Documentation Index
Fetch the complete documentation index at: https://mintlify.com/DanielRivera03/SistemaBancario/llms.txt
Use this file to discover all available pages before exploring further.
CashMan H.A. uses a GET-parameter front-controller pattern. Two query parameters serve as routing tokens: ?cashmanha= for pre-login/authentication routes handled by cIniciosSesionesUsuarios.php, and ?cashmanhagestion= for post-login application routes handled by cGestionesCashman.php. Every incoming request is dispatched through a PHP switch statement keyed on the value of the relevant parameter — unknown values fall through to a default case that redirects back to the login page, preventing arbitrary parameter injection.
Entry Point
index.php at the application root redirects to:
controlador/cIniciosSesionesUsuarios.php?cashmanha=iniciarsesion
?cashmanha= value is supplied the router defaults to iniciarsesion. Likewise, if no ?cashmanhagestion= value is supplied after login the router defaults to inicioadministradores.
Authentication Routes (?cashmanha=)
These routes are served by controlador/cIniciosSesionesUsuarios.php. None require an active session — they exist specifically to establish or recover one.
| Route | Method | Required Role | Description |
|---|
iniciarsesion | GET | None | Render login page |
validar-sesiones | POST | None | Process login, set session variables, redirect by role |
credenciales-incorrectas | GET | None | Login error page (bad username or password) |
reestablecer-contrasena | GET | None | Forgot password form |
recuperar-cuentas | POST | None | Generate recovery code, send email via PHPMailer, insert token |
confirmacion-recuperacion-cuentas | GET | None | Recovery email sent confirmation page |
codigo-seguridad-recuperacion | GET | None | Enter the 5-digit recovery code sent by email |
cambio-estado-token | POST | None | Validate recovery code, upgrade $_SESSION['EstadoCodigos'] to ValidarCodigoAcceso |
cambio-contrasenia-usuarios | GET | None | New password entry form |
cambiar-contrasenia-recuperacion | POST | None | Hash and persist new password, send confirmation email, destroy session |
confirmacion-cambio-contrasenia | GET | None | Success page — destroys session before rendering |
error-cambio-contrasenia | GET | None | Error page — destroys session before rendering |
token-codigo-invalido | GET | None | Invalid or expired recovery token page |
expiracion-cambio-contrasenia | GET | None | Session expiry cleanup — unsets session, redirects to login |
cerrarsesion | GET | Any authenticated | Destroy session (session_unset() + session_destroy()), redirect to login |
The password hashing pattern used in validar-sesiones and cambiar-contrasenia-recuperacion is:$cifrado = sha1($_POST['val-password']);
$Contrasenia = crypt($conectarsistema->real_escape_string($_POST['val-password']), $cifrado);
Session Variables Set on Login
When validar-sesiones succeeds, the following $_SESSION keys are populated from the usuarios table row:
| Key | Source Field | Description |
|---|
id_usuario | idusuarios | User’s unique integer ID |
nombre_usuario | nombres | First name |
apellido_usuario | apellidos | Last name |
usuario_unico | codigousuario | Unique username code |
id_rol | idrol | Role integer (1–5) |
correo_usuario | correo | Email address |
foto_perfil | fotoperfil | Profile photo filename |
estado_usuario | estado_usuario | Account state |
comprobar_iniciosesion_primeravez | nuevousuario | First-login flag |
habilitar_sistema | habilitarsistema | Whether credit has been approved |
comprobacioncuenta_ahorros | poseecuenta | Has a savings account |
comprobacioncreditos_clientes | poseecredito | Has an associated credit |
Dashboard Routes (?cashmanhagestion=)
These routes are served by controlador/cGestionesCashman.php. Every case begins by checking $_SESSION['id_rol']; an incorrect role redirects to redirecciones-sistema-cashmanha.
Portal Home Pages
| Route | Role Required | View File | Description |
|---|
inicioadministradores | 1 | vista/Administradores/inicio-administradores.php | Administrator dashboard |
iniciopresidencia | 2 | vista/Presidencia/inicio-presidencia.php | Presidency dashboard |
iniciogerencia | 3 | vista/Gerencia/inicio-gerencia.php | Management dashboard |
inicioatencionclientes | 4 | vista/AtencionClientes/inicio-atencion-clientes.php | Customer Service dashboard |
inicioclientes | 5 | vista/Clientes/inicio-clientes.php | Client dashboard |
Profile Routes
| Route | Role Required | Description |
|---|
perfiladministradores | 1 | Administrator profile |
perfilpresidencia | 2 | Presidency profile |
perfilgerencia | 3 | Management profile |
perfilatencionclientes | 4 | Customer Service profile |
perfilclientes | 5 | Client profile |
actualizar-configuracion-cuenta-administradores | 1 | Update admin account settings (JSON response) |
actualizar-configuracion-cuenta-presidencia | 2 | Update presidency account settings (JSON response) |
actualizar-configuracion-cuenta-gerencia | 3 | Update management account settings (JSON response) |
actualizar-configuracion-cuenta-atencion-al-cliente | 4 | Update customer service account settings (JSON response) |
actualizar-configuracion-cuenta-clientes | 5 | Update client account settings (JSON response) |
actualizacion-detalles-perfil-usuarios | 1–5 | Update personal profile details for any authenticated role (JSON response) |
Profile photo uploads are renamed on the server using the pattern {date("dHi")}_{uniqid()}_{originalname} and stored in vista/images/fotoperfil/. If no new photo is submitted, a separate stored procedure without a photo parameter is called.
