Tips for organizing authorization in rest applications on yii2?

Question

Yii

Good day.
I would like to hear the opinion of experienced developers on the following issues:

1. Let's say I have a users api. Should I use the controller of this api for authorization / registration, or should I make an authorization module in addition to the rest modules?
   
2. The next question, more about the architecture itself: is it worth separating the user model into <model for database> and <model with identity interface>?
   

Although the project is small (spa, yii2 + vue), I would like to do everything right from the beginning.
Thank you for your attention. And I apologize if the questions are poorly worded.

Answer 1

Auth0 to help you and rbac on the server

Answer 2

make in addition to rest-modules also an authorization module

sounds weird. If you have rest, then you need to somehow implement user storage in it. That is, with some of the requests, it will be necessary to send authorization data. I don’t understand what a separate module will give you?
Why and most importantly how? You will store users out of a DB?

Answer 3

1. If the project is small, then I see no reason to bother with creating a separate module.
2. I think it should be divided. In the future, it will save you from the problem of littering the code.