User Management is the shared account layer for the PHP and JSON projects in the repository. The goal is to avoid rebuilding login, password changes, role checks, and session behavior separately inside every small application.
The system provides same-host login for integrated projects. Accounts have User, Admin, and Super Admin roles, while project access is granted separately. A person can have access to selected projects, all projects, or central directory administration when explicitly allowed.
The integration point is deliberately explicit. Registering a project in the portal does not automatically protect it, and deploying the account system does not migrate old users by itself. Each application still has to call the shared identity provider and gate every protected page, API, download, and write handler.
Security details are treated as first-class behavior. The project includes server-side permission checks, CSRF tokens, secure cookies, session rotation, idle expiry, login throttling, required password changes, and session revocation after account or password changes.
The first administrator is created through a private setup flow or CLI command. There is no shipped default account or password, and there is no email recovery service. The documentation is blunt about keeping a second administrator and private backups.
Storage uses protected JSON files with stable locks and atomic replacement. Runtime files remain ignored by Git, which protects credentials from source control but also makes hosting backup and deployment preservation essential.
The project also documents limits. This is same-host, same-PHP-session-storage integration, not OAuth, OIDC, or cross-domain single sign-on. Static HTML cannot be protected by a JavaScript login check; it needs to be served through a protected route if access control matters.
The value is consistency. Once shared identity is in place, individual projects can spend less code on account plumbing and more code on their actual workflow, while still keeping access decisions visible and testable.
Update history
These notes record article updates associated with repository changes. The original publication date is retained.