README

Secure user management, authentication and RBAC for modern Yii 2 applications. The package targets PHP 8.2–8.4 and Bootstrap 5.

This project is derived from 2amigos/yii2-usuario. See NOTICE.md and LICENSE.md.

Pełna instrukcja instalacji i obsługi po polsku: docs/PL_GUIDE.md.

Features

registration, email confirmation and password recovery;
user and profile administration;
roles, permissions, rules and per-user assignments;
optional TOTP, email and SMS two-factor authentication;
social authentication;
session history and session termination;
GDPR helpers;
Bootstrap 5 interface;
login rate limiting;
route permission scanner and route access filter;
permission groups;
authentication security log;
single-use password-reset tokens that revoke remember-me cookies.

Requirements

PHP 8.2, 8.3 or 8.4;
Yii 2.0.50 or newer;
Bootstrap 5;
an application cache component for login rate limiting.

Quick installation

After the first public release:

composer require bilipl/yii2-user-management-bilipl

To test this development ZIP before it is published, extract it outside your application and run in the application directory:

composer config repositories.bilipl-user path D:/workspace/yii2-user-management-bilipl
composer require bilipl/yii2-user-management-bilipl:@dev

Add the module to both web and console configuration:

use BiliPL\UserManagement\Module;

return [
    'modules' => [
        'user' => Module::class,
    ],
];

Install the user and Yii RBAC schemas, then create the first administrator:

php yii user/install
php yii user/create admin@example.com admin "A-long-random-password" admin

Open /user/login to sign in and /user/admin to manage users.

Application menu

The package supplies Bootstrap Nav items without replacing the application's layout. Add them anywhere among your own items:

use BiliPL\UserManagement\Widget\UserMenu;

$items = [
    ['label' => 'Home', 'url' => ['/site/index']],
    ...UserMenu::items(),
    ['label' => 'Contact', 'url' => ['/site/contact']],
];

Registration is shown to guests only when Module::$enableRegistration is enabled. Disable registration and its menu item together in module config:

'user' => [
    'class' => BiliPL\UserManagement\Module::class,
    'enableRegistration' => false,
],

Individual entries can be hidden without copying the module menu:

...UserMenu::items([
    'adminLabel' => 'Administration',
    'hiddenItems' => ['rules', 'networks'],
]),

Route permissions

Create permissions for conventional controller actions:

php yii user/routes/scan

To enforce them globally, attach the filter in application configuration:

use BiliPL\UserManagement\Filter\RouteAccessFilter;

return [
    'as routeAccess' => RouteAccessFilter::class,
];

Configure public routes through Module::$publicRoutes. A protected route such as /order/update maps to route:/order/update.

For access-aware links use:

use BiliPL\UserManagement\Helper\AccessHtml;

echo AccessHtml::a('Orders', ['/order/index']);

Hiding a link does not replace server-side authorization.

Security defaults

passwords require at least 10 characters;
logout and administrative mutations use POST;
password reset rotates auth_key and consumes its token;
OAuth cannot silently bypass application-level 2FA;
TOTP secrets should be encrypted by an application-specific model override when database-at-rest protection is required.

Run dependency checks regularly:

composer audit
composer outdated --direct

License and origin

BSD-3-Clause. The original Usuario copyright notice and license are retained. New and modified code is maintained by BiliPL. See NOTICE.md.

bilipl / yii2-user-management-bilipl

Package info

Security

Statistics