# Smart Redirect Proxy (SRP)

PHP 8.3 affiliate traffic-routing system. Three modules share one MySQL database;
no framework — procedural PHP with `require`/`include`. Composer is used only for
third-party `vendor/` libraries.

## Modules & UI

Reached by subdomain (routing handled in the root `.htaccess` before PHP):

| Subdomain | Module | UI / purpose |
|---|---|---|
| `gen.<domain>` | `public/` | **Admin panel** — trackers, campaigns, addon domains, shortlinks, CF Config |
| `s.<domain>` | `statistics/` | **Stats panel** — realtime clicks, analytics, postback receiver |
| `r.<domain>` | `redirect/` | **Redirect engine** — handles every inbound click |
| any wildcard | `redirect/index.php` | Addon-domain affiliate link entry point (`?sub_id={token}`) |

Other entry points:

- **Admin login** — `public/login.php` (`ADMIN_PASSWORD`). Per-tracker user portal uses bcrypt `generate.password`; the dashboard tracker table shows the real password via an eye **show/hide** toggle (stored in `password_plain`, login still verifies the bcrypt hash).
- **Stats login** — `statistics/login.php` (bcrypt hash in `statistics/report_auth.php`, created manually).
- **`.env` editor** — `env-config.php` (standalone; `A2ROOT_PASSWORD` → `ADMIN_PASSWORD` → `ENV_EDITOR_PASSWORD`). The most sensitive endpoint — it can rewrite all secrets.
- **Health check** — `/health.php` (db, geoip2, tmp_writable, extensions, PHP version).

## Quick start

```bash
composer install                       # runtime + dev tools (root vendor/)
cp .env.example .env && chmod 640 .env # then fill in — see comments in .env.example
mysql -u user -p dbname < schema.sql   # single source of truth (idempotent upgrades included)
php install.php                         # first-time setup (writes install.lock)
bash setup-cron.sh                      # cache cleanup (daily 02:00) + GeoIP update (Wed 03:00)
```

Full step-by-step (cPanel wildcard, Cloudflare, GeoIP, stats password): see **[INSTALL.md](INSTALL.md)**.

## Configuration

All runtime config lives in `.env` at the project root. **[.env.example](.env.example)**
documents every key (DB, admin/cPanel/Cloudflare, secrets, geo-blocking, filter,
postback, GeoIP). Edit it in a browser via `env-config.php` or by hand.

Generate the auto-secrets:

```bash
php -r "foreach(['AF_SECRET','IXG_BYPASS_KEY','SRP_API_KEY','POSTBACK_SECRET'] as \$k) echo \$k.'='.bin2hex(random_bytes(32)).PHP_EOL;"
```

## Commands

```bash
vendor/bin/phpunit                 # test suite (tests/Unit/)
vendor/bin/phpstan analyse         # static analysis (level max + baseline)
vendor/bin/php-cs-fixer fix        # format (PER-CS + strict types)
vendor/bin/phpcs                   # PSR-12 lint
php redirect/update-geoip.php      # refresh GeoLite2-Country.mmdb
php redirect/cleanup-cache.php     # purge stale srp_bb/ cache
```

## Docs

- [INSTALL.md](INSTALL.md) — full deployment guide
- [auth.md](auth.md) — auth contexts & sessions
- `CLAUDE.md` / `AGENTS.md` — architecture reference for AI tooling

Proprietary. Not for redistribution.
