- app
-- controllers
-- models
-- views
- public

class Users extends Model {
    // ...
    protected $id;
    protected $username;
    protected $email;
    // setters and getters, validation
}

class UserController extends ControllerBase {
    // ...
    public function loginAction() {
        if ($this->request->isPost()) {
            // ... get post
            // check login is correct
            // create session
            // redirect
        }
        $this->view->var = $var;
    }
}

class ApiController extends ControllerBase {
    // ...
    public function loginAction() {
        if ($this->request->isPost() //or put) {
            $json = $this->request->getJsonRawBody();
            // ... get json
            // check login is correct
            // create session
        }
        $response->setStatusCode('2xx/4xx', 'msg');
        $response->setJsonContent([
            'status' => 'OK / ERROR',
            'message' => '$msg / $ex->getMessage()'
        ]);
    }
}

class MyClass extends ParentClass {
    public function login($username, $password) {
        $user = Users::findFirstByEmail($email);
        if ($user->password === hash($password)) {
            $successLogin = new UserSuccessLogins();
            $successLogin ->setId('id');
            $successLogin ->setIpAddress('ip');
            $successLogin ->save();
        } else {
            $failedLogin = new UserFailedLogins();
            $failedLogin->setId('id');
            $failedLogin->setIpAddress('ip');
            $failedLogin->save();
        }
    }
}

class UserController extends ControllerBase {
    public function loginAction() {
        if ($this->request->isPost()) {
            $c = new MyClass();
            if ($c->login($username, $password)) {
                // redirect
            }
        }
        $this->view->var = $var;
    }
}

class ApiController extends ControllerBase {
    public function loginAction() {
        if ($this->request->isPost() //or put) {
            $c = new MyClass();
            if ($c->login($username, $password)) {
                // send json OK
            } else {
                // send json Error
            }
        }
    }
}

-app
--components
--controllers
--models
--views
-public

use PhalconMvcModel;
class Users extends Model {
    // ...
    protected $id;
    protected $username;
    protected $email;
    // setters and getters, validation
}

use PhalconMvcUserComponent;
class UserComponent extends Component {
    // class with access to dependecy injector
    public login ($email, $password) {
        $user = Users::findFirstByEmail($email);
        // logic with setting session in $di
    }
}

class UserController extends ControllerBase {
    public function loginAction() {
        if ($this->request->isPost()) {
            $userComponent = new UserComponent();
            if ($userComponent ->login($username, $password)) {
                return $this->response->redirect($this->url->getBaseUri(), false, 301);
            } else {
                $this->flash->error('message');
            }
        }
        // setting view variables if not post or login filed
        $this->view->var = $var;
    }
}


class ApiController extends ControllerBase {
    public function loginAction() {
        if ($this->request->isPost()) {
            $userComponent = new UserComponent();
            if ($userComponent ->login($username, $password)) {
                //json OK
            } else {
                //json Error
            }
        }
    }
}