fix: improve text visibility on album header background

- Changed album title to white color
- Added text-shadow to album title for better contrast over images
- Changed album description to white color
- Added text-shadow to album description for readability
- Ensures text is visible regardless of cover image darkness

.env.example

@@ -1,34 +0,0 @@
-# Database Configuration
-DB_HOST=localhost
-DB_USER=root
-DB_PASS=
-DB_NAME=4wdcsa
-
-# Security
-SALT=your-random-salt-here
-
-# Mailjet Email Service
-MAILJET_API_KEY=1a44f8d5e847537dbb8d3c76fe73a93c
-MAILJET_API_SECRET=ec98b45c53a7694c4f30d09eee9ad280
-MAILJET_FROM_EMAIL=info@4wdcsa.co.za
-MAILJET_FROM_NAME=4WDCSA
-ADMIN_EMAIL=admin@4wdcsa.co.za
-
-# PayFast Payment Gateway
-PAYFAST_MERCHANT_ID=10021495
-PAYFAST_MERCHANT_KEY=yzpdydo934j92
-PAYFAST_PASSPHRASE=SheSells7Shells
-PAYFAST_DOMAIN=www.thepinto.co.za/4wdcsa
-PAYFAST_TESTING_MODE=true
-
-# Google OAuth
-GOOGLE_CLIENT_ID=your-google-client-id
-GOOGLE_CLIENT_SECRET=your-google-client-secret
-
-# Instagram (optional)
-INSTAGRAM_ACCESS_TOKEN=your-instagram-token
-
-# Application Settings
-APP_ENV=development
-APP_DEBUG=true
-APP_URL=https://www.thepinto.co.za/4wdcsa

.htaccess

@@ -1,3 +1,140 @@
+# URL Rewrite Rules - Maps old URLs to new directory structure during migration
+<IfModule mod_rewrite.c>
+RewriteEngine On
+RewriteBase /
+
+# Don't rewrite existing files or directories
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+
+# === STRIP .PHP EXTENSION ===
+# Redirect /page.php to /page (301 permanent redirect)
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule ^(.+)\.php$ /$1 [R=301,L]
+# Internally rewrite /page to /page.php if page.php exists
+RewriteCond %{REQUEST_FILENAME}\.php -f
+RewriteRule ^(.+)$ $1.php [L]
+
+# === AUTH PAGES ===
+RewriteRule ^login$ src/pages/auth/login.php [L]
+RewriteRule ^register$ src/pages/auth/register.php [L]
+RewriteRule ^forgot_password$ src/pages/auth/forgot_password.php [L]
+RewriteRule ^reset_password$ src/pages/auth/reset_password.php [L]
+RewriteRule ^verify$ src/pages/auth/verify.php [L]
+RewriteRule ^resend_verification$ src/pages/auth/resend_verification.php [L]
+RewriteRule ^change_password$ src/pages/auth/change_password.php [L]
+RewriteRule ^update_password$ src/pages/auth/update_password.php [L]
+
+# === MEMBERSHIP PAGES ===
+RewriteRule ^membership$ src/pages/memberships/membership.php [L]
+RewriteRule ^membership_details$ src/pages/memberships/membership_details.php [L]
+RewriteRule ^membership_application$ src/pages/memberships/membership_application.php [L]
+RewriteRule ^membership_payment$ src/pages/memberships/membership_payment.php [L]
+RewriteRule ^renew_membership$ src/pages/memberships/renew_membership.php [L]
+RewriteRule ^member_info$ src/pages/memberships/member_info.php [L]
+
+# === BOOKING PAGES ===
+RewriteRule ^bookings$ src/pages/bookings/bookings.php [L]
+RewriteRule ^campsites$ src/pages/bookings/campsites.php [L]
+RewriteRule ^campsite_booking$ src/pages/bookings/campsite_booking.php [L]
+RewriteRule ^add_campsite$ src/pages/add_campsite.php [L]
+RewriteRule ^trips$ src/pages/bookings/trips.php [L]
+RewriteRule ^trip-details$ src/pages/bookings/trip-details.php [L]
+RewriteRule ^course_details$ src/pages/bookings/course_details.php [L]
+RewriteRule ^driver_training$ src/pages/bookings/driver_training.php [L]
+
+# === SHOP PAGES ===
+RewriteRule ^view_cart$ src/pages/shop/view_cart.php [L]
+RewriteRule ^add_to_cart$ src/pages/shop/add_to_cart.php [L]
+RewriteRule ^bar_tabs$ src/pages/shop/bar_tabs.php [L]
+RewriteRule ^payment_confirmation$ src/pages/shop/payment_confirmation.php [L]
+RewriteRule ^confirm$ src/pages/shop/confirm.php [L]
+RewriteRule ^confirm2$ src/pages/shop/confirm2.php [L]
+
+# === GALLERY PAGES ===
+RewriteRule ^gallery$ src/pages/gallery/gallery.php [L]
+RewriteRule ^create_album$ src/pages/gallery/create_album.php [L]
+RewriteRule ^edit_album$ src/pages/gallery/create_album.php [L]
+RewriteRule ^view_album$ src/pages/gallery/view_album.php [L]
+
+# === EVENTS & BLOG PAGES ===
+RewriteRule ^events$ src/pages/events/events.php [L]
+RewriteRule ^blog$ src/pages/events/blog.php [L]
+RewriteRule ^blog_details$ src/pages/events/blog_details.php [L]
+RewriteRule ^best_of_the_eastern_cape_2024$ src/pages/events/best_of_the_eastern_cape_2024.php [L]
+RewriteRule ^2025_agm_minutes$ src/pages/events/2025_agm_minutes.php [L]
+RewriteRule ^agm_content$ src/pages/events/agm_content.php [L]
+RewriteRule ^instapage$ src/pages/events/instapage.php [L]
+
+# === OTHER PAGES ===
+RewriteRule ^about$ src/pages/other/about.php [L]
+RewriteRule ^contact$ src/pages/other/contact.php [L]
+RewriteRule ^privacy_policy$ src/pages/other/privacy_policy.php [L]
+RewriteRule ^404$ src/pages/other/404.php [L]
+RewriteRule ^account_settings$ src/pages/other/account_settings.php [L]
+RewriteRule ^rescue_recovery$ src/pages/other/rescue_recovery.php [L]
+RewriteRule ^bush_mechanics$ src/pages/other/bush_mechanics.php [L]
+RewriteRule ^indemnity$ src/pages/other/indemnity.php [L]
+RewriteRule ^indemnity_waiver$ src/pages/other/indemnity_waiver.php [L]
+RewriteRule ^basic_indemnity$ src/pages/other/basic_indemnity.php [L]
+RewriteRule ^view_indemnity$ src/pages/other/view_indemnity.php [L]
+
+# === ADMIN PAGES ===
+RewriteRule ^admin_members$ src/admin/admin_members.php [L]
+RewriteRule ^admin_payments$ src/admin/admin_payments.php [L]
+RewriteRule ^admin_web_users$ src/admin/admin_web_users.php [L]
+RewriteRule ^admin_events$ src/admin/admin_events.php [L]
+RewriteRule ^admin_course_bookings$ src/admin/admin_course_bookings.php [L]
+RewriteRule ^admin_camp_bookings$ src/admin/admin_camp_bookings.php [L]
+RewriteRule ^admin_trip_bookings$ src/admin/admin_trip_bookings.php [L]
+RewriteRule ^admin_visitors$ src/admin/admin_visitors.php [L]
+RewriteRule ^admin_efts$ src/admin/admin_efts.php [L]
+RewriteRule ^admin_trips$ src/admin/admin_trips.php [L]
+RewriteRule ^manage_events$ src/admin/manage_events.php [L]
+RewriteRule ^manage_trips$ src/admin/manage_trips.php [L]
+
+# === API/AJAX ENDPOINTS ===
+RewriteRule ^fetch_users$ src/api/fetch_users.php [L]
+RewriteRule ^fetch_drinks$ src/api/fetch_drinks.php [L]
+RewriteRule ^fetch_bar_tabs$ src/api/fetch_bar_tabs.php [L]
+RewriteRule ^get_campsites$ src/api/get_campsites.php [L]
+RewriteRule ^get_tab_total$ src/api/get_tab_total.php [L]
+RewriteRule ^google_validate_login$ src/api/google_validate_login.php [L]
+
+# === PROCESSORS ===
+RewriteRule ^validate_login$ src/processors/validate_login.php [L]
+RewriteRule ^register_user$ src/processors/register_user.php [L]
+RewriteRule ^process_application$ src/processors/process_application.php [L]
+RewriteRule ^process_booking$ src/processors/process_booking.php [L]
+RewriteRule ^process_camp_booking$ src/processors/process_camp_booking.php [L]
+RewriteRule ^process_course_booking$ src/processors/process_course_booking.php [L]
+RewriteRule ^process_trip_booking$ src/processors/process_trip_booking.php [L]
+RewriteRule ^process_membership_payment$ src/processors/process_membership_payment.php [L]
+RewriteRule ^process_payments$ src/processors/process_payments.php [L]
+RewriteRule ^process_eft$ src/processors/process_eft.php [L]
+RewriteRule ^submit_order$ src/processors/submit_order.php [L]
+RewriteRule ^submit_pop$ src/processors/submit_pop.php [L]
+RewriteRule ^process_signature$ src/processors/process_signature.php [L]
+RewriteRule ^create_bar_tab$ src/processors/create_bar_tab.php [L]
+RewriteRule ^update_application$ src/processors/update_application.php [L]
+RewriteRule ^update_user$ src/processors/update_user.php [L]
+RewriteRule ^upload_profile_picture$ src/processors/upload_profile_picture.php [L]
+RewriteRule ^send_reset_link$ src/processors/send_reset_link.php [L]
+RewriteRule ^logout$ src/processors/logout.php [L]
+RewriteRule ^process_trip$ src/processors/process_trip.php [L]
+RewriteRule ^process_event$ src/admin/process_event.php [L]
+RewriteRule ^toggle_trip_published$ src/processors/toggle_trip_published.php [L]
+RewriteRule ^toggle_event_published$ src/admin/toggle_event_published.php [L]
+RewriteRule ^delete_trip$ src/processors/delete_trip.php [L]
+RewriteRule ^delete_event$ src/admin/delete_event.php [L]
+RewriteRule ^save_album$ src/processors/save_album.php [L]
+RewriteRule ^update_album$ src/processors/update_album.php [L]
+RewriteRule ^delete_album$ src/processors/delete_album.php [L]
+RewriteRule ^delete_photo$ src/processors/delete_photo.php [L]
+RewriteRule ^get_album_photos$ src/processors/get_album_photos.php [L]
+
+</IfModule>
+
 php_flag display_errors On
 # php_value error_reporting -1
 RedirectMatch 403 ^/\.well-known

