Merge remote-tracking branch 'upstream/master' into 1fa-channels-email-sms

CHANGELOG.md

@@ -1,6 +1,6 @@
 # CHANGELOG
 
-## work in progress
+## 1.6.0 work in progress
  - Fix replace non-working travis build with working github actions build (TonisOrmisson)
  - Fix user login events not triggered on ajax requests (TonisOrmisson)
  - Enh: Added minimum requirements when a new password is automatically generated (MatteoF96)
@@ -9,9 +9,10 @@
  - Enh #387: Added Persian translation (hadi-aj)
  - Fix #384: Delete flash messages after consuming (cgsmith)
  - Enh: Added SK translations (snickom)
- - Fix: allow password_changed_at to be saved when reseting password (p4blojf)
+ - Fix: allow `password_changed_at` to be saved when reseting password (p4blojf)
- - Fix #430: Moved EVENT_BEFORE_PROFILE_UPDATE to correct place (eluhr)
+ - Fix #430: Moved `EVENT_BEFORE_PROFILE_UPDATE` to correct place (eluhr)
- - 
+ - Ehn #456: Added filter to allow forcing 2FA for specific user roles (acordeddu)
+ - Ehn #458: Multiple 2FA channels (email, sms) (acordeddu)
 
 ## 1.5.1 April 5, 2020
  - Fix #370: Extending view fix (effsoft)

docs/installation/configuration-options.md

@@ -48,6 +48,23 @@ The following is the default configuration:
 
 For instructions about implementation of SMS sending see at the following link: https://www.yiiframework.com/extension/yetopen/yii2-sms-aruba
 
+#### twoFactorAuthenticationForcedPermissions (type: `array`, default: `[]`)
+
+The list of permissions for which two factor authentication is mandatory. In order to perform the check in every action you must configure a filter into your config file like this:
+
+use Da\User\Filter\TwoFactorAuthenticationEnforceFilter;
+...
+'on beforeAction' => function() {
+        Yii::$app->controller->attachBehavior(
+            'enforceTwoFactorAuthentication',[
+                'class' => TwoFactorAuthenticationEnforceFilter::class,
+                'except' => ['login', 'logout', 'account', 'two-factor', 'two-factor-enable'],
+            ]
+        );
+    },
+...   
+This will redirect the user to their account page until the two factor authentication is enabled.
+
 #### enableGdprCompliance (type: `boolean`, default: `false`)
 
 Setting this attribute enables a serie of measures to comply with EU GDPR regulation, like data consent, right to be forgotten and data portability.

src/User/Controller/SecurityController.php

@@ -1,6 +1,6 @@
 <?php
 
-/*
+/**
  * This file is part of the 2amigos/yii2-usuario project.
  *
  * (c) 2amigOS! <http://2amigos.us/>
@@ -120,17 +120,21 @@ class SecurityController extends Controller
             return $this->goHome();
         }
 
-        /** @var LoginForm $form */
+        /**
+        * @var LoginForm $form 
+        */
         $form = $this->make(LoginForm::class);
 
-        /** @var FormEvent $event */
+        /**
+        * @var FormEvent $event 
+        */
         $event = $this->make(FormEvent::class, [$form]);
 
         if (Yii::$app->request->isAjax && $form->load(Yii::$app->request->post())) {
             Yii::$app->response->format = Response::FORMAT_JSON;
 
             $errors = ActiveForm::validate($form);
-            if(empty($errors)) {
+            if (empty($errors)) {
                 return $errors;
             }
             $this->trigger(FormEvent::EVENT_FAILED_LOGIN, $event);
@@ -139,9 +143,10 @@ class SecurityController extends Controller
 
         if ($form->load(Yii::$app->request->post())) {
             if ($this->module->enableTwoFactorAuthentication && $form->validate()) {
-                if ($form->getUser()->auth_tf_enabled) {
+                $user = $form->getUser();
-                    Yii::$app->session->set('credentials', ['login' => $form->login, 'pwd' => $form->password]);
                 
+                if ($user->auth_tf_enabled) {
+                    Yii::$app->session->set('credentials', ['login' => $form->login, 'pwd' => $form->password]);
                     return $this->redirect(['confirm']);
                 }
             }
@@ -157,11 +162,8 @@ class SecurityController extends Controller
 
                 return $this->goBack();
             }
-            else
-            {
             $this->trigger(FormEvent::EVENT_FAILED_LOGIN, $event);            
         }
-        }
 
         return $this->render(
             'login',
@@ -183,13 +185,17 @@ class SecurityController extends Controller
         }
 
         $credentials = Yii::$app->session->get('credentials');
-        /** @var LoginForm $form */
+        /**
+        * @var LoginForm $form 
+        */
         $form = $this->make(LoginForm::class);
         $form->login = $credentials['login'];
         $form->password = $credentials['pwd'];
         $form->setScenario('2fa');
 
-        /** @var FormEvent $event */
+        /**
+        * @var FormEvent $event 
+        */
         $event = $this->make(FormEvent::class, [$form]);
 
         if (Yii::$app->request->isAjax && $form->load(Yii::$app->request->post())) {
@@ -267,4 +273,5 @@ class SecurityController extends Controller
 
         $this->make(SocialNetworkAccountConnectService::class, [$this, $client])->run();
     }
+
 }

src/User/Controller/SettingsController.php

@@ -1,6 +1,6 @@
 <?php
 
-/*
+/**
  * This file is part of the 2amigos/yii2-usuario project.
  *
  * (c) 2amigOS! <http://2amigos.us/>
@@ -124,7 +124,7 @@ class SettingsController extends Controller
                         'allow' => true,
                         'actions' => ['confirm'],
                         'roles' => ['?', '@'],
-                    ],
+                    ]
                 ],
             ],
         ];
@@ -143,7 +143,11 @@ class SettingsController extends Controller
             $profile->link('user', Yii::$app->user->identity);
         }
 
-        /** @var ProfileEvent $event */
+        /**
+        * 
+        *
+        * @var ProfileEvent $event 
+        */
         $event = $this->make(ProfileEvent::class, [$profile]);
 
         $this->make(AjaxRequestModelValidator::class, [$profile])->validate();
@@ -175,9 +179,11 @@ class SettingsController extends Controller
         if (!$this->module->enableGdprCompliance) {
             throw new NotFoundHttpException();
         }
-        return $this->render('privacy', [
+        return $this->render(
+            'privacy', [
             'module' => $this->module
-        ]);
+            ]
+        );
     }
 
     /**
@@ -194,7 +200,11 @@ class SettingsController extends Controller
         if (!$this->module->enableGdprCompliance) {
             throw new NotFoundHttpException();
         }
-        /** @var GdprDeleteForm $form */
+        /**
+        * 
+        *
+        * @var GdprDeleteForm $form 
+        */
         $form = $this->make(GdprDeleteForm::class);
 
         $user = $form->getUser();
@@ -216,21 +226,25 @@ class SettingsController extends Controller
                 $security = $this->make(SecurityHelper::class);
                 $anonymReplacement = $this->module->gdprAnonymizePrefix . $user->id;
 
-                $user->updateAttributes([
+                $user->updateAttributes(
+                    [
                     'email' => $anonymReplacement . "@example.com",
                     'username' => $anonymReplacement,
                     'gdpr_deleted' => 1,
                     'blocked_at' => time(),
                     'auth_key' => $security->generateRandomString()
-                ]);
+                    ]
-                $user->profile->updateAttributes([
+                );
+                $user->profile->updateAttributes(
+                    [
                     'public_email' => $anonymReplacement . "@example.com",
                     'name' => $anonymReplacement,
                     'gravatar_email' => $anonymReplacement . "@example.com",
                     'location' => $anonymReplacement,
                     'website' => $anonymReplacement . ".tld",
                     'bio' => Yii::t('usuario', 'Deleted by GDPR request')
-                ]);
+                    ]
+                );
             }
             $this->trigger(GdprEvent::EVENT_AFTER_DELETE, $event);
 
