# GoodPlay CI4 Website

Responsive PHP website for the existing GoodPlay customer API. This application is an independent web client; it does not replace or modify the Flutter app or API backend.

## Local setup

Requirements: PHP 8.2 or newer with cURL, Intl and Mbstring enabled.

1. Copy `.env.example` to `.env`.
2. Set `goodplay.apiBasicAuth` to the base64 portion of the existing API Basic authorization value.
3. Set `app.baseURL` for the environment.
4. Ensure PHP has a CA bundle configured. Set `curl.cainfo` in `php.ini`, or set `goodplay.caBundle` in `.env` to an absolute CA bundle path.
5. From this directory, run:

   ```powershell
   php spark serve
   ```

6. Open `http://localhost:8080`.

The checked-out development workspace already has an ignored local `.env` configured. Never commit `.env`.

## Production deployment

- Point the web server document root to `website/public`, not the project root.
- Set `CI_ENVIRONMENT = production` and the production `app.baseURL` in `.env`.
- Serve only over HTTPS and set `app.forceGlobalSecureRequests = true`.
- Keep `.env`, `app`, `system`, `writable`, and `docs` outside public web access.
- Make `writable/` writable by the PHP process.
- Use secure, HTTP-only, SameSite cookies (CI4 defaults are already HTTP-only and SameSite Lax).
- Do not introduce a general-purpose API proxy route; controllers call only known endpoints through `GoodPlayApi`.

No application database is required. Authentication tokens live in server-side CI4 sessions.

## Verification

```powershell
php spark routes
Get-ChildItem app -Recurse -Filter *.php | ForEach-Object { php -l $_.FullName }
```

Live booking and payment acceptance tests require a designated GoodPlay test account and a safe test/zero-value booking.

Guest checkout is supported. After creation, the website keeps only a random session-bound payment reference and checks the existing booking payment API while the customer completes payment in a separate tab.

If the site reports that it cannot reach GoodPlay and the log contains cURL error 60, configure `goodplay.caBundle`; never disable TLS verification.

## Continuation

Read [docs/MIGRATION_PROGRESS.md](docs/MIGRATION_PROGRESS.md) first. Architecture and security decisions are recorded in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).