a ton of fun happened, refactored alot

plugins/auth/routes.py

@@ -1,51 +1,48 @@
-from flask import Blueprint, render_template, request, redirect, url_for, flash, current_app
-from flask_login import login_user, logout_user, login_required
-from werkzeug.security import check_password_hash
-from app import db
-from .models import User
+# File: plugins/auth/routes.py
+
+from flask import Blueprint, render_template, redirect, flash, url_for, request
+from flask_login import login_user, logout_user, login_required
+from .models import User
+from .forms import LoginForm, RegistrationForm
+from app import db
+
+bp = Blueprint(
+    'auth',
+    __name__,
+    template_folder='templates/auth',  # ← now points at plugins/auth/templates/auth/
+    url_prefix='/auth'
+)
 
-bp = Blueprint('auth', __name__, template_folder='templates')
 
 @bp.route('/login', methods=['GET', 'POST'])
 def login():
-    if request.method == 'POST':
-        email = request.form['email']
-        password = request.form['password']
-        user = User.query.filter_by(email=email).first()
-        if user and check_password_hash(user.password_hash, password):
+    form = LoginForm()
+    if form.validate_on_submit():
+        user = User.query.filter_by(email=form.email.data).first()
+        if user and user.check_password(form.password.data):
             login_user(user)
             flash('Logged in successfully.', 'success')
-            return redirect(url_for('core_ui.home'))
-        else:
-            flash('Invalid credentials.', 'danger')
-    return render_template('auth/login.html')
+            return redirect(url_for('home'))
+        flash('Invalid email or password.', 'danger')
+    return render_template('login.html', form=form)  # resolves to templates/auth/login.html
+
 
 @bp.route('/logout')
 @login_required
 def logout():
     logout_user()
     flash('Logged out.', 'info')
-    return redirect(url_for('core_ui.home'))
+    return redirect(url_for('home'))
+
 
 @bp.route('/register', methods=['GET', 'POST'])
 def register():
-    if not current_app.config.get('ALLOW_REGISTRATION', True):
-        flash('Registration is currently closed.', 'warning')
+    form = RegistrationForm()
+    if form.validate_on_submit():
+        user = User(email=form.email.data)
+        user.set_password(form.password.data)
+        db.session.add(user)
+        db.session.commit()
+        flash('Account created! Please log in.', 'success')
         return redirect(url_for('auth.login'))
-
-    if request.method == 'POST':
-        email = request.form['email']
-        password = request.form['password']
-
-        existing_user = User.query.filter_by(email=email).first()
-        if existing_user:
-            flash('Email already registered.', 'warning')
-        else:
-            user = User(email=email)
-            user.set_password(password)
-            db.session.add(user)
-            db.session.commit()
-            flash('Account created. You can now log in.', 'success')
-            return redirect(url_for('auth.login'))
-
-    return render_template('auth/register.html')
+    return render_template('register.html', form=form)  # resolves to templates/auth/register.html