# Dabil Web Application

## Folder Structure
```
dabil/
├── dabil_schema.sql          ← Import this into MySQL first
├── customer/                 ← Customer-facing module
│   ├── config/
│   │   ├── db.php            ← Database connection
│   │   └── paystack.php      ← Paystack keys
│   ├── includes/
│   │   ├── header.php        ← Shared sidebar/topbar layout
│   │   └── footer.php        ← Closing tags + JS
│   ├── login.php             ← Customer login
│   ├── register.php          ← Customer registration
│   ├── dashboard.php         ← Overview page
│   ├── wallet.php            ← Wallet balance + transactions
│   ├── fund_wallet.php       ← Fund via Paystack
│   ├── verify_payment.php    ← Paystack callback handler
│   ├── withdrawal.php        ← Withdraw to bank (form)
│   ├── withdraw.php          ← Withdraw backend handler
│   ├── webhook.php           ← Paystack webhook (transfer events)
│   ├── scan.php              ← QR scanner + menu view
│   ├── checkout.php          ← Cart + order placement
│   ├── orders.php            ← Order list
│   ├── order_detail.php      ← Live order tracking
│   ├── order_status.php      ← AJAX status endpoint
│   ├── get_banks.php         ← Paystack bank list API
│   ├── verify_account.php    ← Account name lookup
│   ├── profile.php           ← Edit profile + password
│   └── logout.php            ← Destroy session
├── superadmin/               ← (Coming next)
└── restaurantadmin/          ← (Coming next)
```

## Setup Instructions

### 1. Database
- Create a MySQL database named `dabil`
- Import `dabil_schema.sql`
- Default Super Admin: `admin@dabil.com` / password: `password`

### 2. Config
Edit `customer/config/db.php`:
```php
$conn = new mysqli("localhost", "your_user", "your_password", "dabil");
```

Edit `customer/config/paystack.php`:
```php
define("PAYSTACK_SECRET", "sk_live_YOUR_SECRET_KEY");
define("PAYSTACK_PUBLIC", "pk_live_YOUR_PUBLIC_KEY");
```

### 3. Paystack Webhook
In your Paystack dashboard, set the webhook URL to:
```
https://yourdomain.com/dabil/customer/webhook.php
```

### 4. Colors
- Primary: `#225AE3` (Blue)
- Background: `#F5F7F8` (Soft Beige)
- Secondary/Cards: `#FFFFFF` (White)

## Security Fixes Applied
- All queries use prepared statements (no SQL injection)
- All user inputs sanitized with `htmlspecialchars()`
- Payment verification uses idempotency checks (no double-crediting)
- Order ownership verified before display
- Session checks on all protected pages
- Wallet balance checked before withdrawal and order payment
- Paystack webhook validates transfer codes before deducting wallet
