# COLORJET Mobile Suite V2 — cPanel Ready

## Refined modules
- `customer/` — splash/onboarding, product catalog, category filter, product detail, quote request, service request and contact.
- `admin/` — secure owner/admin login, live KPI dashboard, tickets, users, engineers, catalog manager, company branding, asset upload, Odoo read-only settings and report summary.
- `api/` — PHP 8.2+ / MySQL backend with session auth, CSRF, role permission checks, audit log, safe file streaming and encrypted Odoo secret storage.

## Deployment
1. Create a new MySQL database and user in cPanel.
2. Upload and extract this ZIP into your desired domain/subdomain document root.
3. Open `https://your-domain.com/install.php`.
4. Enter database settings and create the first Owner account. No default password exists.
5. Open `customer/` or `admin/`.
6. Rename/delete `install.php` after installation.

## Important security rules
- Never place Odoo, WhatsApp, Facebook or SMTP tokens in HTML, JavaScript, localStorage or Android WebView source.
- The Odoo API key is encrypted server-side before database storage.
- The Odoo test requires HTTPS and blocks localhost/private-IP hostnames.
- Files are stored outside public browsing and only public images are served through `api/media.php`.
- Every admin write action requires session authentication plus CSRF header.

## Current production-ready core
- First owner installer
- Roles/permissions and audit log
- Customer quote and service request intake
- Service ticket create/update/assign workflow
- Product categories and products CRUD
- User and engineer creation/update foundations
- Company/branding configuration
- Original asset upload support: logo, app icon, category/product image, banner and PDF
- Odoo server-side authentication test

## Not yet implemented in this package
- Odoo model-level report synchronization and scheduled cron sync
- WhatsApp/Facebook/Instagram/Gmail connectors
- GPS, mobile camera, customer e-signature capture
- PDF/XLSX report generation and Play Store Android wrapper

Those functions need their respective API credentials, data mappings and deployment-specific configuration. The UI deliberately does not claim they are connected before that work is completed.