Все контроллеры переведены на использование jwt токенов

api/controllers/AuthenticationController.php

@@ -4,11 +4,15 @@ namespace api\controllers;
 use api\models\LoginForm;
 use Yii;
 use yii\filters\AccessControl;
+use yii\helpers\ArrayHelper;
 
 class AuthenticationController extends Controller {
 
     public function behaviors() {
-        return array_merge(parent::behaviors(), [
+        return ArrayHelper::merge(parent::behaviors(), [
+            'authenticator' => [
+                'except' => ['login'],
+            ],
             'access' => [
                 'class' => AccessControl::class,
                 'rules' => [

api/controllers/Controller.php

@@ -3,6 +3,7 @@ namespace api\controllers;
 
 use api\traits\ApiNormalize;
 use Yii;
+use yii\filters\auth\HttpBearerAuth;
 
 /**
  * @property \common\models\Account|null $account
@@ -12,8 +13,15 @@ class Controller extends \yii\rest\Controller {
 
     public function behaviors() {
         $parentBehaviors = parent::behaviors();
+        // Добавляем авторизатор для входа по jwt токенам
+        $parentBehaviors['authenticator'] = [
+            'class' => HttpBearerAuth::className(),
+        ];
+
         // xml нам не понадобится
         unset($parentBehaviors['contentNegotiator']['formats']['application/xml']);
+        // rate limiter здесь не применяется
+        unset($parentBehaviors['rateLimiter']);
 
         return $parentBehaviors;
     }

api/controllers/OauthController.php

@@ -14,13 +14,17 @@ use yii\helpers\ArrayHelper;
 class OauthController extends Controller {
 
     public function behaviors() {
-        return array_merge(parent::behaviors(), [
+        return ArrayHelper::merge(parent::behaviors(), [
+            'authenticator' => [
+                'except' => ['validate', 'issue-token'],
+            ],
             'access' => [
                 'class' => AccessControl::class,
                 'rules' => [
                     [
                         'actions' => ['validate', 'issue-token'],
                         'allow' => true,
+                        'roles' => ['?'],
                     ],
                     [
                         'actions' => ['complete'],

api/controllers/SignupController.php

@@ -5,11 +5,15 @@ use api\models\ConfirmEmailForm;
 use api\models\RegistrationForm;
 use Yii;
 use yii\filters\AccessControl;
+use yii\helpers\ArrayHelper;
 
 class SignupController extends Controller {
 
     public function behaviors() {
-        return array_merge(parent::behaviors(), [
+        return ArrayHelper::merge(parent::behaviors(), [
+            'authenticator' => [
+                'except' => ['register', 'confirm'],
+            ],
             'access' => [
                 'class' => AccessControl::class,
                 'rules' => [

tests/codeception/api/functional/_steps/AccountSteps.php

@@ -11,6 +11,9 @@ class AccountSteps extends FunctionalTester {
         $route = new LoginRoute($I);
         $route->login('Admin', 'password_0');
         $I->canSeeResponseIsJson();
+        $I->canSeeResponseJsonMatchesJsonPath('$.jwt');
+        $jwt = $I->grabDataFromResponseByJsonPath('$.jwt')[0];
+        $I->amBearerAuthenticated($jwt);
     }
 
 }