Authentication & Security

How to log in, register, verify your email, recover your password, and manage sessions in Hotel Guevarini.

Hotel Guevarini uses PHP sessions to manage authentication. Every protected page calls session_start() and checks for a valid usuario_id in the session before granting access. Unauthenticated or expired sessions are redirected back to the login page automatically.

Passwords in this system are stored and compared as plain text. This is suitable for local development and learning purposes only. Do not use real or sensitive passwords with this system, and never deploy it to a public environment without first adding proper password hashing.

Roles

There are two roles in the system:

Role	Access
Administrator	Full access to all modules: Clients, Rooms, Reservations, and Users
Client	Can view available rooms and view their own reservations only

The seed data includes test accounts with plaintext password 12345. Change all passwords before deploying to production.

---

Logging In

1. Navigate to the login page

   Open /views/login.php in your browser. If you already have an active session, you will be redirected directly to the dashboard (panel.php).

2. Enter your credentials

   Fill in your Email Address and Password, then click Entrar.

   The seed accounts for testing are:

   Email	Password	Role
   [e-mail]	12345	Administrator
   [e-mail]	12345	Client

3. Access the dashboard

   On success, the system sets your session (usuario_id, usuario_nombre, usuario_rol_id, usuario_rol_nombre) and redirects you to panel.php. If your credentials are wrong, an error message is shown on the login page.

Your email address must be verified before you can log in. Attempting to log in with an unverified account will display an error and offer a button to resend the verification email.

---

Registering a New Account

Self-registration is available from the login page. Accounts created via registration are assigned the Client role by default. An associated client record is also created automatically with a placeholder phone number.

1. Open the registration page

   Click Crear una cuenta nueva on the login page, or navigate to /views/registro.php.

2. Fill in the registration form

   Provide your Full Name, Email Address, and a Password (the form requires at least 5 characters). Email addresses must be unique — registering with an already-used address will show an error.

3. Submit the form

   Click Registrarse. The system creates your user account and a linked client record, then sends a verification email via PHPMailer.

4. Verify your email

   Open the email from [e-mail] (subject: Verifica tu cuenta) and click the verification link. The link is valid until it is used. After verification, your account is active and you can log in.

Email verification is required before your first login. You cannot access the system until your email address has been confirmed.

---

Recovering a Forgotten Password

1. Go to the recovery page

   Click ¿Olvidaste tu contraseña? on the login page, or navigate to /views/recuperar.php.

2. Enter your email address

   Type the email associated with your account and click Solicitar Enlace. For security, the system always shows a generic success message regardless of whether the email exists in the database.

3. Open the reset link

   Check your inbox for a reset email. Click the link, which routes to /views/reset_password.php?token=.... The token is validated against the database and expires after 1 hour (expiracion_token_recuperacion). Expired or invalid tokens are rejected.

4. Set a new password

   Enter your New Password and Confirm Password, then click Restablecer Contraseña. On success, you can log in with the new password.

---

Resending the Verification Email

If you did not receive the verification email or the link expired:

1. Attempt to log in

   Go to the login page and submit your credentials. If your account is not yet verified, an error will appear along with a Reenviar correo de verificación button.

2. Click the resend button

   Clicking the button submits your email to /php/auth/reenviar_verificacion.php. The system generates a new token, updates the database, and sends a fresh verification email.

3. Verify your email

   Open the new email and click the verification link to activate your account.

---

Session Management

• Sessions are started with session_start() on every protected page.
• On successful login, session_regenerate_id(true) is called to prevent session fixation attacks.
• The session stores four values: usuario_id, usuario_nombre, usuario_rol_id, and usuario_rol_nombre.
• Logging out (via /php/auth/logout.php) destroys the session and redirects to the login page.
• If a session has expired or is missing, any protected page redirects the user back to login.php.
• Passwords are compared as plain text — no hashing is applied. Use this system only in controlled local environments.