# Phase 2 — Setup Instructions

This sandbox has no internet access, so I couldn't run `composer create-project`
or `npm install` here. These files are the Phase 2 application code — drop them
into a fresh Laravel install on your machine:

## 1. Create the base project

```bash
composer create-project laravel/laravel showroom
cd showroom
```

## 2. Copy in these files

Copy every file from this delivery into the matching path in your new `showroom/`
project (overwrite `routes/web.php`, `bootstrap/app.php`, `app/Providers/AppServiceProvider.php`,
and `resources/views/layouts/app.blade.php` if they already exist).

## 3. Edit `config/app.php`

Apply the change described in `config/app-locale-note.md`, then delete that file
— it's a note, not a real config file.

## 4. Configure `.env`

```
APP_NAME="আমার ইলেকট্রনিক্স শোরুম"
APP_LOCALE=bn
DB_CONNECTION=mysql
DB_DATABASE=showroom
DB_USERNAME=root
DB_PASSWORD=
```

## 5. Migrate, seed, link storage

```bash
php artisan migrate
php artisan db:seed
php artisan storage:link
```

## 6. Run it

```bash
php artisan serve
```

## Demo logins

| Role | Phone | Password |
|---|---|---|
| Super Admin | 01700000001 | password |
| Admin | 01700000002 | password |
| Staff | 01700000003 | password |

**Change these before any real deployment.**

## What's in Phase 2

- Auth: login/logout, rate-limited (5 attempts), phone-based login (common in BD
  context — say if you'd rather use email), session regeneration, suspended-account
  block
- Roles: `super_admin`, `admin`, `staff` with a `permission`/`role` pivot for
  fine-grained module toggles (seeded with a starter permission set — expand as
  each module is built)
- `role` middleware (fast-fail) + `SettingPolicy` (real authorization) pattern —
  every future module should follow this same middleware-plus-Policy shape
- Base layout: responsive sidebar that becomes a drawer on mobile (Alpine.js),
  Bangla nav labels, Hind Siliguri font, toast for flash messages
- Settings module: Super-Admin-only, showroom name/address/contact/currency/
  invoice-prefix/footers/logo, cached via the `Setting` model
- `activity_logs` table + `ActivityLog::record()` helper, wired into login/
  logout/settings-update as the first examples — every module from Phase 3
  onward should call this on create/update/delete

## Note on the permissions package question

I went with hand-rolled `roles`/`permissions`/`permission_role` tables instead
of `spatie/laravel-permission`, purely because this sandbox can't `composer
require` anything external to verify it. Functionally it's the same shape
Spatie's package uses, so swapping to the package later (if you want its
Blade directives like `@can`) is a straightforward migration, not a rewrite.

## Next

Say "Phase 3" when you're ready for Categories, Products, and Inventory.