Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Edfermachado/proyectoSistemas/llms.txt

Use this file to discover all available pages before exploring further.

UniEvents uses a single authentication system for all user types. Attendees (students and the general public) register and log in at the main /register and /login pages, while faculty administrators use the same login page with a role-type toggle. This guide walks you through creating a new attendee account, signing in, and understanding how sessions are managed.

​
Creating an Account

Navigate to /register to create a new attendee account. All three fields are required:
FieldTypeDescription
emailemailYour university or personal email address
passwordpasswordChoose a secure password
confirmPasswordpasswordMust match password exactly
You must also accept the Terms and Conditions and Privacy Policy by checking the checkbox before submitting. Under the hood the registerUser server action performs the following steps: 
// src/app/actions/auth.ts
const hashedPassword = await bcrypt.hash(password, 10);
const [newUser] = await db.insert(users).values({
  email,
  passwordHash: hashedPassword,
  role: "user",
  tenantId: null,
}).returning();

await createSession(newUser.id, newUser.role, newUser.tenantId, newUser.email);
  1. Validates that all fields are present and passwords match.
  2. Checks that the email is not already registered.
  3. Hashes the password with bcrypt (10 salt rounds).
  4. Inserts the new user with role = 'user' and tenantId = null.
  5. Immediately creates a session cookie — you are logged in right after registration and redirected to /.
1

Go to /register

Open your browser and navigate to https://<your-instance>/register.
2

Enter your email

Type a valid email address. This will be your login identifier and the address used for ticket confirmations.
3

Choose a password

Enter a password and confirm it in the second field. Both values must match or the form will return an error.
4

Accept the terms

Check the Terms and Conditions checkbox. The submit button is disabled until this is checked.
5

Click Registrarse

Submit the form. On success you are redirected to the home page and your session is active immediately.

​
Logging In

Navigate to /login to sign in. The login page features two tabs that control which authentication path is used:

Comunidad (default)

For registered attendees with role = 'user'. Calls loginUser and redirects to / on success.

Facultad

For faculty administrators with roles tenant_admin, event_manager, or access_control. Calls loginFacultyAdmin and redirects to /faculty-admin on success.
Both tabs share the same form fields — email and password — but submit a hidden roleType field (comunidad or facultad) that routes to the correct server action via unifiedLoginAction: 
// src/app/actions/auth.ts
export async function unifiedLoginAction(prevState: any, formData: FormData) {
  const roleType = formData.get("roleType");
  if (roleType === "facultad") {
    return await loginFacultyAdmin(prevState, formData);
  } else {
    return await loginUser(prevState, formData);
  }
}
If you select Facultad but provide credentials belonging to a role = 'user' account (or vice-versa), authentication will fail with an error message — each action strictly validates the expected role before comparing passwords.

​
Session Management

Once authenticated, a JWT session is stored in an HTTP-only cookie named session. The cookie is inaccessible to client-side JavaScript. In production the cookie carries the Secure flag so it is transmitted only over HTTPS; in development the flag is omitted. The cookie also uses sameSite: "lax" to protect against cross-site request forgery. The session payload contains the following claims: 
{
  "userId": "uuid",
  "role": "user | tenant_admin | event_manager | access_control | superadmin",
  "tenantId": "uuid | null",
  "email": "user@example.com",
  "expiresAt": "ISO-8601 timestamp"
}
Sessions expire after 7 days. There is currently no refresh-token mechanism — after expiry you must log in again.

​
Logging Out

Logging out deletes the session cookie and redirects you to /login. The logoutUser server action handles this: 
// src/app/actions/auth.ts
export async function logoutUser() {
  await deleteSession();
  redirect("/login");
}
On the profile page, the logout button is rendered inside a <form> that invokes logoutUser as a server action, ensuring the redirect happens server-side.
Super-admin accounts (role = 'superadmin') do not use the main /login page. They authenticate at /admin/login, which calls the separate loginSuperAdmin action and redirects to /admin on success. Entering super-admin credentials on the regular login page will fail because the loginUser action only accepts role = 'user' accounts.

Build docs developers (and LLMs) love

Get started for freeTalk to us