# SLBD ERP — Setup Guide (v1.0.0)

Setup is now UltimatePOS-style: upload → visit `/install/` → fill two short forms → done. No manual file editing, no phpMyAdmin import, no throwaway scripts.

## 1. Upload to cPanel
1. In cPanel → **Domains**, point your domain/subdomain's document root at this project's `public_html/` folder (e.g. create subdomain `erp.startlaunchbd.com` → document root `slbd-erp/public_html`).
2. Upload the whole `slbd-erp/` folder via File Manager or FTP so the structure is:
   ```
   /home/yourcpaneluser/slbd-erp/app/          <- NOT web-accessible
   /home/yourcpaneluser/slbd-erp/database/     <- NOT web-accessible
   /home/yourcpaneluser/slbd-erp/public_html/  <- THIS is your document root
   ```

## 2. Create an empty database
cPanel → **MySQL Databases** → create a database (e.g. `slbd_erp`) and a user with **all privileges** on it. Write down the three values cPanel gives you (it'll prefix both with your account name, e.g. `ebnhost_slbd_erp` / `ebnhost_dbuser`) — that's all you need, don't touch phpMyAdmin.

## 3. Run the installer
Visit `https://yourdomain.com/install/` in your browser. Three short steps:

1. **Requirements** — auto-checks PHP version, extensions, and folder permissions. Green across the board and you continue; anything red tells you exactly what to fix (usually a folder CHMOD or asking your host to enable an extension).
2. **Database** — paste in the DB name/user/password from step 2 and confirm your site URL (pre-filled automatically). Hit continue and the installer tests the connection, creates all 20 tables, and seeds default data itself.
3. **Admin account** — your name, email, password. This becomes your login.

That's it — you're redirected straight to the dashboard.

**Delete `public_html/install/` after setup finishes** (File Manager → select the folder → Delete). The installer already locks itself against re-running even if you forget, but deleting it removes the attack surface entirely.

---

## How the self-updater works (for future updates)

When I hand you the next module (e.g. Invoices), I'll package it as a `.zip` containing:
```
version.txt                          <- e.g. "1.1.0"
public_html/modules/invoices/...     <- new/changed files
app/...                              <- any changed core files
database/migrations/002_xxx.sql      <- only if new tables/columns are needed
```

To apply it: **Team → System Update** (admin only) → upload the zip → **Backup & Apply Update**.

What happens automatically:
1. Current `app/` + `public_html/` (minus your `uploads/` and `env.php`) gets zipped into `app/backups/` first.
2. New files are copied over the old ones.
3. Any migration file not yet applied gets run once and recorded — so re-uploading a package by accident never re-runs a migration or double-charges a change.
4. Version number and update history update automatically.

**One MySQL limitation to know:** schema changes (`ALTER TABLE`, `CREATE TABLE`) auto-commit in MySQL, so they can't be wrapped in a rollback-able transaction. Keep each migration file focused on one change, and I'll test every migration before it's included in a package.

**Rollback:** file changes can be restored from the timestamped zip in `app/backups/` via File Manager. Database changes from a migration are not auto-reverted — export the DB from phpMyAdmin before major updates if you want an easy undo point.

---

## Confirmed test results (run in a sandboxed MySQL/PHP environment before delivery)
- ✅ **Installer**: requirements check, DB connection test + auto schema import (20 tables), env.php auto-generation, admin account creation, self-lock after completion (blocks even a direct POST attempt to re-run)
- ✅ Full journey: fresh upload → installer → login → dashboard, no manual steps
- ✅ RBAC: employee correctly blocked from Loans, System Update; correctly allowed into Clients (view-only) and Work Log
- ✅ Work log entry → live progress bar math (3/5 → correctly shows over-limit at 6/5)
- ✅ Self-update: real ALTER TABLE migration applied, version bumped, backup created, re-upload correctly skipped the already-applied migration
- ✅ Security: non-zip upload rejected, zip-slip (path traversal) attack rejected, installer permanently locks after setup