@@ -239,14 +253,20 @@ class SettingsController extends Controller
             return $this->goHome();
         }
 
-        return $this->render('gdpr-delete', [
+        return $this->render(
+            'gdpr-delete', [
             'model' => $form,
-        ]);
+            ]
+        );
     }
 
     public function actionGdprConsent()
     {
-        /** @var User $user */
+        /**
+        * 
+        *
+        * @var User $user 
+        */
         $user = Yii::$app->user->identity;
         if ($user->gdpr_consent) {
             return $this->redirect(['profile']);
@@ -254,30 +274,37 @@ class SettingsController extends Controller
         $model = new DynamicModel(['gdpr_consent']);
         $model->addRule('gdpr_consent', 'boolean');
         $model->addRule('gdpr_consent', 'default', ['value' => 0, 'skipOnEmpty' => false]);
-        $model->addRule('gdpr_consent', 'compare', [
+        $model->addRule(
+            'gdpr_consent', 'compare', [
             'compareValue' => true,
             'message' => Yii::t('usuario', 'Your consent is required to work with this site'),
             'when' => function () {
                 return $this->module->enableGdprCompliance;
             },
-        ]);
+            ]
+        );
         if ($model->load(Yii::$app->request->post()) && $model->validate()) {
-            $user->updateAttributes([
+            $user->updateAttributes(
+                [
                 'gdpr_consent' => 1,
                 'gdpr_consent_date' => time(),
-            ]);
+                ]
+            );
             return $this->redirect(['profile']);
         }
 
-        return $this->render('gdpr-consent', [
+        return $this->render(
+            'gdpr-consent', [
             'model' => $model,
             'gdpr_consent_hint' => $this->module->getConsentMessage(),
-        ]);
+            ]
+        );
     }
 
     /**
      * Exports the data from the current user in a mechanical readable format (csv). Properties exported can be defined
      * in the module configuration.
+     *
      * @throws NotFoundHttpException if gdpr compliance is not enabled
      * @throws \Exception
      * @throws \Throwable
@@ -322,7 +349,11 @@ class SettingsController extends Controller
 
     public function actionAccount()
     {
-        /** @var SettingsForm $form */
+        /**
+* 
+         *
+ * @var SettingsForm $form 
+*/
         $form = $this->make(SettingsForm::class);
         $event = $this->make(UserEvent::class, [$form->getUser()]);
 
@@ -389,7 +420,11 @@ class SettingsController extends Controller
             throw new NotFoundHttpException(Yii::t('usuario', 'Not found'));
         }
 
-        /** @var User $user */
+        /**
+        * 
+        *
+        * @var User $user 
+        */
         $user = Yii::$app->user->identity;
         $event = $this->make(UserEvent::class, [$user]);
         Yii::$app->user->logout();
@@ -436,7 +471,11 @@ class SettingsController extends Controller
     {
         Yii::$app->response->format = Response::FORMAT_JSON;
 
-        /** @var User $user */
+        /**
+        * 
+        *
+        * @var User $user 
+        */
         $user = $this->userQuery->whereId($id)->one();
 
         if (null === $user) {
@@ -466,7 +505,11 @@ class SettingsController extends Controller
 
     public function actionTwoFactorDisable($id)
     {
-        /** @var User $user */
+        /**
+        * 
+        *
+        * @var User $user 
+        */
         $user = $this->userQuery->whereId($id)->one();
         
         if (null === $user) {
@@ -496,7 +539,11 @@ class SettingsController extends Controller
      */
     protected function disconnectSocialNetwork($id)
     {
-        /** @var SocialNetworkAccount $account */
+        /**
+        * 
+        *
+        * @var SocialNetworkAccount $account 
+        */
         $account = $this->socialNetworkAccountQuery->whereId($id)->one();
 
         if ($account === null) {

src/User/Filter/TwoFactorAuthenticationEnforceFilter.php

@@ -0,0 +1,50 @@
+<?php
+
+/*
+ * This file is part of the 2amigos/yii2-usuario project.
+ *
+ * (c) 2amigOS! <http://2amigos.us/>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace Da\User\Filter;
+
+use Da\User\Model\User;
+use Da\User\Module;
+use Yii;
+use yii\base\ActionFilter;
+use Da\User\Traits\AuthManagerAwareTrait;
+
+
+class TwoFactorAuthenticationEnforceFilter extends ActionFilter
+{
+    use AuthManagerAwareTrait;
+
+    public function beforeAction($action)
+    {
+        /** @var Module $module */
+        $module = Yii::$app->getModule('user');
+
+        $enableTwoFactorAuthentication = $module->enableTwoFactorAuthentication;
+        // If enableTwoFactorAuthentication is set to false do nothing
+        if (!$enableTwoFactorAuthentication) {
+            return parent::beforeAction($action);
+        }
+
+        if (Yii::$app->user->isGuest) {
+            // Not our business
+            return parent::beforeAction($action);
+        }
+
+        $permissions = $module->twoFactorAuthenticationForcedPermissions;
+        $itemsByUser = array_keys($this->getAuthManager()->getItemsByUser(Yii::$app->user->identity->id));
+        if(!empty(array_intersect($permissions, $itemsByUser))){
+            Yii::$app->session->setFlash('warning', Yii::t('usuario', 'Your role requires 2FA, you won\'t be able to use the application until you enable it'));
+                return Yii::$app->response->redirect(['/user/settings/account'])->send();
+        }
+        
+        return parent::beforeAction($action);
+    }
+}

src/User/Module.php

@@ -81,6 +81,10 @@ class Module extends BaseModule
      * @var bool whether to enable two factor authentication or not
      */
     public $enableTwoFactorAuthentication = false;
+     /**
+     * @var array list of permissions for which two factor authentication is mandatory
+     */
+    public $twoFactorAuthenticationForcedPermissions = [];
     /**
      * @var array list of channels for two factor authentication availables
      */

src/User/resources/i18n/ca/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/da/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/de-DU/usuario.php

@@ -298,10 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@Eine Nachricht wurde an Deine E-Mail Adresse gesendet@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/de/usuario.php

@@ -298,10 +298,6 @@ return [
     'Two factor authentication code by SMS' => '',
     'Two factor authentication code by email' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
+    'Information' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Now you can resume the login process' => '@@@@',
 ];

src/User/resources/i18n/es/usuario.php

@@ -298,11 +298,5 @@ return [
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
-    'An email has been sent with instructions for resetting your password' => '@@Se ha enviado un correo electrónico con instrucciones para restablecer su contraseña@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Two factor authentication protects you against stolen credentials' => '@@La autenticación de dos factores le protege del robo de credenciales@@',
 ];

src/User/resources/i18n/et/usuario.php

@@ -298,9 +298,5 @@ return [
     'Your two factor authentication method is based on "{0}".' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/fa-IR/usuario.php

@@ -294,14 +294,23 @@ return [
     'Your consent is required to work with this site' => '',
     'Your password has expired, you must change it now' => '',
     'Your personal information has been removed' => '',
+<<<<<<< HEAD
     'Your two factor authentication method is based on "{0}".' => '',
+=======
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
+>>>>>>> upstream/master
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
     'An email has been sent with instructions for resetting your password' => '@@ایمیلی حاوی راهنمایی برای تنظیم مجدد رمز عبور به شما ارسال شد@@',
+<<<<<<< HEAD
     'Insert the mobile phone number on which to receive text message.' => '@@@@',
     'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
     'Insert the mobile phone number where you want to receive text message.' => '@@@@',
     'Mobile phone number not registered.' => '@@@@',
+=======
+    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
+    'Now you can resume the login process' => '@@@@',
+>>>>>>> upstream/master
     'Registration ip' => '@@ای پی ثبت نام@@',
 ];

src/User/resources/i18n/fi/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/fr/usuario.php

