# TimeZup (PHP + CSV)

## Run (XAMPP)
- Put this folder in `c:\xampp\htdocs\TimeZup`
- Start Apache in XAMPP
- Open:
  - Map: `http://localhost/TimeZup/index.php`
  - Admin: `http://localhost/TimeZup/admin.php`

## Data storage
CSV files live in `data/`:
- `users.csv`
- `businesses.csv`
- `subscriptions.csv`

## Becoming admin
This MVP keeps it simple:
1. Sign up on the map page
2. Open `data/users.csv`
3. Find your user row and set the `role` column to `admin`
4. Refresh `admin.php`

## Seed business logins (demo)
These are stored in `data/business_accounts.csv`:
- `cafe@timezup.biz` / `TimeZup123!` (b1cafe)
- `gym@timezup.biz` / `TimeZup123!` (b2gym)
- `spa@timezup.biz` / `TimeZup123!` (b3spa)

## Sale notifications when Chrome is closed (Web Push)
The in-page toast notifications use SSE and only work while the page is open.
If you want notifications even when Chrome is closed on the phone, this project supports **Web Push**.

Important notes:
- Web Push requires a **secure context**: HTTPS.
  - `http://localhost/...` is allowed.
  - `http://192.168.x.x/...` is NOT secure, so push will not work on a phone over LAN HTTP.
  - For phone testing, use HTTPS (e.g. a tunnel like ngrok/Cloudflare Tunnel) or set up HTTPS on your LAN with a trusted certificate.

### 1) Install PHP dependencies (once)
This repo includes `composer.phar` and `composer.json`. To install vendor packages:

`C:\xampp\php\php.exe composer.phar install`

### 2) Generate VAPID keys (once)
VAPID keys are stored in `data/vapid_keys.json`.

On some Windows/XAMPP installs, OpenSSL needs `OPENSSL_CONF` set for the PHP CLI.
Run this in PowerShell from the project folder:

`$env:OPENSSL_CONF='C:\xampp\apache\conf\openssl.cnf'; C:\xampp\php\php.exe tools\generate_vapid.php`

### 3) What the app does
- When a user logs in, the site will ask for notification permission and register the device for push.
- When a business starts a sale, subscribers get:
  - an in-page toast (if the site is open)
  - a push notification (even if Chrome is closed), once HTTPS is used

## Deploying to hosting (Afrihost) to test Push
Yes — if your Afrihost domain has a valid HTTPS certificate (no browser warning), you can upload this whole folder and test.

Checklist:
- Upload the entire project, including `vendor/`, `composer.json`, and `composer.lock`.
  - Alternatively, run Composer on the server if you have SSH.
- Ensure `data/` is writable by PHP (server user) because it stores CSV files and `vapid_keys.json`.
- Ensure `data/` is not publicly accessible. This repo includes `data/.htaccess` to block access on Apache.
- Generate VAPID keys on the server (once):
  - `php tools/generate_vapid.php`

If Push still does not arrive:
- Confirm the phone opened the site on the real HTTPS domain (no “continue anyway”).
- Confirm `data/push_subscriptions.csv` has at least 1 row (device registered).
