> ## Documentation Index
> Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Login

> An EcoMail Hub user signs in with the consumer-response-manager guard and lands on the dashboard.

## Real-World Example

Maya is a YouNegotiate mail response user. She opens EcoMail Hub / EcoPortal, enters her email and password, completes reCAPTCHA, and lands on the Pending/Delivery dashboard.

If Maya is already logged in, the login page should redirect her into the portal instead of asking her to sign in again.

## Visual Flow

```mermaid placement="top-right" actions={true} theme={"system"}
flowchart TD
    A["EcoMail Hub user opens login"] --> B["User enters email, password, and reCAPTCHA"]
    B --> C{"Credentials valid and not rate limited?"}
    C -->|No| D["Show login error"]
    C -->|Yes| E["Regenerate session and clear local storage"]
    E --> F["Redirect to Dashboard"]
    classDef default fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef actor fill:#E0F2FE,stroke:#0284C7,stroke-width:2px,color:#0C4A6E;
    classDef system fill:#F8FAFC,stroke:#64748B,stroke-width:1.5px,color:#0F172A;
    classDef decision fill:#FEF3C7,stroke:#D97706,stroke-width:2px,color:#78350F;
    classDef risk fill:#FEE2E2,stroke:#DC2626,stroke-width:2px,color:#7F1D1D;
    classDef outcome fill:#DCFCE7,stroke:#16A34A,stroke-width:2px,color:#14532D;
    class A actor;
    class B,E system;
    class C decision;
    class D risk;
    class F outcome;
    linkStyle default stroke:#94A3B8,stroke-width:2px;
```

## How It Should Work

* It should authenticate only EcoMail Hub / EcoPortal users.
* It should use the `consumer-response-manager` guard.
* It should rate-limit repeated failed attempts.
* It should redirect successful users to the dashboard.

## Login-As Token Flow

When a Super Admin chooses an EcoMail Hub user, the Superadmin API creates a short-lived, single-use handoff. The frontend should immediately send that handoff in the JSON body of the EcoMail Hub `POST /auth/login-as/exchange` endpoint. A successful exchange returns the target user's non-remembered access and refresh tokens, which the frontend stores using the normal EcoMail Hub authentication flow before routing to the dashboard.

The Superadmin response must not contain EcoMail Hub access or refresh tokens. The frontend must not put the handoff in a URL or persist it. Expired, invalid, reused, wrong-portal, or deleted-user handoffs should be rejected without creating a target session.

## How It Should Not Work

* It should not log in creditor, consumer, or Super Admin users through this page.
* It should not bypass reCAPTCHA when the form requires it.
* It should not reuse stale local browser state after login.

## Developer Notes

* Login uses the `consumer-response-manager` guard and regenerates the session after authentication.
* Failed login attempts are throttled by email and IP address.

## Related App Areas

* `routes/ecomailhub/auth.php`
* `app/Livewire/ConsumerResponseManager/Auth/LoginPage.php`
* `app/Livewire/ConsumerResponseManager/Forms/LoginForm.php`
* Backend exchange controller: `app/Http/Controllers/Ecomailhub/Auth/LoginAsHandoffController.php`