@@ -298,9 +298,6 @@ return [
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
+    '{0, date, MMM dd, YYYY HH:mm}' => '',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/hr/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/hu/usuario.php

@@ -298,29 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@Üzenet érkezett az e-mail címedre.@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'An email has been sent with instructions for resetting your password' => '@@E-mailt küldtek a jelszó visszaállításával kapcsolatos utasításokkal@@',
-    'Awesome, almost there. ' => '@@Hurrá, majdnem kész.@@',
-    'Disable Two-Factor Auth' => '@@Letiltja a kétütemű hitelesítést@@',
-    'Enable Two-factor auth' => '@@Engedélyezze a kétütemű hitelesítést@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'I aggree processing of my personal data and the use of cookies to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Aggregálom a személyes adataim feldolgozását és a cookie-k használatát a webhely működésének megkönnyítése érdekében. További információért olvassa el a {privacyPolicy}@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Érvénytelen kétütemű kód@@',
-    'Last login' => '@@Utolsó bejelentkezés@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Ez letiltja a kétütemű hitelesítést. biztos vagy ebben?@@',
-    'Two Factor Authentication' => '@@Két tényező hitelesítés@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Két tényező-hitelesítés megvédi az ellopott hitelesítő adatokat@@',
-    'Two factor successfully enabled.' => '@@Két tényező sikeresen bekapcsolt.@@',
-    'Two-Factor Authentication' => '@@Két faktoros hitelesítés@@',
-    'Two-factor auth protects you against stolen credentials' => '@@A kétütemű auth védelmet nyújt az ellopott hitelesítő adatok ellen@@',
-    'Two-factor authentication code' => '@@Kétszeres hitelesítési kód@@',
-    'Two-factor authorization has been disabled.' => '@@A kétütemű engedélyezés le van tiltva.@@',
-    'Two-factor code' => '@@Kétszámjegyű kód@@',
-    'Unable to disable two-factor authorization.' => '@@Nem sikerült letiltani a kétütemű engedélyezést.@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@A cím megerősítéséhez nem tudtuk újra elküldeni az e-mailt.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@Megerősítő linkeket küldtünk régi és új e-mail címekre.@@',
 ];

src/User/resources/i18n/it/usuario.php

@@ -293,11 +293,10 @@ return [
     'Your personal information has been removed' => 'I tuoi dati personali sono stati rimossi',
     'Your profile has been updated' => 'Il tuo profilo è stato aggiornato',
     'Your two factor authentication method is based on "{0}".' => 'La tua autenticazione a due fattori è basata su "{0}".',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => 'Il tuo ruolo richiede l\'autenticazione a due fattori, non potrai usare l\'applicazione finché non l\'avrai abilitata',
     'privacy policy' => 'politica della privacy',
     '{0, date, MMM dd, YYYY HH:mm}' => '{0, date, MMM dd, YYYY HH:mm}',
     '{0, date, MMMM dd, YYYY HH:mm}' => '{0, date, dd MMMM YYYY HH:mm}',
     '{0} cannot be blank.' => '{0} non può essere vuoto.',
     'This is the code to insert to enable two factor authentication' => '',
-    'An email has been sent with instructions for resetting your password' => '@@È stata inviata un\'email con le istruzioni per azzerare la tua password@@',
-    'Now you can resume the login process' => '@@Ora puoi riprendere il processo di autenticazione@@',
 ];

src/User/resources/i18n/kk/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/lt/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/nl/usuario.php

@@ -298,35 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@Een bericht werd naar jouw emailadres verzonden@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'An email has been sent with instructions for resetting your password' => '@@Er werd een email verstuurd met instructies om jouw wachtwoord te resetten@@',
-    'Awesome, almost there. ' => '@@Super, bijna klaar.@@',
-    'Class "{0}" does not exist' => '@@Class "{0} bestaat niet@@',
-    'Disable Two-Factor Auth' => '@@Tweetraps authenticatie uitschakelen@@',
-    'Enable Two-factor auth' => '@@Tweetraps authenticatie inschakelen@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'I aggree processing of my personal data and the use of cookies
-            to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Ik ga akkoord dat mijn persoonlijke data en cookies worden verwerkt voor het gebruik van deze website. Voor meer informatie lees onze {privacyPolicy}@@',
-    'I aggree processing of my personal data and the use of cookies to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Ik ga akkoord dat mijn persoonlijke data en cookies worden verwerkt voor het gebruik van deze website. Voor meer informatie lees onze {privacyPolicy}@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Ongeldige tweetraps authenticatie code@@',
-    'Last login' => '@@Laatste login@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Registration ip' => '@@Registratie IP@@',
-    'Rule class can not be instantiated' => '@@Registratie IP@@',
-    'Rule class must extend "yii\\rbac\\Rule"' => '@@Regel klasse moet worden uitgebreid met "yii\\rbac\\Rule"@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Dit zal de tweetraps authenticatie uitschakelen. Ben je zeker?@@',
-    'Two Factor Authentication' => '@@Tweetraps authenticatie@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Tweetraps authenticatie beschermt je tegen gestolen inloggegevens@@',
-    'Two factor successfully enabled.' => '@@Tweetraps authenticatie ingeschakeld@@',
-    'Two-Factor Authentication' => '@@Tweetraps authenticatie@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Tweetraps authenticatie beschermt je tegen gestolen authenticatie gegevens@@',
-    'Two-factor authentication code' => '@@Tweetraps authenticatie code@@',
-    'Two-factor authorization has been disabled.' => '@@Tweetraps authenticatie werd uitgeschakeld.@@',
-    'Two-factor code' => '@@Tweetraps authenticatie code@@',
-    'Unable to disable two-factor authorization.' => '@@Tweetraps authenticatie kon niet worden uitgeschakeld@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@Wij konden de email bevestigingsmail niet opnieuw naar jouw adres verzenden.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@We hebben de bevestigingsmail naar zowel jouw oud als nieuw emailadres verzonden.@@',
 ];