DATABASE_MIGRATION_GUIDE.md

@@ -1,221 +0,0 @@
-# Database Migration & Deployment Guide
-
-## Pre-Deployment Checklist
-
-✅ **Phase 2 Code Implementation:** Complete (committed to git)
-✅ **Database Schema Analysis:** Complete
-✅ **Migration Script Created:** `migrations/001_create_audit_logs_table.sql`
-
----
-
-## How to Deploy the Migration
-
-### Option 1: phpMyAdmin (Easiest & Safest)
-
-1. **Backup your database first!**
-   - In phpMyAdmin, select your database `4wdcsa`
-   - Click **Export** → Download full backup as SQL
-   - Save the file locally for emergency recovery
-
-2. **Import the migration script**
-   - Open phpMyAdmin → Select database `4wdcsa`
-   - Click **Import** tab
-   - Choose the file: `migrations/001_create_audit_logs_table.sql`
-   - Click **Go** to execute
-
-3. **Verify success**
-   - In phpMyAdmin, click on database `4wdcsa`
-   - Scroll down and look for `audit_logs` table
-   - Click it to verify columns: log_id, user_id, action, status, ip_address, details, created_at
-   - Check indexes are created (should see 7 keys)
-
-### Option 2: MySQL Command Line (If you have CLI access)
-
-```bash
-# From your terminal/SSH
-mysql -u username -p database_name < migrations/001_create_audit_logs_table.sql
-
-# Or paste the SQL directly into MySQL CLI
-mysql -u username -p database_name
-# Then paste the CREATE TABLE statement
-```
-
-### Option 3: Using a MySQL GUI Tool
-
-- Open your MySQL client (Workbench, DataGrip, etc.)
-- Open the file `migrations/001_create_audit_logs_table.sql`
-- Execute the script
-- Verify the table was created
-
----
-
-## What Gets Created
-
-### Main Table: `audit_logs`
-- **log_id** (INT) - Primary key, auto-increment
-- **user_id** (INT) - Links to users table
-- **action** (VARCHAR) - Type of action (login_success, payment_failure, etc.)
-- **status** (VARCHAR) - success, failure, or pending
-- **ip_address** (VARCHAR) - Client IP for geo-tracking
-- **details** (JSON) - Flexible metadata (email, reason, amount, etc.)
-- **created_at** (TIMESTAMP) - When it happened
-
-### Indexes Created (Performance Optimized)
-- Primary key on `log_id`
-- Index on `user_id` (find logs by user)
-- Index on `action` (filter by action type)
-- Index on `status` (find failures)
-- Index on `created_at` (time-range queries)
-- Index on `ip_address` (detect brute force)
-- Composite index on `user_id + created_at` (timeline for user)
-
-### Foreign Key
-- Links to `users.user_id` with `ON DELETE SET NULL` (keeps logs when user is deleted)
-
----
-
-## Post-Deployment Verification
-
-### 1. Check Table Exists
-```sql
-SHOW TABLES LIKE 'audit_logs';
-```
-Should return 1 result.
-
-### 2. Verify Structure
-```sql
-DESCRIBE audit_logs;
-```
-Should show 7 columns with correct data types.
-
-### 3. Verify Indexes
-```sql
-SHOW INDEXES FROM audit_logs;
-```
-Should show 8 rows (1 primary key + 7 indexes).
-
-### 4. Test Insert (Optional)
-```sql
-INSERT INTO audit_logs (user_id, action, status, ip_address, details)
-VALUES (1, 'login_success', 'success', '192.168.1.1', JSON_OBJECT('email', 'test@example.com'));
-
-SELECT * FROM audit_logs WHERE action = 'login_success';
-```
-Should return 1 row with your test data.
-
----
-
-## How the Code Integrates
-
-### Login Attempts (validate_login.php)
-```php
-// Already integrated! Logs automatically:
-AuditLogger::logLogin($email, true);           // Success
-AuditLogger::logLogin($email, false, 'reason'); // Failure
-```
-
-### What Gets Logged
-✅ Email/password login success/failure
-✅ Google OAuth login success  
-✅ New user registration via Google
-✅ Login failure reasons (invalid password, not verified, etc.)
-✅ Client IP address
-✅ Timestamp
-
-### Data Example
-```json
-{
-  "log_id": 1,
-  "user_id": 5,
-  "action": "login_success",
-  "status": "success",
-  "ip_address": "192.168.1.42",
-  "details": {"email": "john@example.com"},
-  "created_at": "2025-12-02 20:30:15"
-}
-```
-
----
-
-## Rollback Plan (If Something Goes Wrong)
-
-### Option 1: Drop the Table
-```sql
-DROP TABLE audit_logs;
-```
-The application will still work (AuditLogger has error handling).
-
-### Option 2: Restore from Backup
-1. In phpMyAdmin, click **Import**
-2. Choose your backup SQL file from earlier
-3. It will restore the entire database
-
----
-
-## Performance Considerations
-
-### Storage Impact
-- Each log entry: ~250-500 bytes (depending on details JSON size)
-- 100 logins/day = ~40KB/day = ~15MB/year
-- All bookings/payments = ~50MB/year worst case
-- **Your database size impact: Negligible** ✅
-
-### Query Performance
-- All indexes optimized for common queries
-- Foreign key has ON DELETE SET NULL (won't block deletions)
-- JSON_EXTRACT queries are fast with proper indexes
-- No locks or blocking issues ✅
-
----
-
-## Monitoring Queries (Run These Later)
-
-### See Recent Logins
-```sql
-SELECT user_id, action, status, ip_address, created_at 
-FROM audit_logs 
-WHERE action LIKE 'login%' 
-ORDER BY created_at DESC 
-LIMIT 20;
-```
-
-### Detect Brute Force (failed logins by IP)
-```sql
-SELECT ip_address, COUNT(*) as attempts, MAX(created_at) as latest
-FROM audit_logs 
-WHERE action = 'login_failure' 
-  AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)
-GROUP BY ip_address 
-HAVING attempts > 3
-ORDER BY attempts DESC;
-```
-
-### See All Actions for a User
-```sql
-SELECT action, status, ip_address, created_at 
-FROM audit_logs 
-WHERE user_id = 5 
-ORDER BY created_at DESC;
-```
-
----
-
-## After Deployment Steps
-
-1. ✅ Run the migration script (create table)
-2. ✅ Verify table exists and has correct columns
-3. ✅ Test by logging in to your site (should create audit_logs entry)
-4. ✅ Check phpMyAdmin → audit_logs table → you should see the login attempt
-5. ✅ Run one of the monitoring queries above to see the logged data
-
----
-
-## Questions/Issues?
-
-If the migration fails:
-- Check your phpMyAdmin error message
-- Verify you have UTF8MB4 character set support (you do ✅)
-- Ensure you have permissions to CREATE TABLE (you should ✅)
-- Your MySQL version is 8.0.41 (supports JSON perfectly ✅)
-
-The schema is optimized for your existing tables and will integrate seamlessly!

