# Discussion log — 2026-10-12 Authentication

> Documented retroactively on 2026-10-16 (the feature shipped 2026-10-12 but the docs were
> behind the code). The original instruction was not captured verbatim — see
> [../prompts/v2-auth-login.md](../prompts/v2-auth-login.md).

## Decisions
1. **Session login, single CEO account.** Multi-user + roles stay a future item (kickoff). Added
   a `users` table and a session-based guard rather than tokens/JWT — appropriate for a
   single-user local dashboard.
2. **Passwords hashed** with `password_hash()`/bcrypt; `session_regenerate_id(true)` on login.
   Plaintext is never stored in the DB.
3. **Default admin seeded by the installer** from `config['admin']`, overridable via
   `SO_ADMIN_*` env vars. `install.php` upserts the user (`ON DUPLICATE KEY UPDATE`).
4. **Both surfaces guarded:** HTML pages via `require_login_page()` (redirect to login), JSON API
   via `require_login_api()` (401).

## Open items / follow-ups
- Forgotten-password recovery → delivered in v3 (2026-10-16).
- ⚠️ `config/config.php` still contains a plaintext DB-password fallback and the admin password
  fallback. Recommend moving secrets to env-only and rotating.