WordPress Yii2 User Authentication Support

wp-yii2-user-authentication.php

<?php

/*

This will enable user authentication if you migrated the user/pass from yii database to the wordpress db
So you can support both wordpress standard users authentication and your previous yii2 users
*/

add_filter( 'authenticate', function( $user, $username, $password ) {
  
  $cost = 13; // default cost value, change if you have it different
  
  if ( $user instanceof WP_User ) {
		return $user;
	}

    if ( empty( $username ) && empty( $password ) ) {
        if ( is_wp_error( $user ) ) {
			return $user;
		}
        return new WP_Error(
			'invalid_username',
			__( 'Unknown username. Check again or try your email address.' )
		);
    }

    $user = get_user_by( 'login', $username );
    if ( !$user && is_email( $username ) ) {
          $user = get_user_by( 'email', $username );
    }

    if ( !$user ) {
        return new WP_Error(
            'invalid_username',
            __( 'Unknown username. Check again or try your email address.' )
        );
    }

    $user = apply_filters( 'wp_authenticate_user', $user, $password );
    if ( is_wp_error( $user ) ) {
      return $user;
    }

    
    
    $rand = random_bytes( 20 );
    // Form the prefix that specifies Blowfish (bcrypt) algorithm and cost parameter.
    $salt = sprintf( '$2y$%02d$', $cost );
    // Append the random salt data in the required base64 format.
    $salt .= str_replace( '+', '.', substr( base64_encode( $rand ), 0, 22 ) );
    
    $hash = $user->user_pass;
    if ( !preg_match('/^\$2[axy]\$(\d\d)\$[\.\/0-9A-Za-z]{22}/', $hash, $matches)
        || $matches[1] < 4
        || $matches[1] > 30
    ) {
        return new WP_Error(
            'incorrect_password',
            __( 'Unknown password. Check with the system administartor.' )
        );
    }
    
    if ( function_exists( 'password_verify' ) )
        if ( password_verify( $password, $hash ) ) return( $user );
        else return new WP_Error(
            'incorrect_password',
            __( 'Unknown password. Check with the system administartor.' )
        );
    }
    
    $test = crypt( $password, $hash );
    $n = strlen( $test );
    if ( $n !== 60 ) {
        return new WP_Error(
            'incorrect_password',
            __( 'Unknown password. Check with the system administartor.' )
        );
    }
           
    if ( $user->user_pass !== $test ) {
      return new WP_Error(
        'incorrect_password',
        sprintf(
          /* translators: %s: Email address. */
          __( '<strong>Error</strong>: The password you entered for the email address %s is incorrect.' ),
          '<strong>' . $email . '</strong>'
        ) .
        ' <a href="' . wp_lostpassword_url() . '">' .
        __( 'Lost your password?' ) .
        '</a>'
		  );
    }
  
    return( $user );
}, 50, 3);