# Talashare — PHP login gate

A small PHP + MySQL login layer that sits in front of the Node.js
broadcaster app. Users log in here first; admins manage accounts here;
everyone gets redirected into the Node app (`http://localhost:3000`)
once authenticated.

```
Browser → Apache/PHP (this app, e.g. localhost:8080)
             │  login, admin user management, MySQL
             ▼
          Node app (localhost:3000)  ← unchanged, still runs separately
```

## 1. Requirements

- PHP 8+ with the `pdo_mysql` extension
- A MySQL (or MariaDB) server
- Apache with `mod_php` (or PHP-FPM behind Apache/nginx)

## 2. Create the database

```bash
mysql -u root -p < schema.sql
```

This creates a `talashare_auth` database with a `users` table and one
default admin account:

- **username:** `admin`
- **password:** `admin123`

**Log in and change this password immediately** (via your own profile,
or ask another admin to use "Reset password" on your account — see
Notes below on adding a self-service page if you want one).

## 3. Configure the DB connection

Edit `includes/db.php`, or set these environment variables for the
Apache/PHP process instead of hardcoding:

```
TALASHARE_DB_HOST=127.0.0.1
TALASHARE_DB_NAME=talashare_auth
TALASHARE_DB_USER=root
TALASHARE_DB_PASS=your_password
```

## 4. Point Apache at this folder

Example vhost, serving the PHP app on port 8080 while Node keeps 3000:

```apache
<VirtualHost *:8080>
    DocumentRoot "/path/to/talashare/php-auth"
    <Directory "/path/to/talashare/php-auth">
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
```

Restart Apache, then visit **http://localhost:8080** — you'll land on
the login page.

## 5. Start the Node app as usual

```bash
cd talashare
npm install
node server.js
```

It keeps running on `localhost:3000` exactly as before — this PHP
layer doesn't modify it. Right now the Node app itself doesn't check
who's logged in; the PHP gate only controls who *reaches* the link to
it. If you want the Node app to also refuse direct visits (bypassing
PHP), see "Locking down Node too" below.

## What each part does

| File | Purpose |
|---|---|
| `login.php` | Login form, checks username/password against MySQL |
| `logout.php` | Destroys the session |
| `index.php` | Landing gate — sends admins to the panel, users to the Node app |
| `admin/index.php` | List all users |
| `admin/create_user.php` | Admin creates a new user (username, password, role) |
| `admin/edit_user.php` | Admin edits a user's username/role |
| `admin/reset_password.php` | Admin sets a new password for a user |
| `admin/delete_user.php` | Admin deletes a user |
| `includes/db.php` | MySQL connection (PDO) |
| `includes/auth.php` | Session helpers, `require_login()`, `require_admin()`, CSRF |
| `schema.sql` | Creates the database/table + default admin |

Passwords are stored with PHP's `password_hash()` (bcrypt) — never in
plain text. All admin forms are protected with CSRF tokens.

## Notes & limits

- **Two roles only:** `admin` and `user`. Admins reach the user-management
  panel; regular users go straight to the Node app after login.
- **An admin can't delete or demote their own account** — this prevents
  accidentally locking out the last admin.
- **No self-service password change/reset-by-email yet.** Admins reset
  passwords for others via `admin/reset_password.php`. Add a
  `profile.php` page (using the same `password_verify`/`password_hash`
  pattern as `login.php`) if users should change their own password.
- **Session cookie:** uses PHP's default session cookie, named
  `talashare_sid`. For production over HTTPS, set
  `session.cookie_secure = 1` in `php.ini` (or call
  `session_set_cookie_params()` in `includes/auth.php`) so the cookie
  only travels over HTTPS.

## Locking down Node too (optional, more work)

Right now anyone who knows `localhost:3000` can skip the PHP login
entirely. To actually enforce it at the Node layer, the cleanest
options are:
1. **Shared secret cookie** — after PHP login, redirect to
   `http://localhost:3000/?token=...` with a signed token; Node
   validates it against a shared secret before creating a session.
2. **Bind Node to localhost only** and put Apache in front as a
   reverse proxy on the public port, forwarding to Node only after
   PHP's session check passes (via `mod_proxy` + an internal
   redirect).

Both require touching `server.js`. Let me know if you'd like this
wired up — it's a bigger change than the login/admin pages above.
