Client
Browse films, book cinema seats, shop the store, rate content, and manage their personal profile.
Cinema manager
Register and manage cinemas, configure theaters, schedule séances, and view their own venue analytics.
Admin
Full platform access: approve cinemas, manage all users, assign roles, and view platform-wide data.
Registration
Complete the registration form
New users register at
/register by providing:- First name (prenom) and last name (nom) — 2 to 50 characters each
- Email address — must be unique across the platform
- Password — minimum 8 characters
- Phone number — positive integer, used for SMS notifications
- Date of birth — must not be in the future
- Address — 5 to 50 characters
- Role — one of
client,admin, orresponsable de cinema - Profile photo (optional) — uploaded to
/img/users/
Email verification
After registering, a verification email is sent to the provided address. The account cannot be used until the email link is clicked.
Admin-created accounts (created directly from the user dashboard) bypass the verification step and are marked as verified immediately.
Authentication methods
- Email and password
- Google OAuth
- Microsoft OAuth
Standard credential-based login. The user enters their email and password on the login page. Passwords are hashed using Symfony’s password hasher before storage — plain-text passwords are never persisted.Failed login attempts are subject to rate limiting to prevent brute-force attacks.
Two-factor authentication (TOTP)
Rakcha implements TOTP-based 2FA using thescheb/2fa-bundle. Once enabled, users are prompted for a 6-digit code after entering their password.
Enabling 2FA
Access 2FA settings
From your profile page, navigate to the Security section and click Enable Two-Factor Authentication.
Scan the QR code
A QR code is generated from your TOTP secret (SHA-1, 30-second window, 6-digit codes). Scan it with any TOTP-compatible authenticator app such as Google Authenticator or Authy.
Trusted devices
After completing a 2FA challenge you can mark the current device as trusted. Trusted devices skip the 2FA prompt on future logins from the same browser, reducing friction for devices you own.Disabling 2FA
To remove 2FA, clear the TOTP secret from your security settings. You will need to enter your current password to confirm the change.Password reset
Check your email
A password reset link is sent to your address. The link is time-limited and single-use.
User profile management
Each user can update their own profile from/profile/update:
- First name and last name
- Email address
- Date of birth
- Address
- Phone number
- Profile photo — uploading a new photo replaces the existing one
Deleting your account
Users can permanently delete their own account from the profile page. The action requires a valid CSRF token and:- Removes the user record from the database
- Invalidates the current session
- Clears the authentication token
- Redirects to the home page
Admin: managing all users
Admins access the user management dashboard at/usersDash. The dashboard displays all registered users with pagination (5 per page).
Viewing users
The user table shows each user’s name, email, role, and verification status. Click any row to open the user’s profile view.Creating a user (admin)
Admins can create users directly from the dashboard without going through the registration flow. The admin form requires:- All standard profile fields
- Role selection
- Password (hashed on save)
isVerified = true, bypassing email confirmation.
Editing a user
Admins can edit any user’s profile fields, including reassigning their role. Password updates via the admin edit form re-hash the new value before saving.Deleting a user
Admins can delete any user account from the user table. The action requires a valid CSRF token.Role assignment
Roles map to Symfony security roles as follows:| Role label | Symfony role | Access |
|---|---|---|
client | ROLE_CLIENT | Public store, film catalog, cinema booking |
admin | ROLE_ADMIN | Full back-office access, user and cinema management |
responsable de cinema | ROLE_RESPONSABLE_DE_CINEMA | Cinema, salle, and séance management for owned venues |
ROLE_USER automatically.
Role changes take effect on the user’s next login. Ask the user to log out and back in after a role update.