La Comanda authenticates users through a standard PHP session established at theDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/JAQA20/LaComanda/llms.txt
Use this file to discover all available pages before exploring further.
views/login.php form. Once logged in, the browser holds a PHPSESSID cookie that is validated by middleware/auth.php on every protected request. The two endpoints documented here handle the end of a session (logout) and the recovery flow for forgotten passwords.
POST /public/api/logout.php
Destroys the current PHP session, records the logout event in thesesiones_activas table, and redirects the browser back to the login page.
Method: POST
Auth: Any authenticated session (session cookie required)
Request
No request body is required. The endpoint reads$_SESSION directly.
Response
This endpoint does not return JSON. On success it renders a minimal HTML page that immediately redirects the browser toviews/login.php?logged_out=1 via both <meta http-equiv="refresh"> and window.location.replace().
window.LaComandaSessionSync.notifyLogout() (from public/js/session-sync.js) so that any other open tabs are notified of the logout before the redirect fires.
Because logout renders an HTML redirect page rather than issuing an HTTP
Location header directly, calling this endpoint from a non-browser client
(e.g. curl) will receive an HTML body with the redirect URL embedded in it —
not a 302 status.Example
POST /public/api/forgotPassword.php
Initiates the password-reset flow for a registered user. If the submitted email address belongs to an active account, a time-limited reset link is emailed to that address via Mailtrap. To prevent email enumeration, the endpoint always returns the same success response regardless of whether the email was found. Method:POST
Auth: None — this is a public endpoint, no session required
Request
Send the body asapplication/x-www-form-urlencoded (standard HTML form encoding).
The email address associated with the user’s account. Must be a valid email
format; invalid or empty values are silently treated as not found and the
standard success response is returned.
Response
Always
"OK" when the request is processed without a server error.A fixed Spanish-language message that is returned regardless of whether the
email was found:
"Si el correo está registrado, recibirás instrucciones para restablecer tu contraseña."| HTTP Status | Condition |
|---|---|
405 Method Not Allowed | Request method is not POST |
500 Internal Server Error | Database or mailer exception |
Rate Limiting
The endpoint enforces two independent token-budget limits before any email is sent:- Per-user limit: A maximum of 3 active (unused, non-expired) reset tokens are allowed per user. Submitting a new request while 3 tokens are already live silently returns the standard success message without creating a new token.
- Global limit: A maximum of 200 active tokens may exist across all users simultaneously. When this ceiling is reached, all new requests are silently dropped.
Token Details
| Property | Value |
|---|---|
| Token lifetime | 60 minutes from creation |
| Token storage | SHA-256 hash stored in password_resets.token; the plain token is sent in the email only |
| Token format | URL-safe base64 (random_bytes(32), +/ → -_, no padding) |
| Invalidation on new request | All previous active tokens for the user are marked usado = 1 before a new one is inserted |