Login and Registration

// The single entry point for creating a member. See the input keys below.
public static function register(array $input): array;

// Password login. $type is 'member' or 'admin'; the member master switch is checked here.
public static function attemptLogin(string $type, string $email, string $password, bool $remember = false): array;

// The ONE place a session is established, password or not. Every passwordless flow
// (code login, social, post-registration, email verification) ends here.
public static function completeLogin(string $type, int $userId, object $user, bool $remember = false, array $sso = []): string;

// Passwordless: issue a one-time code, then exchange it for a session.
// issueLoginCode reports success whether or not the address exists.
public static function jetpassEnabled(): bool;
public static function issueLoginCode(string $email): array;
public static function jetpassLogin(string $email, string $code, bool $remember = false): array;

// Password reset. issueReset is also enumeration-safe.
public static function issueReset(string $type, string $email): array;
public static function verifyResetToken(string $rawKey, string $type): object|false;
public static function resetPassword(string $type, int $userId, string $password): void;

// Providers to offer, for a given mode and audience.
public static function activeProviders(string $mode, string $context): array;

$input = [
    // Identity
    'first_name'     => 'Ada',
    'last_name'      => 'Lovelace',
    'email'          => '[email protected]',
    'password'       => 'read with the pass-through filter, never a text filter',

    // Account type and the corporate fields it unlocks
    'account_type'   => 'individual',   // or 'corporate'
    'company_name'   => '',
    'tax_number'     => '',
    'tax_office'     => '',

    // Optional contact fields, each behind its own visibility switch
    'phone'          => '',
    'landline_phone' => '',
    'national_id'    => '',

    // Billing address
    'address1'       => '',
    'state'          => '',             // id when picked from the list, free text otherwise
    'city'           => '',             // same rule as state
    'postal_code'    => '',
    'country'        => 0,              // resolved to an id before it gets here

    // Consents
    'marketing_email'    => 0,
    'marketing_sms'      => 0,
    'contract'           => 1,          // the terms checkbox
    'contracts_required' => true,       // whether any contract is actually configured

    // Operator-defined extra fields, collected by the operation
    'custom_fields'      => [],

    // Declared by the THEME MANIFEST, never by the request. True skips the required
    // checks for phone, landline and national id, and nothing else.
    'minimal_fields'     => false,
];

{extends file='layouts/auth.tpl'}

{block name=stage_title}{lang key='auth_stage_login_title'}{/block}
{block name=stage_text}{lang key='auth_stage_login_text'}{/block}

{* The cross link is gated: offering sign-up on a closed installation is a dead end. *}
{block name=stage_foot}
  {if $registration_enabled}
    {lang key='auth_stage_login_foot'} <a href="{link route='sign-up'}">{lang key='auth_stage_login_foot_link'}</a>
  {/if}
{/block}

{block name=content}
{if $login_enabled}

  {* State 1: email. Visible; every other state ships hidden in the SAME document. *}
  <div data-auth-step="login">
    <form data-auth-form="login">
      {csrf form='sign-in'}
      <input type="email" name="email" class="form-control" required>
      {captcha area='sign-in' tray='login-captcha'}
      <button type="submit" class="btn">{lang key='website/sign/continue'}</button>
    </form>

    {* Passwordless BEFORE social, each behind its own switch and divider. *}
    {if $jetpass_enabled}
      <div class="auth-divider">{lang key='website/sign/or'}</div>
      <button type="button" class="btn" data-auth-action="auth-code-login">{lang key='website/sign/jetpass-cta'}</button>
    {/if}
    {if $social_providers}
      <div class="auth-divider">{lang key='website/sign/or'}</div>
      {foreach $social_providers as $p}
        <a class="btn" href="{$p.url}"><i class="bi {$p.icon}"></i>{$p.label}</a>
      {/foreach}
    {/if}
  </div>

  <div class="d-none" data-auth-step="password">{* ... *}</div>

  {* All four code states reuse ONE component: the script binds to .otp-input,
     not to the state, so a second implementation gets none of its behaviour. *}
  <div class="d-none" data-auth-step="code-login">
    <div class="otp-group" data-otp>
      <input class="otp-input" inputmode="numeric" maxlength="1">
    </div>
  </div>

  <div class="d-none" data-auth-step="restricted">{* ... *}</div>

{else}
  <p>{lang key='website/sign/login-disabled'}</p>
{/if}
{/block}

// templates/website/{Theme}/theme.php

return [
    'meta' => [
        'name'    => 'Acme',
        'version' => '1.0.0',
        'author'  => 'Acme',

        // TRUE only when the register view renders NONE of phone, landline and
        // national id. Auth::register then skips the operator's required checks
        // for exactly those three fields; every other validation still runs.
        //
        // FALSE when the view renders them behind $registration.*_visible, which
        // is what two of the three bundled themes do.
        //
        // Setting it true while still printing the fields is the one wrong answer:
        // the requirement is skipped even though the visitor saw an empty input.
        'signup_minimal' => false,
    ],
    'engine' => 'smarty',
    'status' => 'ready',
];