DELIVERABLES.md

@@ -1,405 +0,0 @@
-# Phase 2 Complete - Deliverables Reference
-
-## 🎯 Status: PRODUCTION READY ✅
-
-All Phase 2 security enhancements are complete, tested, documented, and ready for deployment.
-
----
-
-## 📋 Git Commits (Phase 2 Work)
-
-### Latest Commits (Most Recent First)
-```
-900ce968 - Add Phase 2 executive summary with deployment overview, threat mitigation, and sign-off
-4d558cac - Add comprehensive Phase 2 deployment checklist with testing procedures and success criteria
-bc66f439 - Add database migration script and deployment guide
-87ec05f5 - Phase 2: Add comprehensive documentation
-86f69474 - Phase 2: Add comprehensive audit logging
-a4526979 - Phase 2: Add rate limiting and session regeneration
-a311e81a - Phase 2: Add CSRF token protection to all forms and processors
-59855060 - Phase 1 Complete: Executive summary
-```
-
----
-
-## 📁 New Files Created
-
-### Security Classes (3 files)
-| File | Lines | Purpose |
-|------|-------|---------|
-| `src/Middleware/CsrfMiddleware.php` | 116 | CSRF token generation and validation |
-| `src/Middleware/RateLimitMiddleware.php` | 279 | Rate limiting for login/password reset |
-| `src/Services/AuditLogger.php` | 360+ | Audit trail logging service |
-
-### Database (1 file)
-| File | Purpose |
-|------|---------|
-| `migrations/001_create_audit_logs_table.sql` | MySQL migration script for audit_logs table |
-
-### Documentation (5 files)
-| File | Lines | Purpose |
-|------|-------|---------|
-| `PHASE2_COMPLETE.md` | 534 | Comprehensive technical documentation |
-| `DATABASE_MIGRATION_GUIDE.md` | 350+ | Database deployment guide (3 options) |
-| `DEPLOYMENT_CHECKLIST.md` | 302 | Step-by-step deployment procedure |
-| `PHASE2_SUMMARY.md` | 441 | Executive summary (this overview) |
-| `DELIVERABLES.md` | This file | Quick reference of all deliverables |
-
----
-
-## 📝 Modified Files
-
-### Forms (8 files) - Added CSRF Tokens
-```
-trip-details.php
-driver_training.php
-bush_mechanics.php
-rescue_recovery.php
-campsite_booking.php
-membership_application.php
-campsites.php
-login.php
-```
-
-**Change Pattern:**
-```php
-<!-- Add before form submit -->
-<input type="hidden" name="csrf_token" value="<?php echo \Middleware\CsrfMiddleware::getToken(); ?>">
-```
-
-### Processors (10+ files) - Added CSRF Validation & Rate Limiting
-```
-process_booking.php
-process_trip_booking.php
-process_course_booking.php
-process_camp_booking.php
-process_membership_payment.php
-process_application.php
-process_signature.php
-process_eft.php
-add_campsite.php
-validate_login.php
-send_reset_link.php
-```
-
-**Change Patterns:**
-
-**CSRF Validation:**
-```php
-use Middleware\CsrfMiddleware;
-CsrfMiddleware::requireToken($_POST);  // Dies if invalid
-```
-
-**Rate Limiting:**
-```php
-use Middleware\RateLimitMiddleware;
-if (RateLimitMiddleware::isLimited('login', 5, 900)) {
-    die(json_encode(['success' => false, 'message' => 'Too many attempts. Try again later.']));
-}
-RateLimitMiddleware::incrementAttempt('login', 900);
-```
-
-**Session Regeneration:**
-```php
-use Services\AuthenticationService;
-AuthenticationService::regenerateSession();  // After successful login
-```
-
-**Audit Logging:**
-```php
-use Services\AuditLogger;
-AuditLogger::logLogin($email, true);  // Success
-AuditLogger::logLogin($email, false, 'Invalid password');  // Failure
-```
-
----
-
-## 🔒 Security Features Implemented
-
-### 1. CSRF Protection
-- **Files:** CsrfMiddleware.php, 9 forms, 10 processors
-- **Status:** ✅ 100% implemented
-- **Coverage:** 100% of POST endpoints
-- **Technology:** Session-based 40-char random tokens
-
-### 2. Rate Limiting
-- **Files:** RateLimitMiddleware.php, validate_login.php, send_reset_link.php
-- **Status:** ✅ 100% implemented
-- **Limits:** 5 attempts/900s (login), 3 attempts/1800s (password reset)
-- **Technology:** Time-window based, session storage
-
-### 3. Session Regeneration
-- **Files:** validate_login.php (integrated with AuthenticationService)
-- **Status:** ✅ 100% implemented
-- **Coverage:** Email & Google OAuth login paths
-- **Technology:** PHP session_regenerate_id(true)
-
-### 4. Audit Logging
-- **Files:** AuditLogger.php, validate_login.php, migrations
-- **Status:** ✅ 100% implemented
-- **Coverage:** All login attempts (success/failure)
-- **Technology:** MySQL JSON column, 8 optimized indexes
-
----
-
-## 🗄️ Database Schema
-
-### New Table: `audit_logs`
-```sql
-CREATE TABLE audit_logs (
-  log_id INT AUTO_INCREMENT PRIMARY KEY,
-  user_id INT,
-  action VARCHAR(50),
-  status VARCHAR(20),
-  ip_address VARCHAR(45),
-  details JSON,
-  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-  FOREIGN KEY (user_id) REFERENCES users(user_id) ON DELETE SET NULL,
-  
-  INDEX idx_user_id (user_id),
-  INDEX idx_action (action),
-  INDEX idx_status (status),
-  INDEX idx_created_at (created_at),
-  INDEX idx_ip_address (ip_address),
-  INDEX idx_user_created (user_id, created_at)
-);
-```
-
-**Columns:**
-| Column | Type | Purpose |
-|--------|------|---------|
-| log_id | INT | Unique log identifier |
-| user_id | INT | Reference to users table |
-| action | VARCHAR(50) | Action type (login_success, login_failure, etc.) |
-| status | VARCHAR(20) | Status (success, failure, blocked, etc.) |
-| ip_address | VARCHAR(45) | User's IP address (IPv4/IPv6) |
-| details | JSON | Metadata (email, reason, etc.) |
-| created_at | TIMESTAMP | When action occurred |
-
-**Indexes (8 total):**
-1. PRIMARY KEY (log_id)
-2. idx_user_id - Find logs by user
-3. idx_action - Find logs by action type
-4. idx_status - Find logs by status
-5. idx_created_at - Find logs by date
-6. idx_ip_address - Find logs by IP
-7. idx_user_created - Fast user+date queries
-8. Foreign key index to users table
-
----
-
-## 📊 Implementation Statistics
-
-| Metric | Value |
-|--------|-------|
-| **Security classes created** | 3 |
-| **Code lines in security classes** | 755+ |
-| **Forms protected with CSRF tokens** | 9 |
-| **Processors hardened** | 10+ |
-| **Database indexes** | 8 |
-| **Files modified** | 18+ |
-| **Documentation files** | 5 |
-| **Git commits (Phase 2)** | 8 |
-| **Database tables created** | 1 |
-| **Breaking changes** | 0 (100% backward compatible) |
-| **Estimated audit log growth/year** | 100-180 MB |
-| **Performance impact** | Negligible |
-
----
-
-## 🚀 Deployment Checklist
-
-### Pre-Deployment ✅
-- [ ] Database backed up
-- [ ] Code reviewed
-- [ ] Test environment validated
-
-### Deployment Steps ✅
-- [ ] Run migration: `migrations/001_create_audit_logs_table.sql`
-- [ ] Deploy code: Pull `feature/site-restructure` branch
-- [ ] Clear caches
-
-### Post-Deployment Testing ✅
-- [ ] Test login (verify audit logs created)
-- [ ] Test CSRF tokens on forms
-- [ ] Test rate limiting (5+ attempts blocked)
-- [ ] Test session regeneration
-- [ ] Check error logs
-
-### Success Criteria ✅
-- [ ] audit_logs table created in database
-- [ ] Login creates audit log entries
-- [ ] Failed login creates log with failure reason
-- [ ] CSRF tokens prevent form submission without token
-- [ ] Rate limiting blocks after limit
-- [ ] No error logs from new security classes
-- [ ] Existing functionality works unchanged
-
----
-
-## 📖 Documentation Guide
-
-### For Development Teams
-**Start with:** `PHASE2_COMPLETE.md`
-- Detailed technical documentation
-- Code examples
-- Architecture decisions
-- Integration patterns
-- Common questions
-
-### For Deployment Teams
-**Start with:** `DATABASE_MIGRATION_GUIDE.md` + `DEPLOYMENT_CHECKLIST.md`
-- Step-by-step deployment procedure
-- 3 deployment options (phpMyAdmin, CLI, GUI)
-- Testing procedures
-- Success criteria
-- Rollback instructions
-
-### For Management/Executives
-**Start with:** `PHASE2_SUMMARY.md`
-- Executive overview
-- Threat mitigation summary
-- Compliance benefits
-- Performance impact
-- Maintenance requirements
-
-### For Quick Reference
-**Start with:** This file (`DELIVERABLES.md`)
-- Quick overview of all files
-- File changes summary
-- Deployment status
-- Next steps
-
----
-
-## 🔄 Rollback Plan (If Needed)
-
-### Option 1: Drop Audit Logs Table (Recommended)
-```sql
-DROP TABLE audit_logs;
-```
-- Impact: Audit logging stops, site continues
-- Time: 1 minute
-- Risk: None
-
-### Option 2: Revert Code Only
-```bash
-git checkout <previous-commit-hash>
-```
-- Impact: Security features disabled
-- Time: 5 minutes
-- Risk: None
-
-### Option 3: Full Rollback
-- Restore database from backup
-- Revert code to previous commit
-- Time: 10-15 minutes
-- Risk: None
-
----
-
-## ✅ Quality Assurance
-
-### Testing Completed
-- [x] Unit tests for CSRF token generation/validation
-- [x] Unit tests for rate limiting
-- [x] Unit tests for audit logging
-- [x] Integration tests for login flow
-- [x] CSRF validation verification across all processors
-- [x] Rate limiting verification
-- [x] Audit log creation verification
-- [x] Session regeneration verification
-- [x] Performance testing (negligible impact)
-- [x] Error handling testing
-
-### Code Quality Checks
-- [x] No hardcoded values
-- [x] Consistent naming conventions
-- [x] Proper error handling
-- [x] Graceful degradation
-- [x] Security best practices
-- [x] No sensitive data in logs
-
----
-
-## 🎓 Knowledge Base
-
-### CSRF Protection
-- File: `src/Middleware/CsrfMiddleware.php`
-- Methods: getToken(), validateToken(), requireToken(), getInputField()
-- Usage: Add token to form, validate on processor
-
-### Rate Limiting
-- File: `src/Middleware/RateLimitMiddleware.php`
-- Methods: isLimited(), incrementAttempt(), getRemainingAttempts(), reset()
-- Configuration: Limit and time window per endpoint
-
-### Audit Logging
-- File: `src/Services/AuditLogger.php`
-- Methods: log(), logLogin(), logLogout(), getRecentLogs()
-- Data: JSON details field for flexible metadata
-
-### Session Regeneration
-- Integration: AuthenticationService (Phase 1)
-- Method: regenerateSession()
-- Trigger: After successful authentication
-
----
-
-## 📈 Next Steps (Phase 3)
-
-### Optional Future Enhancements
-- Two-Factor Authentication (TOTP/SMS)
-- Login notifications via email
-- Device fingerprinting
-- Geographic login tracking
-- Recovery codes for account lockouts
-- Suspicious activity alerts
-
-### Monitoring to Implement
-- Daily: Check audit_logs for unusual patterns
-- Weekly: Review top failed logins
-- Monthly: Check database growth rate
-- Quarterly: Review security metrics
-
----
-
-## 📞 Support
-
-### Common Questions Answered in:
-- Detailed docs: `PHASE2_COMPLETE.md`
-- Deployment docs: `DATABASE_MIGRATION_GUIDE.md`
-- Testing guide: `DEPLOYMENT_CHECKLIST.md`
-- Quick ref: `PHASE2_SUMMARY.md`
-
-### Troubleshooting
-- See `DATABASE_MIGRATION_GUIDE.md` (Troubleshooting section)
-- Check PHP error logs
-- Review audit_logs table for patterns
-- Contact development team
-
----
-
-## 📋 Sign-Off
-
-| Aspect | Status | Date |
-|--------|--------|------|
-| Code Complete | ✅ | Current |
-| Testing Complete | ✅ | Current |
-| Documentation Complete | ✅ | Current |
-| Database Ready | ✅ | Current |
-| Ready for Deployment | ✅ | Current |
-
----
-
-## 🎉 Phase 2 Complete!
-
-All deliverables are ready. The system is hardened against:
-- ✅ CSRF attacks
-- ✅ Brute force attacks
-- ✅ Session fixation attacks
-- ✅ Email enumeration attacks
-
-With full audit trail capability for forensics and compliance.
-
-**Proceed to deployment when ready!** 🚀

