# Changelog

All notable changes to Hostledger are recorded here. Version shown also
lives in `includes/version.php` (`HOSTLEDGER_VERSION`) — bump both
together.

## 0.1.0 — initial build

First working version, built phase by phase per `PROJECT_PLAN.md`.

- Install wizard (requirements check, DB setup, schema import, admin
  account, config.php generation + self-lock)
- Admin and client authentication with brute-force lockout and audit
  logging
- Client management, password reset via email
- Products/plans, client ordering, invoice generation
- Manual "mark as paid", recurring renewal invoices, overdue/suspend cron
  jobs
- WHM/cPanel provisioning: auto-provision on payment, auto-suspend on
  overdue, manual suspend/unsuspend/terminate
- Domain registration via eNom: availability check, pay-then-register
  flow, expiry reminder emails
- Affiliate program: opt-in referral codes, commission tracking, admin
  payout recording
- Support ticket system with email notifications
- Admin/client dashboards with at-a-glance stats
- Pluggable payment gateways — Stripe, PayPal, and Paystack, each behind a
  shared `GatewayInterface`. Admin pastes credentials into Admin → Gateways
  and enables the ones they want; clients see a "Pay with X" button per
  enabled gateway on their invoice. Each gateway verifies its own webhook
  signature (Stripe: HMAC-SHA256, Paystack: HMAC-SHA512, PayPal: their
  verify-webhook-signature API) before a payment is ever trusted, and
  `Billing::markInvoicePaid()` remains idempotent so retried webhooks can't
  double-credit an invoice.

### Known gaps (see PROJECT_PLAN.md for full detail)

- Admin-side password reset (forgot-password for admin accounts) isn't
  built — only the client-facing flow is.
- No in-app logo *upload* UI — a logo now displays automatically if you
  drop a file at `assets/img/logo.png` (see 0.2.0 below), but there's no
  admin form to upload one through the browser yet.
- Not yet decided: license-key gating for resale vs. sold as unlocked
  source (see PROJECT_PLAN.md Phase 10).
- None of this PHP code has been executed against a real PHP/MySQL server
  — the build environment had no PHP runtime available, so everything here
  is the result of careful manual review (syntax, logic, brace/paren
  balance checks), not actual test runs. Treat Phase 11 QA against a real
  cPanel/MySQL environment as mandatory before relying on this in
  production, especially the three payment gateways and the eNom
  integration.

## 0.2.0 — branding & settings

- Logo support: `includes/layout.php` shows `assets/img/logo.png` in the
  topbar automatically if the file exists (wrapped in a white pill, since
  the supplied logo has a light background rather than transparency), and
  falls back to the plain text brand otherwise.
- `admin/settings.php` — new admin page for `company_name`, `currency`,
  `timezone`, and a "show developer credit" checkbox. `company_name`
  previously had no admin UI at all (schema-seed only); this was a real gap
  closed as part of adding the setting below.
- "Developed by SEO Boost Hosting" credit, shown in three places: the
  README/project docs (permanent authorship record), a footer line on
  every page (togglable per-install via the new `show_developer_credit`
  setting, default on), and the install wizard's finish screen.
- Fixed stale copy on the install wizard's finish screen (referenced
  "Phase 10", an incorrect gateway settings path, and only 2 of the 3 cron
  jobs).
- `database/schema.sql`: added `show_developer_credit` setting,
  `schema_version` bumped 4 → 5.