SAFE RESOURCES LTD - V6.1 ONLINE / MOBILE PRODUCTION GUIDE
============================================================

IMPORTANT
1. Make a full database backup before any migration.
2. If your current database already received V6's database/update_v6.sql, import only:
   database/update_v6_1_production.sql
   If it has NOT received V6 yet, import update_v6.sql first, then update_v6_1_production.sql.
3. Do NOT import security_management.sql over your live database.

RECOMMENDED HOSTING
- PHP 8.1+ (8.2/8.3 recommended)
- MySQL 8 or MariaDB 10.5+
- HTTPS/SSL certificate
- Apache with mod_headers; mod_rewrite recommended
- PHP PDO MySQL extension
- Set the web/subdomain DocumentRoot to: security_management_system/public

DATABASE SETTINGS
The application now reads hosting environment variables:
DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASS, APP_BASE_URL, APP_ENV.

If your host provides an Environment Variables panel, use it.
Example:
APP_ENV=production
DB_HOST=localhost
DB_PORT=3306
DB_NAME=your_host_database
DB_USER=your_host_database_user
DB_PASS=your_strong_database_password
APP_BASE_URL=https://your-domain.example

If APP_BASE_URL is not supplied, the app tries to detect the /public URL automatically.

SECURITY BEFORE GOING LIVE
- Never use root as the online database user.
- Give the database user access only to this application's database.
- Use HTTPS.
- Remove/disable any unused FTP accounts.
- Change the admin password BEFORE public launch.
- The old admin/admin123 fallback is disabled when APP_ENV=production.

To change a password on a machine with PHP CLI:
php tools/set_user_password.php admin "A-Strong-Password-Here"

If your shared host has no CLI, generate a PHP password_hash locally and update users.password in phpMyAdmin.

MOBILE
- Navigation collapses into a phone menu.
- Forms use full-width phone controls.
- Ordinary tables turn into stacked mobile cards.
- The weekly roster remains a horizontally swipeable schedule with the guard column sticky.
- Buttons and pagination are touch-friendly.

PUBLIC DOCUMENT ROOT
Best setup:
your subdomain -> /path/to/security_management_system/public

This prevents config/, database/, storage/, includes/ and tools/ from being web-accessible.
.htaccess rules are included as additional protection, but DocumentRoot-to-public is still recommended.

ERROR LOGS
Technical PHP errors are written to:
storage/php-errors.log
Do not make the storage folder publicly browsable.

BACKUPS
Before migrations and at least daily in production, back up:
- MySQL database
- uploaded/generated application files, if any are added later


ADMIN PASSWORD MIGRATION
------------------------
The historical admin/admin123 compatibility works ONLY from localhost so you can safely
migrate an old installation:
1. Run the upgraded app on XAMPP.
2. Sign in locally with admin/admin123 if your old stored hash is not valid.
3. Open Account -> Change Password.
4. Set a strong password of at least 10 characters.
5. Back up that updated database and use it for the online deployment.
admin/admin123 is NOT accepted from the public internet.
