# Maros Global — Deployment & Setup Guide

This is a full Laravel 11 application: customer storefront + seller/admin
portal. Follow these steps in order to get it live on your cPanel hosting.

---

## 0. What you already need from your hosting provider

- cPanel access with **PHP 8.2+** selected (cPanel → *MultiPHP Manager*)
- A **MySQL database** created in cPanel → *MySQL Databases* (note the DB
  name, username, password — cPanel prefixes them with your account name,
  e.g. `marosglob_ecommerce`)
- **SSH access** or the cPanel **Terminal** app, to run one `composer install`
  command. If your host truly has neither, see the "No terminal access"
  fallback at the bottom.
- Your domain already pointed at this hosting account (you said you have this).

---

## 1. Upload the code

1. Extract the zip you received.
2. Upload the **entire contents** to your hosting account, e.g. into
   `~/marosglobal/` (not directly into `public_html`, for security — see step 3).
3. Or `git clone`/upload via SFTP — either works.

## 2. Install PHP dependencies

In cPanel Terminal (or SSH):

```bash
cd ~/marosglobal
composer install --no-dev --optimize-autoloader
```

This downloads the Laravel framework and other libraries listed in
`composer.json`. It creates the `vendor/` folder (intentionally not included
in the zip — this is standard practice for any PHP/Composer project).

If your host doesn't have `composer` on the PATH, cPanel usually has a
**"Setup Composer App"** or you can run `php composer.phar install` after
uploading `composer.phar` (download from https://getcomposer.org/composer.phar
using your own machine and upload it).

## 3. Point your domain to the `public/` folder

This is the most important step for security — the `app/`, `.env`, and
`database/` folders must **never** be web-accessible.

**Best option:** In cPanel → *Domains*, edit your domain and set its
**Document Root** to `marosglobal/public` (i.e. the `public` folder inside
where you uploaded the code).

**If your host won't let you change the document root** (some very basic
shared plans): upload the code as `~/marosglobal` (outside `public_html`),
then copy `.htaccess.root-fallback` into `public_html/.htaccess` and copy
everything from `marosglobal/public/*` into `public_html/`, editing
`public_html/index.php`'s two `require` paths to point up to
`../marosglobal/vendor/autoload.php` and `../marosglobal/bootstrap/app.php`.
Setting the document root is strongly preferred if at all possible.

## 4. Configure your `.env` file

```bash
cd ~/marosglobal
cp .env.example .env
php artisan key:generate
```

Edit `.env` and fill in:

- `APP_URL` — your real domain, e.g. `https://marosglobal.com`
- `DB_DATABASE`, `DB_USERNAME`, `DB_PASSWORD` — from the MySQL database you
  created in cPanel
- `MAIL_*` — your email sending details (cPanel usually gives you an SMTP
  mailbox like `orders@marosglobal.com`)
- `ADMIN_EMAIL` / `ADMIN_PASSWORD` — **add these two lines** before seeding,
  so your first admin account isn't the placeholder one:

```
ADMIN_EMAIL=you@marosglobal.com
ADMIN_PASSWORD=SomethingLongAndRandom!
```

## 5. Run migrations, seed initial data, link storage

```bash
php artisan migrate --force
php artisan db:seed --force
php artisan storage:link
```

This creates all database tables, creates your admin account, and creates
the payment-method rows (all disabled by default — enable and configure them
in step 7), a default delivery charge, and starter categories.

`storage:link` creates the `public/storage` symlink so uploaded product
images are actually reachable from the browser.

## 6. Set folder permissions

```bash
chmod -R 755 storage bootstrap/cache
```

## 7. First login and configuration

1. Visit `https://yourdomain.com/admin/login` and log in with the
   `ADMIN_EMAIL` / `ADMIN_PASSWORD` you set in step 4.
2. Go to **Payment Settings** — enter your real bKash/Nagad/Rocket numbers
   and/or bank details, and toggle "enabled" for whichever you accept.
   (Nothing is visible to customers at checkout until you enable it here.)
3. Go to **Delivery Settings** — set your delivery charge.
4. Go to **Categories** — adjust/add your real product categories.
5. Go to **Products → Add Product** — add your first real product with
   colour variants and stock quantities.

## 8. SSL

Use cPanel's **AutoSSL** (or Let's Encrypt) to issue a free certificate for
your domain — most cPanel hosts do this automatically once the domain is
active. Once SSL is on, the app forces HTTPS automatically in production
(see `AppServiceProvider`).

## 9. Cron (recommended, optional)

Laravel's queue/scheduler isn't required for this app to function today (all
processing happens inline), but if you later add features like email/SMS
notifications, add this cron job in cPanel → *Cron Jobs*:

```
* * * * * cd ~/marosglobal && php artisan schedule:run >> /dev/null 2>&1
```

---

## What you need to provide / decide (not invented by this build)

- **bKash / Nagad / Rocket account numbers** — enter in Admin → Payment Settings
- **Bank account details** — enter in Admin → Payment Settings
- **SMTP email credentials** — for order emails (fill in `.env` `MAIL_*`)
- **Delivery charges** — set in Admin → Delivery Settings
- Any **SMS gateway** (for SMS notifications) or **courier API** — not
  included, per your instruction to keep the architecture extensible rather
  than build unrequested integrations. These can be added later without
  restructuring the app.

---

## Updating the site later

```bash
cd ~/marosglobal
git pull   # or re-upload changed files
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache
```

## Security notes already built in

- Admin portal (`/admin`) is fully separated from the storefront and
  protected by role-based middleware — customer accounts cannot access it.
- Passwords are hashed (bcrypt) — never stored in plain text.
- Every price/stock check happens server-side at checkout inside a database
  transaction with row locking, so two customers can never oversell the last
  unit of a variant, and the frontend can never be trusted to set prices.
- Product variant `stock` is a hidden model attribute — it is never
  serialized into any customer-facing page or JSON response, only the
  admin controllers explicitly reveal it.
- Payment account numbers live only in the database, configured from the
  admin panel — never hard-coded in any frontend file.
- File uploads are restricted to image mime types/extensions and size limits.
- CSRF protection is on for every form (Laravel default).