# Velora — Go-live checklist

## Access model (trial vs paid)

| Feature | Free trial (default 72h) | After trial (unpaid) | Paid Monthly Access |
|---------|--------------------------|----------------------|---------------------|
| Register / login | Yes | Yes | Yes |
| Edit profile / photos | Yes | Yes | Yes |
| Discover / swipe | Yes | **No** → Premium | Yes |
| Like / pass / rewind | Yes | **No** | Yes |
| Matches list & **Inbox / chat** | **No** | **No** | **Yes** |
| Blue verified badge | No | No | **Yes** (30 days) |

Messaging is **paid-only** on purpose (genuine chats, less spam).

## 1. Install
1. Extract to `htdocs/velora-dating-platform`
2. Apache + MySQL on (XAMPP)
3. Import `database/velora.sql` then **`database/COMBINED_UPDATE.sql`**
4. Optional photos only: `database/REFRESH_DEMO_PHOTOS.sql`
5. Set `app/config/config.php` → `app_url` to your real URL (HTTPS in production)

## 2. Permissions
```
public/uploads/profiles  writable
storage/logs             writable
```

## 3. Admin → Payment integrations
Login: `admin@velora.local` / `password`

**M-Pesa Daraja**
- Enable STK, sandbox or live
- Consumer key/secret, shortcode, passkey
- Callback: `https://YOUR-DOMAIN/.../public/premium/mpesa/callback`

**Stripe (cards)**
- Enable cards
- `pk_...` publishable, `sk_...` secret
- Webhook secret `whsec_...`
- Stripe Dashboard webhook URL: `https://YOUR-DOMAIN/.../public/premium/stripe/webhook`
- Events: `checkout.session.completed`, `checkout.session.async_payment_succeeded`, `checkout.session.expired`, `payment_intent.succeeded`, `payment_intent.payment_failed`

## 4. Security
- Change CSRF key in config
- Use HTTPS only
- Do not commit live API keys to public repos
- Strict M-Pesa IP optional after go-live

## 5. Demo accounts
- Admin: admin@velora.local / password
- Paid demos: demo1@velora.local … demo15@velora.local / password
- All demos are **paid** (inbox works)

## 6. Health
`GET /public/health` → JSON database status
