**Database install:** use only `database/velora.sql`.

# Velora — deployment readiness

## What was fixed / improved

1. **User profiles**
   - Auto-create missing profile, preferences, wallet and notification rows
   - Safer photo upload (finfo / mime_content_type / extension fallback)
   - Profile completion score updated from bio, gender, city, photos
   - Interests and prompts save correctly

2. **Chat between users**
   - Chat **requires a mutual match** (GET and POST)
   - Blocked users cannot open or send messages
   - **AJAX send** + **3-second poll** for near-realtime messages (`/chat/poll`)
   - Unmatch, block and report available inside the chat UI
   - Read receipts marked when the other person opens the thread

3. **Matches**
   - Shows last message snippet and unread counts
   - Seed data creates demo matches + sample messages (Amina↔Brian, Chloe↔David)

4. **Admin panel**
   - Stats: users, active, matches, messages, subs, open reports, revenue
   - User status + role controls (non-admin)
   - Credit adjustments (logged)
   - Report moderation workflow
   - Plan price/description/active toggles
   - Payment history
   - Verification request review
   - Admin activity log + operational checklist

5. **Code quality**
   - Cleaner front controller with helpers (`are_matched`, `is_blocked`, `ensure_user_rows`, `json_out`)
   - PHP syntax verified

## Local install (XAMPP / LAMP)

1. Extract to web root (e.g. `htdocs/velora-dating-platform`).
2. Start Apache + MySQL.
3. Import `database/schema.sql` then `database/seed.sql` in phpMyAdmin.
4. Edit `app/config/config.php` — set `app_url` to your public URL and DB credentials.
5. Ensure `public/uploads/profiles` and `public/uploads/verification` are writable (chmod 775).
6. Open `http://localhost/velora-dating-platform/public/`.

### Demo logins (password for all: `password`)

| Account | Email |
|---------|-------|
| Admin | admin@velora.local |
| User | amina@example.com |
| User | brian@example.com |
| User | chloe@example.com |
| User | david@example.com |

**Try chat:** log in as `amina@example.com` → Matches → Chat with Brian.

## Production checklist

- [ ] Change all demo passwords; create a new admin and remove demo users if needed
- [ ] Set strong `csrf_key` and session name in config
- [ ] Point `app_url` to HTTPS production URL
- [ ] Use a dedicated MySQL user with least privilege (no root)
- [ ] Force HTTPS (HSTS) and secure cookies
- [ ] Disable directory listing; keep `app/`, `database/`, `storage/` outside or blocked (root `.htaccess` already forbids app/database/storage/tests)
- [ ] Real payment provider (M-PESA / card) with **server-side** callback verification — current flow is **demo only**
- [ ] Rate-limit login, register, message send, uploads
- [ ] Backup MySQL daily
- [ ] PHP 8.1+ with extensions: pdo_mysql, mbstring, fileinfo, gd (optional)

## Admin responsibilities (day-to-day)

1. Clear **open reports** (set reviewing → resolved / dismissed).
2. Ban or suspend abusive accounts.
3. Watch payment/subscription rows after real payments go live.
4. Review verification requests when that feature is used.
5. Keep plan pricing accurate.
6. Do not grant admin role lightly.

## Health check

`GET /health` → JSON `{ ok: true, database: "connected" }` when DB is up.
