8. Authentication System

Veldora includes a robust, secure authentication system out of the box with session management, password hashing (Argon2id/Bcrypt), remember tokens, and route protection middleware.

Generating Full Auth Scaffold

Generate complete, production-ready login, registration, and dashboard controllers and views with a single command:

php veldora make:auth
php veldora migrate

This creates:

• app/Controllers/AuthController.php — Handles login, registration, logout, and password resets
• app/Models/User.php — Authenticatable model with password hashing and fillable attributes
• database/migrations/*_create_users_table.php — Database schema with email, password, remember_token
• resources/views/auth/login.veldora.php — Accessible login form with CSRF token
• resources/views/auth/register.veldora.php — Registration form with client and server validation
• resources/views/dashboard.veldora.php — Protected user dashboard
• Automatic authentication routes registered in routes/web.php

Global Authentication Helpers

// Check if the current visitor is logged in
if (auth()->check()) {
    $user = auth()->user(); // Returns current User model instance
    $userId = auth()->id();  // Returns current user ID
}

// Log in a specific user model
auth()->login($user, $remember = true);

// Log out and invalidate the session
auth()->logout();

Protecting Routes with Middleware

Protect routes so only authenticated users or guests can access them:

// Only logged-in users can access
$router->group(['middleware' => ['auth']], function ($r) {
    $r->get('/dashboard', [DashboardController::class, 'index']);
    $r->get('/settings',  [SettingsController::class, 'index']);
});

// Only guests (unauthenticated visitors) can access login/register
$router->group(['middleware' => ['guest']], function ($r) {
    $r->get('/login',    [AuthController::class, 'showLogin']);
    $r->post('/login',   [AuthController::class, 'login']);
    $r->get('/register', [AuthController::class, 'showRegister']);
    $r->post('/register',[AuthController::class, 'register']);
});

Password Hashing

Passwords are automatically hashed securely using PHP's native password_hash() with modern Argon2id or Bcrypt:

use Veldora\Framework\Support\Hash;

// Hash a plaintext password
$hashed = Hash::make($request->input('password'));

// Verify password against hash
if (Hash::check($request->input('password'), $user->password)) {
    // Password matches!
}