fixed multi school account

app/Http/Controllers/Web/Auth/LoginController.php

@@ -66,19 +66,18 @@ class LoginController extends Controller
 
         // Validazione del campo school
         $schoolSlug = $request->input('school');
+
         if ($schoolSlug) {
             $school = School::where('slug', $schoolSlug)->first();
-            if (!$school) {
-                return redirect()->to('login' . $to)
-                    ->withErrors(['school' => trans('auth.school_not_found')]);
+
+            if ($school) {
+                // Se presente e valida → salva in sessione
+                $request->session()->put('school_id', $school->id);
             }
-            // Salva lo school_id nella sessione
-            $request->session()->put('school_id', $school->id);
-        } else {
-            // Se il campo school è vuoto, possiamo gestire il caso di default
-            return redirect()->to('login' . $to)
-                ->withErrors(['school' => trans('auth.school_required')]);
+            // ⚠️ se non esiste → NON blocchiamo il login
         }
+        // ⚠️ se è vuota → NON facciamo nulla
+
 
         $credentials = $request->getCredentials();
 
@@ -125,7 +124,7 @@ class LoginController extends Controller
         if ($user->hasRole('Admin')) {
             return redirect()->to('userarea/admin.php');
         } elseif ($user->hasRole('User')) {
-            return redirect()->to('userarea/index.php');
+            return redirect()->to('userarea/select_school.php');
         } elseif ($user->hasRole('teacher')) {
             return redirect()->to('userarea/teacher.php');
         } elseif ($user->hasRole('school_owner')) {
@@ -151,12 +150,48 @@ class LoginController extends Controller
     /**
      * Log the user out of the application.
      */
-    public function logout(): RedirectResponse
+
+
+    public function logout(Request $request): RedirectResponse
     {
         event(new LoggedOut);
 
+        // 1) Logout Laravel
         Auth::logout();
 
+        // 2) Pulisci + invalida session Laravel (NON solo forget)
+        $request->session()->forget(['school_id', 'school_name', 'school_selected']);
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        // 3) Pulisci anche la session PHP nativa usata in userarea (PHPSESSID)
+        if (session_status() !== PHP_SESSION_ACTIVE) {
+            @session_start();
+        }
+
+        unset(
+            $_SESSION['school_id'],
+            $_SESSION['school_name'],
+            $_SESSION['school_selected']
+        );
+
+        // Se vuoi essere ancora più “definitivo”, distruggi tutta la PHP session:
+        $_SESSION = [];
+
+        if (ini_get('session.use_cookies')) {
+            $params = session_get_cookie_params();
+            setcookie(
+                session_name(),
+                '',
+                time() - 42000,
+                $params['path'],
+                $params['domain'],
+                $params['secure'],
+                $params['httponly']
+            );
+        }
+        @session_destroy();
+
         return redirect('login');
     }
 }