User Management Routes
All routes in this section require Role 1 (Administrator).
| Route | Method | Description |
|---|
registro-usuarios-administrador | GET | User registration page — also shows users with incomplete profiles |
envio-datos-registro-usuarios-administrador | POST | Submit new user credentials; stores session data for credential report |
registro-detalles-usuarios-administrador | GET | Complete user profile form (?codigounicousuario=) |
envio-datos-registro-detalles-nuevos-usuarios | POST | Submit full user profile including DUI, NIT, and signature images |
mostrar-informe-nuevos-clientes-administrador | GET | Printable PDF credential report for the newly registered user |
consulta-general-usuarios-administrador | GET | List all active, inactive, and blocked users |
modificar-usuarios-administrador | GET | Edit user form — requires ?idusuario= |
envio-datos-modificar-usuarios-administrador | POST | Submit user account changes |
desactivar-usuarios-clientes | POST | Deactivate user (JSON response, ?idusuario=) |
bloquear-usuarios-clientes | POST | Block user (JSON response, ?idusuario=) |
reactivar-usuarios-clientes | POST | Reactivate inactive or blocked user (JSON response, ?idusuario=) |
The user registration workflow is a two-step process. Step 1 (envio-datos-registro-usuarios-administrador) creates the user account. Step 2 (envio-datos-registro-detalles-nuevos-usuarios) attaches full personal details and identity documents. Document images (DUI front, DUI back, NIT, signature) are renamed with the same date_uniqid_filename scheme and stored in their respective subdirectories under vista/images/.
Credit Routes
| Route | Role(s) | Description |
|---|
gestion-creditos-primer-paso-gerencia | 3, 1 | First credit review step (Gerencia department) |
gestion-creditos-segundo-paso-presidencia | 2, 1 | Final credit approval step (Presidencia) |
gestionador-cuotas-contratos-creditos | 1, 4 | Manage installment schedules and loan contracts |
orden-pagos-cuotas-creditos-clientes | 1, 4 | Process an installment payment order |
consulta-clientes-creditos-activos-en-curso | 1, 2, 3, 4 | List all active/in-progress credits |
consulta-clientes-creditos-cancelados | 1, 2, 3, 4 | Historical list of fully paid or cancelled credits |
consulta-clientes-creditos-denegados | 1, 2, 3, 4 | List of denied credit requests |
consulta-listado-morosos | 1, 3 | Delinquent clients with overdue installments |
Credit approval follows a strict two-step workflow: Gerencia reviews first (gestion-creditos-primer-paso-gerencia), then Presidencia gives final approval (gestion-creditos-segundo-paso-presidencia). Skipping either step will leave the credit in an incomplete state and the client will not have their system access enabled (habilitarsistema flag).
Savings Account Routes
| Route | Role(s) | Description |
|---|
registro-nuevas-cuentas-ahorro | 1, 4 | Open a new savings account for a client |
registro-deposito-cuenta-ahorro | 1, 4 | Record a deposit into a savings account |
registro-retiro-cuenta-ahorro | 1, 4 | Record a withdrawal from a savings account |
registro-transferencia-cuentas | 1, 4, 5 | Initiate an inter-account transfer (requires security code via email) |
consulta-general-cuentas-ahorros | 1, 2, 3, 4 | List all registered savings accounts |
AJAX Response Pattern
POST routes that mutate data in cGestionesCashman.php return echo json_encode($result) directly, making them suitable for jQuery AJAX calls. The $result value is a string returned by the model method — "OK" on success or "ERROR" on failure.
$.ajax({
url: 'cGestionesCashman.php?cashmanhagestion=desactivar-usuarios-clientes&idusuario=' + userId,
type: 'POST',
dataType: 'json',
success: function(response) {
// handle JSON response
if (response === 'OK') {
// operation succeeded
Swal.fire('Success', 'User deactivated.', 'success');
}
},
error: function(xhr, status, error) {
console.error('Request failed:', error);
}
});
CashMan H.A. uses SweetAlert2 (sweetalert2.min.js) and Toastr (toastr.min.js) for user-facing feedback on AJAX responses. These libraries are included via the vista/vendor/ directory.