# Installation Guide — cPanel Shared Hosting

## 1. Requirements

- PHP 8.0 or higher (PHP 8.1–8.3 recommended)
- MySQL 5.7+ or MariaDB 10.3+
- PHP extensions: `pdo_mysql`, `mbstring`, `fileinfo`, `curl`, `openssl`,
  `json` (all enabled by default on virtually every cPanel host)
- No Composer, no Node.js, no shell access required (though cron jobs need
  cPanel's built-in "Cron Jobs" UI, which every host provides)

## 2. Upload the files

1. Zip the contents of this project (already done if you're reading this
   from the delivered zip).
2. In cPanel → File Manager (or via FTP), upload and extract into
   `public_html/` (or a subfolder like `public_html/school-erp/` if you want
   it at a sub-path — the app auto-detects its depth, no code changes
   needed).

## 3. Import the database schema

Your database (`mytoolsh_schooldata`) and user (`mytoolsh_schooluser`) are
already created. Just import the schema:

1. cPanel → **phpMyAdmin** → select `mytoolsh_schooldata` → **Import** →
   choose `database/schema.sql` → Go.
   - This creates all 37 tables and seeds: 3 default subscription plans
     (Trial/Basic/Pro), one super admin login, and default global settings.

## 4. Configure the application

**This is already done for this deployment** — `config/constants.php` is
pre-configured with:
```php
define('DB_NAME', 'mytoolsh_schooldata');
define('DB_USER', 'mytoolsh_schooluser');
define('DB_PASS', 'Samir@154198');
define('JWT_SECRET', '35c026d27b40707f95610a9d9fc80cf390cdaede64b59714a2a0aafc8302a89c');
define('APP_DEBUG', false);
```
No editing needed unless you're redeploying this same codebase to a
**different** database/hosting account — in that case, update the four `DB_*`
values to match the new database.

## 5. Set folder permissions

Via File Manager, right-click → Permissions:

- `uploads/` and all its subfolders → `755` (writable by PHP)
- `backups/` → `755`
- Everything else → default (`644` for files, `755` for folders) is fine.

## 6. First login & first school

1. Visit `https://yourdomain.com/admin/super-admin/login.php`
2. Log in with the seeded super admin:
   - Email: `superadmin@schoolerp.com`
   - Password: `Admin@123`
3. **Immediately** go to your profile / change password (or update the
   `erp_super_admins` row directly via phpMyAdmin using
   `password_hash()` — there's no self-service "change password" screen for
   super admin in v1, use **Forgot Password** flow or update the DB row
   directly with a bcrypt hash).
4. Go to **Add School** — this creates the school AND its first Admin
   login in one step. Note the Admin email/password you set; hand these to
   the school.
5. Log into `https://yourdomain.com/admin/school-admin/login.php` with
   those credentials to start configuring the school (classes, sections,
   subjects, then students/teachers).

## 7. Set up cron jobs (recommended, not required for basic operation)

cPanel → **Cron Jobs** → Add New Cron Job for each of the following. Use the
full path to PHP CLI on your host (commonly `/usr/local/bin/php` or
`/usr/bin/php` — check cPanel → "Select PHP Version" page for the exact
path, or ask your host).

| Job | Schedule | Command |
|---|---|---|
| Fee reminders | Daily, e.g. 8:00 AM | `/usr/local/bin/php /home/USER/public_html/cron/fee-reminders.php` |
| Push notification delivery | Every 5 minutes | `/usr/local/bin/php /home/USER/public_html/cron/send-push-notifications.php` |
| Nightly database backup | Daily, e.g. 2:00 AM | `/usr/local/bin/php /home/USER/public_html/cron/nightly-backup.php` |
| Subscription expiry check | Daily, e.g. 1:00 AM | `/usr/local/bin/php /home/USER/public_html/cron/subscription-check.php` |

Replace `/home/USER/public_html/` with your actual absolute path (visible
in cPanel's File Manager path bar).

## 8. Set up Firebase Cloud Messaging (for push notifications)

Push notifications are queued into the database regardless of whether FCM
is configured (so nothing breaks without it), but to actually deliver them
to phones:

1. Create a Firebase project at https://console.firebase.google.com (free).
2. Add your Flutter app to it (Android/iOS) and follow Firebase's
   `google-services.json` / `GoogleService-Info.plist` setup in the Flutter
   project.
3. Firebase Console → Project Settings → **Service Accounts** → **Generate
   new private key** → downloads a JSON file.
4. Upload that JSON file to your server **outside** `public_html/` (e.g.
   `/home/USER/firebase-service-account.json`) so it is never web-accessible.
5. Edit `cron/send-push-notifications.php` and set:
   ```php
   define('FIREBASE_SERVICE_ACCOUNT_PATH', '/home/USER/firebase-service-account.json');
   define('FIREBASE_PROJECT_ID', 'your-firebase-project-id');
   ```
6. The Flutter app calls `POST /api/notifications/register-token.php` after
   login (and whenever FCM issues a refreshed token) to register each
   device — this is required for delivery to work.

## 9. SMS/Email for password resets (optional, TODO wiring)

`api/auth/forgot-password.php` generates a 6-character reset code and
stores it in `erp_password_resets`, but does **not** send it anywhere yet —
wire in your SMS gateway (for parent/phone logins) or SMTP (for
admin/teacher email logins) at the marked `// TODO` in that file. This
mirrors the same pattern used elsewhere in the codebase (MSG91/Fast2SMS,
SMTP) — see the school's own **Settings** page for where credentials would
typically be configured per-school.

## 10. Verify everything works

- [ ] Super admin can log in and see the dashboard
- [ ] Creating a school works and the admin login is issued
- [ ] School admin can log in and add a class/section/subject
- [ ] Adding a student auto-creates a parent login (check **Parents** page)
- [ ] `POST /api/auth/login.php` with `role: parent` and the student's
      mobile number returns a token (test with curl or Postman — see
      `API_DOCUMENTATION.md`)
- [ ] Marking attendance as Absent queues a notification (check
      `erp_notification_log` table — it will sit as `pending` until the
      push cron + Firebase are configured)
- [ ] File uploads (student photo, homework attachment) work and the
      resulting URL is reachable in a browser

## Troubleshooting

**"Authorization token missing" on every API call, even with a valid
token** — Your host is stripping the `Authorization` header. The root
`.htaccess` already includes a `mod_rewrite` fix for this; if it still
fails, ask your host to enable `CGIPassAuth On` for your account, or add
this to `.htaccess`:
```apache
CGIPassAuth On
```

**"DB connection failed"** — Double-check `DB_HOST`/`DB_NAME`/`DB_USER`/
`DB_PASS` in `config/constants.php`. On most cPanel hosts, `DB_HOST` is
`localhost` and the DB name/user are prefixed with your cPanel username
(e.g. `youruser_schoolerp`).

**Uploaded images/PDFs 404** — Check that `UPLOAD_URL_BASE` in
`config/constants.php` matches where you deployed the app (e.g. if you
deployed to a subfolder `school-erp/`, set it to `/school-erp/uploads`).