src/User/resources/i18n/nl_NL/usuario.php

@@ -1,273 +0,0 @@
-<?php
-/**
- * Message translations.
- *
- * This file is automatically generated by 'yii message/extract' command.
- * It contains the localizable messages extracted from source code.
- * You may modify this file by translating the extracted messages.
- *
- * Each array element represents the translation (value) of a message (key).
- * If the value is empty, the message is considered as not translated.
- * Messages that no longer need translation will have their translations
- * enclosed between a pair of '@@' marks.
- *
- * Message string can be used with plural forms format. Check i18n section
- * of the guide for details.
- *
- * NOTE: this file must be saved in UTF-8 encoding.
- */
-return [
-    '(not set)' => '-',
-	'A confirmation message has been sent to your new email address' => 'Een bevestigingsbericht is verzonden naar je nieuwe e-mailadres',
-	'A message has been sent to your email address. It contains a confirmation link that you must click to complete registration.' => 'Een email met een bevestigingslink werd verzonden naar je emailadres. Klik op de link om de registratie te voltooien.',
-	'A new confirmation link has been sent' => 'Een nieuwe bevestigingslink is verzonden',
-	'A password will be generated automatically if not provided' => 'Een wachtwoord wordt automatisch gegenereerd als er dit niet wordt opgegeven',
-	'Account' => 'Account',
-	'Account confirmation' => 'Accountbevestiging',
-	'Account details' => 'Accountdetails',
-	'Account details have been updated' => 'Accountdetails werden bijgewerkt',
-	'Account settings' => 'Account-instellingen',
-	'Already registered? Sign in!' => 'AL geregistreerd? Log in!',
-	'An email has been sent with instructions for resetting your password' => 'Er is een email verstuurd met instructies om je wachtwoord te herstellen',
-	'An error occurred processing your request' => 'Er is een fout opgetreden bij het verwerken van je aanvraag',
-	'Are you sure you want to block this user?' => 'Weet je zeker dat je deze gebruiker wil blokkeren?',
-	'Are you sure you want to confirm this user?' => 'Weet je zeker dat je deze gebruiker wil bevestigen?',
-	'Are you sure you want to delete this user?' => 'Wet je zeker dat je deze gebrukiker wil verwijderen?',
-	'Are you sure you want to switch to this user for the rest of this Session?' => 'Weet je zeker dat je als deze gebruiker wil verder gaan voor deze sessie?',
-	'Are you sure you want to unblock this user?' => 'Weet je zeker dat je deze gebruiker wil activeren?',
-	'Are you sure you wish the user to change their password at next login?' => 'Weet je zeker dat de gebruiker zijn wachtwoord moet wijzigen bij de volgende keer dat deze inlogt?',
-	'Are you sure you wish to send a password recovery email to this user?' => 'Weet je zeker dat je een wachtwoord herstel-email naar deze gebruiker wil verzenden?',
-	'Are you sure? Deleted user can not be restored' => 'Weet je het zeker? Een verwijderde gebruiker kan niet worden hersteld!',
-	'Are you sure? There is no going back' => 'Weet je het zeker? Dit kan niet ongedaan gemaakt worden!',
-	'Assignments' => 'Toewijzingen',
-	'Assignments have been updated' => 'Toewijzingen zijn bijgewerkt',
-	'Auth item with such name already exists' => 'Auth item met deze naam bestaat al',
-	'Authentication rule class {0} can not be instantiated' => 'Authenticatie regel klasse {0} kan niet worden geïnstantieerd',
-	'Authorization item successfully created.' => 'Authorisatie item met succes aangemaakt',
-	'Authorization item successfully removed.' => 'Authorisatie item met succes verwijderd',
-	'Authorization item successfully updated.' => 'Authorisatie item met succes geüpdatet',
-	'Authorization rule has been added.' => 'Authorisatie regel werd toegevoegd',
-	'Authorization rule has been removed.' => 'Authorisatie regel werd verwijderd',
-	'Authorization rule has been updated.' => 'Authorisatie regel werd geüpdatet',
-	'Awesome, almost there. Now you need to click the confirmation link sent to your new email address.' => 'Super, bijna klaar. Open alleen nog de bevestigingslink in de mail die naar jouw nieuwe emailadres gestuurd is',
-	'Awesome, almost there. Now you need to click the confirmation link sent to your old email address.' => 'Super, bijna klaar. Open alleen nog de bevestigingslink in de mail die naar jouw oude emailadres gestuurd is',
-	'Back to privacy settings' => 'Terug naar privcay settings',
-	'Bio' => 'Biografie',
-	'Block' => 'Blokkeer',
-	'Block status' => 'Blokkering',
-	'Blocked at {0, date, MMMM dd, YYYY HH:mm}' => 'Geblokkeerd op {0, date, MMMM dd, YYYY HH:mm}',
-	'Cancel' => 'Annuleren',
-	'Cannot assign role \'{0}\' as the AuthManager is not configured on your console application.' => 'Kan rol {0} niet toewijzen doordat de AuthManager niet geconfigureerd is op de console-applicatie',
-	'Change your avatar at Gravatar.com' => 'Wijzig je avatar op Gravatar.com',
-	'Children' => 'Kinderen',
-	'Class' => 'Klasse',
-	'Close' => 'Sluiten',
-	'Complete password reset on {0}' => 'Voltooi het herstellen van je wachtwoord op {0}',
-	'Confirm' => 'Bevestig',
-	'Confirm account on {0}' => 'Bevestig account op {0}',
-	'Confirm email change on {0}' => 'Bevestig email-wijziging op {0}',
-	'Confirmation' => 'Bevestiging',
-	'Confirmation status' => 'Bevestigingsstatus',
-	'Confirmation time' => 'Tijdstip bevestiging',
-	'Confirmed' => 'Bevestigd',
-	'Confirmed at {0, date, MMMM dd, YYYY HH:mm}' => 'Bevestigd op {0, date, MMMM dd, YYYY HH:mm}',
-	'Connect' => 'Verbinden',
-	'Continue' => 'Verder',
-	'Create' => 'Maak aan',
-	'Create a user account' => 'Maak een gebruikersaccount aan',
-	'Create new permission' => 'Maak een nieuwe permissie aan',
-	'Create new role' => 'Maak een nieuw rol aan',
-	'Create new rule' => 'maak een nieuwe regel aan',
-	'Created at' => 'Gemaakt op',
-	'Credentials will be sent to the user by email' => 'Inloggevens worden via mail naar de gebruiker verzonden',
-	'Current password' => 'Huidig wachtwoord',
-	'Current password is not valid' => 'Huidig wachtwoord is niet geldig',
-	'Data processing consent' => 'Toestemming gegevensverwerking',
-	'Delete' => 'Verwijder',
-	'Delete account' => 'Verwijder account',
-	'Delete my account' => 'Verwijder mijn account',
-	'Delete personal data' => 'Verwijder mijn persoonlijke gegevens',
-	'Deleted by GDPR request' => 'Verwijderd vanwege mijn AVG verzoek',
-	'Description' => 'Omschrijving',
-	'Didn\'t receive confirmation message?' => 'Geen bevestigings-email ontvangen?',
-	'Disable two factor authentication' => '2 traps authenticatie uitschakelen',
-	'Disconnect' => 'Verbreek verbindig',
-	'Don\'t have an account? Sign up!' => 'Geen account? Meld je aan',
-	'Download my data' => 'Download mijn gegevens',
-	'Email' => 'Email',
-	'Email (public)' => 'Email (publiek)',
-	'Enable' => 'Schakel in',
-	'Enable two factor authentication' => 'Schakel 2 traps authenticatie in',
-	'Error occurred while changing password' => 'Fout bij wijzigen van het wachtwoord',
-	'Error occurred while confirming user' => 'Fout bij bevestigen van de gebruiker',
-	'Error occurred while deleting user' => 'Fout bij verwijderen van de gebruiker',
-	'Error sending registration message to \'{email}\'. Please try again later.' => 'Er is een fout opgetreden bij verzenden van de registratie-email naar \'{email}\'. Probeer later nog eens.',
-	'Error sending welcome message to \'{email}\'. Please try again later.' => 'Er is een fout opgetreden bij verzenden van de welkomst-email naar \'{email}\'. Probeer later nog eens.',
-	'Export my data' => 'Exporteer mijn gegevens',
-	'Finish' => 'beëindig',
-	'Force password change at next login' => 'Forceer wachtwoord-herstel bij volgende login',
-	'Forgot password?' => 'Wachtwoord vergeten?',
-	'Gravatar email' => 'Gravatar email',
-	'Hello' => 'Hallo',
-	'Here you can download your personal data in a comma separated values format.' => 'Hier kan je al jouw persoonlijke data downloaden in een komma-gescheiden formaat.',
-	'I agree processing of my personal data and the use of cookies to facilitate the operation of this site. For more information read our {privacyPolicy}' => 'Ik ga akkoord met het verwerken van mijn persoonlijke data en het gebruik van cookies om de werking van deze website te vergemakkelijken. Voor meer, lees onze {privacyPolicy}',
-	'If you already registered, sign in and connect this account on settings page' => 'Als je al geregistreerd bent, meldt je aan en verbind deze account via de instellingen pagina',
-	'If you cannot click the link, please try pasting the text into your browser' => 'Kopieer en plak deze tekst in jouw browser als je niet op deze link kan klikken',
-	'If you did not make this request you can ignore this email' => 'Als je deze aanvraag niet hebt gedaan kan je deze email negeren',
-	'Impersonate this user' => 'Ga verder als deze gebruiker',
-	'In order to complete your registration, please click the link below' => 'Klik op onderstaande link om je registratie te voltooien',
-	'In order to complete your request, please click the link below' => 'Klik op onderstaande link om je registratie te voltooien',
-	'In order to finish your registration, we need you to enter following fields' => 'De volgende velden moeten verplicht worden ingevuld voor je registrate',
-	'Information' => 'Informatie',
-	'Invalid login or password' => 'Ongeldige login of wachtwoord',
-	'Invalid or expired link' => 'Ongeldige of vervallen link',
-	'Invalid password' => 'Ongeldig wachtwoord',
-	'Invalid two factor authentication code' => 'Ongeldige 2 traps authenticatie code',
-	'Invalid value' => 'Ongeldige waarde',
-	'It will be deleted forever' => 'Het zal voor altijd verwijderd worden',
-	'Items' => 'Items',
-	'Joined on {0, date}' => 'Aangemeld op {0, date}',
-	'Last login IP' => 'Laatste login IP',
-	'Last login time' => 'Laatste login',
-	'Last password change' => 'Laatste wachtwoordwijziging',
-	'Location' => 'Locatie',
-	'Login' => 'Log in',
-	'Logout' => 'Log uit',
-	'Manage users' => 'Beheer gebruikers',
-	'Name' => 'Naam',
-	'Networks' => 'Netwerken',
-	'Never' => 'Nooit',
-	'New email' => 'Nieuwe email',
-	'New password' => 'Nieuw wachtwoord',
-	'New permission' => 'Nieuwe permissies',
-	'New role' => 'Nieuwe rol',
