# BarberShop site package

This zip is the **shop website** you install after you buy a BarberShop site. It is generic on purpose. Until you edit Admin, the public header says **Company Name Here** and the hero says **Title Here**.

Your shop lives at:

**`https://YOURSHOP.barber-shop.us/`**

Replace `YOURSHOP` with the subdomain you were given (example: `joes` → `https://joes.barber-shop.us/`). Charlie’s (`charlies.barber-shop.us`) is only the live test shop — not the name baked into this product.

Customers do **not** need their own copy of this zip. They use your public site, or the shared Android app from the parent site:

**https://barber-shop.us/download-app.php**

Then they enter **your shop name** (the `YOURSHOP` slug).

## What you are installing

| Piece | Who uses it |
|-------|-------------|
| This zip (PHP site + SQL + starter photos) | You, the shop owner |
| `https://YOURSHOP.barber-shop.us/admin/` | You (admin) |
| `https://YOURSHOP.barber-shop.us/` | Your clients (web) |
| BarberShop Android app | Your clients (phone) |

One Android app serves every shop on the platform. You do not rebuild the app for each sale.

## Install (GoDaddy / cPanel)

Full hosting checklist: **`DEPLOY.md`**. Short version:

1. Unzip so `index.php` is in the subdomain document root (do not nest a second folder).
2. Create a MySQL database + user. Grant that user all privileges on that database only.
3. phpMyAdmin → select that database → **Import** `sql/install.sql`.
4. Edit `sql/set-shop-slug.sql` (put your slug in place of `yourshop`) → Import that file too.
5. Copy `config/db.local.example.php` → `config/db.local.php` and fill cPanel DB name, user, and password. Leave `'APP_BASE' => ''`.
6. Make `uploads/` and `storage/` writable (0755 or 0775). Keep `uploads/tenant_1/` — those are the starter photos.

Open `https://YOURSHOP.barber-shop.us/` — you should see the starter site.

## First-time setup (owner)

Sign in at **`/admin/login.php`**

Default owner login (change immediately):

- Username: `admin`
- Password: `password32`

Then:

1. **Branding** — company name, colors, fonts. Set **Subdomain** to `YOURSHOP` (must match the hostname). Optional: custom domain later.
2. **Page Content** — replace **Title Here**, address, phone, SEO.
3. **Media** — starter photos are already linked. Replace any you do not want.
4. **Services / Staff / Styles / Products** — edit the catalog.
5. **Payments / Policy / Reminders** — when you are ready for real bookings.

A test customer row ships in SQL (`sam@charlies.barber-shop.us` / `customer32`). Delete or rename it after go-live.

## Let clients download the Android app

Put this on your cards, texts, and Instagram:

1. Open **https://barber-shop.us/download-app.php** (or your shop link **`/download-app.php`**, which sends them there).
2. Download **BarberShop.apk**.
3. Install (Android will warn — that is normal until the app is on Google Play; see below).
4. Open the app and enter shop name **`YOURSHOP`**.

Your public site footer also has **Get the Android app**. That page tells the client *which shop name to type*.

Owners stay on the website admin. The app rejects owner/admin logins on purpose.

## Android “risk” / Play Protect warning

Sideloading an APK (installing from a website instead of Google Play) **always** shows extra Android and Chrome warnings. That is the phone protecting the user, not a broken file.

Until the app is listed on **Google Play**, clients will typically see:

1. **Chrome** — “File isn’t commonly downloaded” / “This file might be harmful” → **Download anyway** / **Keep**.
2. **Install unknown apps** — Settings → allow Chrome (or Files) to install apps.
3. **Play Protect** — “Play Protect doesn’t recognize this app” → **Install anyway** / **More details → Install**.

The file they should install is only the APK from **https://barber-shop.us/download-app.php**. Do not send clients a copy from email or Drive.

**The warning goes away for customers only after the app is published on Google Play** (even an Internal testing track is enough for invited testers). A release-signed APK (not a debug build) is required for Play, and it is what the parent site should host. Debug APKs from Android Studio are signed with a well-known test key and get a harsher Play Protect block.

See the Android project README (`barbershop-android`) for release signing and Play Console steps.

## After install — sanity checks

- Public site loads with **Company Name Here** until you brand it.
- Admin login works; change the password.
- Book a test appointment as a customer (site or app).
- App: shop name `YOURSHOP` opens `https://YOURSHOP.barber-shop.us/`.
