# CashPit LAMP Project

This package contains:
- MySQL schema
- PHP mobile APIs
- PHP admin dashboard
- Postman collection
- Twilio SMS hook
- Gmail SMTP email hook via PHPMailer
- APNs token-based push notification helper (no Firebase)

## Stack
- PHP 8.1+
- MySQL 8+
- Apache/Nginx
- jQuery + DataTables + Bootstrap 5

## Setup
1. Copy `.env.example` to `.env`
2. Fill database, Gmail SMTP, Twilio, and APNs credentials in `.env`
3. Run:
   ```bash
   composer install
   ```
4. Import database:
   ```bash
   mysql -u root -p < sql/schema.sql
   ```
5. Point your web server document root to the project directory or serve through Apache in a subfolder.

## API Base URL
```text
http://localhost/cashpit_app/api/v1/index.php?endpoint=ENDPOINT_NAME
```

## Admin Dashboard URLs
- Login: `/public/admin/login.php`
- Signup: `/public/admin/signup.php`
- Users: `/public/admin/users.php`
- CashPits: `/public/admin/cashpits.php`
- Debit Card Requests: `/public/admin/debit-card-requests.php`

Default seeded admin:
- Email: `admin@example.com`
- Password: `Admin@123`

## Notes
- `debit_card_number` is stored in the database so the app can derive the last four digits. The login response omits the full card number.
- `toggle_2fa` supports `verification_method_2fa` as `face_id` or `text_msg`.
- `signup` sends the verification code by SMS when `mobile_number` is present, otherwise by email.
- `login` issues a token in `access_tokens` and returns the user's CashPits.
- `deposit_to_main_balance` distributes funds by `auto_deposit_percent` and sends the remainder to `main_balance`.
- `unlock_cashpit` applies a 10% penalty to the CashPit balance.
- DataTables row-length preference is stored in browser localStorage.
- Bulk actions exist for Users, CashPits, and Debit Card Requests.

## Security recommendations before production
- Move all secrets into `.env` only; never hardcode them.
- Add HTTPS, CSRF protection for admin forms, API auth middleware, and rate limiting.
- Validate card spending limits and 2FA verification flow more strictly.
- Add background jobs or cron for merchant auto-pay processing.
- Store APNs device tokens per device instead of a single user field when you support multiple devices.


## API Notes
- `login` returns an `access_token`. Send that token in the JSON body as `access_token` for every protected API request.
- Open endpoints: `signup`, `account_verification`, `login`.
- Protected endpoints return HTTP 401 for missing/invalid/expired tokens and HTTP 403 when the token does not belong to the requested `user_id`.


## Numeric type notes

The following fields are stored and handled as `float` consistently across the database schema and APIs: `main_balance`, `debit_card_spending_limit`, `target_amount`, `current_balance`, and `merchant_monthly_payment_amount`.