expiration check and session tracking
AfterRegisterEvent	New user registration	Sends admin notification email

Additional events (no default listeners)

Dispatched by the library, but nothing consumes them by default — attach your own listener via the event dispatcher configuration if you need to react to them.

• UserEvent — Carries a getType() discriminator: UserEvent::CREATE, BLOCK, UNBLOCK, CONFIRM, SWITCH_IDENTITY, RESTORE_IDENTITY, PASSWORD_RESET, or DELETE
• UserProfileEvent — Dispatched when a user updates their profile
• GdprEvent — Dispatched after a user's account is anonymized (not on hard delete, which fires UserEvent with type UserEvent::DELETE)
• ResetPasswordEvent — Password reset flow
• SessionEvent — Dispatched with type SESSION_CREATED on login, and with type SESSION_TERMINATED whenever a user's sessions are terminated (account deletion, GDPR anonymization, or being blocked). The SESSION_UPDATED type is defined but not currently dispatched.

Support