-	'New rule' => 'Nieuwe regel',
-	'New user' => 'Nieuwe gebruiker',
-	'Not blocked' => 'Niet geblokkeerd',
-	'Not found' => 'Niet gevonden',
-	'Once you delete your account, there is no going back' => 'Als je jouw account verwijdert kan dit niet ongedaan gemaakt worden',
-	'Once you have deleted your data, you will not longer be able to sign in with this account.' => 'Als je jouw data verwijdert is inloggen met deze account niet meer mogelijk.',
-	'Password' => 'Wachtwoord',
-	'Password age' => 'Ouderdeom wachtwoord',
-	'Password has been changed' => 'Wachtwoord is gewijzigd',
-	'Permissions' => 'Machtigingen',
-	'Please be certain' => 'Weet je het zeker?',
-	'Please click the link below to complete your password reset' => 'Klik op onderstaande link om je wachtwoordherstel te voltooien',
-	'Please fix following errors:' => 'Los de volgende fouten op:',
-	'Privacy' => 'Privacy',
-	'Privacy settings' => 'Privacy-instellingen',
-	'Profile' => 'Profiel',
-	'Profile details' => 'Profieldetails',
-	'Profile details have been updated' => 'Profieldetails werden geüpdatet',
-	'Profile settings' => 'Profiel-instellingen',
-	'Recover your password' => 'Herstel je wachtwoord',
-	'Recovery link is invalid or expired. Please try requesting a new one.' => 'Herstel-link is ongeldig of vervallen. Vraag een nieuwe aan',
-	'Recovery message sent' => 'Herstelbericht is verzonden',
-	'Registration IP' => 'Registratie IP',
-	'Registration on this website is disabled' => 'Registratie is gedeactiveerd op deze website',
-	'Registration time' => 'Registratietijdstip',
-	'Remember me next time' => 'Onthoud mij',
-	'Request new confirmation message' => 'Vraag een nieuw bevestigingsbericht aan',
-	'Required \'key\' cannot be empty.' => 'Verplicht veld \'key\' kan niet leeg zijn.',
-	'Required \'secret\' cannot be empty.' => 'Verplicht veld \'geheim\' kan niet leeg zijn.',
-	'Reset your password' => 'Reset jouw wachtwoord',
-	'Role \'{0}\' not found. Creating it.' => 'Rol \'{0}\' kan niet worden gevonden. Het wordt aangemaakt',
-	'Roles' => 'Rollen',
-	'Rule' => 'Regel',
-	'Rule class must extend \'yii\rbac\Rule\'.' => 'Regel class moet \'yii\rbac\Rule\' extenden.',
-	'Rule name' => 'Regel naam',
-	'Rule name {0} is already in use' => 'Regel met naam \'{0}\' is al in gebruik',
-	'Rule {0} does not exists' => 'Regel {0} bestaat niet',
-	'Rule {0} not found.' => 'Regel {0} werd niet gevonden',
-	'Rules' => 'Regels',
-	'Save' => 'Opslaan',
-	'Scan the QrCode with Google Authenticator App, then insert its temporary code on the box and submit.' => 'Scan de QR coe met Google Authenticator (of vergelijkbare app), voer de tijdelijke code in en klik op verzenden.',
-	'Send password recovery email' => 'Verzend wachtwoord herstel-email',
-	'Sign in' => 'Aanmelden',
-	'Sign up' => 'Registreren',
-	'Something went wrong' => 'Er ging iets mis',
-	'Switch identities is disabled.' => 'Identiteit-wisselen is niet ingeschakeld',
-	'Thank you for signing up on {0}' => 'Bedankt voor je registratie op {0}',
-	'Thank you, registration is now complete.' => 'Bedankt, je registratie is voltooid.',
-	'The \'recaptcha\' component must be configured.' => 'De \'recaptcha\' component moet worden geconfigureerd.',
-	'The confirmation link is invalid or expired. Please try requesting a new one.' => 'De bevestigingslink is ongeldig of verlopen. Vraag een nieuwe aan.',
-	'The verification code is incorrect.' => 'De bevestigingscode is ongeldig',
-	'There is neither role nor permission with name \'{0}\'' => 'Er is geen rol of machtiging met de naam \'{0}\'',
-	'There was an error in saving user' => 'Er was een fout bij het opslaan van de gebruiker',
-	'This account has already been connected to another user' => 'Dit account is al verbonden met een andere gebruiker',
-	'This email address has already been taken' => 'Dit emailadres is al in gebruik',
-	'This username has already been taken' => 'Deze gebruikersnaam is al in gebruik',
-	'This will disable two factor authentication. Are you sure?' => 'Dit zal de 2 traps authenticatie uitschakelen. Ben je zeker?',
-	'This will remove your personal data from this site. You will no longer be able to sign in.' => 'Dit zal jouw persoonlijke data van de website wissen. Je zal niet langer kunnen inloggen.',
-	'Time zone' => 'Tijdzone',
-	'Time zone is not valid' => 'Tijdzone is niet geldig',
-	'Two Factor Authentication (2FA)' => '2 traps authenticatie (2FA)',
-	'Two factor authentication code' => '2 traps authenticatie code',
-	'Two factor authentication has been disabled.' => '2 traps authenticatie is uitgeschakeld',
-	'Two factor authentication protects you against stolen credentials' => '2 traps authenticatie beschermt je tegen gestolen inloggegevens',
-	'Two factor authentication successfully enabled.' => '2 traps authenticatie met succes ingeschakeld',
-	'Unable to confirm user. Please, try again.' => 'Kan de gebruiker niet bevestigen. Probeer opnieuw.',
-	'Unable to create an account.' => 'Kan geen account aanmaken.',
-	'Unable to create authorization item.' => 'Kan geen authorisatie-item aanmaken',
-	'Unable to create new authorization rule.' => 'Kan geen authorisatieregel aanmaken',
-	'Unable to delete user. Please, try again later.' => 'Kan de gebruiker niet wissen. Probeer later opnieuw.',
-	'Unable to disable Two factor authentication.' => 'Kan de 2 traps authenticatie niet uitschakelen.',
-	'Unable to remove authorization item.' => 'Kan het authorisatie item niet wissen.',
-	'Unable to send confirmation link' => 'Kan de bevestigingsmail niet versturen',
-	'Unable to send recovery message to the user' => 'Kan de herstel-mail niet naar de gebruiker versturen',
-	'Unable to update authorization item.' => 'Kan het authorisatie-item niet aanpassen.',
-	'Unable to update authorization rule.' => 'Kan de authorisatieregel niet aanpassen.',
-	'Unable to update block status.' => 'Kan de geblokkeerstatus niet aanpassen',
-	'Unblock' => 'Maak actief',
-	'Unconfirmed' => 'Niet bevestigd',
-	'Update' => 'Update',
-	'Update assignments' => 'Update toewijzingen',
-	'Update permission' => 'Update machtigingen',
-	'Update role' => 'Update rol',
-	'Update rule' => 'Update regel',
-	'Update user account' => 'Update gebruikersaccount',
-	'Updated at' => 'geüpdatet op',
-	'User account could not be created.' => 'Gebruikers-account kan niet worden aangemaakt.',
-	'User block status has been updated.' => 'Blokkering gebruiker is aangepast.',
-	'User could not be registered.' => 'Gebruiker kan niet worden geregistreerd.',
-	'User has been confirmed' => 'Gebruiker is bevestigd',
-	'User has been created' => 'Gebruiker is aangemaakt',
-	'User has been deleted' => 'Gebruiker is verwijderd',
-	'User is not found' => 'Gebruiker niet gevonden',
-	'User not found.' => 'Gebruiker niet gevonden',
-	'User will be required to change password at next login' => 'Gebruiker zal verplicht worden zijn wachtwoord aan te passen bij volgende login',
-	'Username' => 'Gebruikersnaam',
-	'Users' => 'Gebruikers',
-	'VKontakte' => 'VKontakte',
-	'Verification failed. Please, enter new code.' => 'Bevestiging mislukt. Geef een nieuwe code op.',
-	'We couldn\'t re-send the mail to confirm your address. Please, verify is the correct email or if it has been confirmed already.' => 'Het was niet mogelijk een email te sturen om je adres te bevestigen. Controleer het email-adres en controleer of het niet al bevestigd is.',
-	'We have generated a password for you' => 'Er is een wachtwoord voor je ingesteld',
-	'We have received a request to change the email address for your account on {0}' => 'We ontvingen een aanvraag om het email-adres te wijzigen voor je account op {0}',
-	'We have received a request to reset the password for your account on {0}' => 'Wij ontvingen een aanvraag om je wachtwoord te herstellen voor je account op {0}',
-	'We have sent confirmation links to both old and new email addresses. You must click both links to complete your request.' => 'Er is een bevestigingslink naar zowel je oude als je nieuwe email adres gestuurd. Je moet beiden links openen om de aanvraag te voltooien.',
-	'Website' => 'Website',
-	'Welcome to {0}' => 'Welkom bij {0}',
-	'Yandex' => 'Yandex',
-	'You are about to delete all your personal data from this site.' => 'Je staat op het punt om al je persoonlijke gegevens te wissen van deze website',
-	'You can assign multiple roles or permissions to user by using the form below' => 'Je kan meerdere rollen of machtigingen toewijzen aan de gebruiker doormiddel van onderstaand formulier',
-	'You can connect multiple accounts to be able to log in using them' => 'Je kan meerdere accounts verbinden om met deze accounts in te loggen',
-	'You cannot remove your own account' => 'Je kan je eigen account niet verwijderen.',
-	'You need to confirm your email address' => 'Je moet je email-adres nog bevestigen',
-	'Your account details have been updated' => 'Je account-details werden bijgewerkt',
-	'Your account has been blocked' => 'Je account is geblokkeerd',
-	'Your account has been blocked.' => 'Je account is geblokkeerd.',
-	'Your account has been completely deleted' => 'Je account is volledig verwijderd',
-	'Your account has been connected' => 'Je account is verbonden',
-	'Your account has been created' => 'Je account is aangemaakt',
-	'Your account has been created and a message with further instructions has been sent to your email' => 'Je account is aangemaakt en een bericht met verdere instructies is naar je e-mailadres verzonden',
-	'Your account on {0} has been created' => 'Je account op {0} is aangemaakt',
-	'Your confirmation token is invalid or expired' => 'Je bevestigingscode is ongeldig of verlopen',
-	'Your consent is required to register' => 'Je moet akkoord gaan met je toestemming om te registreren',
-	'Your email address has been changed' => 'Je email adres werd gewijzigd',
-	'Your password has expired, you must change it now' => 'Je wachtwoord is verlopen. Het moet nu gewijzigd worden',
-	'Your personal information has been removed' => 'Je persoonlijke gegevens zijn verwijderd',
-	'Your profile has been updated' => 'Je profiel is bijgewerkt',
-	'privacy policy' => 'privacy policy',
-	'{0, date, MMMM dd, YYYY HH:mm}' => '{0, date, dd MMMM, YYYY HH:mm}',
-	'{0} cannot be blank.' => '{0} kan niet leeg zijn.',
-];

