# SmartPay360 V3 — Bochat UX + Reconstructed Database

SmartPay360 V3 is the consolidated production-oriented build of SmartPay360. It keeps the active business modules from the cleaned V2 codebase, adds a fresh-install database schema, and applies one Bochat-style application shell across desktop and mobile.

## Design language

- Blueprint Blue `#0075D8`
- Safety Gold `#FDDC01`
- White cards on a light blue-grey workspace
- Expandable desktop icon rail / sidebar
- Centered global search (`Ctrl/Cmd + K`)
- Gold contextual **Create** launcher
- Executive dashboard cards and attention panels
- Full readable mobile drawer + bottom navigation
- Read-only mobile tables can become compact record cards
- Long entry modals become bottom/full-screen mobile sheets

The Bochat-style UX is applied globally through:

- `includes/layout2.php`
- `assets/css/smartpay360-bochat.css`
- `assets/js/bochat-ui.js`

## Fresh installation

1. Create an empty MariaDB/MySQL database and user.
2. Copy `.env.example` to `.env` and set `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, and `DB_PASS`.
3. Point the site/subdirectory to `/smartpay360` (or change `APP_BASE` if deployed elsewhere).
4. Open `/smartpay360/setup/` in the browser.
5. Click **Install database schema**.
6. Create the first administrator.
7. Sign in. The setup screen locks after the first user exists.

You can alternatively import `database/smartpay360_complete_schema.sql` using phpMyAdmin/HeidiSQL and then use `/setup/` only for the first administrator.

## Database

`database/smartpay360_complete_schema.sql` is the reconstructed fresh-install schema generated from the active application code and retained compatibility requirements. `database/init_schema.sql` is an identical bootstrap copy for installers expecting that filename.

The schema currently contains **173 tables plus 1 compatibility view**. It deliberately includes compatibility structures for older but still retained screens (legacy till reports, cheque layouts/banks, payroll profiles, reconciliation and RMS/POS sync) so opening a less frequently used module does not immediately fail on a missing table.

This schema is intended for **fresh installs**. Existing production databases should be backed up and migrated instead of being overwritten.

## Security/configuration

Secrets belong in `.env`; do not hard-code database, SMS, OpenAI or device credentials in PHP. The V3 core uses secure session cookies, central CSRF helpers, branch context, permission helpers, audit events and targeted notification infrastructure.

Optional ZKTeco attendance utilities use `ZK_DEVICE_IP` from `.env`.

## Production checklist

- Set `APP_ENV=production` and `APP_DEBUG=false`.
- Use HTTPS.
- Rotate any credentials that existed in old source archives.
- Keep `.env`, database exports and logs outside public download paths.
- Back up the database before updates.
- Run PHP lint/CI before every deployment.
- Verify each role and branch with test accounts before go-live.
