Skip to main content

​
Real-World Example

Maya is a YouNegotiate mail response user. She opens EcoMail Hub / EcoPortal, enters her email and password, completes reCAPTCHA, and lands on the Pending/Delivery dashboard. If Maya is already logged in, the login page should redirect her into the portal instead of asking her to sign in again.

​
Visual Flow

​
How It Should Work

  • It should authenticate only EcoMail Hub / EcoPortal users.
  • It should use the consumer-response-manager guard.
  • It should rate-limit repeated failed attempts.
  • It should redirect successful users to the dashboard.

​
Login-As Token Flow

When a Super Admin chooses an EcoMail Hub user, the Superadmin API creates a short-lived, single-use handoff. The frontend should immediately send that handoff in the JSON body of the EcoMail Hub POST /auth/login-as/exchange endpoint. A successful exchange returns the target user’s non-remembered access and refresh tokens, which the frontend stores using the normal EcoMail Hub authentication flow before routing to the dashboard. The Superadmin response must not contain EcoMail Hub access or refresh tokens. The frontend must not put the handoff in a URL or persist it. Expired, invalid, reused, wrong-portal, or deleted-user handoffs should be rejected without creating a target session.

​
How It Should Not Work

  • It should not log in creditor, consumer, or Super Admin users through this page.
  • It should not bypass reCAPTCHA when the form requires it.
  • It should not reuse stale local browser state after login.

​
Developer Notes

  • Login uses the consumer-response-manager guard and regenerates the session after authentication.
  • Failed login attempts are throttled by email and IP address.
  • routes/ecomailhub/auth.php
  • app/Livewire/ConsumerResponseManager/Auth/LoginPage.php
  • app/Livewire/ConsumerResponseManager/Forms/LoginForm.php
  • Backend exchange controller: app/Http/Controllers/Ecomailhub/Auth/LoginAsHandoffController.php
Last modified on July 19, 2026