Procedural implementation of authentication and registration logic, backed by simplistic json-file storage

public/login.php

@@ -1,11 +1,20 @@
 <?php
 
-// 1. fetch user by email
-// 2. compare user password hash against given password
-// 3. is the user banned? (optional)
-// 4. log login (optional)
-// 5. store user identifier into the session
-
-// discuss: should the fetching by password happen at database level?
-//          Should it happen inside the entity?
-//          Or in a service?
+$user = $_POST['emailAddress'];
+$password = $_POST['password'];
+
+$existingUsers = json_decode(file_get_contents(__DIR__ . '/../data/users.json'), true);
+
+if (!isset($existingUsers[$user])) {
+    echo 'Nope';
+
+    return;
+}
+
+if (! password_verify($password, $existingUsers[$user])) {
+    echo 'Nope';
+
+    return;
+}
+
+echo 'Ok';

public/register.php

@@ -2,10 +2,24 @@
 
 // registering a new user:
 
-// 1. check if a user with the same email address exists
-// 2. if not, create a user
-// 3. hash the password
-// 4. send the email to confirm activation (we will just display it)
-// 5. save the user
+$email = $_POST['emailAddress'];
+$password = $_POST['password'];
+
+$existingUsers = json_decode(file_get_contents(__DIR__ . '/../data/users.json'), true);
+
+if (isset($existingUsers[$email])) {
+    echo 'Already registered';
+
+    return;
+}
+
+$hash = password_hash($password, \PASSWORD_DEFAULT);
+
+$existingUsers[$email] = $hash;
+
+error_log('Registration mail sent here');
+
+file_put_contents(__DIR__ . '/../data/users.json', json_encode($existingUsers));
+
+echo 'OK';
 
-// Tip: discuss - email or saving? Chicken-egg problem