# AI Auto Reply Marketing — Admin Panel

Core PHP + MySQL admin panel. No Composer, no framework — runs on any standard
cPanel shared hosting (PHP 7.4+, MySQL/MariaDB, Apache with mod_rewrite).

## This build is pre-configured for

- **Domain**: http://ai.wbtopper.in/
- **Database**: `wbtopper_aidata`
- **DB user**: `wbtopper_aiuser`
- `config/database.php` already has these credentials filled in — you only
  need to upload the files, import the schema, and log in.

## What's included (10/10 steps complete)

1. **Foundation** — 15+ table schema, PDO config, admin auth (opaque bearer
   token sessions), brute-force login protection
2. **Dashboard** — user/revenue/call stats + 3 live charts (Chart.js)
3. **User management** — search/filter/paginate, create, block/unblock,
   reset password, reset device lock, extend/change plan, delete
4. **Templates** — CRUD, media upload, category/channel/event filters,
   enable/disable
5. **Banners** — CRUD, image upload, enable/disable
6. **Plans** — CRUD, enable/disable (referral commission lives in App Settings)
7. **Payments** — Razorpay / PhonePe / Manual UPI config (secrets masked,
   SUPER_ADMIN only), transactions list, UTR approve/reject with
   idempotent plan-extension (`FOR UPDATE` row lock)
8. **Reports & audit** — call log breakdown + filterable list, full audit
   trail of every admin action
9. **SMTP & app settings** — SMTP config + live test-email send (custom
   socket-based mailer, no PHPMailer/Composer needed), legal pages,
   social links, referral commission, AI (Gemini) key — all admin-editable
10. **Security & polish** — CSRF-safe design (bearer tokens, not cookies),
    input validation everywhere, uploads folder locked against PHP
    execution, responsive Bootstrap 5 UI (desktop/tablet/mobile),
    role separation (ADMIN vs SUPER_ADMIN for sensitive actions)

## Deploy to cPanel (ai.wbtopper.in)

1. **Upload files** — in cPanel File Manager, go to the document root for
   `ai.wbtopper.in` (this subdomain's own folder, not `public_html` unless
   the subdomain points there) and extract this zip's contents directly
   into it, so `admin/index.html` ends up at
   `http://ai.wbtopper.in/admin/index.html`.

2. **Import the schema** — cPanel → phpMyAdmin → select `wbtopper_aidata` →
   Import → choose `database/schema.sql` → Go. This creates all 19 tables
   and seeds the default plans, payment gateway rows, and admin account.

3. **Database credentials are already set** in `config/database.php`
   (`wbtopper_aidata` / `wbtopper_aiuser`) — nothing to edit here unless
   the password changes later.

4. **First login** — go to `http://ai.wbtopper.in/admin/` and log in with:
   - Email: `admin@gmail.com`
   - Password: `Admin@123`

   **Change this password immediately** after the first login (there's a
   "change password" endpoint wired in, or update it directly via
   phpMyAdmin using PHP's `password_hash()` if you prefer — see
   `tools/generate_password_hash.php` for a self-serve way to generate a
   verified hash any time without needing to ask anyone).

5. **Set up SMTP** — Admin panel → SMTP section → use your cPanel mail
   account for this domain (typically `mail.ai.wbtopper.in` or
   `mail.wbtopper.in`, port 465, SSL) → Save → send a test email to confirm.

6. **Configure payment gateways** — Payment gateways section (SUPER_ADMIN
   only) → add your real Razorpay/PhonePe keys or Manual UPI ID + QR code.
   Only one gateway should be marked active in production at a time.

7. **Point the Flutter app at this backend** — the app will call
   `http://ai.wbtopper.in/api/...` once the user-facing APIs are built in
   the next phase (same patterns as the `api/admin/*.php` files here).
   Switch to `https://` once an SSL certificate is issued for the
   subdomain (cPanel → AutoSSL, usually automatic).

## Security notes

- All admin API endpoints require a valid `Authorization: Bearer <token>`
  header — no session cookies, so it works identically from the web panel
  and from any admin mobile client.
- Payment gateway secrets and SMTP password are **masked** in every GET
  response — the UI never round-trips real secrets back to the browser.
  Only SUPER_ADMIN can view/edit payment gateway and SMTP config.
- The `uploads/` folder has a `.htaccess` that blocks PHP execution, so
  even if a malicious file were uploaded, it cannot run as a script.
- Every state-changing action is written to `audit_logs` with the admin's
  email, IP, and a short description — visible under Audit Logs.

## Local testing (optional)

If you want to test on your own machine before uploading to cPanel:

```bash
php -S localhost:8000 -t .
```

Then open `http://localhost:8000/admin/` in your browser (make sure MySQL
is running locally and `config/database.php` points to it).
