rossaddison/ddd-template

A lean Yii3 starter with working auth + 2FA + RBAC, and a real Domain/Application/Infrastructure/Shell DDD layering example (Settings + Telegram bot connectivity) to build your own modules on top of.

v0.1.0 2026-07-27 15:30 UTC

Requires

• php: 8.3 - 8.5
• ext-ctype: *
• ext-curl: *
• ext-intl: *
• ext-json: *
• ext-mbstring: *
• ext-openssl: *
• ext-pdo: *
• ext-sodium: *
• brick/math: >=0.17.2
• chillerlan/php-qrcode: ^6.0.1
• cycle/annotated: ^4.6.0
• cycle/database: ^2.21.0
• cycle/entity-behavior: ^1.7.1
• cycle/orm: ^2.18.0
• cycle/schema-provider: ^1.0
• doctrine/collections: >2.6.0
• doctrine/inflector: >=2.2.0
• guzzlehttp/guzzle: >=8.0.1
• guzzlehttp/psr7: >=3
• httpsoft/http-message: ^1.1.6
• nyholm/psr7: ^1.8.2
• phptg/bot-api: >=0.21.2
• psr/container: ^2.0.2
• psr/http-client: >=1.0.3
• psr/http-factory: ^1.1
• psr/http-message: ^2.0
• psr/http-server-handler: ^1.0.2
• psr/http-server-middleware: ^1.0.2
• psr/log: ^3.0.2
• ramsey/uuid: >=4.9.3
• rossaddison/yii-cycle-1: dev-master
• spomky-labs/otphp: ^11.5.0
• symfony/console: >=8.1.1
• symfony/process: >=8.1.0
• vlucas/phpdotenv: ^5.6.4
• yiisoft/access: ^2.0.1
• yiisoft/aliases: ^3.1.1
• yiisoft/arrays: ^3.2.1
• yiisoft/assets: ^5.1.2
• yiisoft/auth: ^3.2.1
• yiisoft/bootstrap5: ^1.2
• yiisoft/cache: ^3.2
• yiisoft/cache-file: ^3.2
• yiisoft/config: ^1.6.2
• yiisoft/cookies: ^1.2.4
• yiisoft/csrf: ^2.2.3
• yiisoft/data: ^2.0.0
• yiisoft/data-cycle: dev-master
• yiisoft/data-response: ^2.2.0
• yiisoft/db: ^2.0.1
• yiisoft/db-mysql: ^2
• yiisoft/definitions: ^3.4.1
• yiisoft/di: ^1.4.1
• yiisoft/error-handler: ^4.3.2
• yiisoft/factory: ^1.3.1
• yiisoft/files: ^2.1
• yiisoft/form: ^1.5.2
• yiisoft/form-model: ^1.1.1
• yiisoft/friendly-exception: ^1.2
• yiisoft/html: >=4.2
• yiisoft/http: ^1.3
• yiisoft/i18n: ^1.2.2
• yiisoft/injector: ^1.2.1
• yiisoft/input-http: >=1.0.1
• yiisoft/json: ^1.1
• yiisoft/log: >=2.2.1
• yiisoft/log-target-file: >=3.1
• yiisoft/mailer: ^6.1.0
• yiisoft/mailer-symfony: ^4.0.1
• yiisoft/middleware-dispatcher: ^5.4
• yiisoft/rate-limiter: dev-master
• yiisoft/rbac: ^2.1.2
• yiisoft/rbac-cycle-db: >=3
• yiisoft/rbac-php: >=2.1
• yiisoft/rbac-rules-container: >=2.1
• yiisoft/request-provider: ^1.3
• yiisoft/router: ^4.0.2
• yiisoft/router-fastroute: ^4.0.3
• yiisoft/security: ^1.2.0
• yiisoft/session: ^3.0.1
• yiisoft/strings: ^2.7
• yiisoft/translator: ^3.2.1
• yiisoft/translator-message-php: ^1.1.2
• yiisoft/user: ^2.3.2
• yiisoft/validator: ^2.6.0
• yiisoft/var-dumper: ^1.7.1
• yiisoft/view: ^12.2.4
• yiisoft/widget: ^2.2.2
• yiisoft/yii-auth-client: dev-master
• yiisoft/yii-console: ^2.4.2
• yiisoft/yii-event: ^2.2
• yiisoft/yii-http: ^1.1.1
• yiisoft/yii-middleware: ^1.1.2
• yiisoft/yii-runner-console: ^2.2.1
• yiisoft/yii-runner-http: ^3.2.1
• yiisoft/yii-view-renderer: ^7.4.1

Requires (Dev)

• dg/bypass-finals: ^1.11.0
• mockery/mockery: ^1.6.12
• rector/rector: ^2.5.8
• testo/bridge-mockery: ^0.1.1
• testo/facade: >=0.1.1
• testo/testo: ^0.10.38
• vimeo/psalm: >=6.16.1

BSD-3-Clause

• template
• ddd
• yii
• domain-driven-design

Published on Packagist.org on 2026-07-27 15:32 UTC

README

ddd-template

A lean Yii3 starter, extracted from rossaddison/invoice, meant to be built on top of — not another invoicing app.

It carries over only the reusable skeleton:

• Auth (login/signup/password reset) with 2FA (Aegis/TOTP-compatible) and RBAC.
• OAuth social login (yiisoft/yii-auth-client) — Facebook, GitHub, Google, LinkedIn, Microsoft, VKontakte, X, Yandex.
• A bare nav-menu Shell (no domain-specific frills).

...plus one fully worked example of the layering pattern this repo is actually here to demonstrate — a real Domain / Application / Infrastructure / Shell DDD split (contrasted with the anemic Cycle-ORM-entity-as-domain-model pattern most of the invoice app itself uses):

• src/Domain/{Setting,Telegram} — pure PHP entities, value objects, repository/gateway interfaces. No framework dependency.
• src/Application/{Setting,Telegram} — use-case classes (__invoke), orchestrating Domain interfaces.
• src/Infrastructure/Persistence/{Setting,Telegram}, src/Infrastructure/Telegram — Cycle ORM + Telegram Bot API implementations of those interfaces.
• src/Shell — the HTTP/presentation layer: BaseController, RBAC permissions, view injections, controllers, views.

Settings admin and Telegram bot connectivity (token/webhook/chat-id/test message) are the worked example — copy the same four-layer shape when adding your own module.

Status

Runnable end-to-end and live-verified: signup → login → mandatory 2FA setup → 2FA verify → Shell → logout, all exercised against a real local MySQL database. See docs/PROGRESS.md for exactly what was tested, the deliberate simplifications made versus invoice's own Auth flow (no email-verification gate, no HMRC/GovUk/OpenBanking), and what's still out of scope (live OAuth provider callbacks, a real Telegram bot).

Requirements

• PHP 8.3 – 8.5
• MySQL (or another Cycle ORM–supported database)
• Composer

Getting started

composer install
cp .env.example .env
# fill in DB_*, COOKIE_SECRET_KEY, and any OAuth provider credentials you want

Database schema is entity-driven (Cycle ORM), not migration-file-driven: set BUILD_DATABASE=true in .env, hit the app once to sync tables, then set it back to false.

php yii serve

Quality

vendor/bin/psalm --no-cache   # errorLevel=1, findUnusedCode=true — clean
vendor/bin/testo --suite=Unit # 22/22 passing