Pdfboxi.in (pdfboxi.in) - INSTALL GUIDE
=====================================

WHAT IS IN THIS ZIP
  public_html/       -> the website (pages, tools, API). Goes into your domain's public_html folder.
  pdfboxi_private/   -> secret settings + database + logs. Goes ONE LEVEL ABOVE public_html (same level as public_html).
  README-INSTALL.txt -> this file.

1) UPLOAD (cPanel > File Manager)
  a. Upload this ZIP to your home folder and click Extract.
  b. Move everything inside "public_html" (from the zip) into your real public_html folder (index.html must be directly inside public_html).
  c. Move the folder "pdfboxi_private" to the home folder, next to public_html (NOT inside it).
     Keep config.php, the SQLite database, sessions and logs OUTSIDE the web document root.
     Do NOT put this folder inside public_html: .htaccess protection is not reliable on every server
     (for example, some Nginx configurations ignore .htaccess). If your hosting account does not
     allow a private folder beside public_html, ask GreenServer support for the correct private
     writable path and update the private-path lookup in api/_boot.php with that absolute path.
  d. Make sure PHP can write to pdfboxi_private/data and pdfboxi_private/logs (permissions 755, or 775 if you get a database error).

2) PHP REQUIREMENTS (cPanel > Select PHP Version / MultiPHP Manager)
  PHP 7.4 or newer (8.x is best) with these extensions switched ON:
  pdo_sqlite (or pdo_mysql if you use MySQL), curl, openssl, mbstring, json.
  Ask greenserver support if you cannot find them. Without PHP the tools still work, but login/OTP/payments will not.

3) EDIT THE SETTINGS FILE:  pdfboxi_private/config.php
  - razorpay > key_id and key_secret: enter the matching LIVE key pair from Razorpay Dashboard > Account & Settings > API Keys.
    Never share key_secret in chat, email, screenshots or the public_html folder. If a secret has ever been exposed,
    revoke/regenerate the key pair in Razorpay and update both values here. The key_id may be sent to the browser;
    the key_secret must remain private. Payment activation now also checks the payment status, order, amount and INR currency
    directly with Razorpay before granting a plan.
  - secret : any long random text (already generated for you; change it if you wish - before real users sign up).
  - mail : see step 4.
  - free_daily_runs : free tool runs per day for people without a plan (default 3). 0 = a plan is required for every tool.
  - plans : prices and days. If you change a price here, also change the numbers shown on pricing.html, index.html and the policy pages.
  - db : SQLite works out of the box. To use MySQL: create an empty database + user in cPanel, set driver to "mysql" and fill in the details.

4) EMAIL (needed for the 6-digit OTP codes, password reset and receipts)
  a. In cPanel > Email Accounts create the mailbox  support@pdfboxi.in  (this is also your customer support inbox).
  b. Easiest and most reliable: in config.php set  mail > driver = 'smtp'  and fill  smtp > pass  with that mailbox password
     (host mail.pdfboxi.in, port 465, secure ssl - check "Connect Devices" in cPanel for the exact host).
  c. Or leave driver = 'mail' (server mail). Then check SPF and DKIM in cPanel > Email Deliverability so mails do not go to spam.
  d. TEST: sign up with your own email and see that the code arrives.

5) RAZORPAY
  - Live mode must be activated in your Razorpay account.
  - Optional but recommended webhook (activates the plan even if the customer closes the browser after paying):
    Razorpay Dashboard > Settings > Webhooks > Add: URL  https://pdfboxi.in/api/razorpay-webhook.php
    events: payment.captured and order.paid, choose a secret, and put the same secret in config.php > razorpay > webhook_secret.
  - TEST with a real small payment (Rs 29) using your own account, then check Account page and the receipt email.
  - The secret key is only used inside the PHP files in pdfboxi_private and api/. It is never sent to the browser.

6) HTTPS and SEO
  - Install SSL (cPanel > SSL/TLS Status > Run AutoSSL).
  - In public_html/.htaccess remove the # signs from the HTTPS redirect lines.
  - Google Search Console (search.google.com/search-console): add pdfboxi.in, then submit  https://pdfboxi.in/sitemap.xml
  - Bing Webmaster Tools: same sitemap. (Bing also feeds several AI assistants.)
  - robots.txt allows Google, Bing, GPTBot, ClaudeBot, PerplexityBot and Google-Extended. llms.txt describes the site for AI tools.
  - Real rankings take weeks and depend on content, links and competition. Nobody can guarantee a position.

7) POLICIES - PLEASE REVIEW
  privacy.html, terms.html and refund-policy.html are drafts written to match how the site works. Read them and adjust them
  (business name, address, refund rules, GST/tax wording) - ideally with a lawyer or CA - before you take real payments.

8) HOW THE FREE LIMIT WORKS (and its limit)
  The tools run in the visitor's browser, so the limit is checked by the page before each run (api/usage.php).
  It is a business rule, not a lock: a technically skilled person can bypass it, because the code runs on their device.
  If the server cannot be reached, tools keep working (fail-open) so honest customers are never blocked by a server problem.

9) BACKUP
  Back up pdfboxi_private/data/pdfboxi.sqlite regularly (it holds users, orders and plans).