src/User/resources/i18n/pl/usuario.php

@@ -298,24 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'An email has been sent with instructions for resetting your password' => '@@Email z instrukcją resetowania hasła został wysłany@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Disable Two-Factor Auth' => '@@Wyłącz uwierzytelnianie dwuetapowe@@',
-    'Enable Two-factor auth' => '@@Włącz uwierzytelnianie dwuetapowe@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Nieprawidłowy kod uwierzytelniania dwuetapowego@@',
-    'Last login' => '@@Data ostatniego logowania@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'This will disable two-factor auth. Are you sure?' => '@@To wyłączy uwierzytelnianie dwuetapowe. Czy jesteś pewny?@@',
-    'Two Factor Authentication' => '@@Uwierzytelnianie dwuetapowe@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Uwierzytelnianie dwuetapowe chroni Cię przed kradzieżą danych logowania@@',
-    'Two factor successfully enabled.' => '@@Dwuetapowe uwierzytelnianie poprawnie włączone.@@',
-    'Two-Factor Authentication' => '@@Uwierzytelnianie dwuetapowe@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Uwierzytelnianie dwuetapowe chroni Cię przed kradzieżą danych logowania@@',
-    'Two-factor authentication code' => '@@Kod uwierzytelniania dwuetapowego@@',
-    'Two-factor authorization has been disabled.' => '@@Dwuetapowa autoryzacja została wyłączona.@@',
-    'Two-factor code' => '@@Kod dwuetapowy@@',
-    'Unable to disable two-factor authorization.' => '@@Nie można wyłączyć dwuetapowej autoryzacji.@@',
 ];

