@jorgediaz, I am including the user id in the $_SESSION variable in Authenticator.php:

<?php

namespace Core;

class Authenticator
{
    public function attempt($email, $password)
    {
        $user = App::resolve(Database::class)
				->query('select * from users where email = :email', [
'email' => $email
        ])->find();
        if($user) {
            if(password_verify($password, $user['password'])){
                $this->login([
                    'id' => $user['id'],
                    'email' => $user['email']
                ]);
                return true;
            }
        }
        return false;
    }

    public function login($user)
    {
        $_SESSION['user'] = [
            'id' => $user['id'],
            'email' => $user['email']
        ];
        session_regenerate_id(true);
    }

    function logout()
    {
        Session::destroy();
    }

}

and then retrieving the user like this in notes/store.php, for example:

$currentUserId = $_SESSION['user']['id'];
$db->query('INSERT INTO notes(body, user_id) VALUES(:body, :user_id)', [
    'body' => $_POST['body'],
     'user_id' => $currentUserId
]);

and elsewhere the authenticated user is needed. I would like someone to review/correct/improve/replace this code.

Install Two Composer Packages: Collections and PestPHP