# BizInvoice SA cPanel API deployment

## Requirements

- PHP 8.1 or newer with PDO MySQL, fileinfo, mbstring, zip, xml and gd.
- MariaDB/MySQL database and user created in cPanel.
- Composer available in Terminal or run locally and upload `vendor/`.
- DNS for `api.bizinvoicesa.co.za` pointed to the cPanel account with AutoSSL enabled.

## Install

1. Create the API subdomain with document root pointing to `cpanel-api/public`.
2. Move `cpanel-api/private` above `public_html` where possible and update `$configPath` in `public/index.php`.
3. Fill the database name, user and password in `private/config.local.php`. Keep file permissions at `0600`.
4. Import `database/schema.sql` using phpMyAdmin.
5. Run `composer install --no-dev --optimize-autoloader` in `cpanel-api`.
6. Create the first tenant owner:

   `php scripts/create_user.php "ABC Trading (Pty) Ltd" owner@example.co.za "strong-password"`

7. Open `https://api.bizinvoicesa.co.za/v1/health` and confirm JSON reports `ok: true`.
8. Open `https://api.bizinvoicesa.co.za/import.html` for the spreadsheet Import Centre.

## Email security

SMTP is read only by PHP from `private/config.local.php`; it is never returned by the API or packaged in Android. Configure SPF, DKIM and DMARC for `bizinvoicesa.co.za`. Rotate the SMTP password before production because any credential shared in chat should be treated as exposed.

## Spreadsheet columns

- Customers: `name,email,mobile,external_ref`
- Employees: `name,employment_type,pay_frequency,rate,external_ref`
- Suppliers: `name,email,mobile,account_no,external_ref`
- Stock: `sku,name,cost_price,selling_price,quantity,reorder_level,location,external_ref`

Imports are tenant-scoped and recorded in `import_batches`. Invalid rows are returned with row numbers; valid rows are committed in one transaction.