Voyti

Middleware

The extension ships eight PSR-15 middleware classes for session handling and access control:

Middleware	Description	Auto-registered on the extension's own routes?
AccessRuleMiddleware	Redirects guests to the login page (voyti/session-login); checks administratorPermissionName for admin access	Yes - on admin/* (users and RBAC management) and the REST API group
RequireLoginMiddleware	Redirects guests to the login page (voyti/session-login); unlike AccessRuleMiddleware, only requires an authenticated user, not an admin permission. Returns a JSON 401 instead when the request's Accept header includes application/json	Yes - on settings/* (profile, account, social networks, sessions, privacy, two-factor)
ApiTokenAuthenticationMiddleware	Resolves the Authorization: Bearer <token> header to a user for that request only (no session); returns 401 if missing/invalid	Yes - on the REST API group, ahead of AccessRuleMiddleware, in place of the session cookie
RememberMeMiddleware	Logs a guest back in from the autoLogin remember-me cookie, then writes the cookie back onto the response - either the immediate reissue after a session rotation or the periodic sliding-expiration refresh. Must run after session middleware and before the enforcement middleware below, since those need CurrentUser already resolved	Yes
SessionRevocationEnforceMiddleware	Logs out and redirects to the login page (voyti/session-login) when the current session's user_sessions row is gone - i.e. it was terminated from the sessions list (self-service or admin) on another request. Without this, terminating a session only removed the row; the browser that owned it stayed logged in until its PHP session expired on its own. Otherwise touches the row's updated_at on every request, so the sessions list can show "last seen" activity per device.	Yes
PasswordAgeEnforceMiddleware	Redirects to the account settings page (voyti/user-account) when maxPasswordAge is exceeded	Yes, when maxPasswordAge is greater than 0
TwoFactorAuthenticationEnforceMiddleware	Redirects to the two-factor settings page (voyti/user-two-factor), with an explanatory flash message, when required permissions twoFactorAuthenticationForcedPermissions are assigned for that user, but 2FA isn't enabled. Two-factor routes and the logout route stay reachable so the user can actually complete setup	Yes, when enableTwoFactorAuthentication is true
VoytiMiddleware	Convenience wrapper that chains RememberMeMiddleware, SessionRevocationEnforceMiddleware, PasswordAgeEnforceMiddleware, and TwoFactorAuthenticationEnforceMiddleware in a single middleware entry	No, add it to the Group wrapping your app's own routes - see the Register routes example. Make sure to place it after SessionMiddleware so CurrentUser is resolvable. Each sub-middleware checks its own feature flag, so disabled features are no-ops. Keep it scoped to your own routes, not the voyti-routes group.

Site-wide enforcement

The auto-registration above only covers routes this extension defines. Without VoytiMiddleware wrapping your routes, a user with an expired password, missing 2FA, or a revoked session can still browse your app's own dashboard, home page, or any other route outside this extension - and a visitor with a valid remember-me cookie won't be logged back in either.