# Smart Tech OMP / Purchase Haat Production-Readiness Update

**Release:** v2  
**Release date:** 25 June 2026  
**Base:** Completed release dated 24 June 2026

## Purpose

The completion release restored the marketplace, vendor, affiliate, wallet, payment and POS transaction paths. This second update focuses on production failure modes: insecure fallbacks, stale sessions, cross-role/cross-vendor authorization, direct ledger editing, unsafe deployment defaults and incomplete operational diagnostics.

## Authentication and session hardening

- Removed the database-offline demonstration-login fallback. Authentication now fails closed when MariaDB is unavailable.
- Removed the real-looking default database password from application configuration.
- Added idle and absolute session expiry, periodic session-ID regeneration and periodic account-status revalidation.
- Added `users.auth_version` so password resets, account suspension and administrator-triggered password changes invalidate existing sessions.
- Added `users.must_change_password` and a mandatory password-change workflow.
- Marked the supplied seeded demonstration accounts for password replacement when v2 is imported.
- Removed prefilled credentials from login screens and rejected non-administrator roles from the administrator login endpoint.
- Added persistent database-backed rate limiting for login and sensitive API requests.

## Staff permissions and account isolation

- Added module-level staff permissions using `permissions`, `roles` and `role_permissions`.
- Filtered the administrator sidebar according to the signed-in staff account's allowed modules.
- Added a permission-management screen for the built-in staff role.
- Replaced generic users-table management with dedicated staff and customer screens.
- Staff creation and administrator password reset use strong temporary passwords and force first-login replacement.
- Customer/staff exports are role-filtered and exclude password hashes, transaction PIN hashes, tokens, secrets and raw gateway payloads.
- Replaced the customer report wrapper with a read-only customer-only report.

## Financial, stock and report integrity

- Generic report screens are read-only.
- Wallet balances, administration wallets, payments, payment logs, reward ledgers, stock ledgers, PSA transactions, royalty results, affiliate statements, activity/login logs and POS ledgers cannot be edited directly through generic CRUD pages.
- Withdrawal requests now validate method, amount, account-detail length, PIN and request frequency before moving money into the hold wallet.
- Wallet transfers are rate-limited, amount-validated and audit logged.
- Reward conversion now locks the user's point-ledger rows inside the transaction before validating and crediting the purchase wallet, preventing concurrent over-redemption.

## POS and vendor isolation

- Removed POS-role aliases that previously allowed a cashier/manager to enter the vendor panel as a vendor.
- Vendor accounts resolve only their own approved vendor profile.
- Administrator/staff POS access requires an explicit valid vendor selection.
- Held carts, product search, receipt lookup, scan logging, settings and customer creation are scoped to the selected/assigned vendor.
- POS staff assignment validates vendor, outlet, register and user ownership and does not convert arbitrary existing users into POS staff.

## Affiliate and referral controls

- Affiliate plan activation now requires valid payment/wallet handling and prevents duplicate active enrollment.
- Member pages no longer silently create an affiliate profile without a valid plan.
- Referral clicks validate the referral code/member, constrain redirect paths, rate-limit requests and store safe request metadata.
- Vendor affiliate screens no longer fall back to another shop when the current vendor has no approved profile.

## Upload, API and deployment safety

- Public image uploads enforce authentication, CSRF, MIME, size and image-dimension checks.
- PDF documents are stored outside the public tree and served only through an authorized media endpoint.
- Executable extensions are blocked from the public upload folder without blocking valid images.
- API JSON responses use no-store and include request IDs for error tracing.
- CSV/Excel exports prevent spreadsheet-formula injection.
- `.htaccess` blocks direct access to application internals, SQL, logs, local configuration, storage and dotfiles.
- Dynamic PWA manifest and service-worker paths now support installation in a domain subfolder.
- Cron day closing now uses the shared cron authorization/bootstrap and updates idempotently by vendor/date.
- The control-panel checker now verifies security tables, session/password-rotation columns, configuration, HTTPS, extensions, writable storage and PWA files.

## Database changes

`install/database_updates_v2.sql` adds:

- `security_rate_limits`
- `users.auth_version`
- `users.must_change_password`
- `users.password_changed_at`
- staff-access permission rows for all registered administrator modules
- conservative default staff permissions
- supporting user/permission indexes
- mandatory password rotation for the supplied seeded demonstration accounts

The complete fresh-install SQL contains **135 tables**. All **109 unique database tables** referenced by the administration module registry are present.

## Static validation performed

- PHP syntax: **313 files passed**.
- JavaScript syntax: **100 files passed**.
- Administration module database coverage: **109/109 referenced tables present**.
- v2 module permissions seeded: **132 access permissions**.
- Executable database-offline login fallback removed.
- Embedded default database password removed.
- Production login forms contain no prefilled credentials.

## Live-server tests still required

This container does not have access to the target MariaDB database, mail server, writable hosting account, cron service or payment merchant accounts. Therefore these items must be verified after upload:

- SQL import on the server's MariaDB version
- real registration/login/password-reset email delivery
- writable upload/log/backup directories
- complete COD and wallet order lifecycle
- POS cash, wallet, split-payment, refund and close-shift lifecycle
- SSLCommerz sandbox session, callback and IPN validation
- cron execution and retention behavior
- Apache rewrite/header rules and subfolder PWA installation

bKash and Nagad are intentionally not represented as completed live integrations without approved merchant APIs and credentials.
