Voyti

User management, authentication & authorization

RBAC

Admin UI for managing permissions, roles, and rules (create, update, delete, filter)
Assignment management - assign/revoke roles and permissions per user from the admin panel
Parent-child hierarchy - roles can have child permissions/roles
Rule management - register and manage custom RuleInterface classes

Role hierarchy

Roles and permissions form a hierarchy: a parent role inherits all permissions from its children, avoiding duplication across multiple roles.

Example hierarchy:

admin (role) → inherits from moderator
- moderator (role) → inherits from editor
  - post.edit (permission)
  - post.delete (permission)
- admin.manage-users (permission)

A user assigned the admin role automatically has post.edit, post.delete, and admin.manage-users permissions without explicit assignment. You can build hierarchies with both direct permissions and role-to-role inheritance.

The RBAC Cookbook

Checking permissions in code

The examples below show how to implement RBAC checks in your host application. Voyti provides the admin UI and storage, plus helpers like AuthHelper, but permission checks ultimately use the underlying yiisoft/rbac interfaces.

Use AuthHelper to check if a user has a specific role or is an administrator:

use YiiRocks\Voyti\Helper\AuthHelper;

public function __construct(private AuthHelper $authHelper) {}

public function someAction(): ResponseInterface
{
    $userId = $this->currentUser->getIdentity()?->getId();

    // Check if user is an admin
    if ($this->authHelper->isAdmin($userId)) {
        // Admin-only logic
    }

    // Check if user has a specific role
    if ($this->authHelper->hasRole($userId, 'editor')) {
        // Editor-only logic
    }
}

For more complex permission checks, inject ManagerInterface directly:

use Yiisoft\Rbac\ManagerInterface;

public function __construct(private ManagerInterface $rbacManager) {}

public function editPost(int $postId): ResponseInterface
{
    $userId = $this->currentUser->getIdentity()?->getId();

    // Check a specific permission
    if (!$this->rbacManager->userHasPermission($userId, 'post.edit')) {
        throw new ForbiddenHttpException('You cannot edit posts.');
    }
}

Rules

Rules add conditional logic to permissions: a permission with a rule only grants access if the rule’s code passes. Register custom rules by implementing RuleInterface and tagging them in your DI container.

// src/Rbac/IsPostOwnerRule.php
use Yiisoft\Rbac\RuleInterface;

final readonly class IsPostOwnerRule implements RuleInterface
{
    public function __construct(private PostRepositoryInterface $posts) {}

    public function getName(): string
    {
        return 'isPostOwner';
    }

    public function execute(?int $userId, Item $item, array $params = []): bool
    {
        $postId = $params['postId'] ?? null;
        if (!$postId || !$userId) {
            return false;
        }

        $post = $this->posts->findById($postId);
        return $post && $post->getAuthorId() === $userId;
    }
}

return [
    IsPostOwnerRule::class => [
        'class' => IsPostOwnerRule::class,
        'tags' => ['yiisoft/rbac/rule'],
    ],
];

Create a permission post.edit-own via the admin UI or code, attach the isPostOwner rule to it, then check it by passing params:

if ($this->rbacManager->userHasPermission($userId, 'post.edit-own', ['postId' => 42])) {
    // User owns post 42 and can edit it
}

Assignments

Assignments link users to roles and permissions. The admin UI (under RBAC > Roles and RBAC > Permissions) shows an “Assigned users” section where you can add or remove user assignments. Programmatically, use AssignmentsStorageInterface:

use Yiisoft\Rbac\AssignmentsStorageInterface;

public function __construct(
    private AssignmentsStorageInterface $assignments,
    private ManagerInterface $rbacManager,
) {}

// Assign a role to a user
$role = $this->rbacManager->getRole('editor');
$this->assignments->assign($role, $userId);

// Revoke a role
$this->assignments->revoke($role, $userId);

// Get all roles/permissions assigned to a user
$userAssignments = $this->assignments->getByUserId($userId);

Practical example

Say you want to let users edit and publish their own posts but not others’. Create the structure via the admin UI:

Create permission post.edit
Create permission post.publish
Create permission post.edit-own and attach the isPostOwner rule
Create role author with post.edit-own and post.publish
Assign the author role to your users

In your controller:

public function editPost(int $postId): ResponseInterface
{
    $userId = $this->currentUser->getIdentity()?->getId();

    // Check if user can edit this specific post
    if (!$this->rbacManager->userHasPermission($userId, 'post.edit-own', ['postId' => $postId])) {
        throw new ForbiddenHttpException('You can only edit your own posts.');
    }

    // ... proceed with edit logic
}

Routes Events