Voyti

User management, authentication & authorization

Data export and account anonymization ship as a separate package, yiirocks/voyti-gdpr. Core only ever collects mandatory personal-data-processing consent at signup and offers hard account deletion (allowAccountDelete) - export and anonymization are optional, and this package is where they live. It reuses core's ConsentForm for password re-confirmation, and core's User, UserProfile, UserSessions, and UserSocialAccount models to build the export.

Installation

Create an issue →

GitHub → Packagist →

Configuration

Override under this package's own yiirocks/voyti-gdpr key:

gdprExportProperties array

['email', 'username', 'userProfile.public_email', 'userProfile.name', 'userProfile.gravatar_email', 'userProfile.location', 'userProfile.website', 'userProfile.bio', 'userProfile.birthday', 'userSessions', 'userSocialAccount']

Properties included in the data export (JSON). Unrecognized names are silently omitted, not exported as null. userSessions exports each login's ip, user_agent, created_at, updated_at; userSocialAccount exports each linked account's provider, username, email, created_at, and data (the decoded provider profile payload).

gdprAnonymizePrefix string

'GDPR'

Prefix used for the masked email/username on anonymization, followed by the user's numeric id (e.g. GDPR42, GDPR42@example.com).

// config/params.php
return [
    'yiirocks/voyti-gdpr' => [
        'gdprExportProperties' => ['email', 'username'],
        'gdprAnonymizePrefix' => 'ANON',
    ],
];

Routes

Route name	Method	Path	Purpose
`voyti/user-privacy-export`	`GET`	`settings/privacy/export`	Download personal data as a JSON attachment
`voyti/user-privacy-anonymize`	`GET, POST`	`settings/privacy/anonymize`	Anonymize account (password-confirmed) - masks email/username, blocks login, rotates the auth key; the row itself is kept

Events

Anonymizing an account dispatches GdprEvent (carrying the now-anonymized User) after it's saved. Nothing consumes it by default - attach your own listener via the event dispatcher configuration for things like admin notification or downstream data-retention cleanup.

← REST API Events →