SWAMPy

✎ CARVE FLESH

EDITING: INSTALL-NO-COMPOSER.md.3

# JILMEK API — shared cPanel installation without Composer

Upload the contents of this package into the document root for `api.jilmekroofingandconstruction.com`. The package contains the PHP API, project media, SQL migrations, OpenAPI documentation, and no Composer dependency.

## Install or update

1. Back up the current API folder and database before replacing files.
2. Upload and extract this ZIP into the API subdomain document root. Do not overwrite the production `.env` with the example file.
3. Keep the existing `.env` and verify `APP_URL`, a long random `JWT_SECRET`, database credentials, and exact production `CORS_ORIGINS`.
4. In cPanel, select PHP 8.1+ and enable `PDO`, `PDO_MySQL`, `JSON`, and `mbstring`.
5. For a new database, import in this order: `database/schema.sql`, `database/001_foundation.sql`, `database/002_media_seed.sql`, `database/003_content_seed.sql`, then `database/004_enquiry_read_flag.sql`. The content seed inserts starter products/listings; run it once only.
6. For an existing install, do not re-import `schema.sql` or the content seed. Apply only any migration not yet run; `004_enquiry_read_flag.sql` is safe to run more than once.
7. Set `PROJECT_MEDIA_DIR` in `.env` to the API's `media/projects` directory (or leave it unset to use that package-relative location). Ensure the PHP process can write there. Only project-image uploads use this directory.
8. Confirm HTTPS is active for the API subdomain, then test `https://api.jilmekroofingandconstruction.com/api/health` and `/api/ready`.

## Website and image behavior

The API does not make all website images API-dependent. Product and property/listing images use the frontend's static `/images/...` assets. The authenticated media library accepts only JPEG, PNG, and WebP **project photos** (maximum 8 MB) and stores them under `/media/projects/`. Only photos linked through `project_media` are included in `GET /api/projects`; project photos are returned with absolute URLs based on `APP_URL`. Logos, hero images, product imagery, and other non-project assets remain on the Vercel/frontend static host.

A typical project image URL is:

```text
https://api.jilmekroofingandconstruction.com/media/projects/example.jpeg
```

## API routes

Public:

- `GET /api/health`, `GET /api/ready`
- `GET /api/site-settings/public`, `GET /api/services`, `GET /api/projects`
- `GET /api/products`, `GET /api/listings`
- `POST /api/enquiries`

Authenticated with a Bearer admin token:

- `POST /api/auth/login`, `GET /api/auth/me`
- `GET /api/enquiries`; `PATCH /api/enquiries/:id` updates `status` and/or `is_read`; `DELETE /api/enquiries/:id`
- `GET /api/admin/products`, `POST /api/products`, `PUT /api/products/:id`, `DELETE /api/products/:id`
- `GET /api/admin/listings`, `POST /api/listings`, `PUT /api/listings/:id`, `DELETE /api/listings/:id`
- `GET /api/media`, `POST /api/media` (multipart field `file`, project images only), `DELETE /api/media/:key`
- `POST /api/projects/:slug/images` and `DELETE /api/projects/:slug/images/:media_id`

Enquiry form submissions are stored in `enquiries` and appear in the dashboard list. Read/unread state is persisted by the `004_enquiry_read_flag.sql` migration. Testimonials intentionally remain frontend-local and have no API route in this update.

## Admin JWT flow

Create an administrator in `admin_users` with a bcrypt password hash (generate one with `php -r 'echo password_hash("YOUR_PASSWORD", PASSWORD_DEFAULT), PHP_EOL;'`). The dashboard signs in with `POST /api/auth/login` using `{ "email": "...", "password": "..." }`, then sends `Authorization: Bearer <access_token>` on protected requests. `GET /api/auth/me` validates the current token. Tokens use HS256, the `JWT_SECRET` environment variable, and expire after `JWT_TTL` seconds.

CORS is origin allowlisted through `CORS_ORIGINS`. Include the production website origin and any Vercel preview origins that need access. The API explicitly permits `Authorization`, JSON, and preflight `OPTIONS` requests.

## Secret handling

This package deliberately contains no production `.env`, database password, JWT secret, admin login, or production database dump. Never put those values in the ZIP or Git repository. Replace every placeholder in `.env.example` only in the server's private `.env` file.

