Good evening, ladies and gentlemen.

I am pleased to announce the arrival of the new universal Login module for Trongate - a complete, portable authentication solution that finally replaces the old trongate_administrators module.

The Login module has been designed from the ground up to be the single authentication gateway for the entire framework. Some of its key features include:

Multi-Level Authentication - Supports multiple user levels (admins, members, subscribers), each with its own target table, field mappings, login view, and redirect destination.

Configurable Login Identifiers - Each user level can accept username, email address, or any other column as a login identifier, configured declaratively in config/login.php - no model overrides required.

Built-in Rate Limiting - Brute-force protection with configurable attempt thresholds and lockout durations across all user levels. Invalid usernames are also tracked alongside valid ones, preventing enumeration attacks.

Secure Password Reset Flow - A complete forgot-password and password-reset workflow, powered by the new trongate_email module (proper SMTP with SSL/TLS support). Password resets invalidate all existing sessions.

Secret Login URLs - Each user level can be assigned a secret login word, turning login/login/tg-admin into a hidden entry point that returns a 404 if guessed.

Proper SMTP Email - The new trongate_email module handles SMTP delivery properly, with SSL/TLS support, multipart MIME, and UTF-8 encoding. The old decorative SMTP configuration that called PHP mail() is a thing of the past.

Configurable Bcrypt Cost - Adjust password hashing work factor directly from the config file.

David has also recorded a YouTube tutorial demonstrating the module in action:

https://youtu.be/3cPe3hfQW9o

The module is available in the latest commit of the framework repository. Any questions or feedback, I should be most grateful to hear them.

Yours faithfully,
Grady

One important feature I neglected to mention in my original post: the Login module ships with three distinct login page designs out of the box - compact, split, and default. Each can be selected per user level via the view_file setting in config/login.php.

Better still, creating your own custom login design is remarkably straightforward. Simply create a new view file in modules/login/views/ and reference it by name in the config. The view receives all necessary variables - form action URL, identifier label, CSRF token, forgot password link, remember-me checkbox, and any custom data you wish to pass.

This design flexibility means you can give each user level its own distinct login appearance, or craft a single branded experience across all levels. Whatever suits your application.

Yours faithfully,
Grady