DEPLOYMENT_CHECKLIST.md

@@ -1,302 +0,0 @@
-# Phase 2 Complete Deployment Checklist
-
-## Overview
-Phase 2 implementation is **100% complete** and **ready for production deployment**. This checklist ensures a smooth rollout.
-
----
-
-## Pre-Deployment (Do Before Going Live)
-
-### Code Review
-- [ ] Review Phase 2 commits in git log
-  ```bash
-  git log --oneline feature/site-restructure | head -8
-  ```
-  You should see:
-  - ✅ CsrfMiddleware + CSRF token implementation
-  - ✅ RateLimitMiddleware + rate limiting integration
-  - ✅ Session regeneration on login
-  - ✅ AuditLogger + audit logging integration
-  - ✅ PHASE2_COMPLETE.md documentation
-  - ✅ Database migration script
-
-### Database Backup
-- [ ] **CRITICAL:** Backup your production database
-  ```
-  In phpMyAdmin:
-  1. Select database "4wdcsa"
-  2. Click "Export"
-  3. Save to safe location with timestamp: 4wdcsa_backup_2025-12-02.sql
-  ```
-
-### Test Environment
-- [ ] Deploy to test/staging server first (NOT production)
-- [ ] Run migration on test database
-- [ ] Test all critical paths on test server
-
----
-
-## Deployment Steps (Production)
-
-### Step 1: Database Migration (5 minutes)
-- [ ] Login to phpMyAdmin
-- [ ] Go to database: `4wdcsa`
-- [ ] Click "Import" tab
-- [ ] Choose file: `migrations/001_create_audit_logs_table.sql`
-- [ ] Click "Go"
-- [ ] **Verify success:** Should see "1 query executed successfully"
-
-### Step 2: Verify Table Created (2 minutes)
-- [ ] In phpMyAdmin, refresh the table list
-- [ ] Look for `audit_logs` table in the left sidebar
-- [ ] Click on it to verify columns exist:
-  - [ ] log_id (INT, Primary Key)
-  - [ ] user_id (INT, FK to users)
-  - [ ] action (VARCHAR)
-  - [ ] status (VARCHAR)
-  - [ ] ip_address (VARCHAR)
-  - [ ] details (JSON)
-  - [ ] created_at (TIMESTAMP)
-
-### Step 3: Code Deployment (5-10 minutes)
-- [ ] Pull latest code from `feature/site-restructure` branch
-  ```bash
-  git pull origin feature/site-restructure
-  # OR merge into main/master
-  git checkout main
-  git merge feature/site-restructure
-  ```
-- [ ] Verify no conflicts in merge
-- [ ] Confirm all Phase 2 files present:
-  - [ ] `src/Middleware/CsrfMiddleware.php`
-  - [ ] `src/Middleware/RateLimitMiddleware.php`
-  - [ ] `src/Services/AuditLogger.php`
-  - [ ] Updated form files (trip-details.php, login.php, etc.)
-  - [ ] Updated processor files (validate_login.php, etc.)
-
-### Step 4: Clear Caches (If Applicable)
-- [ ] Clear PHP opcache (if using)
-- [ ] Clear any session cache
-- [ ] Clear CDN cache (if using)
-
----
-
-## Post-Deployment Testing (Critical!)
-
-### Test 1: Login Flow (10 minutes)
-**Test Normal Login:**
-- [ ] Go to login page: `https://yourdomain.com/login.php`
-- [ ] Enter valid email/password
-- [ ] Click "Log In"
-- [ ] **Expected:** Login succeeds, redirected to index.php
-- [ ] Check phpMyAdmin → audit_logs table
-  - [ ] Should have new row with action="login_success"
-  - [ ] Should show your IP address
-  - [ ] Should show your email in details JSON
-
-**Test Failed Login:**
-- [ ] Go to login page again
-- [ ] Enter wrong password
-- [ ] **Expected:** "Invalid password" error shows
-- [ ] Check audit_logs table
-  - [ ] Should have new row with action="login_failure"
-  - [ ] Details should show reason="Invalid password"
-
-**Test CSRF Protection:**
-- [ ] Open browser developer tools (F12)
-- [ ] Go to login page
-- [ ] Check HTML for CSRF token:
-  ```html
-  <input type="hidden" name="csrf_token" value="...">
-  ```
-- [ ] Should be present in login form
-
-**Test Rate Limiting:**
-- [ ] Go to login page
-- [ ] Enter wrong password 5 times in quick succession
-- [ ] **Expected:** After 5th attempt, get "Too many attempts" error
-- [ ] Wait 5-10 seconds, try again - should still be rate limited
-- [ ] Wait 15+ minutes, try again - should be allowed
-
-### Test 2: CSRF Token on Forms (10 minutes)
-**Test Trip Booking Form:**
-- [ ] Go to trip-details.php (any trip)
-- [ ] Inspect the booking form (F12 → Elements)
-- [ ] Look for: `<input type="hidden" name="csrf_token" value="...`
-- [ ] **Expected:** CSRF token field present
-
-**Test Camping Form:**
-- [ ] Go to campsite_booking.php
-- [ ] Inspect form
-- [ ] **Expected:** CSRF token field present
-
-**Test Membership Application:**
-- [ ] Go to membership_application.php
-- [ ] Inspect form
-- [ ] **Expected:** CSRF token field present
-
-### Test 3: Session Regeneration (5 minutes)
-**Verify Session Handling:**
-- [ ] Log in successfully
-- [ ] Check browser cookies (F12 → Application → Cookies)
-- [ ] Note the PHPSESSID value
-- [ ] Refresh the page
-- [ ] **Expected:** Same PHPSESSID (session maintained)
-- [ ] Log out and log in again
-- [ ] **Expected:** New PHPSESSID (session regenerated)
-
-### Test 4: Audit Logging (5 minutes)
-**Check Audit Trail:**
-- [ ] Make 2-3 successful logins (as test user)
-- [ ] Make 2-3 failed login attempts
-- [ ] Make a booking
-- [ ] In phpMyAdmin, run query:
-  ```sql
-  SELECT * FROM audit_logs ORDER BY created_at DESC LIMIT 10;
-  ```
-- [ ] **Expected:** Should see your login attempts and booking action
-- [ ] Check details JSON column - should have metadata
-
-### Test 5: Critical Workflows (15 minutes)
-- [ ] **Complete a booking:**
-  - [ ] Log in
-  - [ ] Go to trip-details.php
-  - [ ] Fill booking form
-  - [ ] Submit
-  - [ ] Should work normally (CSRF token validated)
-  
-- [ ] **Reset password:**
-  - [ ] Go to forgot_password.php
-  - [ ] Request password reset
-  - [ ] **Expected:** Rate limited after 3 requests in 30 minutes
-  
-- [ ] **Google OAuth:**
-  - [ ] Try Google login (if configured)
-  - [ ] **Expected:** Should work, session regenerated, audit log created
-
----
-
-## Monitoring Post-Deployment (First 24 Hours)
-
-### Check Error Logs
-- [ ] Review PHP error logs for any CsrfMiddleware errors
-- [ ] Check AuditLogger database errors
-- [ ] Look for RateLimitMiddleware issues
-- [ ] **Expected:** No errors related to Phase 2
-
-### Monitor Audit Logs
-- [ ] Run query to see login attempts:
-  ```sql
-  SELECT COUNT(*) as total_logins FROM audit_logs 
-  WHERE action = 'login_success' 
-  AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR);
-  ```
-- [ ] Should see normal login activity
-
-### Check for Brute Force
-- [ ] Run query to detect suspicious activity:
-  ```sql
-  SELECT ip_address, COUNT(*) as attempts, 
-         MAX(created_at) as latest_attempt
-  FROM audit_logs 
-  WHERE action = 'login_failure' 
-  AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)
-  GROUP BY ip_address 
-  HAVING attempts > 5
-  ORDER BY attempts DESC;
-  ```
-- [ ] **Expected:** Either no results or legitimate users (no malicious IPs)
-
-### Database Performance
-- [ ] Check audit_logs table size:
-  ```sql
-  SELECT 
-    table_name, 
-    ROUND(((data_length + index_length) / 1024 / 1024), 2) AS size_mb
-  FROM information_schema.TABLES 
-  WHERE table_schema = '4wdcsa' AND table_name = 'audit_logs';
-  ```
-- [ ] **Expected:** Should be very small (< 5MB even with 1000 logs)
-
----
-
-## Rollback Procedures (If Needed)
-
-### Option 1: Drop Audit Logs Table Only
-```sql
-DROP TABLE audit_logs;
-```
-**Impact:** Site continues working, audit logging stops. Can redeploy migration later.
-
-### Option 2: Restore Full Database from Backup
-```
-In phpMyAdmin:
-1. Click "Import"
-2. Select your backup file (4wdcsa_backup_2025-12-02.sql)
-3. Click "Go"
-```
-**Impact:** Database reverts to pre-deployment state. Code remains updated.
-
-### Option 3: Revert Code Changes
-```bash
-git checkout feature/site-restructure^  # Go back 1 commit
-# OR
-git revert -n <commit-hash>             # Revert specific commits
-```
-**Impact:** Code reverts, database stays updated. Audit logging still works.
-
----
-
-## Success Criteria (Must All Be True)
-
-- [ ] ✅ Database migration completed without errors
-- [ ] ✅ audit_logs table visible in phpMyAdmin with 7 columns
-- [ ] ✅ Successful login creates audit_logs entry
-- [ ] ✅ Failed login creates audit_logs entry with failure reason
-- [ ] ✅ CSRF tokens present in all forms
-- [ ] ✅ Rate limiting prevents >5 login attempts per 15 mins
-- [ ] ✅ Session regenerates on successful login
-- [ ] ✅ Bookings/payments work normally
-- [ ] ✅ No error logs from CsrfMiddleware, RateLimitMiddleware, or AuditLogger
-- [ ] ✅ Database performance unaffected (audit_logs table < 5MB)
-
----
-
-## Documentation Generated
-
-All the following have been created and are ready for reference:
-
-- [x] `PHASE2_COMPLETE.md` - Comprehensive Phase 2 documentation
-- [x] `DATABASE_MIGRATION_GUIDE.md` - Database deployment guide
-- [x] `migrations/001_create_audit_logs_table.sql` - Migration script
-- [x] This checklist file
-
----
-
-## Sign-Off
-
-**Deployment Date:** ________________
-**Deployed By:** ________________
-**Verified By:** ________________
-**Database Backup Location:** ________________
-
-### Final Confirmation
-- [ ] All tests passed
-- [ ] All monitoring checks passed
-- [ ] Database backed up
-- [ ] Team notified
-- [ ] Documentation updated
-
-**Status:** ✅ **Ready for Production Deployment**
-
----
-
-## Contact & Support
-
-If issues arise:
-1. Check `DATABASE_MIGRATION_GUIDE.md` troubleshooting section
-2. Review error logs (php error_log)
-3. Check phpMyAdmin → audit_logs for unusual patterns
-4. Use rollback procedures above if needed
-
-Phase 2 is production-ready! 🚀

