Configure Mobile Login Rules

I have an existing mobile application running in production and I now need the backend adjusted so that log-in behaviour and access are controlled by clear, enforceable rules. Your task is to design and implement those rules on the server side, wire them into the current API, and verify that the app responds correctly.

What I already have
• A functioning mobile front-end that hits a live backend
• Basic user accounts already stored in the database

What I need from you
1. Clearly defined login flow that the app will follow (session, token, or similar—advise on best fit).
2. Rule set that determines who can reach which endpoints or data.
3. Code changes and migrations applied to the existing repository (Git).
4. Post-implementation tests to confirm the rules work on real devices.
5. A short technical note that documents the new logic so my in-house team can maintain it.

Tech stack is standard REST over HTTPS; we are open to any language-specific libraries you normally use (Node.js, Django, Laravel, Spring Boot—your choice, as long as it integrates cleanly). Please outline your proposed approach, a timeline, and any past work securing mobile apps.

I am ready to grant repo access and staging credentials as soon as we agree on the plan.