# Deploying to a Linux / GoDaddy VPS (PHP + MySQL)

## 1. Database
```bash
mysql -u USER -p DBNAME < backend/schema.sql
```
Tables use InnoDB with foreign keys and indexes on `(room_id, start_time, end_time)`
so overlap probes stay fast under load.

## 2. API
Copy `backend/api/*.php` to the web root as `/api/` and edit the constants at the
top of `_bootstrap.php` (DB credentials, `GOOGLE_CLIENT_ID`).

Endpoints (all return `{ "data": ... }` or `{ "error": "..." }`):

| Endpoint | Actions |
|---|---|
| `/api/auth.php` | `session`, `google`, `logout` |
| `/api/bookings.php` | `list`, `create`, `update`, `cancel-series`, `cancel-batch`, `activity`, `activity-read` |
| `/api/rooms.php` | `list`, `rules`, `save`, `delete`, `save-rule`, `delete-rule` |
| `/api/settings.php` | `get`, `save` (multipart logo upload) |
| `/api/users.php` | `authorized`, `list`, `add-authorized`, `set-status`, `remove` |

## 3. Uploads
```bash
mkdir -p /var/www/html/uploads/logo && chown -R www-data:www-data /var/www/html/uploads
```
Logos are validated by MIME type, capped at 2 MB, stored with a random filename
and referenced from `app_settings.logo_url`.

## 4. Frontend
Build the SPA and serve `dist/` from the same domain so cookies/session work:
```bash
VITE_API_BASE="" npm run build
```
Setting `VITE_API_BASE` switches the app from the built-in demo store to the live
PHP API. Without it (Lovable preview) everything runs against browser storage.

## 5. Concurrency guarantee
`bookings.php?action=create` wraps the whole checkout in
`START TRANSACTION` → `SELECT ... FOR UPDATE` overlap probe per slot →
`INSERT` → `COMMIT`, rolling back with HTTP 409 and the message
"Slot already reserved! …" if another transaction holds the range.

## 6. Google OAuth
Use Google Identity Services on the client, POST the `id_token` to
`/api/auth.php?action=google`. The server verifies the token against
`GOOGLE_CLIENT_ID`, then checks `authorized_emails`; unlisted or suspended
addresses get their session destroyed and receive the authorization error.