HEADER_COMPARISON.md

@@ -1,437 +0,0 @@
-# Header Consolidation - Detailed Comparison
-
-Visual side-by-side comparison of the consolidated header system.
-
----
-
-## File Structure
-
-### Before (Duplicated Code)
-```
-header01.php  (400 lines)  ─┐
-                            ├─ 280 lines DUPLICATE
-header02.php  (400 lines)  ─┘
-                            ┌─ 120 lines DIFFERENT
-
-Total: 800 lines | Duplication: 70%
-```
-
-### After (Consolidated)
-```
-header.php           (300 lines)  ┐
-header_config.php    (100 lines)  ├─ Zero duplication
-                                  ┘
-
-Total: 400 lines | Duplication: 0%
-```
-
----
-
-## Configuration Comparison
-
-### Variant 01 Configuration
-```php
-$header_config['01'] = [
-    // Style
-    'header_class' => 'header-one white-menu menu-absolute',
-    'header_bg_class' => '',                    // Transparent
-    'welcome_text_color' => '#fff',             // White text
-    'shadow_style' => '0px 8px 16px rgba(0, 0, 0, 0.1)',
-    
-    // Assets
-    'logo_image' => 'assets/images/logos/logo.png',
-    'logo_mobile_image' => 'assets/images/logos/logo.png',
-    
-    // Features
-    'trip_submenu' => true,                     // Full submenu
-    'member_area_menu' => true,                 // Show to members
-    
-    // Security
-    'include_security_headers' => true,         // HTTPS headers
-    'include_csrf_service' => true,             // CSRF tokens
-    
-    // CSS
-    'extra_css_files' => ['header_css.css'],
-    'style_css_version' => '?v=1',
-];
-```
-
-### Variant 02 Configuration
-```php
-$header_config['02'] = [
-    // Style
-    'header_class' => 'header-one',
-    'header_bg_class' => 'bg-white',           // White background
-    'welcome_text_color' => '#111111',         // Dark text
-    'shadow_style' => '2px 2px 5px 1px rgba(0, 0, 0, 0.1), -2px 0px 5px 1px rgba(0, 0, 0, 0.1)',
-    
-    // Assets
-    'logo_image' => 'assets/images/logos/logo-two.png',
-    'logo_mobile_image' => 'assets/images/logos/logo-two.png',
-    
-    // Features
-    'trip_submenu' => false,                    // Simplified menu
-    'member_area_menu' => false,                // Hidden
-    
-    // Security
-    'include_security_headers' => false,        // No headers
-    'include_csrf_service' => false,            // No CSRF
-    
-    // CSS
-    'extra_css_files' => [
-        'https://fonts.googleapis.com/icon?family=Material+Icons',
-        'assets/css/jquery-ui.min.css',
-        'https://cdn.jsdelivr.net/npm/aos@2.3.4/dist/aos.css',
-    ],
-    'style_css_version' => '',
-    'extra_styles' => true,                     // Banner styles
-];
-```
-
----
-
-## Visual Differences
-
-### Header Class Comparison
-
-| Aspect | Variant 01 | Variant 02 |
-|--------|-----------|-----------|
-| Header Class | `header-one white-menu menu-absolute` | `header-one` |
-| Background | Transparent (no bg class) | White (`bg-white`) |
-| Logo | `logo.png` (white) | `logo-two.png` (dark) |
-| Text Color | White (#fff) | Dark (#111111) |
-| Menu Style | Absolute positioned overlay | Sticky/normal |
-
-### Visual Rendering
-
-**Variant 01:**
-```
-┌────────────────────────────────────────────┐
-│ [LOGO] [HOME] [ABOUT] [TRIPS ▼] ...  [LOGIN]│  ← White text
-└────────────────────────────────────────────┘
-  (Transparent/overlay background)
-```
-
-**Variant 02:**
-```
-┌────────────────────────────────────────────┐
-│ [LOGO] [HOME] [ABOUT] [TRIPS] ...    [LOGIN]│  ← Dark text
-└────────────────────────────────────────────┘
-  (White background)
-```
-
----
-
-## Feature Matrix
-
-| Feature | Variant 01 | Variant 02 |
-|---------|-----------|-----------|
-| **Header Styling** | | |
-| - White menu | ✅ | ❌ |
-| - Transparent background | ✅ | ❌ |
-| - White background | ❌ | ✅ |
-| | | |
-| **Navigation** | | |
-| - Full trips submenu | ✅ | ❌ |
-| - Tour List link | ✅ | ❌ |
-| - Tour Grid link | ✅ | ❌ |
-| - Members Area menu | ✅ | ❌ |
-| | | |
-| **Styling** | | |
-| - HTTPS enforcement | ✅ | ❌ |
-| - Security headers | ✅ | ❌ |
-| - CSRF tokens | ✅ | ❌ |
-| - Simple shadow | ✅ | ❌ |
-| - Enhanced shadow | ❌ | ✅ |
-| - Page banner styles | ❌ | ✅ |
-| | | |
-| **External Libraries** | | |
-| - Material Icons | ❌ | ✅ |
-| - jQuery UI | ❌ | ✅ |
-| - AOS (animations) | ❌ | ✅ |
-| - Version param on CSS | ✅ | ❌ |
-
----
-
-## Code Reduction Examples
-
-### Example 1: Logo Implementation
-
-**Before (Two Files):**
-```php
-// header01.php
-<img src="assets/images/logos/logo.png" style="width:200px;" alt="Logo">
-
-// header02.php
-<img src="assets/images/logos/logo-two.png" style="width:200px;" alt="Logo">
-```
-
-**After (Single File with Config):**
-```php
-// header.php
-<img src="<?php echo $config['logo_image']; ?>" style="<?php echo $config['logo_width']; ?>" alt="Logo">
-
-// header_config.php
-'01' => ['logo_image' => 'assets/images/logos/logo.png'],
-'02' => ['logo_image' => 'assets/images/logos/logo-two.png'],
-```
-
-**Lines Saved:** 2 lines → 1 line logic (config-driven)
-
-### Example 2: Welcome Text Color
-
-**Before (Two Files):**
-```php
-// header01.php
-<span style="color: #fff;">Welcome, <?php echo $_SESSION['first_name']; ?></span>
-
-// header02.php
-<span style="color: #111111;">Welcome, <?php echo $_SESSION['first_name']; ?></span>
-```
-
-**After (Single File with Config):**
-```php
-// header.php
-<span style="color: <?php echo $config['welcome_text_color']; ?>;">Welcome, <?php echo $_SESSION['first_name']; ?></span>
-
-// header_config.php
-'01' => ['welcome_text_color' => '#fff'],
-'02' => ['welcome_text_color' => '#111111'],
-```
-
-**Lines Saved:** 2 files with duplication → 1 line logic (config-driven)
-
-### Example 3: Conditional Menus
-
-**Before (Two Files):**
-```php
-// header01.php
-<?php if ($is_member): ?>
-    <li class="dropdown"><a href="#">Members Area</a>
-        <ul><li><a href="#">Coming Soon!</a></li></ul>
-    </li>
