Accounts auth
Login and logout
Email/username plus password login with email-verification gate; logout clears the session.
Implemented Verified from source User-facing
In one sentence
Users sign in with email or username and password; unverified accounts are blocked; logout destroys the session.
Current behavior
auth_attempt_login() looks up the user, verifies the password with password_verify, blocks when email_verified = 0, then auth_login() sets $_SESSION['user_id'] and regenerates the session id. last_login is updated. Logout clears session data and redirects to login.
Two login entry points exist: arcana.login.php (canonical) and login.php (near-duplicate; auth_check.php redirects to login.php by default).
Step-by-step flow
- Submit identifier + password + CSRF.
- Credential check; email verification gate.
- Session established; redirect to dashboard.
- Logout clears session and flashes a message.
Failure cases
- Bad credentials → generic error.
- Unverified email → verification message + resend link (UX may also append a generic failure message).
- CSRF failure → session-token error.
Known limitations
users.status(suspended/banned) is not checked at login.- Duplicate login pages can diverge.