# Rice & Curry RMS — Anuradhapura
Restaurant Management System — Phase 1 (Foundation)

## What's in this build
Full DB schema (25+ tables) + working: Login, Dashboard, User Management,
Roles & Permissions, System Settings, Audit Log. Orders/Stock/Delivery/
Payroll/Finance/Reports are wired into the sidebar as placeholders —
these get built out in the next phases.

---

## 1. XAMPP Local Setup

1. Copy the whole `rms` folder into `C:\xampp\htdocs\rms`
2. Start Apache + MySQL in XAMPP Control Panel
3. Open `config/config.php` and confirm:
   - `DB_NAME` = `rms_anuradhapura` (or change if you prefer)
   - `DB_USER` = `root`, `DB_PASS` = `` (default XAMPP has no password)
4. Open your browser: **http://localhost/rms/install.php**
   - This creates the database, all tables, and seed data automatically
   - It also sets your admin password securely
5. After it says "Setup complete!", **delete `install.php`** (important — don't leave it live)
6. Go to **http://localhost/rms/public/login**
   - Username: `admin`
   - Password: `Admin@123`
   - **Change this password immediately** from Admin → Users → Edit

> Note: the app itself lives under `/public` (this is your document root in production).
> Locally that means URLs look like `http://localhost/rms/public/...`

---

## 2. cPanel Live Deployment

1. Upload the whole `rms` folder to your hosting (outside `public_html`, e.g. `/home/username/rms`)
2. Point your domain/subdomain's **document root** to `rms/public` (cPanel → Domains → set document root)
   - This keeps `config/`, `database/`, `app/` outside the web-accessible folder — safer
3. Create a MySQL database + user in cPanel → MySQL Databases, note down the credentials
4. Edit `config/config.php`:
   - Set `APP_ENV` to `'live'`
   - Set `DB_NAME`, `DB_USER`, `DB_PASS` to your cPanel MySQL credentials
   - Set your live domain in the `BASE_URL` for the `'live'` branch
5. Temporarily move `install.php` into the document root (`public/`) or adjust its path, run it once via browser, then **delete it**
6. Test login at your domain

---

## 3. Key Patterns (for future development)

- All DB access goes through `Database::getConnection()` — PDO, prepared statements only
- New pages: add a route in `routes.php`, a Controller in `app/controllers/`, a view in `app/views/`
- Permission-gate every controller action with `Auth::requirePermission('module_key', 'view|add|edit|delete')`
- Every meaningful action should call `AuditLogger::log(...)`
- `Router::url('path')` — always use this for links, never hardcode URLs (works on both XAMPP and cPanel)
- CSRF: every POST form needs `<?= $this->csrfField() ?>` and the controller must call `$this->verifyCsrf()`
- New DB tables → add to `database/schema.sql` and give it a migration number if it's a live update to an existing install

---

## 4. Default Login
| Username | Password   |
|----------|------------|
| admin    | Admin@123  |

**Change this immediately after first login.**