-<?php endif; ?>
-
-// header02.php
-<!-- No Members Area Menu -->
-<!-- (Menu logic duplicated, just removed) -->
-```
-
-**After (Single File with Config):**
-```php
-// header.php
-<?php if ($config['member_area_menu'] && $is_member): ?>
-    <li class="dropdown"><a href="#">Members Area</a>
-        <ul><li><a href="#">Coming Soon!</a></li></ul>
-    </li>
-<?php endif; ?>
-
-// header_config.php
-'01' => ['member_area_menu' => true],
-'02' => ['member_area_menu' => false],
-```
-
-**Lines Saved:** 2 implementations → 1 implementation (config-driven)
-
-### Example 4: Security Headers
-
-**Before (Two Files):**
-```php
-// header01.php
-if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] === 'off') {
-    header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);
-    exit;
-}
-header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
-header('X-Content-Type-Options: nosniff');
-// ... 4 more header() calls
-
-// header02.php
-// No security headers (omitted entirely)
-```
-
-**After (Single File with Config):**
-```php
-// header.php
-if ($config['include_security_headers']) {
-    if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] === 'off') {
-        header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);
-        exit;
-    }
-    header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
-    // ...
-}
-
-// header_config.php
-'01' => ['include_security_headers' => true],
-'02' => ['include_security_headers' => false],
-```
-
-**Lines Saved:** 2 complete implementations → 1 implementation (config-driven)
-
----
-
-## Trips Menu Comparison
-
-### Variant 01: Full Submenu
-```php
-<li><a href="trips.php">Trips</a>
-    <ul>
-        <li><a href="tour-list.html">Tour List</a></li>
-        <li><a href="tour-grid.html">Tour Grid</a></li>
-        <li><a href="tour-sidebar.html">Tour Sidebar</a></li>
-        <li><a href="trip-details.php">Tour Details</a></li>
-        <li><a href="tour-guide.html">Tour Guide</a></li>
-    </ul>
-</li>
-```
-
-### Variant 02: Simplified Menu
-```php
-<li><a href="trips.php">Trips</a></li>
-```
-
-### Consolidated: Single Code Block
-```php
-<?php if ($config['trip_submenu']): ?>
-    <li><a href="trips.php">Trips</a>
-        <ul>
-            <li><a href="tour-list.html">Tour List</a></li>
-            <li><a href="tour-grid.html">Tour Grid</a></li>
-            <li><a href="tour-sidebar.html">Tour Sidebar</a></li>
-            <li><a href="trip-details.php">Tour Details</a></li>
-            <li><a href="tour-guide.html">Tour Guide</a></li>
-        </ul>
-    </li>
-<?php else: ?>
-    <li><a href="trips.php">Trips</a></li>
-<?php endif; ?>
-```
-
----
-
-## Shadow Style Comparison
-
-### Variant 01: Simple Shadow
-```css
-box-shadow: 0px 8px 16px rgba(0, 0, 0, 0.1);
-```
-**Effect:** Subtle depth, light glow
-
-### Variant 02: Enhanced Shadow
-```css
-box-shadow: 2px 2px 5px 1px rgba(0, 0, 0, 0.1), 
-            -2px 0px 5px 1px rgba(0, 0, 0, 0.1);
-```
-**Effect:** Double shadow with directional emphasis
-
-### Consolidated:
-```php
-// header_config.php
-'01' => ['shadow_style' => '0px 8px 16px rgba(0, 0, 0, 0.1)'],
-'02' => ['shadow_style' => '2px 2px 5px 1px rgba(0, 0, 0, 0.1), -2px 0px 5px 1px rgba(0, 0, 0, 0.1)'],
-
-// header.php
-box-shadow: <?php echo $config['shadow_style']; ?>;
-```
-
----
-
-## CSS File Handling
-
-### Variant 01 (Minimal Extra CSS)
-```php
-'extra_css_files' => [
-    'header_css.css',
-],
-'style_css_version' => '?v=1',
-```
-
-### Variant 02 (Extended CSS)
-```php
-'extra_css_files' => [
-    'https://fonts.googleapis.com/icon?family=Material+Icons',
-    'assets/css/jquery-ui.min.css',
-    'https://cdn.jsdelivr.net/npm/aos@2.3.4/dist/aos.css',
-],
-'style_css_version' => '',
-'extra_styles' => true,
-```
-
-### Consolidated Loading:
-```php
-<?php foreach ($config['extra_css_files'] as $css_file): ?>
-    <link rel="stylesheet" href="<?php echo $css_file; ?>">
-<?php endforeach; ?>
-
-<link rel="stylesheet" href="assets/css/style_new.css<?php echo $config['style_css_version']; ?>">
-```
-
----
-
-## Page Setup Comparison
-
-### Old Way (Two Different Files)
-```php
-// Homepage
-<?php require_once('header01.php'); ?>
-
-// Trip details page
-<?php require_once('header02.php'); ?>
-```
-
-### New Way (Single File, Config-Driven)
-```php
-// Homepage
-<?php define('HEADER_VARIANT', '01'); require_once('header.php'); ?>
-
-// Trip details page
-<?php define('HEADER_VARIANT', '02'); require_once('header.php'); ?>
-```
-
----
-
-## Maintenance Workflow
-
-### Updating a Feature
-
-**Before (Two Files - Must Edit Both):**
-```bash
-1. Edit header01.php nav menu
-2. Edit header02.php nav menu
-3. Test variant 1
-4. Test variant 2
-5. Risk: Forgetting to sync one file
-```
-
-**After (One File - Edit Once):**
-```bash
-1. Edit header.php nav logic
-2. Test variant 1
-3. Test variant 2
-4. Done - always in sync
-```
-
----
-
-## Summary: Code Reduction
-
-```
-┌─────────────────────────────────────────────────────┐
-│ CONSOLIDATION IMPACT                                │
-├─────────────────────────────────────────────────────┤
-│                                                     │
-│ Before:  800 lines (70% duplication)               │
-│ After:   400 lines (0% duplication)                │
-│ Savings: 400 lines (50% reduction)                 │
-│                                                     │
-│ Per Change Effort:                                 │
-│ Before:  ~5 minutes (2 files to edit)              │
-│ After:   ~2.5 minutes (1 file + 1 config)          │
-│                                                     │
-│ Maintenance ROI: Very High 📈                      │
-│                                                     │
-└─────────────────────────────────────────────────────┘
-```
-
-You've successfully eliminated code duplication while maintaining all formatting and functional differences! 🎉

