# Smart Tech OMP / Purchase Haat — Production-Readiness Release v2

**Release date:** 25 June 2026  
**Stack:** Raw PHP 8.2+, PDO MySQL/MariaDB, JavaScript, Bootstrap and Apache rewrite rules  
**Composer/Node requirement on server:** None

This package contains the completed marketplace release plus the second production-readiness update. It includes customer, vendor, affiliate/member, administrator, staff-RBAC and POS panels.

## Server requirements

- PHP 8.2 or newer; PHP 8.4 is supported
- PHP extensions: `pdo_mysql`, `mbstring`, `fileinfo`, `json`; `curl` is required for SSLCommerz
- MariaDB 10.6+ recommended; the supplied source database came from MariaDB 11.4
- Apache with `mod_rewrite`; `mod_headers` is strongly recommended
- HTTPS before live gateway credentials are enabled
- PHP write access to `storage/logs`, `storage/private_uploads` and `public/uploads`

## Installation paths

### Existing database that already received v1

1. Back up the current project files and database.
2. Upload this release over the previous completed release.
3. Import **only** `install/database_updates_v2.sql` once.
4. Review `app/config.local.php` against the current example.
5. Sign in and open `admin/control-panel-check.php`.

### Existing original database that has not received any completion migration

1. Back up the current project files and database.
2. Upload this release.
3. Import `install/database_updates_v1.sql` once.
4. Import `install/database_updates_v2.sql` once, after v1.
5. Configure `app/config.local.php` and run the control-panel health check.

### Fresh database

1. Create an empty database in cPanel/phpMyAdmin.
2. Import `install/smarmvty_smart_completed.sql` only.
3. Copy `app/config.local.example.php` to `app/config.local.php` and enter production values.
4. Sign in with an existing seeded account from the supplied project. Seeded demonstration accounts must change their password before dashboard/API access is allowed.

Do not import the complete database over a populated database. Do not import v1 or v2 again after using the complete fresh-install dump.

## Required configuration

Keep `app/config.local.php` private. The included Apache rules block direct browser access, but the file must also be excluded from public repositories and support screenshots.

Set at least:

- `APP_ENV=production`
- `APP_DEBUG=0`
- `APP_URL` with the exact HTTPS domain and subfolder, when applicable
- a random `APP_KEY` of at least 32 characters
- `FORCE_HTTPS=1`
- database host, port, name, username and password
- a random `CRON_TOKEN` of at least 24 characters
- mail sender address/name
- SSLCommerz store credentials and sandbox/live mode

Enable `TRUST_PROXY_HEADERS` only behind a trusted proxy/CDN that correctly replaces forwarded headers.

bKash and Nagad checkout remain unavailable until merchant-approved credentials and provider-specific server APIs are configured. The application will not treat an unverified browser callback as payment success.

## Security behavior in v2

- Database-offline/demo authentication has been removed; login fails closed.
- No database password or shared login password is embedded in executable configuration.
- Seeded demonstration accounts are forced through password change after v2 migration.
- Sessions use idle/absolute expiry, periodic regeneration and database-backed invalidation.
- Disabling an account or changing its password invalidates existing sessions through `auth_version`.
- Staff accounts use explicit module permissions managed from **Admin → Roles & Staff Permissions**.
- Customers and staff are managed by role-filtered screens, preventing cross-role account edits.
- Reports and financial/stock/payment/POS ledgers are read-only in generic administration screens.
- Uploads enforce authentication, CSRF, MIME/size checks and private storage for documents.
- Login, OTP, upload, export, contact, referral, withdrawal, wallet-transfer and reward endpoints are rate-limited.
- POS searches, held carts, scans, settings, receipts and customer creation are vendor-scoped.

## Cron jobs

Use PHP CLI whenever available. Replace the example account path with the actual server path.

```text
*/15 * * * * php /home/USER/public_html/cron/abandoned_cart_recovery.php
0 2 * * * php /home/USER/public_html/cron/backup.php
10 2 * * * php /home/USER/public_html/cron/sitemap_generate.php
30 23 * * * php /home/USER/public_html/cron/pos_day_close.php
0 3 * * 1 php /home/USER/public_html/cron/weekly_statement.php
15 3 * * 1 php /home/USER/public_html/cron/royalty_eligibility.php
30 3 1 * * php /home/USER/public_html/cron/monthly_statement.php
0 4 * * * php /home/USER/public_html/cron/rank_upgrade.php
15 4 * * * php /home/USER/public_html/cron/auto_suspend_reactivate.php
```

CLI cron execution does not need a URL token. Web-triggered cron requests require the configured `CRON_TOKEN`; CLI is preferred.

## Deployment workflow test

1. Confirm every critical item is green in `admin/control-panel-check.php`.
2. Change the seeded administrator password when prompted.
3. Create a staff account and verify that only assigned modules appear.
4. Register and approve a vendor; confirm it cannot access another vendor's POS data.
5. Register a customer, create a COD order and complete pending → confirmed → processing → shipped → delivered.
6. Confirm stock decreases once and status history/invoice records are present.
7. Test wallet transfer, reward conversion and withdrawal approval/rejection accounting.
8. Open a POS shift, sell a product, print its receipt, refund it and close the shift with expected cash/variance.
9. Test SSLCommerz in sandbox with real sandbox credentials and verify callback/IPN validation.
10. Run each cron command from CLI and inspect `storage/logs` plus the related `cron_runs` records.

## Supplied database files

- `install/database_updates_v1.sql` — completion migration for the original database
- `install/database_updates_v2.sql` — production-readiness/security migration; import after v1
- `install/smarmvty_smart_completed.sql` — complete fresh-install database containing the original schema plus v1 and v2

See `COMPLETION_REPORT.md` for the first completion audit and `PRODUCTION_READINESS_REPORT.md` for this update's security scope, validation and remaining live-server tests.

## Unified smart-form update

This build also includes the project-wide form standardization layer.

- 123 generic administrator modules now use schema-aware, sectioned forms.
- Foreign-key fields are rendered as live select boxes where the relationship is known.
- Image, logo, banner, avatar, OG image and document fields use secure upload controls instead of plain path inputs.
- Description/content fields have a built-in rich-text editor without external CDN dependencies.
- Slugs, meta titles, meta keywords, SKU/barcode/code values can be generated automatically.
- JSON fields are validated and can be formatted before submission.
- Search, pagination, file previews, status selectors and clearer table output are included.
- The vendor product form now matches the administrator product workflow while preserving vendor ownership and administrator approval controls.

No additional SQL migration is required for the unified form update.
