# Installation Guide - Multi-Site Vehicle Sales Platform

Stack: PHP 8+ (PDO MySQL), MySQL, no framework, ready for shared cPanel hosting (Namecheap).

## 1. Project structure

```
public_html/                 <- the contents of this folder go to the ROOT of the main domain (adminadolf.work)
  config.php                 <- DB connection details (fill in)
  install.php                <- creates the first super admin account (DELETE after first use)
  schema.sql                 <- (stays outside public_html, only for import into phpMyAdmin)
  core/                      <- shared code (DB connection, auth, functions) - do NOT touch
  superadmin/                <- super admin panel (adminadolf.work/superadmin/)
  assets/admin.css           <- shared stylesheet for both admin panels
  uploads/                   <- logos and vehicle photos, uploaded from admin
  site-template/             <- TEMPLATE for every new car sales site (see step 4)
```

## 2. Database

1. In cPanel > **MySQL Databases**, create a database and a user with full privileges on it.
2. In **phpMyAdmin**, select the database and import the `schema.sql` file (Import > choose file > Go).
3. Open `public_html/config.php` and fill in `DB_HOST`, `DB_NAME`, `DB_USER`, `DB_PASS` with the real values.

## 3. Main domain = Super Admin

1. The hosting account's main domain (`adminadolf.work`) must have its document root set to the `public_html/` folder.
2. Upload the entire contents of the `public_html/` folder (from this package) to the root of the hosting account, via File Manager or FTP.
3. In `config.php`, make sure this is set: `define('SUPERADMIN_DOMAIN', 'adminadolf.work');`
4. Visit `https://adminadolf.work/install.php`, create the super admin account (name, email, password), then **immediately delete the `install.php` file from the server** (via File Manager).
5. Log in at `https://adminadolf.work/superadmin/login.php`.

## 4. Adding a new site (client / new company)

Each new site = an **addon domain** on the same hosting account, plus an entry in the `sites` table.

1. In cPanel > **Domains** > **Create A New Domain**, add the client's domain (e.g. `example-motors.co.uk`). cPanel automatically creates the folder `public_html/example-motors.co.uk/`.
2. Open File Manager, go into `public_html/site-template/`, select all its contents (all files and the `admin/`, `partials/`, `assets/` folders), **Copy**, and paste them into `public_html/example-motors.co.uk/`.
   - Alternatively, if you have SSH access: create a symlink instead of copying the files, so you don't keep multiple code copies: `rm -rf public_html/example-motors.co.uk && ln -s public_html/site-template public_html/example-motors.co.uk`. With a symlink, any change made later in `site-template/` is automatically reflected on every site.
3. From the super admin panel (`adminadolf.work/superadmin/sites.php`), click **+ New site** and fill in:
   - The domain (exactly as added in step 1, without `https://` and without `www.`)
   - Company name, logo, contact details
   - That site's admin name and email + a password
4. Enable free SSL for the new domain from cPanel > **SSL/TLS Status** > **AutoSSL**.
5. The site is live at `https://example-motors.co.uk/`, and its admin logs in at `https://example-motors.co.uk/admin/login.php` to manage their own vehicle inventory, with no access to other sites.

## 5. What each role can do

- **Super admin** (`/superadmin/`): creates/edits/disables sites, sets the admin for each site, sees overall statistics.
- **Site admin** (`/admin/` on that domain): adds/edits/deletes vehicles with photos, moderates reviews published on their site, sees incoming contact messages, edits the publicly displayed company name / logo / contact details.

## 6. Technical notes and security

- PHP 8.0+ with the `pdo_mysql` and `fileinfo` extensions enabled (standard on cPanel Namecheap).
- Passwords are hashed (`password_hash`), never stored in plain text.
- Login forms and any form that writes to the database are CSRF-protected.
- The `uploads/` folder blocks PHP file execution (see the `.htaccess` inside it) - safe to accept photos uploaded by admins.
- `config.php` is blocked from direct browser access via `.htaccess`.
- Recommendation: change the super admin password periodically and don't share site_admin logins between clients.

## 7. What's missing / possible next steps

- Pagination on the inventory page (currently shows up to 60 vehicles per site).
- Advanced editing of legal text (warranty / buy-back) directly from admin - currently these are templates shared by all sites.
- Automatic email notifications on new contact messages.
- Automatic export/backup of photos from `uploads/`.