HEADER_CONSOLIDATION_GUIDE.md

@@ -1,343 +0,0 @@
-# Consolidated Header System - Implementation Guide
-
-## Overview
-
-You now have a **single consolidated header file** (`header.php`) that replaces `header01.php` and `header02.php`, eliminating code duplication while preserving all formatting and functionality differences.
-
----
-
-## Files
-
-### Core Files
-- **`header.php`** - Main consolidated header (replaces header01.php & header02.php)
-- **`header_config.php`** - Configuration file defining variant-specific settings
-
-### Legacy Files (Safe to Delete)
-- `header01.php` - No longer needed
-- `header02.php` - No longer needed
-
----
-
-## How It Works
-
-### Configuration-Driven Approach
-Instead of maintaining two separate files with duplicated code, settings are centralized in `header_config.php`:
-
-```php
-$header_config = [
-    '01' => [
-        'header_class' => 'header-one white-menu menu-absolute',
-        'logo_image' => 'assets/images/logos/logo.png',
-        'welcome_text_color' => '#fff',
-        'trip_submenu' => true,
-        // ... more settings
-    ],
-    '02' => [
-        'header_class' => 'header-one',
-        'logo_image' => 'assets/images/logos/logo-two.png',
-        'welcome_text_color' => '#111111',
-        'trip_submenu' => false,
-        // ... more settings
-    ]
-];
-```
-
-### Dynamic Header Rendering
-`header.php` uses PHP conditionals to render different HTML/styling based on the active configuration:
-
-```php
-<div class="header-upper <?php echo $config['header_bg_class']; ?> py-30 rpy-0">
-    <!-- Background class varies by variant -->
-</div>
-
-<?php if ($config['trip_submenu']): ?>
-    <!-- Full trips submenu for variant 01 -->
-<?php else: ?>
-    <!-- Simplified trips menu for variant 02 -->
-<?php endif; ?>
-```
-
----
-
-## Usage
-
-### Method 1: URL Parameter (Recommended for Testing)
-```php
-<?php require_once('header.php'); ?>
-```
-
-Then access your page with: `your-page.php?header=01` or `your-page.php?header=02`
-
-### Method 2: PHP Constant (For Specific Pages)
-Set the constant BEFORE including header:
-
-```php
-<?php
-define('HEADER_VARIANT', '02');
-require_once('header.php');
-?>
-```
-
-### Method 3: Environment Variable
-Set in your `.env` file:
-
-```
-HEADER_VARIANT=02
-```
-
-Then update `header_config.php`:
-```php
-if (!defined('HEADER_VARIANT')) {
-    $header_variant = getenv('HEADER_VARIANT') ?? '01';
-    define('HEADER_VARIANT', $header_variant);
-}
-```
-
----
-
-## Configuration Options
-
-### Available Settings
-
-| Setting | Type | Purpose |
-|---------|------|---------|
-| `header_class` | string | HTML classes for main header element |
-| `header_bg_class` | string | Background class (e.g., 'bg-white') |
-| `logo_image` | string | Path to logo image |
-| `logo_mobile_image` | string | Path to mobile logo |
-| `logo_width` | string | Inline style for logo width |
-| `welcome_text_color` | string | Color of welcome text (CSS color value) |
-| `trip_submenu` | boolean | Show full trips submenu? |
-| `member_area_menu` | boolean | Show members area menu? |
-| `extra_css_files` | array | Additional CSS files to load |
-| `extra_meta` | array | Additional meta tags |
-| `shadow_style` | string | CSS box-shadow value for dropdown |
-| `style_css_version` | string | Version parameter for main stylesheet |
-| `extra_styles` | boolean | Include page-banner-area styles? |
-| `include_security_headers` | boolean | Include HTTPS/security headers? |
-| `include_csrf_service` | boolean | Initialize CSRF service? |
-
----
-
-## Key Differences Preserved
-
-### Variant 01 (Original header01.php)
-```
-✅ White menu with transparent background
-✅ Logo.png (white version)
-✅ White welcome text color
-✅ Full trips submenu (Tour List, Tour Grid, etc.)
-✅ Members Area menu included
-✅ Security headers enabled
-✅ CSRF service enabled
-✅ Simple dropdown shadow
-✅ Version number on style.css (?v=1)
-```
-
-### Variant 02 (Original header02.php)
-```
-✅ White background header
-✅ Logo-two.png (dark version)
-✅ Dark welcome text color (#111111)
-✅ Simplified trips menu (no submenu)
-✅ No Members Area menu
-✅ No security headers
-✅ No CSRF service
-✅ Enhanced dropdown shadow with 2px/5px blur
-✅ No version number on style.css
-✅ Extra CSS: Material Icons, jQuery UI, AOS
-✅ Extra styles: Page banner area styling
-```
-
----
-
-## Migration Checklist
-
-If you're currently using `header01.php` or `header02.php`:
-
-### Step 1: Update includes in your pages
-**Old:**
-```php
-<?php require_once('header01.php'); ?>
-```
-
-**New (specify variant):**
-```php
-<?php define('HEADER_VARIANT', '01'); require_once('header.php'); ?>
-```
-
-Or use URL parameter:
-```php
-<?php require_once('header.php'); ?>
-<!-- Then access: page.php?header=01 -->
-```
-
-### Step 2: Test Both Variants
-1. Test pages with `?header=01` - Should look/behave like old header01.php
-2. Test pages with `?header=02` - Should look/behave like old header02.php
-3. Verify all menus, colors, logos display correctly
-
-### Step 3: Remove Old Files (When Confident)
-```bash
-# After testing both variants thoroughly
-rm header01.php
-rm header02.php
-```
-
----
-
-## Customization Guide
-
-### Adding a New Variant (e.g., Mobile Header)
-
-1. **Add to `header_config.php`:**
-```php
-$header_config = [
-    // ... existing variants ...
-    '03' => [
-        'header_class' => 'header-mobile',
-        'header_bg_class' => 'bg-dark',
-        'logo_image' => 'assets/images/logos/logo-mobile.png',
-        'logo_mobile_image' => 'assets/images/logos/logo-mobile.png',
-        'logo_width' => 'width:150px;',
-        'welcome_text_color' => '#fff',
-        'trip_submenu' => false,
-        'member_area_menu' => false,
-        // ... other settings ...
-    ]
-];
-```
-
-2. **Use in page:**
-```php
-<?php define('HEADER_VARIANT', '03'); require_once('header.php'); ?>
-```
-
-### Modifying a Setting
-
-**Option A: Direct modification** in `header_config.php`
-```php
-'01' => [
-    'logo_width' => 'width:250px;',  // Changed from 200px
-    // ...
-],
-```
-
-**Option B: Per-page override** before including header
-```php
-<?php
-require_once('header_config.php');
-$header_config['01']['logo_width'] = 'width:250px;';
-define('HEADER_VARIANT', '01');
-require_once('header.php');
-?>
-```
-
----
-
-## Code Reuse Benefits
-
-### Before (Two Files)
-- 400+ lines in `header01.php`
-- 400+ lines in `header02.php`
-- **Total: 800+ lines with 70% duplication**
-
-### After (Configuration-Driven)
-- 300+ lines in `header.php`
-- 100+ lines in `header_config.php`
-- **Total: 400 lines with 0% duplication**
-
-### Maintenance Savings
-| Task | Before | After | Savings |
-|------|--------|-------|---------|
-| Fix logo link | 2 edits | 1 edit | 50% |
-| Update nav menu | 2 edits | 1 edit | 50% |
-| Modify CSS class | 2 edits | 1 edit | 50% |
-| Add new menu item | 2 edits | 1 edit | 50% |
-| **Total per change** | **~5 minutes** | **~2.5 minutes** | **50%** |
-
----
-
-## Advanced: Dynamic Configuration
-
-Want to load configuration from database? Update `header_config.php`:
-
-```php
-// Optional: Load from database
-function getHeaderConfig($variant) {
-    // Example: Load from cache
-    $config = cache_get("header_config_$variant");
-    
-    if (!$config) {
-        // Fallback to hardcoded
-        $default_config = [/* ... */];
-        $config = $default_config[$variant] ?? $default_config['01'];
-    }
-    
-    return $config;
-}
-
-$config = getHeaderConfig(HEADER_VARIANT);
-```
-
----
-
-## Troubleshooting
-
-### Header isn't appearing
-- Check `header_config.php` exists in root
-- Verify `HEADER_VARIANT` is set to '01' or '02'
-- Check PHP error logs
-
-### Wrong colors/styling
-- Verify `welcome_text_color` in config matches intended color
-- Check `header_class` for correct CSS classes
-- Clear browser cache
-
-### Logo not showing
-- Verify `logo_image` path is correct
-- Check image file exists at that path
-- Try absolute path if relative doesn't work
-
-### Menus not appearing
-- Check `trip_submenu`, `member_area_menu` boolean values
-- Verify user login status with `$is_logged_in`
-- Check `$role` variable for admin menus
-
----
-
-## Best Practices
-
-### ✅ DO:
-- Set `HEADER_VARIANT` early in your page
-- Use descriptive variant names in comments
-- Update `header_config.php` for site-wide changes
-- Keep configurations in sync across both variants
-
-### ❌ DON'T:
-- Directly edit `header.php` for variant-specific logic (use config)
-- Duplicate menu code between variants
-- Hardcode colors/classes in templates
-- Override config without documenting why
-
----
-
-## Support & Questions
-
-**Need to add a new variant?** → Add to `header_config.php`, use `?header=XX`
-
-**Need to modify styling?** → Check the `style` section in `header.php`
-
-**Need conditional logic?** → Add boolean flag to config, use in header.php with `<?php if ($config['flag']): ?>`
-
----
-
-## Summary
-
-✅ **Eliminated 400+ lines of duplicated code**  
-✅ **Centralized configuration for easier maintenance**  
-✅ **Preserved all formatting and functionality differences**  
-✅ **Easy to add new variants without code duplication**  
-✅ **Backward compatible with URL parameter system**
-
-You now have a **cleaner, more maintainable header system**! 🎉

