Voyti
User management, authentication & authorization
Middleware
Core ships 6 PSR-15 middleware classes for session handling and access control; installed sibling packages can contribute their own on top.
Namespace: YiiRocks\Voyti\Middleware
| Middleware | Description | Auto-registered? |
|---|---|---|
AccessRuleMiddleware |
Redirects guests to the login page (voyti/session-login); checks administratorPermissionName for admin access |
Yes - on admin/* (users and RBAC management) |
RequireLoginMiddleware |
Redirects guests to the login page (voyti/session-login); unlike AccessRuleMiddleware, only requires an authenticated user, not an admin permission. Returns a JSON 401 instead when the request’s Accept header includes application/json |
Yes - on settings/* (profile, account, social authentication, sessions, privacy, two-factor authentication) |
RememberMeMiddleware |
Logs a guest back in from the autoLogin remember-me cookie, then writes the cookie back onto the response - either the immediate reissue after a session rotation or the periodic sliding-expiration refresh. Must run after session middleware and before the enforcement middleware below, since those need CurrentUser already resolved |
Yes |
SessionRevocationEnforceMiddleware |
Logs out and redirects to the login page (voyti/session-login) when the current session’s user_sessions row is gone - i.e. it was terminated from the sessions list (self-service or admin) on another request. Without this, terminating a session only removed the row; the browser that owned it stayed logged in until its PHP session expired on its own. Otherwise touches the row’s updated_at on every request, so the sessions list can show “last seen” activity per device. |
Yes |
PasswordAgeEnforceMiddleware |
Redirects to the account settings page (voyti/user-account) when maxPasswordAge is exceeded |
Yes, when maxPasswordAge is greater than 0 |
VoytiMiddleware |
Convenience wrapper that runs RememberMeMiddleware first, then every middleware tagged voyti.enforce-middleware - core contributes SessionRevocationEnforceMiddleware and PasswordAgeEnforceMiddleware, and installed packages contribute their own |
No, add it to the Group wrapping your app’s own routes. Make sure to place it after SessionMiddleware so CurrentUser is resolvable. Each sub-middleware checks its own feature flag, so disabled features are no-ops. Keep it scoped to your own routes, not the voyti-routes group. |
2FA
Namespace: YiiRocks\Voyti\TwoFactor\Middleware
| Middleware | Description | Auto-registered? |
|---|---|---|
TwoFactorAuthenticationEnforceMiddleware |
Enforces 2FA for users with forcedPermissions by redirecting to the settings page (voyti/user-two-factor) with an explanatory message. Two-factor and logout routes remain accessible during setup |
Yes |
Social Authentication
Namespace: YiiRocks\Voyti\SocialAuth\Middleware
| Middleware | Description | Auto-registered? |
|---|---|---|
CaptureAuthActionRequestMiddleware |
Stores the real incoming request so it survives past yiisoft/yii-auth-client’s AuthAction, which never forwards it to its success/cancel callbacks - needed so social login can complete through the same LoginCompletionService::complete() path password login uses |
Yes - wraps the whole social authentication route group |
Site-wide enforcement
The auto-registration above only covers routes this extension defines. Without
VoytiMiddleware wrapping your routes, a user with an expired password, missing 2FA, or
a revoked session can still browse your app’s own dashboard, home page, or any other route outside
this extension - and a visitor with a valid remember-me cookie won’t be logged back in either.