# Hostiva v3 — Enterprise Property & Operations Platform

A premium, production-ready SaaS-style platform for property, booking, finance, channel integrations (Airbnb, Hospitable, etc.), team and operations management. PHP 7.4+ / MySQL 5.7+, zero npm build step required.

**v3.2 production build** — full page/API repair, session fix for XAMPP/cPanel subfolders, Channels module. See `docs/BLUEPRINT.md` and `docs/DEPLOYMENT_CHECKLIST.md`.

**v4.0 STR Operating System** — additive Command Center, OTA sync engine, live calendar, inbox, AI insights, automations, real-time events. See `docs/V4_STR_OS.md`. Run `database/migrations_002_v4_str_os.sql` to enable.

**v5.0 STR Ecosystem** — owner portal, reservation locks, OTA webhook import, workflow builder, background jobs. See `docs/V5_ECOSYSTEM.md`. Run `database/migrations_003_v5_ecosystem.sql` after V4.

---

## ✨ Highlights

- **Luxury dashboard UI** — glassmorphism, dark/light mode, responsive, skeleton loaders, toasts.
- **Single-entry API** (`/api/?r=route`) with CSRF, rate-limit, RBAC, audit log.
- **Bookings with race-safe double-booking prevention** (`FOR UPDATE` row locks).
- **Roles & permissions** — super_admin, admin, manager, staff, viewer.
- **Modules** — Dashboard, Bookings, Properties, Operations (kanban), Finance (payments & expenses), Reports (CSV export), Team, Activity Log, Settings.
- **AI-style insights** — automatic margin, alerts, occupancy summaries.
- **Audit log** for every write action with user, IP, user agent.
- **Install wizard** at `install.php` — sets up DB and admin in one screen.
- **Two deployments** — XAMPP-ready and cPanel-ready zips.

---

## 🚀 Install — XAMPP (local)

1. Extract this zip into `C:\xampp\htdocs\hostiva` (or your htdocs path).
2. Start **Apache** and **MySQL** in XAMPP.
3. Open `http://localhost/hostiva/install.php` and follow the wizard.
4. After install succeeds, **delete `install.php`**.
5. Login at `http://localhost/hostiva/pages/login.html` with the credentials you set (default: `admin@hostiva.local` / `Admin@12345`).

### Manual setup (alternative)
- Import `database/hostiva_v3.sql` via phpMyAdmin.
- Copy `config/config.sample.php` → `config/config.php` and fill in DB credentials.
- Done.

---

## 🌐 Install — cPanel / Shared hosting

1. Create a MySQL database, user, and password in cPanel.
2. Upload the entire folder to `public_html/hostiva/` via File Manager or FTP.
3. Visit `https://yourdomain.com/hostiva/install.php` and run the wizard with your DB details.
4. Delete `install.php`.
5. (Optional) Force HTTPS by uncommenting the redirect lines in `.htaccess`.

> The `.htaccess` files block direct access to `config/`, `logs/`, and `includes/`.

---

## 🔐 Security features

- bcrypt password hashing
- CSRF token enforced on all writes
- Per-session rate limiting on login (lockout after 6 failures)
- Security headers (`X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, HSTS on HTTPS)
- HttpOnly + SameSite cookies; secure cookie flag toggle
- PDO prepared statements everywhere (no raw queries)
- Soft-delete for users & properties
- Audit log on every write
- Role + permission middleware (`require_permission`)
- Failed-login lockout
- Optional HTTPS forcing in `.htaccess`

---

## 🗂 Folder structure

```
hostiva/
├── api/                      # All backend routes
│   ├── bootstrap.php         # DB, session, security, helpers
│   ├── index.php             # Single-entry router
│   └── controllers/          # One file per route
├── assets/
│   ├── css/hostiva.css       # Premium theme
│   └── js/hostiva.js         # API client, toasts, modals
│   └── js/layout.js          # Sidebar/topbar injector
├── config/
│   ├── config.sample.php
│   └── config.php            # (created by installer)
├── database/
│   └── hostiva_v3.sql        # Complete fresh schema + seeds
├── pages/                    # All dashboard HTML pages
├── uploads/                  # User-uploaded files
├── logs/                     # PHP error log
├── includes/                 # Internal partials (blocked)
├── install.php               # One-time install wizard
├── index.html                # Landing
└── .htaccess
```

---

## 🧪 Test endpoints

- `GET /api/?r=ping` — server reachable
- `GET /api/?r=health` — DB + tables status
- `POST /api/?r=auth/login` — `{email,password}`
- `GET /api/?r=dashboard` — KPIs + insights

---

## 📦 What's in this build

| Module       | Features |
| ------------ | -------- |
| Auth         | Login, register (pending approval), logout, CSRF, lockout |
| Dashboard    | KPIs · 30-day revenue chart · AI insights · occupancy · recent activity |
| Bookings     | List/filter/search · create with availability lock · cancel · add payment |
| Properties   | CRUD · pricing · status · soft-delete |
| Operations   | Kanban (open / in progress / done) · priority · assign |
| Finance      | Payment & expense tracking · auto payment_status recompute |
| Reports      | Revenue / Expenses / Occupancy + CSV export |
| Team         | Invite, edit, suspend, role assignment, force-reset password |
| Activity     | Full audit trail with IP and user agent |
| Settings     | Branding, currency, timezone, email |

---

## 🛣 Roadmap (next versions)

- iCal / Airbnb / Booking.com 2-way sync
- Stripe + Razorpay native checkout
- PDF invoice generation (Dompdf)
- Email & SMS notifications (PHPMailer + Twilio)
- File uploads with image optimization (Intervention)
- Multi-currency FX with daily rates
- WhatsApp guest concierge bot
- Native mobile PWA shell
- Multi-tenant white-label mode

---

## 📜 License

MIT — use freely in personal or commercial projects.
