Tears down both transports for every live WebSocket the user has open, on all devices.

Call this after an account-wide revocation (password change or reset, account disable) has invalidated the user's sessions, so both drop immediately instead of staying authorised until they happen to reconnect.

Logout does not use this; see log_out_user/1.

Authenticates the user by looking into the session and remember me token.

This is where :live_socket_id is written, so a revocation can reach the pages the user already has open.

The /live transport topic addressing every LiveView connection the user has open.

Keyed per user rather than per session token, so an authorisation change reaches pages that are already open. phx.gen.auth keys it per token; the LiveView security-model guide keys it per user, and we follow the guide.

We don't use the guide's name for it, users_socket:. That is one character from user_socket: above, and both are broadcast from the same function.

Logs the user in by creating a new session token.

Logs the user out.

It clears all session data for safety. See renew_session.

This hangs up the account's LiveView connections on every device, but revokes only the token it was logged out of, so the other devices reconnect and stay signed in.

@spec login_blocked_message(:disabled | :scheduled_deletion) :: String.t()

The flash message shown when login is refused for a given Lightning.Accounts.login_blocked_reason/1 value. Shared by the password and SSO login paths so their wording can't drift apart.

Only the two blocked reasons are valid inputs; gate with Lightning.Accounts.login_blocked?/1.

Assigns the token to a new session.

It renews the session ID and clears the whole session to avoid fixation attacks. See the renew_session function to customize this behaviour.

Used for LiveView routes that require the user to be reauthenticated.

Reauthenticate the user by using the sudo token

Used for routes that require the user to not be authenticated.

Returns to or redirects to the dashboard and potentially set remember_me token.

Used for API routes that require the resource to be authenticated. A resource can be a User or a ProjectRepoConnection

Used for routes that require the user to be authenticated.

Refuses a session whose second factor is still pending, and one whose email address is unconfirmed past the deadline — the latter is confined to the handful of paths in LightningWeb.ConfirmationLockout.

Used for routes that require the user to be reauthenticated.

Require that the user has the superuser role

The /socket transport topic addressing every LightningWeb.UserSocket connection the user has open.