Update auth_token.py

auth_token.py

@@ -379,12 +379,13 @@ def complete_signup(username, email, password, otp_input):
 def login(username_or_email, password):
     user = _get_user(username_or_email)
     if not user:
-        return False, None, "Account not found. Please sign up first."
+        return False, None, None, "Account not found. Please sign up first."
     if user["password"] != hash_password(password):
-        return False, None, "Incorrect password. Please try again."
+        return False, None, None, "Incorrect password. Please try again."
     token = generate_token()
-    _update_user(user["username"], {"token": token, "last_login": time.time()})
-    return True, token, "Login successful!"
+    real_username = user["username"]   # always the stored username, never the email
+    _update_user(real_username, {"token": token, "last_login": time.time()})
+    return True, token, real_username, "Login successful!"
 
 # ══════════════════════════════════════════════════════════════════════════════
 # TOKEN / LOGOUT