Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/DanielRivera03/SistemaBancario/llms.txt

Use this file to discover all available pages before exploring further.

CashMan H.A. uses native PHP sessions as its sole authentication state mechanism. Every request that enters controlador/cGestionesCashman.php must carry a valid session populated at login — there are no tokens or external session stores. Each protected route individually inspects $_SESSION['id_rol'] before serving any content, ensuring that a user who guesses or crafts a URL for a different role is immediately bounced to the system redirect page.

​
Session Variables

The following variables are written to $_SESSION immediately after IniciarSesionUsuarios() returns a successful result. They remain active for the entire authenticated session.
Session KeyTypeDescription
$_SESSION['id_usuario']intUnique user ID
$_SESSION['nombre_usuario']stringFirst name
$_SESSION['apellido_usuario']stringLast name
$_SESSION['usuario_unico']stringUnique username / account code
$_SESSION['id_rol']intRole ID (1–5)
$_SESSION['correo_usuario']stringEmail address
$_SESSION['foto_perfil']stringProfile photo filename
$_SESSION['estado_usuario']stringAccount status (activo / inactivo / bloqueado)
$_SESSION['comprobar_iniciosesion_primeravez']stringFirst-login flag — marks whether this is the user’s first session
$_SESSION['habilitar_sistema']stringCredit/system access flag — controls whether a client’s credit has been approved
$_SESSION['comprobacioncuenta_ahorros']stringSavings account existence flag
$_SESSION['comprobacioncreditos_clientes']stringActive credit existence flag

​
Role Guard Pattern

Every route case inside cGestionesCashman.php wraps its logic in a strict role check against $_SESSION['id_rol']. If the session role does not match the required value, the request is unconditionally redirected to the system redirect page — no content is rendered and no queries are executed. 
case "inicioadministradores":
    if ($_SESSION['id_rol'] == 1) {
        // load admin dashboard
    } else {
        header('location:cGestionesCashman.php?cashmanhagestion=redirecciones-sistema-cashmanha');
    }
    break;
This pattern is repeated for every protected route. The redirect destination ?cashmanhagestion=redirecciones-sistema-cashmanha serves a generic “access denied” page and does not expose which resource was requested.

​
Logout

The logout route is ?cashmanha=cerrarsesion in cIniciosSesionesUsuarios.php. It calls session_unset() to clear all session variables, then session_destroy() to invalidate the session ID on the server, and finally redirects to the login page: 
case "cerrarsesion":
    session_unset();
    session_destroy();
    header('location:cIniciosSesionesUsuarios.php?cashmanha=iniciarsesion');
    break;
There is no “remember session” mechanism — logout is always immediate and complete.

​
Session Expiration for Password Recovery

During the password recovery flow, two additional session keys track the time window for code validity:
  • $_SESSION['expirar_sesion']
  • $_SESSION['tiempo_sesion']
These are cleaned up explicitly — via unset() before session_unset() / session_destroy() — on any route that terminates the recovery flow: ?cashmanha=expiracion-cambio-contrasenia, ?cashmanha=confirmacion-cambio-contrasenia, and ?cashmanha=error-cambio-contrasenia. This prevents stale timer state from persisting if a user starts a new recovery flow without completing the previous one.
For production deployments, harden session cookies by configuring the following flags in php.ini or at runtime with session_set_cookie_params() before calling session_start():
session_set_cookie_params([
    'httponly' => true,   // prevent JavaScript access to the session cookie
    'secure'   => true,   // transmit only over HTTPS
    'samesite' => 'Strict' // block cross-site request forgery vectors
]);
session_start();
These settings are not applied by default in the codebase and should be added before going live.

Build docs developers (and LLMs) love

Get started for freeTalk to us