yiirocks/voyti-2fa

Two-factor authentication subsystem for the YiiRocks Voyti Yii3 extension

dev-main / 1.0.x-dev 2026-08-11 19:39 UTC

Requires

• php: >=8.3
• yiirocks/voyti: dev-2fa

Requires (Dev)

• friendsofphp/php-cs-fixer: @stable
• infection/infection: ^0.34.0
• nyholm/psr7: ^1.8
• phpunit/phpunit: @stable
• rector/rector: ^2.1.1
• vimeo/psalm: 6.x-dev
• yiisoft/code-style: ^1.1
• yiisoft/config: ^1.6
• yiisoft/csrf: ^2.0
• yiisoft/db-migration: ^2.0
• yiisoft/db-sqlite: ^2.0
• yiisoft/di: *
• yiisoft/mailer: ^6.1
• yiisoft/router: ^4.0
• yiisoft/router-fastroute: ^4.0
• yiisoft/session: ^3.0
• yiisoft/user: ^2.3
• yiisoft/yii-view-renderer: ^7.1

BSD-3-Clause

• Mr.42

• user
• extension
• auth
• two-factor
• yii
• 2fa
• yii3

Published on Packagist.org on 2026-08-11 19:39 UTC

README

The two-factor authentication base package for Voyti, the Yii3 user-management extension. It carries the whole 2FA subsystem — data, login-confirmation flow, settings screen, backup codes, and per-permission enforcement — that Voyti core no longer ships itself.

Stats for Nerds

What this is

Two-factor authentication is pluggable in Voyti: this base package provides the machinery, and each method (email, TOTP, WebAuthn) ships as its own small package on top of it. 2FA becomes active as soon as a method package is installed — there is no separate on/off flag. It hooks into core's login flow through the voyti.login-challenge seam and auto-joins the enforcement middleware chain via the voyti.enforce-middleware tag, so a host needs no extra wiring.

Requirements

• PHP 8.3+
• yiirocks/voyti

Installation

You do not install this package directly — on its own it provides no working 2FA. Install a method package instead and this base is pulled in automatically as a dependency:

• yiirocks/voyti-2fa-email — emailed one-time code
• yiirocks/voyti-2fa-totp — authenticator-app TOTP
• yiirocks/voyti-2fa-webauthn — WebAuthn / passkeys

The base package ships a migration creating its user_two_factor and user_backup_code tables; its migration path is registered for yiisoft/db-migration automatically, so a host's migrate command picks it up.

Documentation

Installation steps, the enforcement/config reference, and the guide to writing your own method plugin are all covered at Yii.Rocks.

Testing

# Unit tests
composer phpunit

# Mutation testing
composer infection

# Static analysis
composer psalm

# Code style fixer
composer php-cs-fixer