src/User/resources/i18n/pt-BR/usuario.php

@@ -298,35 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@Uma mensagem foi enviada para o seu endereço de e-mail.@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'An email has been sent with instructions for resetting your password' => '@@Um e-mail foi enviado com instruções para redefinir sua senha@@',
-    'Awesome, almost there. ' => '@@Incrível, quase lá.@@',
-    'Class "{0}" does not exist' => '@@A classe "{0}" não existe@@',
-    'Disable Two-Factor Auth' => '@@Desabilitar autenticação em dois fatores@@',
-    'Enable Two-factor auth' => '@@Habilitar autenticação em dois fatores@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'I aggree processing of my personal data and the use of cookies
-            to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Concordo com o processamento de meus dados pessoais e o uso de cookies para facilitar a operação deste site. Para mais informações, leia nosso {privacyPolicy}@@',
-    'I aggree processing of my personal data and the use of cookies to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Concordo com o processamento de meus dados pessoais e o uso de cookies para facilitar a operação deste site. Para mais informações, leia nosso {privacyPolicy}@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Código de dois fatores inválido@@',
-    'Last login' => '@@Último login@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Registration ip' => '@@IP de registro@@',
-    'Rule class can not be instantiated' => '@@A classe de regras não pode ser instanciada@@',
-    'Rule class must extend "yii\\rbac\\Rule"' => '@@A classe de regras deve estender de "yii\\rbac\\Rule"@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Isso desativará a autenticação de dois fatores. Você tem certeza?@@',
-    'Two Factor Authentication' => '@@Autenticação de dois fatores@@',
-    'Two factor authentication protects you against stolen credentials' => '@@A autenticação de dois fatores protege você contra credenciais roubadas@@',
-    'Two factor successfully enabled.' => '@@Dois fatores habilitados com sucesso.@@',
-    'Two-Factor Authentication' => '@@Autenticação de dois fatores@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Autenticação de dois fatores protege você contra credenciais roubadas@@',
-    'Two-factor authentication code' => '@@Código de autenticação de dois fatores@@',
-    'Two-factor authorization has been disabled.' => '@@A autorização de dois fatores foi desabilitada.@@',
-    'Two-factor code' => '@@Código de dois fatores@@',
-    'Unable to disable two-factor authorization.' => '@@Não é possível desabilitar a autorização de dois fatores.@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@Não poderíamos re-enviar o correio para confirmar o seu endereço.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@Enviamos links de confirmação para endereços de e-mail antigo e novo.@@',
 ];

src/User/resources/i18n/pt-PT/usuario.php

@@ -298,9 +298,5 @@ return [
     'Your two factor authentication method is based on "{0}".' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/ro/usuario.php

@@ -298,31 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@A fost trimis un mesaj la adresa dvs. de e-mail.@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'An email has been sent with instructions for resetting your password' => '@@A fost trimis un e-mail cu instrucțiuni pentru resetarea parolei@@',
-    'Awesome, almost there. ' => '@@Minunat, aproape gata.@@',
-    'Disable Two-Factor Auth' => '@@Dezactivați autentificarea cu două factori@@',
-    'Enable Two-factor auth' => '@@Activați Auth@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'I aggree processing of my personal data and the use of cookies
-            to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Am agregat prelucrarea datelor mele personale și utilizarea cookie-urilor pentru a facilita funcționarea acestui site. Pentru mai multe informații, citiți {privacyPolicy}@@',
-    'I aggree processing of my personal data and the use of cookies to facilitate the operation of this site. For more information read our {privacyPolicy}' => '@@Am agregat prelucrarea datelor mele personale și utilizarea cookie-urilor pentru a facilita funcționarea acestui site. Pentru mai multe informații, citiți {privacyPolicy}@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Cod de două factori nevalid@@',
-    'Last login' => '@@Ultima logare@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Aceasta va dezactiva auth-ul cu două factori. Esti sigur?@@',
-    'Two Factor Authentication' => '@@Două autentificare cu factori@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Autentificarea cu două factori vă protejează împotriva acreditărilor furate@@',
-    'Two factor successfully enabled.' => '@@Doi factori activat cu succes.@@',
-    'Two-Factor Authentication' => '@@Două factori de autentificare@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Autostradă cu două factori vă protejează împotriva acreditărilor furate@@',
-    'Two-factor authentication code' => '@@Cod de autentificare cu două factori@@',
-    'Two-factor authorization has been disabled.' => '@@A fost dezactivată autorizația cu două factori.@@',
-    'Two-factor code' => '@@Cod de două factori@@',
-    'Unable to disable two-factor authorization.' => '@@Imposibil de dezactivat autorizația cu două factori.@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@Nu am putut retrimite mesajul pentru a vă confirma adresa.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@Am trimis legături de confirmare adreselor de e-mail vechi și noi.@@',
 ];

src/User/resources/i18n/ru/usuario.php

@@ -298,32 +298,5 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
-    'A message has been sent to your email address. ' => '@@Сообщение было отправлено на вашу электронную почту@@',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
-    'An email has been sent with instructions for resetting your password' => '@@Вам отправлено письмо с инструкциями по смене пароля@@',
-    'Awesome, almost there. ' => '@@Замечательно, почти готово!@@',
-    'Class "{0}" does not exist' => '@@Класс "{0}" не найден@@',
-    'Disable Two-Factor Auth' => '@@Отключить двухфакторную авторизацию@@',
-    'Enable Two-factor auth' => '@@Включить двухфакторную авторизацию@@',
-    'Every user having your role has two factor authentication mandatory, you must enable it' => '@@@@',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Invalid two-factor code' => '@@Неверный код двухфакторной авторизации@@',
-    'Last login' => '@@Последний вход@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Registration ip' => '@@IP при регистрации@@',
-    'Rule class can not be instantiated' => '@@Класс правила не может быть создан@@',
-    'Rule class must extend "yii\\rbac\\Rule"' => '@@Класс правила должен наследоваться от "yii\\rbac\\Rule"@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Вы уверены, что хотите отключить двухфакторную авторизацию?@@',
-    'Two Factor Authentication' => '@@Двухфакторная авторизация@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Двухфакторная авторизация защитит вас от кражи параметров доступа@@',
-    'Two factor successfully enabled.' => '@@Включена двухфакторная авторизация.@@',
-    'Two-Factor Authentication' => '@@Двухфакторная авторизация@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Двухфакторная авторизация предотвращает кражу ваших данных для входа.@@',
-    'Two-factor authentication code' => '@@Код двухфакторной авторизации@@',
-    'Two-factor authorization has been disabled.' => '@@Двухфакторная авторизация отключена.@@',
-    'Two-factor code' => '@@Код двухфакторной авторизации@@',
-    'Unable to disable two-factor authorization.' => '@@Не удалось отключить двухфакторную авторизацию.@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@Мы не можем повторно отправить письмо для подтверждения вашего адреса электронной почты.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@Мы отправили письма на ваш старый и новый почтовые ящики. Вы должны перейти по обеим, чтобы завершить процесс смены адреса.@@',
 ];

src/User/resources/i18n/th/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/tr-TR/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/uk/usuario.php

