Login

Introduction

Login is the entry point for every Damsy ERP session. Users select a company, enter Login ID and password, and submit the form. The application validates credentials against SQL Server, initializes session state with user identity and module access flags, and redirects to the dashboard.

The login page lives at / and /Login/Index — there is no separate marketing or landing site.

Purpose

This page walks through the user-visible login flow and its server-side steps so you can support users, test authentication, and extend the login experience without breaking session initialization.

When to Use

Use this page when you:

• Test authentication on a new environment or blank database
• Explain what happens when login fails
• Verify which module flags a user receives after sign-in
• Troubleshoot company dropdown or lockout messages

How It Works

Flow diagram

Step 1 — GET login page

URL: /Login/Index (also /)

Action	Detail
Authenticated check	If Session["CompID"] exists → redirect /Dashboard/Index
Company list	Common.GetCompany() populates dropdown
Placeholder row	"Select Company" with CompID = 0
Version	UpdateSoftwareVersion() may update DB version row
View	UserLogin.cshtml with anti-forgery token for POST

Legacy URL /Login/UserLogin redirects to Index.

Step 2 — POST credentials

URL: POST /Login/Index

Field	BO property	Required
Company	User.Compid	Yes (≥ 1)
Login ID	User.LoginID	Yes
Password	User.Password	Yes

Server-side steps:

1. Validate anti-forgery token
2. Check login attempt lockout (LoginAttemptTracker)
3. Set User.IsActive = true
4. Call Login_DAL.GetLoginUser → [dbo].[GetLoginUser]
5. Password encrypted via HashCryptography before SP call
6. On success, load default month/year and email configuration

Step 3 — Module flags from database

GetLoginUser maps SQL columns to BO.User booleans stored in Session["dtVerifyUser"]:

DB-driven flag	User property	Enables module
Payroll	Payroll	Payroll Area
Webenroll	Webenroll	Registration Area
Billing	Billing	Bills Area
Zstock	ZSTOCK	Stock Area
ZSales	ZSales	Sales Area
EmpSelfServices	Ess	ESS Area
ControlPanel	ControlPanel	Adminisration Area
AttendancePuncging	AttPunch	AttendancePunching Area
Operation	Operation	Operation Area
ZManagementDashboard	ManagementDashboard	ManagmentDashBoard Area
ZContratedRates	ContractedRates	ContractedRates Area
VerificationAndApproval	VerificationAndApproval	VerificationAndApproval Area

No ModuleAccess session key

Module visibility uses dtVerifyUser properties, not Session["ModuleAccess"].

Step 4 — Redirect to dashboard

Successful login:

Session.Clear()
→ populate identity, company, flags, SMTP, e-invoice keys
→ Redirect ~/Dashboard/Index

Failure:

• Increment failed attempt counter
• Show: "The user name or password provided is incorrect"
• Re-render login form with company list

Developer Notes

• Blank DB credentials (when using minimal seed): Company Damsy Technologies, Login admin, Password Admin@123
• Lockout: Too many failures show minutes remaining — implemented in LoginAttemptTracker
• Menu permissions are separate from module flags — user may login but see limited menus if MenuMaster / permissions are not seeded

Examples

curl-style test (browser form POST)

Use the login form in browser — POST requires valid __RequestVerificationToken from GET response. Automated tests should extract the token from HTML.

Verifying flags after login (developer)

var user = Session["dtVerifyUser"] as User;
// user.Payroll, user.Billing, etc.

Failed login UX

Condition	User sees
Wrong password	Generic invalid credentials message
Lockout	"Too many failed login attempts. Try again in N minute(s)."
Company not selected	Model validation error on Compid

Related Pages

• Authentication Flow
• Session Management
• Dashboard
• Session Lifecycle

Important Notes

Always select a company

CompID 0 fails validation. Multi-company deployments require explicit company selection every login.

Already logged in

Hitting /Login/Index while session is active skips the form and sends the user to the dashboard.

Common Mistakes

Mistake	Symptom
Testing with wrong company DB	Valid user but wrong CompID fails auth
Expecting tiles for flags not set in DB	Login succeeds; module hidden on dashboard
Clearing cookies but not session server-side	Rare stale session on shared machines — use Logout
Typo in Login ID	Same generic error as wrong password

Next Steps

1. Continue to Dashboard to see how module flags become tiles.
2. Read Module Routing to enter a module from the dashboard.