a ton of fun happened, refactored alot

plugins/auth/models.py

@@ -1,7 +1,9 @@
+# File: plugins/auth/models.py
+
 from werkzeug.security import generate_password_hash, check_password_hash
 from flask_login import UserMixin
 from datetime import datetime
-from app import db
+from app import db, login_manager
 
 class User(db.Model, UserMixin):
     __tablename__ = 'users'
@@ -15,14 +17,10 @@ class User(db.Model, UserMixin):
     excluded_from_analytics = db.Column(db.Boolean, default=False)
     created_at = db.Column(db.DateTime, default=datetime.utcnow)
 
-    # Soft-delete flag
     is_deleted      = db.Column(db.Boolean, nullable=False, default=False)
-    # Permanent ban flag
     is_banned       = db.Column(db.Boolean, nullable=False, default=False)
-    # Temporary suspension until this UTC datetime
     suspended_until = db.Column(db.DateTime, nullable=True)
 
-    # Use back_populates, not backref
     submitted_submissions = db.relationship(
         "Submission",
         foreign_keys="Submission.user_id",
@@ -42,3 +40,20 @@ class User(db.Model, UserMixin):
 
     def check_password(self, password):
         return check_password_hash(self.password_hash, password)
+
+
+# ─── Flask-Login integration ─────────────────────────────────────────────────
+
+def _load_user(user_id):
+    """Return a User by ID, or None."""
+    if not str(user_id).isdigit():
+        return None
+    return User.query.get(int(user_id))
+
+
+def register_user_loader(app):
+    """
+    Hook into Flask-Login to register the user_loader.
+    Called by our JSON-driven loader if declared in plugin.json.
+    """
+    login_manager.user_loader(_load_user)