# Nexora SMS Gateway — Installation Guide

## What's included (working core)
- Full MySQL schema (`database/schema.sql`)
- User panel: register, login, dashboard, device list, manual SMS send
- Admin panel: dashboard, users (block/change plan), plans (create/delete), devices, API logs, APK link settings
- API: `/api/device/connect`, `/api/device/status`, `/api/device/settings`, `/api/sms/fetch`, `/api/sms/update`, `/api/send`
- Security: PDO prepared statements, password hashing, CSRF tokens on all admin/user forms, per-API-key rate limiting, session hardening

## Also included now
- `user/checkout.php` — plan picker that creates a pending payment record
- `api/payment/webhook.php` — gateway-agnostic webhook skeleton (signature
  verification is a TODO — plug in your provider's HMAC check before going
  live, it refuses to process anything until you do)
- `admin/payments.php` — admin can manually confirm/reject pending payments
  in the meantime (activates the subscription immediately on confirm)
- `admin/create-user.php` — create a user account directly from the admin panel
- `user/api-keys.php` — users can generate/revoke multiple API keys themselves

## Not included yet (stubbed / for you to extend)
- Actual payment gateway wiring (Razorpay/Stripe/etc signature verification
  and hosted checkout redirect) — do this once you have the provider's docs
- Email verification / password reset flow

## Deploy steps (cPanel — matches your `mgamero1` / `mgameron` setup on DraggerHost)

1. Upload the contents of this folder to your domain's document root, e.g.
   `public_html/` for `nexoraclub.mgamer.online` (or a subdomain folder if you're
   hosting it under a subdomain in cPanel).

2. In cPanel → MySQL Databases:
   - Create a database (e.g. `mgamero1_nexora`)
   - Create a DB user, add it to the database with all privileges
   - Import `database/schema.sql` via phpMyAdmin

3. Edit `includes/config.php`:
   ```php
   define('DB_NAME', 'mgamero1_nexora');
   define('DB_USER', 'mgamero1_youruser');
   define('DB_PASS', 'your-password');
   ```

4. Default admin login: `admin` / `ChangeMe123!`
   **Change this password immediately** — log into `/admin/login.php`, then
   run this once via phpMyAdmin to set a new one (generate the hash with
   PHP's `password_hash()`, don't store plaintext):
   ```sql
   UPDATE admins SET password = '<new_hash>' WHERE username = 'admin';
   ```

5. Make sure PHP 8+ with the `pdo_mysql` extension is enabled (cPanel →
   MultiPHP Manager).

6. Force HTTPS (cPanel → SSL/TLS Status → AutoSSL, then add a redirect rule)
   since sessions are configured as secure-cookie-only.

7. Visit `https://nexoraclub.mgamer.online/user/register.php` to create your
   first user account, then assign a plan to it from the admin panel
   (`/admin/users.php`) so it can queue SMS.

## API quick reference

**Send an SMS (from your own website/app/CRM):**
```
POST /api/send
{
  "api_key": "...",
  "gateway_id": "GW-123456",
  "device_id": "",          // optional, blank = auto load-balanced
  "number": "9876543210",
  "message": "Hello"
}
```

**Android device polls for work:**
```
POST /api/sms/fetch    { "api_key": "...", "device_id": "NEX-SAM123456" }
POST /api/sms/update   { "api_key": "...", "task_id": 42, "status": "success" }
```

## A note on compliance
Sending bulk/commercial SMS in India is regulated by TRAI's DLT
(Distributed Ledger Technology) framework — sender IDs, templates and
consent all need to be registered separately from anything in this app.
This project only handles the technical transport layer; make sure
whatever you route through it (and your users' use of it) complies with
DLT/TRAI rules and applicable telecom/anti-spam law in the regions you
operate in.