LOGIN MODULE  v1.0
==================
Drop-in PHP authentication: register, login, logout, remember-me, forgot/reset password,
change password, roles, brute-force lockout. SQLite by default (no database setup) or MySQL.
Requires PHP 8.0+ with PDO (pdo_sqlite or pdo_mysql).

INSTALL
-------
1. Upload the login-module folder to your hosting (e.g. public_html/login-module/).
2. Edit config.php: app_name, base_url (optional), mail settings.
3. Open /login-module/register.php and create the first account — the FIRST user becomes "admin".
4. Make sure storage/ is writable (chmod 755 / 775). Database file is created automatically.
5. After creating your admin, set  'allow_registration' => false  if you do not want public sign-ups.

PROTECT YOUR OWN PAGES
----------------------
At the top of any PHP page:

    require __DIR__ . '/login-module/src/bootstrap.php';
    require __DIR__ . '/login-module/src/SmtpMailer.php';
    require __DIR__ . '/login-module/src/Auth.php';
    boot();
    $user = Auth::require();          // not logged in  -> redirected to login.php
    // Auth::require('admin');         // admins only
    echo 'Hello ' . htmlspecialchars($user['name']);

(If your page is outside the module folder, set 'login_page' / 'after_login' in config.php to full paths like '/login-module/login.php'.)
dashboard.php is a working example.

MYSQL
-----
In config.php:  'dsn' => 'mysql:host=localhost;dbname=YOURDB;charset=utf8mb4', 'db_user' => '...', 'db_pass' => '...'
Tables (lm_users, lm_attempts, lm_tokens) are created automatically.

PASSWORD-RESET EMAIL
--------------------
'mail' => ['driver' => 'mail']  PHP mail()  | 'smtp' any SMTP server (recommended) | 'log' writes the link to storage/mail.log (local testing)
SMTP examples: Gmail smtp.gmail.com 587 tls (App Password) • Zoho smtp.zoho.in 465 ssl • Brevo smtp-relay.brevo.com 587 tls

SECURITY BUILT IN
-----------------
password_hash (bcrypt/argon default) • CSRF tokens • session fixation protection (regenerate on login) • HttpOnly/SameSite cookies
• prepared statements (SQL-injection safe) • login lockout per email+IP • hashed reset & remember-me tokens • reset links expire
• identical response whether or not an email exists • all other sessions/remember tokens revoked on password change
src/, views/ and storage/ are blocked by .htaccess. On Nginx add a deny rule for those folders.

SUPPORT: ping@dakshb.co.in • https://dakshb.co.in