TROUBLESHOOTING
  - "Server is not reachable" on login: PHP not enabled, or pdfboxi_private is in the wrong place.
  - "Database connection failed": make pdfboxi_private/data writable.
  - No OTP email: check config.php mail settings, spam folder, and pdfboxi_private/logs for errors (set driver to 'log' to test: codes are written to logs/mail.log).
  - Payment window does not open: check the Razorpay key id/secret, and that live mode is active.
  - OCR / PDF tools fail to load: make sure all files in public_html/assets were uploaded (the folder is about 17 MB).
  - After updating files, press Ctrl+F5. The site has an offline cache that refreshes itself on the next visit.

Third-party: Noto Sans Bengali and Noto Sans Devanagari fonts (SIL Open Font License), Tesseract OCR, pdf-lib, PDF.js, JSZip.
Support email for your customers: support@pdfboxi.in


9) ADMIN PANEL (NEW)
  - Upload the updated public_html and pdfboxi_private folders together.
  - Open https://YOUR-DOMAIN/admin/setup.html
  - Open pdfboxi_private/config.php and copy the one-time admin_setup_key value into the setup form.
  - Create your admin email and a strong password (12+ characters).
  - After setup, the key is automatically removed from config.php. Delete public_html/admin/setup.html.
  - Admin login: https://YOUR-DOMAIN/admin/
  - Admin can edit plan name/days/prices, set free daily runs, enable/disable tools, search/block users,
    set a temporary password, grant/revoke access, and create/disable discount coupon records.
  - User passwords are stored as secure password hashes. Admin cannot view existing passwords; use Reset Password.
  - Coupon management records coupons, but coupon application in Razorpay checkout is not connected in this build yet.
  - Existing paid orders and subscriptions are not repriced when plan prices change.


10) ADVANCED ADMIN PANEL (NEW)
  - Admin: https://YOUR-DOMAIN/admin/
  - Admin setup is one-time at /admin/setup.html (only before first admin exists).
  - Website branding: name, tagline, logo upload, footer links/text, light/dark/system theme.
  - Content: About, Terms, Privacy, FAQ are independently editable from admin.
  - Payment: choose the active checkout provider (Razorpay or ZapUPI). Razorpay Key ID/Secret/Webhook Secret and ZapUPI Key can be changed in admin; blank secret fields preserve the saved secret.
  - ZapUPI: enter the ZapUPI Key and select ZapUPI as the active checkout provider. PHP backend creates orders at pay.zapupi.com, redirects the customer to the payment_url, receives /api/zapupi-webhook.php, and confirms each event with the server-side /api/order-status endpoint before activating a subscription. Add https://YOUR-DOMAIN/api/zapupi-webhook.php as your ZapUPI webhook URL in its dashboard. Test with a small amount and confirm webhook delivery before enabling for customers.
  - Offers: show/hide a website offer banner with an expiry countdown.
  - Emails: send to all verified users or one specific email; schedule future campaigns.
  - Automatic expiry reminders: 3 days and 1 day before expiry.
  - Register external/custom tool links. Registering a link does not create the underlying PDF processing engine; that code must exist separately.
  - Offline enforcement: when enabled, gated tools require a successful online usage check. Tools marked always-free in the browser code may need additional backend gating to enforce a strict rule.
  - Admin can add plan durations in days (e.g. 7, 30, 365); 30 days is a month approximation and 365 days a year approximation.

11) SCHEDULED EMAILS / REMINDERS (CRON REQUIRED)
  - In cPanel > Cron Jobs, run every 15 minutes:
    php /home/CPANEL_USERNAME/public_html/api/cron.php
  - Replace CPANEL_USERNAME with your actual hosting account path. Ask hosting support for the exact PHP CLI path if required.
  - Alternative URL cron (less preferred): https://YOUR-DOMAIN/api/cron.php?key=YOUR_CRON_SECRET
    The secret is in pdfboxi_private/config.php as cron_secret. Never share it publicly.
  - Cron must run for scheduled campaigns and automatic expiry reminders. Without cron, they will not send automatically.

12) MYSQL / PHPMYADMIN IMPORT
  - Included file: pdfboxi_mysql_schema.sql
  - cPanel > MySQL Databases: create a database and database user; grant ALL PRIVILEGES.
  - phpMyAdmin: select the new empty database > Import > choose pdfboxi_mysql_schema.sql > Go.
  - Then edit pdfboxi_private/config.php: db.driver = 'mysql', mysql_host='localhost', mysql_name='CPANEL_DB_NAME', mysql_user='CPANEL_DB_USER', mysql_pass='YOUR_DB_PASSWORD'.
  - Keep sqlite_file as it is; it is ignored when driver=mysql.
  - IMPORTANT: schema import creates empty tables; it does NOT copy existing SQLite users/orders/subscriptions. Back up SQLite before switching. Existing data migration needs a separate export/import.
  - Ensure PHP pdo_mysql extension is enabled.

13) SECURITY NOTES
  - Never paste API secrets into public HTML or share them in screenshots.
  - Change credentials only over HTTPS and keep config/database backups.
  - Logo uploads are limited to 2 MB and supported image types.
  - Admin can reset a user's password but cannot view the original password.
