yiirocks/voyti

Highly customizable and extensible user management, authentication, and authorization Yii3 extension

dev-main / 1.0.x-dev 2026-08-24 12:44 UTC

Requires

• php: >=8.3
• ext-intl: *
• psr/clock: ^1.0
• psr/event-dispatcher: ^1.0
• psr/http-factory: ^1.0
• psr/http-message: ^1.0 || ^2.0
• psr/http-server-middleware: ^1.0
• yiirocks/voyti-views: ^1.0
• yiisoft/active-record: ^1.0
• yiisoft/auth: ^3.3
• yiisoft/cookies: ^1.2
• yiisoft/csrf: ^2.0
• yiisoft/data: ^2.0
• yiisoft/data-db: ^1.0
• yiisoft/db-migration: ^2.0
• yiisoft/form-model: ^1.1
• yiisoft/html: ^4.0
• yiisoft/http: ^1.2
• yiisoft/input-http: ^1.0
• yiisoft/json: ^1.0
• yiisoft/mailer: ^6.1
• yiisoft/rbac-db: dev-fix-101
• yiisoft/router: ^4.0
• yiisoft/security: ^1.2
• yiisoft/session: ^3.0
• yiisoft/translator-message-php: ^1.0
• yiisoft/user: ^2.3
• yiisoft/validator: ^2.6
• yiisoft/widget: ^2.2
• yiisoft/yii-console: ^2.3
• yiisoft/yii-dataview: ^1.1
• yiisoft/yii-view-renderer: ^7.1

Requires (Dev)

• friendsofphp/php-cs-fixer: @stable
• infection/infection: ^0.35.0
• nyholm/psr7: ^1.8
• phpunit/phpunit: @stable
• rector/rector: ^2.1.1
• vimeo/psalm: ^6.0
• yiirocks/recaptcha: ^1.0
• yiirocks/toast-bootstrap5: ^1.0
• yiirocks/voyti-views-bootstrap5: ^1.0
• yiisoft/code-style: ^1.1
• yiisoft/config: ^1.6
• yiisoft/db-sqlite: ^2.0
• yiisoft/di: *
• yiisoft/router-fastroute: ^4.0

Suggests

• yiirocks/recaptcha: Google reCAPTCHA v2 and v3 field + server-side validator for Yii3
• yiirocks/toast-bootstrap5: Bootstrap 5 toast notifications for flash messages
• yiirocks/voyti-2fa-email: Email-code two-factor authentication method
• yiirocks/voyti-2fa-totp: TOTP authenticator-app 2FA method with QR code provisioning
• yiirocks/voyti-2fa-webauthn: WebAuthn/passkey two-factor authentication method
• yiirocks/voyti-api: REST API for the Voyti user-management extension: JSON user CRUD endpoints, bearer-token auth, OpenAPI 3.1 spec, and API-token console commands
• yiirocks/voyti-gdpr: GDPR compliance addon: data export, account anonymization
• yiirocks/voyti-lockout: Brute-force protection for login and registration endpoints
• yiirocks/voyti-social-auth: Social/OAuth2 login via Google, GitHub, Facebook, and more

BSD-3-Clause

• Mr.42

• authorization
• api
• Authentication
• oauth2
• registration
• user
• extension
• password
• management
• session
• auth
• yii
• permissions
• rbac
• 2fa
• user-management
• access-control
• rest-api
• social-login
• two-factor-authentication
• usuario
• session-management
• gdpr
• yii3
• data-export
• role-based-access-control
• email-verification
• audit-logging
• password-management

Published on Packagist.org on 2026-08-24 12:44 UTC

README

войти
/vɐjˈtʲi/
verb

"to enter" or "to log in"

Highly customizable and extensible user management, authentication, and authorization extension for Yii Framework 3.

Originally ported from Usuario, Voyti has since been rebuilt around modern PSR standards and Yiisoft components. It has been extensively redesigned to provide a flexible, modular foundation that adapts to a wide range of authentication and authorization requirements.

Stats for Nerds

Features

• User Management — Registration, email confirmation, login/logout with remember-me, password recovery, password expiration
• Profile Management — User profiles with gravatar, timezone, bio, and a personal website link
• Social Authentication — OAuth2 login via Google, GitHub, Facebook, and more
• Two-Factor Authentication — Email codes, TOTP (authenticator app) with QR provisioning, or WebAuthn/passkeys - with enforced-per-permission support and one-time backup codes for account recovery
• RBAC Management — Full admin UI for roles, permissions, and rules with parent-child hierarchy, assignment management, and filtering
• Identity Switching — Admins can temporarily switch into another user's identity for support or debugging, then restore their own session with one click
• Session Management — Session tracking and termination
• GDPR Data Handling — Data export and account anonymization
• Password Policies — Minimum complexity requirements, max age enforcement via middleware
• Email Change Confirmation — Three modes: immediate, confirm new address, confirm both old and new
• REST API — JSON user CRUD (Bearer-token auth)
• Bot Protection — Google reCAPTCHA v2/v3 for registration and login forms
• Brute-Force Protection — Exponential backoff delays for failed login and registration attempts, tracked per IP address
• i18n — Built-in translations for multiple languages
• Pluggable Views — View-agnostic core with Bootstrap 5 views available; alternative UI frameworks can implement the standard interface
• Email Customization — Mail templates are independently overridable for complete control over transactional email content and styling
• Toast Notifications — Native Bootstrap toast support with automatic fallback to flash messages

Requirements

• PHP 8.3+
• ext-intl
• Various yiisoft packages (automatic installation via composer)

Views Implementation

Voyti's core is view-agnostic; you need a views implementation package to render any pages. yiirocks/voyti-views-bootstrap5 is the reference implementation using Bootstrap 5. You can substitute an alternative views package if you prefer a different UI framework, as long as it implements the yiirocks/voyti-views interface.

Installation

composer require yiirocks/voyti yiirocks/voyti-views-bootstrap5

Documentation

The complete reference guide is available at Yii.Rocks.