# Smart Tech OMP / Purchase Haat Completion Report

**Release date:** 24 June 2026  
**Technology:** Raw PHP, PDO MySQL/MariaDB, JavaScript, Bootstrap, Apache rewrite rules

## Audit summary

The supplied archive and SQL dump were reviewed as one application. The database already described a large marketplace, POS and affiliate platform, but much of the PHP layer was a mixture of working modules, generic wrappers, hardcoded sample screens and API placeholders. Existing server logs also showed missing-table and duplicate-registration failures.

This release turns the core business paths into database-backed, role-controlled operations and adds an incremental migration so the existing database can be retained.

## Main corrections

### Platform and security

- Added local/environment configuration support without Composer.
- Hardened sessions, CSRF handling, role checks, JSON endpoints, uploads and exports.
- Added secure password-reset token storage and expiry handling.
- Prevented duplicate email/phone registration crashes.
- Removed stale error logs, backup source files and the nested obsolete release archive.
- Blocked direct access to SQL, logs, local configuration and storage files through Apache rules.

### Marketplace

- Replaced hardcoded catalog/category/brand/shop/CMS/tracking/contact views with live database queries.
- Rebuilt cart and checkout around a transaction that locks products/variants and recalculates prices, stock, shipping, coupon discount and wallet payment on the server.
- Added order items, status history, payment rows, stock ledger changes and customer/vendor visibility.
- Added vendor item fulfillment and automatic marketplace-order completion when all vendor items are delivered.
- Added COD payment completion and affiliate settlement only after paid + delivered conditions are met.

### Payments

- Removed the insecure callback that accepted a browser-supplied payment status.
- Added SSLCommerz session creation, callback/IPN processing and server validation of transaction ID, amount and BDT currency.
- Added idempotent payment recording so repeated callbacks do not pay an order twice.
- Kept bKash/Nagad safely disabled until actual merchant credentials and provider-approved API details are provided.

### Wallets and withdrawals

- Added row-locked wallet debit/credit operations and transaction records.
- Withdrawal requests move money into a hold wallet.
- Approval releases the hold once and records the fee in the administration wallet.
- Rejection/cancellation returns the full held amount to the source wallet.
- Finalized withdrawal requests cannot be processed twice.

### Affiliate / PSA

- Added referral click/session attribution, member plans, selected products and live landing pages.
- Connected eligible paid-and-delivered orders to PSA, commission, rank, conversion and statement data.
- Added idempotency constraints to prevent duplicate commission processing.
- Implemented weekly/monthly statements, rank upgrades, royalty cycles and suspension/reactivation jobs.

### POS

- Enforced vendor/register/cashier/shift ownership.
- Ignored client-supplied product prices and recalculated every line from locked database records.
- Merged duplicate cart lines before checking stock.
- Validated split payments and prevented non-cash overpayments from creating cash change.
- Added customer-wallet payment checks, accurate cash expected totals, stock ledgers and receipts.
- Prevented cumulative refunds from exceeding the original sale and connected cash/wallet refund accounting.
- Added secure shift opening/closing, variance calculation and cash-in/cash-out updates.

### Database migration

The migration adds missing tables and fields used by the completed code, including:

- `commission_rules`
- `contact_messages`
- `password_reset_tokens`
- affiliate attribution, conversion and idempotency indexes
- vendor coupon ownership
- order-item fulfillment/tracking fields
- withdrawal processing timestamp/indexes
- payment, OTP, statement and royalty indexes

## Validation performed

- Full PHP syntax check across the release: no syntax errors.
- JavaScript syntax check for project JavaScript files.
- HTTP smoke tests against the local PHP server for key public routes.
- Module-registry/table comparison against the completed SQL.
- Search for operational placeholder/TODO handlers.
- Release archive integrity test after packaging.

## Limits of the local test environment

The build container did not include the PDO MySQL or cURL PHP extensions and had no access to the user's live MariaDB server or merchant accounts. Therefore, live database transactions, email delivery and real payment-gateway settlement could not be executed here. Those items must be verified on the target web server using the deployment checklist in `README.md`.

The code deliberately refuses to claim successful bKash or Nagad payments without a real approved integration. SSLCommerz still requires the user's store credentials and sandbox/live configuration.


## Production-readiness follow-up

The 25 June 2026 v2 update adds fail-closed authentication, forced seeded-password rotation, session invalidation, staff module permissions, cross-vendor POS isolation, read-only ledger/report screens, persistent rate limits and deployment diagnostics. See `PRODUCTION_READINESS_REPORT.md`.