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 api/	DIR	—	2026-11-06 12:19
📁 api.2/	DIR	—	2026-11-06 13:01
📁 assets/	DIR	—	2026-08-16 09:58
📁 client/	DIR	—	2026-11-06 12:30
📁 database/	DIR	—	2026-11-06 11:40
📁 database.1/	DIR	—	2026-11-06 11:40
📁 database.2/	DIR	—	2026-11-06 11:40
📁 database.3/	DIR	—	2026-11-06 14:09
📁 dist/	DIR	—	2026-08-16 09:51
📁 docs/	DIR	—	2026-11-06 10:07
📁 docs.1/	DIR	—	2026-11-06 10:07
📁 docs.2/	DIR	—	2026-11-06 10:07
📁 docs.3/	DIR	—	2026-11-06 10:07
📁 JILMEK-cpanel-api/	DIR	—	2026-11-06 10:07
📁 media/	DIR	—	2026-11-06 11:41
📁 media.1/	DIR	—	2026-11-06 11:41
📁 media.2/	DIR	—	2026-11-06 11:41
📁 media.3/	DIR	—	2026-11-06 11:41
📁 src/	DIR	—	2026-11-06 10:12
📁 src.1/	DIR	—	2026-11-06 10:12
📁 src.2/	DIR	—	2026-11-06 12:33
📁 src.3/	DIR	—	2026-11-06 14:06
📁 storage-private/	DIR	—	2026-11-06 13:44
📄 .env	ENV	679 B	2026-11-06 13:45	EDIT
📄 .env.example	EXAMPLE	206 B	2026-11-06 12:38	EDIT
📄 .env.example.1	1	602 B	2026-11-06 11:49	EDIT
📄 .env.example.2	2	666 B	2026-11-06 12:34	EDIT
📄 .env.example.3	3	728 B	2026-11-06 14:15	EDIT
📄 .gitignore	GITIGNORE	52 B	2026-11-06 12:30	EDIT
📄 .htaccess	HTACCESS	334 B	2026-11-06 10:05	EDIT
📄 .htaccess-backup	HTACCESS-BACKUP	281 B	2026-11-06 11:06	EDIT
📄 .htaccess.1	1	281 B	2026-11-06 12:13	EDIT
📄 .htaccess.2	2	334 B	2026-11-06 10:05	EDIT
📄 .htaccess.3	3	718 B	2026-11-06 12:30	EDIT
📄 .htaccess.4	4	718 B	2026-11-06 12:30	EDIT
📄 .trash_restore	TRASH_RESTORE	5.3 KB	2026-11-11 22:58	EDIT
📄 .well-known.zip	ZIP	44.7 MB	2026-11-04 07:58	EDIT
📄 api.1	1	0 B	2026-11-06 12:53	EDIT
📄 api.jilmekroofingandconstruction.com-cpanel-direct-upload.zip	ZIP	5.4 MB	2026-11-06 11:56	EDIT
📄 api.jilmekroofingandconstruction.com-cpanel-direct-upload.zip.1	1	5.4 MB	2026-11-06 12:07	EDIT
📄 api.jilmekroofingandconstruction.com-cpanel-direct-upload.zip.2	2	5.4 MB	2026-11-06 12:52	EDIT
📄 api.jilmekroofingandconstruction.com-updated.zip	ZIP	5.4 MB	2026-11-06 13:07	EDIT
📄 api.zip	ZIP	42.6 MB	2026-11-04 08:13	EDIT
📄 components.json	JSON	388 B	2026-11-06 12:30	EDIT
📄 dist.zip	ZIP	2.2 MB	2026-08-16 09:38	EDIT
📄 edit-faiz.php	PHP	12.7 KB	2026-08-18 05:41	EDIT
📄 favicon.ico	ICO	19.9 KB	2026-07-12 19:59	EDIT
📄 image.png	PNG	156.7 KB	2026-11-06 12:30	EDIT
📄 inde	?	0 B	2026-11-06 10:25	EDIT
📄 index.html	HTML	4.3 KB	2026-08-16 09:09	EDIT
📄 index.php	PHP	145 B	2026-11-06 10:45	EDIT
📄 index.php.1	1	1.5 KB	2026-11-06 11:50	EDIT
📄 index.php.2	2	1.5 KB	2026-11-06 11:50	EDIT
📄 index.php.3	3	1.5 KB	2026-11-06 12:34	EDIT
📄 index.php.4	4	1.5 KB	2026-11-06 14:07	EDIT
📄 info.php.1	1	16 B	2026-10-22 23:44	EDIT
📄 INSTALL-NO-COMPOSER.md	MD	1 KB	2026-11-06 11:50	EDIT
📄 INSTALL-NO-COMPOSER.md.1	1	1 KB	2026-11-06 11:50	EDIT
📄 INSTALL-NO-COMPOSER.md.2	2	2.7 KB	2026-11-06 12:37	EDIT
📄 INSTALL-NO-COMPOSER.md.3	3	4.2 KB	2026-11-06 14:12	EDIT
📄 jilmek-api-updated.zip	ZIP	5.5 MB	2026-11-06 14:24	EDIT
📄 Jilmek-Construction-project-images-api-only.zip	ZIP	5.7 MB	2026-11-06 12:50	EDIT
📄 JILMEK-cpanel-api-with-images.zip	ZIP	5.4 MB	2026-11-06 11:48	EDIT
📄 package-lock.json	JSON	168 KB	2026-11-06 12:30	EDIT
📄 package.json	JSON	2.4 KB	2026-11-06 12:30	EDIT
📄 tsconfig.json	JSON	576 B	2026-11-06 12:30	EDIT
📄 tsconfig.node.json	JSON	479 B	2026-11-06 12:30	EDIT
📄 vercel.json	JSON	266 B	2026-11-06 12:30	EDIT
📄 vite.config.ts	TS	734 B	2026-11-06 12:30	EDIT