@@ -298,6 +298,7 @@ return [
     'Unfortunately, you can not work with this site without giving us consent to process your data.' => '',
     'Your consent is required to work with this site' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'A message has been sent to your email address. ' => '@@На вашу електронну адресу надіслано повідомлення@@',
     'An email has been sent with instructions for resetting your password' => '@@Лист з інструкціями по зміні пароля надіслано на електронну адресу@@',
     'Awesome, almost there. ' => '@@Чудово, майже все.@@',
@@ -311,20 +312,4 @@ return [
     'Insert the mobile phone number where you want to receive text message.' => '@@@@',
     'Invalid two-factor code' => '@@Невірний код двофакторної авторизації@@',
     'Last login' => '@@Останній вхід@@',
-    'Mobile phone number not registered.' => '@@@@',
-    'Registration ip' => '@@IP реєстрації@@',
-    'Rule class can not be instantiated' => '@@Клас Правила не може бути ініційований@@',
-    'Rule class must extend "yii\\rbac\\Rule"' => '@@Клас Правила має розширювати "yii\\rbac\\Rule"@@',
-    'This will disable two-factor auth. Are you sure?' => '@@Це вимкне двофакторну аутентифікацію. Ви впевнені?@@',
-    'Two Factor Authentication' => '@@Двофакторна аутентифікація@@',
-    'Two factor authentication protects you against stolen credentials' => '@@Двофакторна аутентифікація дає Вам додатковий захист даних авторизації@@',
-    'Two factor successfully enabled.' => '@@Двофакторна аутентифікація успішно підключена@@',
-    'Two-Factor Authentication' => '@@Двофакторна аутентифікація@@',
-    'Two-factor auth protects you against stolen credentials' => '@@Двофакторна аутентифікація дає Вам додатковий захист даних авторизації@@',
-    'Two-factor authentication code' => '@@Код двофакторної аутентифікації@@',
-    'Two-factor authorization has been disabled.' => '@@Двофакторна аутентифікація відключена@@',
-    'Two-factor code' => '@@Двофакторний код@@',
-    'Unable to disable two-factor authorization.' => '@@Неможливо відключити двофакторну авторизацію.@@',
-    'We couldn\'t re-send the mail to confirm your address. ' => '@@Ми не змогли надіслати email для підтвердження Вашої електронної адреси.@@',
-    'We have sent confirmation links to both old and new email addresses. ' => '@@Ми надіслали повідомлення з підтверджуючими посиланнями на обидві Ваші електронні адреси: стару і нову.@@',
 ];

src/User/resources/i18n/vi/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

src/User/resources/i18n/zh-CN/usuario.php

@@ -294,12 +294,9 @@ return [
     'Your personal information has been removed' => '',
     'Your profile has been updated' => '',
     'Your two factor authentication method is based on "{0}".' => '',
+    'Your role requires 2FA, you won\'t be able to use the application until you enable it' => '',
     'privacy policy' => '',
     '{0, date, MMM dd, YYYY HH:mm}' => '',
     '{0, date, MMMM dd, YYYY HH:mm}' => '',
     '{0} cannot be blank.' => '',
-    'Insert the mobile phone number on which to receive text message.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message in international format.' => '@@@@',
-    'Insert the mobile phone number where you want to receive text message.' => '@@@@',
-    'Mobile phone number not registered.' => '@@@@',
 ];

tests/_app/config/test.php

@@ -1,5 +1,7 @@
 <?php
 
+use Da\User\Filter\TwoFactorAuthenticationEnforceFilter;
+
 return [
     'id' => 'yii2-user-tests',
     'basePath' => dirname(__DIR__),
@@ -47,4 +49,12 @@ return [
         ],
     ],
     'params' => [],
+    'on beforeAction' => function() {
+        Yii::$app->controller->attachBehavior(
+            'enforceTwoFactorAuthentication',[
+                'class' => TwoFactorAuthenticationEnforceFilter::class,
+                'except' => ['login', 'logout','account','two-factor', 'two-factor-enable'],
+            ]
+        );
+    },
 ];

tests/_fixtures/AssignmentFixture.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace tests\_fixtures;
+
+use yii\test\ActiveFixture;
+
+class AssignmentFixture extends ActiveFixture
+{
+    public $modelClass = 'Da\User\Model\Assignment';
+    public $tableName = 'auth_assignment';
+}

tests/_fixtures/PermissionFixture.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace tests\_fixtures;
+
+use yii\test\ActiveFixture;
+
+class PermissionFixture extends ActiveFixture
+{
+    public $modelClass = 'Da\User\Model\Permission';
+    public $tableName = 'auth_item';
+}

tests/_fixtures/data/auth_assignment.php

@@ -0,0 +1,8 @@
+<?php
+
+return [
+    'auth_assignment' => [
+        'item_name' => 'admin',
+        'user_id' => '1',
+    ],
+];

tests/_fixtures/data/auth_item.php

@@ -0,0 +1,9 @@
+<?php
+
+return [
+    'auth_item' => [
+        'name' => 'admin',
+        'type' => 1,
+        'description' => 'test admin',
+    ],
+];

tests/_fixtures/data/user.php

@@ -73,4 +73,17 @@ return [
         'updated_at' => $time,
         'confirmed_at' => $time,
     ],
+    'user_with_2fa_enabled' => [
+        'id' => 7,
+        'username' => 'user2fa',
+        'email' => 'user2faenabled@example.com',
+        'password_hash' => '$2y$13$qY.ImaYBppt66qez6B31QO92jc5DYVRzo5NxM1ivItkW74WsSG6Ui',
+        'auth_key' => '39HU0m5lpjWtqstFVGFjj6lFb7UZDeRq',
+        'auth_tf_key' => '',
+        'auth_tf_enabled' => true,
+        'created_at' => $time,
+        'updated_at' => $time,
+        'confirmed_at' => $time,
+        'gdpr_consent' => false,
+    ],
 ];

tests/functional/TwoFactorAuthenticationCept.php

@@ -0,0 +1,55 @@
+<?php
+
+/**
+ * @var Codeception\Scenario
+ */
+
+use tests\_fixtures\UserFixture;
+use tests\_fixtures\PermissionFixture;
+use tests\_fixtures\AssignmentFixture;
+use tests\_fixtures\ProfileFixture;
+
+
+$I = new FunctionalTester($scenario);
+$I->wantTo('ensure that two factor authentication check works');
+$I->haveFixtures(['user' => UserFixture::className()]);
+$I->haveFixtures(['permission' => PermissionFixture::className()]);
+$I->haveFixtures(['assignment' => AssignmentFixture::className()]);
+
+$I->amGoingTo('try to login with user having two factor authentication enabled');
+Yii::$app->getModule('user')->enableTwoFactorAuthentication = true;
+$I->amOnRoute('/user/security/login');
+$user = $I->grabFixture('user', 'user_with_2fa_enabled');
+$I->fillField('#loginform-login', $user->email);
+$I->fillField('#loginform-password', 'qwerty');
+$I->click('Sign in');
+$I->expectTo('See form to insert two factor authentication code');
+$I->see('Two factor authentication code');
+
+
+$I->amGoingTo('try to login with user permission admin, having two factor authentication disabled');
+Yii::$app->getModule('user')->enableTwoFactorAuthentication = true;
+Yii::$app->getModule('user')->twoFactorAuthenticationForcedPermissions = ['admin'];
+$I->haveFixtures(['user' => UserFixture::className(), 'profile' => ProfileFixture::className()]);
+$I->amOnRoute('/user/security/login');
+$user = $I->grabFixture('user', 'user');
+$I->fillField('#loginform-login', $user->email);
+$I->fillField('#loginform-password', 'qwerty');
+$I->click('Sign in');
+$I->expectTo('The user must be forced to enable two factor authentication');
+$I->see('Your role requires 2FA, you won\'t be able to use the application until you enable it');
+Yii::$app->user->logout();
+
+$I->amGoingTo('try to login with correct credentials when two factor authentication is disabled on the module');
+Yii::$app->getModule('user')->enableTwoFactorAuthentication = false;
+$I->amOnRoute('/user/security/login');
+$I->amGoingTo('try to login with correct credentials');
+$user = $I->grabFixture('user', 'user');
+$I->fillField('#loginform-login', $user->email);
+$I->fillField('#loginform-password', 'qwerty');
+$I->click('Sign in');
+$I->dontSee('Login');
+$I->see('Logout');
+
+
+