Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JAQA20/LaComanda/llms.txt

Use this file to discover all available pages before exploring further.

La Comanda uses PHP native sessions for authentication. When a user logs in successfully, their identity and role are written into $_SESSION and used on every subsequent request to verify both identity and permissions. There are no JWTs or API tokens — all protected views rely on the session cookie that PHP sets automatically.

​
Login Flow

1

User submits credentials

The login form at views/login.php sends a POST request to /public/api/loginController.php with the user’s email and password.
2

Credential validation

loginController.php looks up the submitted email in the usuarios table. If no matching record is found, or if the account has activo = 0, the login is rejected with an error message.
3

Password verification

The stored password hash is checked using password_verify() against the bcrypt hash stored at registration. Plain-text passwords are never stored.
4

Session initialised

On success, session_start() is called (if not already active) and the following keys are written into $_SESSION. The SesionesActivas::registrar() method is also called to record the new session in the active sessions log.
5

Role-based redirect

The controller redirects the user to the dashboard appropriate for their role:
rol_idDestination
1 (Admin)views/admin/admin.php
2 (Waiter)views/index.php
3 (Kitchen)views/cocina.php
4 (Barista)views/barista.php

​
Session Data

After a successful login the following variables are available in $_SESSION for the duration of the session:
VariableTypeDescription
$_SESSION["usuario_id"]intPrimary key of the authenticated user
$_SESSION["nombre"]stringUser’s first name
$_SESSION["apellido"]stringUser’s last name
$_SESSION["email"]stringUser’s email address
$_SESSION["rol_id"]intRole identifier (1–4) used by verificarRol()
These values are read by middleware/roles.php and by any view that needs to display the current user’s name or personalise its content.

​
Session Activity Tracking

La Comanda tracks which users are currently online through the SesionesActivas class. Session data is persisted in a flat JSON file (sesiones_activas.json) rather than the database, keeping the overhead minimal.
Called immediately after a successful login. Writes a new entry to sesiones_activas.json containing:
  • session_id — the PHP session ID
  • usuario_id, nombre, email, rol_id — copied from the authenticated user
  • login_at — ISO-8601 timestamp of when the session started
  • ultima_actividad — timestamp updated on every subsequent request
  • ip — client IP address
  • user_agent — browser/client string
  • pagina_actual — the URL of the page last visited
The 30-minute TTL (1800 seconds) only governs which sessions appear as “active” in the admin’s session viewer. It does not terminate the PHP session itself — actual session expiry is controlled by session.gc_maxlifetime in your server’s php.ini.

​
Password Reset

La Comanda provides a token-based password reset flow delivered over email via Mailtrap SMTP.
1

Request a reset link

The user visits views/forgotPassword.php and submits their email address. The form posts to /public/api/forgotPassword.php.
2

Token generation

The API generates a cryptographically random 32-byte token using random_bytes(32). The SHA-256 hash of that token is stored in the password_resets table alongside the user’s ID and a 60-minute expiry timestamp. The raw (unhashed) token is embedded in the reset link sent to the user.
3

Email delivery

The reset link (/views/resetPassword.php?token=...) is sent to the user’s registered email address via Mailtrap SMTP. The response returned to the browser is always the same generic message regardless of whether the email exists — this prevents email enumeration attacks.
4

Set new password

The user clicks the link and lands on views/resetPassword.php. The application hashes the URL token with SHA-256, looks it up in password_resets, and confirms it has not expired. The user then sets a new password, which is stored as a fresh password_hash(PASSWORD_DEFAULT) bcrypt hash.
Token limits: A maximum of 3 active reset tokens are allowed per user at any time. When a new token is requested and the limit is reached, the oldest token is invalidated automatically.
To enable password reset emails, set the following variables in your .env file:
MAILTRAP_SMTP_USERNAME=your_mailtrap_username
MAILTRAP_SMTP_PASSWORD=your_mailtrap_password
MAILTRAP_ENABLED=true

​
Logout

Logout is triggered by a POST request to /public/api/logout.php. The endpoint:
  1. Calls SesionesActivas::cerrarSesionActual() to move the session record to the history log.
  2. Calls session_destroy() to invalidate the PHP session and clear all $_SESSION data.
  3. Redirects the browser to views/login.php.
Using a POST request for logout prevents the action from being triggered accidentally by link prefetching or browser history navigation.

Build docs developers (and LLMs) love

Get started for freeTalk to us