> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/CKoldo/Vacaciones-front/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How login, roles, and session management work in the Módulo de Registro de Vacaciones.

The application uses **JWT (JSON Web Token)** based authentication. There are no external identity providers — access is granted through credentials managed in the backend.

<Warning>
  Never share your username or password with anyone, including colleagues. Each user account carries a specific role that determines what actions can be performed in the system.
</Warning>

## Logging in

Navigate to the root URL (`/`). You will see the **Sistema de Gestión de Vacaciones** login screen with two fields:

| Field          | Description           |
| -------------- | --------------------- |
| **Usuario**    | Your account username |
| **Contraseña** | Your account password |

Click **Iniciar Sesión** to submit. The app sends your credentials to the backend:

```
POST /api/auth/login
Content-Type: application/json

{
  "username": "your_username",
  "password": "your_password"
}
```

On success, the backend returns a JWT. The token is stored in the browser's `localStorage` and attached as a `Bearer` token on every subsequent API request.

### Error states

| Situation                  | Message shown                          |
| -------------------------- | -------------------------------------- |
| Either field is empty      | "Por favor, complete todos los campos" |
| Wrong username or password | "Usuario o contraseña incorrectos"     |

Both error messages appear inside an alert below the password field. Correct the input and try again.

## User roles

Every account has one of two roles:

| Role    | Access level                                                                                                        |
| ------- | ------------------------------------------------------------------------------------------------------------------- |
| `admin` | Full access — can create, edit, and delete employees, schedules, vacation ranges, reschedulings, and ESINAD records |
| `user`  | Read-only or limited access — can view records but cannot perform administrative actions                            |

Your role is encoded in the JWT and determined at login. Contact your system administrator if you need a different level of access.

## Session management

Your session is active as long as a valid token exists in `localStorage`.

* **Persistence**: closing and reopening the browser tab does not log you out — the token persists in `localStorage` until it expires or you explicitly sign out.
* **Expiry**: when the token expires, protected routes will no longer load correctly. You will need to log in again to obtain a new token.
* **Logout**: clicking the logout control removes the token from `localStorage` and returns you to the login screen. No further API requests can be made until you log in again.

## Protected routes

All routes except `/` (the login screen) require a valid session. If you try to access a protected URL without being logged in — for example, by navigating directly to `/home` — the app redirects you to `/` automatically.

<Note>
  This redirect also applies if your token has expired. Refreshing a protected page after expiry will send you back to the login screen.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Get the app running locally and log in for the first time.
  </Card>

  <Card title="Personal registry" icon="user-plus" href="/modules/personal-registry">
    Start managing employee records after logging in.
  </Card>
</CardGroup>