Daycry Auth Documentation

Welcome to the complete documentation for Daycry Auth, a comprehensive authentication and authorization library for CodeIgniter 4.

Getting Started

Authentication

Controllers & Filters

Authorization & Logging

Compliance & Operations

Testing & Reference

Main Features

Authentication

  • Multiple Authenticators: Session, Access Token (with scope enforcement), JWT (with refresh tokens), Magic Link

  • JWT Access-Token Revocation: users.token_version lets you invalidate every outstanding access token at once — User::revokeIssuedTokens() (“log out everywhere”), fired automatically on ban and password change (JWT)

  • TOTP Two-Factor Authentication with backup codes, optional “Trust this device” bypass, brute-force lockout, and single-use (anti-replay) codes (TOTP)

  • WebAuthn / Passkeys — passwordless login (usernameless/discoverable) and passkey 2FA, phishing-resistant, opt-in per user behind a global availability flag (WebAuthn)

  • Device Session Tracking with optional concurrent-session limit and real, enforced revocation — a revoked session is forced to re-authenticate on the next request (Device Sessions)

  • Password Reset + Force Password Reset + optional rotation policy + history (no reuse), with hashed-at-rest magic-link & reset tokens

  • OAuth 2.0 / Social Login: Google, GitHub, Facebook, Microsoft Azure, custom profile fields, OAuth events, explicit account linking (oauth/link/(:segment)) and verified-email merge safety (OAuth)

Authorization

  • Groups & Permissions (RBAC) with optional persistent cache, uniform wildcard matching (*, posts.*) across user- and group-level permissions, and a Gate → RBAC bridge (gateFallbackToRbac)

  • API token scope enforcement (token-scope: filter)

  • Per-Route Rate Limiting — rates:<limit>,<period> overrides the global limit for a single route (<period> in seconds or SECOND/MINUTE/HOUR/DAY/WEEK) (Filters)

  • Sudo Mode (Password Confirmation) — password-confirm:<seconds> enforces a fresh confirmation on the most sensitive routes, overriding the global window (Filters)

  • Flexible Filters: Auth, chain, group, permission, gate, token-scope, password-age, rate limiting (rates), force-reset, password-confirm

Security

  • Per-User Account Lockout (atomic) — independent of IP-based blocking, now also applied to TOTP / backup-code verification

  • Compromised-Password Recheck on Login (HIBP integration, opt-in)

  • Suspicious Login Detection with suspicious-login event for email alerts, plus remember-me theft detection (a mismatched validator purges all of the user’s tokens and fires remember-me-theft)

  • Secret-safe login log — Access Token / JWT credentials are stored in auth_logins as a non-reversible SHA-256 fingerprint, never the raw bearer token

  • Timing-safe OAuth state validation

Compliance & Operations

  • Granular audit log (auth_audit_logs) — 22 canonical event types, filterable CLI

  • GDPR helpers — JSON data export + account anonymization

  • Admin CLI: auth:tokens revoke, auth:sessions terminate, auth:totp reset, auth:audit, auth:gdpr export|anonymize

  • Scheduled Maintenance: auth:purge [--days <n>] — purges expired remember-me tokens and old terminated device sessions; run on a schedule instead of the probabilistic on-login purge (CLI Commands)

  • Complete Logging: CI4 Events + database login attempts + audit log

  • Highly Customizable: Extend or replace any component

Quick Start

composer require daycry/auth
php spark migrate --all
php spark auth:setup

// Login
$result = auth()->attempt(['email' => 'user@example.com', 'password' => 'secret']);

if ($result->isOK()) {
    return redirect()->to('/dashboard');
}

Documentation Sections

Quick Start Guide

Install and configure Daycry Auth in minutes.

Configuration

Every configuration option explained with examples.

Authentication

Session, Access Token, JWT (with refresh), Magic Link, Password Reset, and more.

OAuth 2.0 & Social Login

Google, GitHub, Facebook, Microsoft Azure — and any OIDC provider. Profile fields, custom resolvers, OAuth events, scopes tracking, explicit account linking, and allowUnverifiedEmailLink merge safety.

TOTP Two-Factor Authentication

Time-based OTP with authenticator apps, brute-force lockout, and single-use anti-replay codes.

Device Sessions

Track and manage active logins across devices, with enforced revocation that forces re-authentication.

Security Filters

Protect routes with authentication and authorization filters, including per-route rate limits (rates:<limit>,<period>) and sudo mode (password-confirm:<seconds>).

Controllers

All included controllers: Login, Register, Password Reset, Force Reset, JWT, UserSecurity.

Authorization

Groups, permissions, permission cache, wildcard matching, the Gate → RBAC bridge, and RBAC patterns.

Logging & Monitoring

CI4 Events, database logs, per-user lockout, and rate limiting.

Testing

Unit and integration testing with authentication mocking.

Additional Resources