Native Login & User Management Suite

Based on the MCP schemas, object definitions, and underlying implementation in WYSIWYG Web Builder, the software provides an extensive, production-ready Login & User Management System MCP namespace login*).

It is designed to secure PHP-based websites without writing server-side code manually, handling everything from authentication and role-based page protection to email verification, OAuth social logins, and administrative dashboards.

1. Core Architecture & Security Foundation

flowchart TD
    subgraph Storage ["Storage Layer"]
        DB1["Flat-File (usersdb.php)"]
        DB2["MySQL Database (USERS Table)"]
        DB3["Built-in Users (JSON / Project)"]
    end

    subgraph Auth ["Authentication & Lifecycle"]
        Signup["loginSignup
(Registration & Verification)"]
        Login["loginLogin / loginSocialLogin
(Authentication Gate)"]
        Recovery["loginPasswordRecovery
(Token Reset via Mail/SMTP)"]
    end

    subgraph Routing ["Access Control & Routing"]
        Redirect["loginUserRedirect
(Role/User Dispatcher)"]
        Protect["loginProtectPage
(Session & Role Validator)"]
        Single["loginSinglePage
(Inline Page Barrier)"]
    end

    subgraph UserArea ["User Experience & Self-Service"]
        Greeting["loginLoginName
(Username / Avatar)"]
        Edit["loginEditProfile
(Update Profile / Avatar)"]
        Pass["loginChangePassword
(Update Password)"]
        Del["loginDeleteProfile
(Self-Delete Account)"]
        Logout["loginLogout
(Session Termination)"]
    end

    subgraph AdminArea ["Administration"]
        Admin["loginAdmin
(User Management Console)"]
    end

    Signup --> Storage
    Login --> Storage
    Storage --> Auth
    Auth --> Routing
    Routing --> Protect
    Protect --> UserArea
    Storage <--> Admin
  

Dual Backend Modalities

1. Flat-File Database (usersdb.php):
2. Stores users in an encrypted, PHP-protected flat text/CSV file directly on the web server.
3. Requires zero MySQL configuration; works on virtually any basic PHP shared host.
4. MySQL Database (USERS table):
5. High-performance relational backend for sites with larger user bases.
6. Automatically initializes and queries tables: username, password, email, fullname, active, role, avatar, and custom profile fields.
7. Supports optional access logging to USERS_LOG or CSV.
8. Built-in Users List (login.database.users.json):
9. Static users defined in the project file, useful for simple password-protected client areas.

Session & Security Engine

• Session Management: Automatically emits $PHPSESSION$, tracking $_SESSION['username'], $_SESSION['fullname'], $_SESSION['role'], and $_SESSION['avatar'].
• Sliding Session Expiration: Enforces session timeouts (login.sessionTimeout, default 600 seconds) and automatically invalidates abandoned sessions.
• Referrer Memory ($_SESSION['referrer']): When an unauthenticated visitor hits a protected page, it preserves the original URL ($_SERVER['REQUEST_URI']) so they are seamlessly routed back upon successful login.
• Password Hashing: Configurable hashing supporting PHP password_hash() (Bcrypt/Argon2), SHA, and MD5.

2. Comprehensive Tool Catalog (13 Built-in Objects)

A. Authentication & Sign-In

B. Access Control & Page Protection

C. Registration & Account Lifecycle

D. Profile Management & User Context

E. Administration & Management

3. Comparing the 3 Storage Modes

4. Standard Implementation Workflow

A standard member portal implementation in WYSIWYG Web Builder typically utilizes 5 core pages:

1. login.php (Public):
2. Houses loginLogin and loginSocialLogin.
3. Links to signup.php and recover.php.
4. Configured with Destination Page: redirect.php and useReferrer: true.
5. signup.php (Public):
6. Contains loginSignup with Captcha enabled and Account Activation: Email Verification.
7. On submission, user receives an email pointing to activate.php.
8. redirect.php (Protected Dispatcher):
9. Invisible routing page containing loginUserRedirect.
10. Evaluates roles: [admin] → admin.php, [subscriber] → members.php.
11. members.php (Protected Content Area):
12. Top of page: loginProtectPage configured to require valid session and allowed roles.
13. Header area: loginLoginName (displays avatar + "Welcome, John!"), and loginLogout.
14. Profile tab: loginEditProfile and loginChangePassword.
15. admin.php (Protected Management Portal):
16. Top of page: loginProtectPage configured for role [admin].
17. Body: loginAdmin for user search, activation approval, and role assignments.

The demo website has been built using the native Login Tools in WYSIWYG Web Builder, strictly without any custom HTML or CSS objects.

Project Architecture Overview

Native Tools & Configurations

All pages and authentication tools share the flat-file user database (./usersdb.php, database.type: 0), requiring zero MySQL/SQL server configuration:

1. loginLogin (login.php):
2. Layout: Responsive (login.style.layout: 1).
3. Destination: Redirects authenticated users to members.php.
4. Error Handling: Redirects invalid attempts to login.php.
5. Features: Remember-me persistent cookie and password hashing.
6. loginSignup (signup.php):
7. Layout: Responsive (signup.style.layout: 1).
8. Activation: Automatic activation (signup.approvalMode: 0), allowing users to log in immediately after registration.
9. Destination: Redirects upon creation to login.php.
10. loginProtectPage (members.php, profile.php, admin.php):
11. Injects server-side PHP session verification at the top of the file before page rendering.
12. Redirects unauthenticated visitors to login.php while preserving the intended target URL.
13. loginLoginName (members.php, profile.php):
14. Displays real-time logged-in user identity: "Logged in as: <username>".
15. loginLogout (members.php, profile.php, admin.php):
16. Native session destruction form button styled in slate red, redirecting back to index.php.
17. loginEditProfile (profile.php):
18. Self-service form allowing logged-in members to update their registered full name and email address.
19. loginChangePassword (profile.php):
20. Form verifying existing password and updating to a new hashed password.
21. loginAdmin (admin.php):
22. Embedded administrator management console with items pagination and user activation/editing tools.
23. Administrator Password: admin123.
24. loginPasswordRecovery (recover.php):
25. Email-based password reset workflow.

Pre-Seeded Test Credentials

A starter database file (./usersdb.php) has been seeded in your project directory for testing:

• Admin User:
• Username: admin
• Password: admin
• Admin Console Password: admin123
• Standard Member:
• Username: demouser
• Password: 123456
• New Registration:
• Navigate to signup.php to register any new username; accounts activate instantly and append directly to ./usersdb.php.