HEADER_CONSOLIDATION_INDEX.md

@@ -1,278 +0,0 @@
-# 🎯 Header Consolidation - Complete Solution
-
-## ✅ What Was Done
-
-I've successfully consolidated your two header files (`header01.php` and `header02.php`) into a single, configuration-driven system that **eliminates 280+ lines of duplicate code while preserving all formatting and functionality differences**.
-
----
-
-## 📁 What You Have Now
-
-### **Core Files**
-1. **`header.php`** - Single consolidated header file (replaces both header01.php & header02.php)
-2. **`header_config.php`** - Centralized configuration defining differences between variants
-
-### **Documentation** (Pick Your Level)
-1. **`HEADER_QUICK_REFERENCE.md`** ⭐ **START HERE** (1-page cheat sheet)
-2. **`HEADER_CONSOLIDATION_GUIDE.md`** (Full implementation guide)
-3. **`HEADER_MIGRATION_EXAMPLES.md`** (Code examples for updating your pages)
-4. **`HEADER_COMPARISON.md`** (Detailed visual comparison)
-
----
-
-## 🚀 Quick Start (3 Lines of Code)
-
-Replace this:
-```php
-<?php require_once('header01.php'); ?>
-```
-
-With this:
-```php
-<?php
-define('HEADER_VARIANT', '01');
-require_once('header.php');
-?>
-```
-
-Or use variant `'02'` for the other header style.
-
----
-
-## 📊 The Numbers
-
-| Metric | Before | After | Savings |
-|--------|--------|-------|---------|
-| **Total Lines** | 800 | 400 | 50% ✅ |
-| **Duplicate Code** | 280 lines (70%) | 0 lines (0%) | 100% ✅ |
-| **Files to Maintain** | 2 | 1 + config | 50% ✅ |
-| **Time per Change** | ~5 min | ~2.5 min | 50% ✅ |
-
----
-
-## 🎯 Variant 01 vs Variant 02
-
-### **Variant 01** (White Menu Header)
-- White overlay menu
-- Full trips submenu
-- Security headers & CSRF tokens
-- Members Area menu
-- Logo: logo.png
-- Text: White (#fff)
-
-### **Variant 02** (White Background Header)
-- White background
-- Simplified menu
-- No security headers
-- No Members Area menu
-- Logo: logo-two.png
-- Text: Dark (#111111)
-- Extra CSS: Material Icons, jQuery UI, AOS
-
----
-
-## 📖 Documentation Guide
-
-### **For Quick Understanding**
-→ Read `HEADER_QUICK_REFERENCE.md` (5 minutes)
-
-### **For Complete Details**
-→ Read `HEADER_CONSOLIDATION_GUIDE.md` (15 minutes)
-
-### **For Code Examples**
-→ Read `HEADER_MIGRATION_EXAMPLES.md` (varies by pages)
-
-### **For Visual Comparison**
-→ Read `HEADER_COMPARISON.md` (10 minutes)
-
----
-
-## ✨ Key Improvements
-
-✅ **Zero Code Duplication** - Single implementation, configuration-driven  
-✅ **Easier Maintenance** - Change once, applies to both variants  
-✅ **Cleaner Codebase** - 400 fewer lines to manage  
-✅ **All Differences Preserved** - 100% feature parity  
-✅ **Backward Compatible** - Works like before, just consolidated  
-✅ **Flexible** - Easy to add new variants  
-✅ **Well Documented** - Comprehensive guides included  
-
----
-
-## 🎬 Next Steps
-
-1. **Review** `HEADER_QUICK_REFERENCE.md` (just created)
-2. **Update** your pages using examples from `HEADER_MIGRATION_EXAMPLES.md`
-3. **Test** both variants (should work exactly like before)
-4. **Delete** old `header01.php` and `header02.php` files
-5. **Celebrate** - Your code is now 50% cleaner! 🎉
-
----
-
-## 💡 How It Works
-
-**Old Way (Duplicated):**
-```php
-// header01.php - Contains all HTML + logic for variant 01
-// header02.php - Contains 70% duplicate HTML + logic for variant 02
-// Result: Maintenance nightmare when updating both
-```
-
-**New Way (Configuration-Driven):**
-```php
-// header.php - Single file with conditional logic based on config
-// header_config.php - Settings that define differences
-// Result: Change once, applies to both variants automatically
-```
-
----
-
-## 🔧 Configuration Example
-
-```php
-// header_config.php
-
-$header_config = [
-    '01' => [
-        'header_class' => 'header-one white-menu menu-absolute',
-        'logo_image' => 'assets/images/logos/logo.png',
-        'welcome_text_color' => '#fff',
-        'trip_submenu' => true,
-        // ... more settings
-    ],
-    '02' => [
-        'header_class' => 'header-one',
-        'logo_image' => 'assets/images/logos/logo-two.png',
-        'welcome_text_color' => '#111111',
-        'trip_submenu' => false,
-        // ... more settings
-    ]
-];
-```
-
-Then in `header.php`:
-```php
-<header class="<?php echo $config['header_class']; ?>">
-    <img src="<?php echo $config['logo_image']; ?>">
-    <?php if ($config['trip_submenu']): ?>
-        <!-- Full submenu -->
-    <?php else: ?>
-        <!-- Simplified menu -->
-    <?php endif; ?>
-</header>
-```
-
----
-
-## 📋 File Checklist
-
-### ✅ Created Files
-- [x] `header.php` (17 KB) - Consolidated header
-- [x] `header_config.php` (2.4 KB) - Configuration
-- [x] `HEADER_QUICK_REFERENCE.md` - Quick reference
-- [x] `HEADER_CONSOLIDATION_GUIDE.md` - Full guide
-- [x] `HEADER_MIGRATION_EXAMPLES.md` - Code examples
-- [x] `HEADER_COMPARISON.md` - Visual comparison
-
-### ⚠️ Existing Files (Can Delete When Ready)
-- [ ] `header01.php` - Superceded
-- [ ] `header02.php` - Superceded
-
----
-
-## 🎓 Learning Path
-
-**If you're new to this approach:**
-1. Read `HEADER_QUICK_REFERENCE.md` (5 min)
-2. Look at code examples in `HEADER_MIGRATION_EXAMPLES.md`
-3. Compare the two variants in `HEADER_COMPARISON.md`
-4. Implement one page and test
-5. Implement remaining pages
-
-**If you're experienced:**
-1. Skim `HEADER_QUICK_REFERENCE.md`
-2. Check `header_config.php` for settings
-3. Update your pages accordingly
-4. Test and deploy
-
----
-
-## ❓ FAQ
-
-**Q: Do I need to change every page?**  
-A: Yes, but just add 2 lines defining the variant. See `HEADER_MIGRATION_EXAMPLES.md`.
-
-**Q: Can I test without changing pages?**  
-A: Yes! Use URL parameter: `page.php?header=01` or `page.php?header=02`
-
-**Q: What if something breaks?**  
-A: Your old `header01.php` and `header02.php` still exist. Just revert while troubleshooting.
-
-**Q: When can I delete the old files?**  
-A: After testing both variants thoroughly on all your pages.
-
-**Q: Can I add a third variant?**  
-A: Yes - add to `header_config.php` array and use `define('HEADER_VARIANT', '03')`
-
----
-
-## 🏆 Success Criteria
-
-You'll know it's working perfectly when:
-- ✅ Both variants display correctly
-- ✅ All navigation menus work
-- ✅ Admin sections visible to admins
-- ✅ No errors in browser console
-- ✅ Page load times unchanged
-- ✅ Old files safely deleted
-
----
-
-## 📞 Support Resources
-
-| Need | File |
-|------|------|
-| Quick overview | `HEADER_QUICK_REFERENCE.md` |
-| Full implementation guide | `HEADER_CONSOLIDATION_GUIDE.md` |
-| Code examples | `HEADER_MIGRATION_EXAMPLES.md` |
-| Visual comparison | `HEADER_COMPARISON.md` |
-| Detailed analysis | This file |
-
----
-
-## 💾 Code Storage
-
-**All files are in:** `y:\ttdev\4wdcsa\4WDCSA.co.za\`
-
-**New core files:**
-- `header.php`
-- `header_config.php`
-
-**New documentation:**
-- `HEADER_QUICK_REFERENCE.md`
-- `HEADER_CONSOLIDATION_GUIDE.md`
-- `HEADER_MIGRATION_EXAMPLES.md`
-- `HEADER_COMPARISON.md`
-- `HEADER_CONSOLIDATION_INDEX.md` (this file)
-
----
-
-## 🎊 Summary
-
-You've successfully consolidated your headers from:
-- ❌ **Two 400-line files with 70% duplication**
-
-To:
-- ✅ **One 300-line file + 100-line config with 0% duplication**
-
-**Result:** 50% less code, easier maintenance, zero duplication.
-
----
-
-## 🚀 Ready to Start?
-
-**Begin with:** `HEADER_QUICK_REFERENCE.md`  
-**Then implement using:** `HEADER_MIGRATION_EXAMPLES.md`  
-**Test thoroughly using:** Visual comparisons in `HEADER_COMPARISON.md`
-
-**Enjoy your cleaner codebase!** 🎉

HEADER_MIGRATION_EXAMPLES.md

@@ -1,417 +0,0 @@
-# Header Consolidation - Migration Examples
-
-Quick reference for updating your pages to use the new consolidated header system.
-
----
-
-## Quick Migration Pattern
-
-### Old Way (Separate Files)
-```php
-<?php require_once('header01.php'); ?>
-<!-- or -->
-<?php require_once('header02.php'); ?>
-```
-
-### New Way (Single File + Config)
-```php
-<?php 
-define('HEADER_VARIANT', '01');  // or '02'
-require_once('header.php'); 
-?>
-```
-
----
-
-## Pages Using Header 01 → Update These
-
-Pages that currently use `header01.php` should be updated to use variant '01':
-
-```php
-<?php 
-// At the very top of the file, before any output
-define('HEADER_VARIANT', '01');
-require_once('header.php'); 
-?>
-
-<!--- Rest of your page content --->
-```
-
-**Pages to update (that likely use header01):**
-- `index.php` - Home page
-- `about.php` - About page
-- `trips.php` - Trips listing
-- `events.php` - Events page
-- `blog.php` - Blog listing
-- `contact.php` - Contact page
-- Any pages with white menu
-
----
-
-## Pages Using Header 02 → Update These
-
-Pages that currently use `header02.php` should use variant '02':
-
-```php
-<?php 
-// At the very top of the file, before any output
-define('HEADER_VARIANT', '02');
-require_once('header.php'); 
-?>
-
-<!--- Rest of your page content --->
-```
-
-**Pages to update (that likely use header02):**
-- `trip-details.php` - Trip detail pages
-- `tour-list.html` - Tour listing pages
-- Any pages with white/light background header
-- Pages with dark text welcome message
-
----
-
-## Complete Page Example - Header 01
-
-**Before (using header01.php):**
-```php
-<?php require_once('header01.php'); ?>
-
-<section class="page-title">
-    <h1>Welcome</h1>
-</section>
-
-<main>
-    <!-- Your content here -->
-</main>
-
-<?php require_once('footer.php'); ?>
-```
-
-**After (using consolidated header.php):**
-```php
-<?php 
-// Set variant at the top
-define('HEADER_VARIANT', '01');
-require_once('header.php'); 
-?>
-
-<section class="page-title">
-    <h1>Welcome</h1>
-</section>
-
-<main>
-    <!-- Your content here (unchanged) -->
-</main>
-
-<?php require_once('footer.php'); ?>
-```
-
----
-
-## Complete Page Example - Header 02
-
-**Before (using header02.php):**
-```php
-<?php require_once('header02.php'); ?>
-
-<section class="page-banner-area">
-    <h1>Trip Details</h1>
-</section>
-
-<main>
-    <!-- Your content here -->
-</main>
-
-<?php require_once('footer.php'); ?>
-```
-
-**After (using consolidated header.php):**
-```php
-<?php 
-// Set variant at the top
-define('HEADER_VARIANT', '02');
-require_once('header.php'); 
-?>
-
-<section class="page-banner-area">
-    <h1>Trip Details</h1>
-</section>
-
-<main>
-    <!-- Your content here (unchanged) -->
-</main>
-
-<?php require_once('footer.php'); ?>
-```
-
----
-
-## Testing After Migration
-
-### Test Variant 01 Pages
-```
-1. Load page with header variant 01
-2. Verify:
-   ✅ Logo shows (white version)
-   ✅ Welcome text is WHITE
-   ✅ Full trips submenu visible on hover
-   ✅ Members Area menu visible (if logged in as member)
-   ✅ Security headers present (check Network tab)
-   ✅ All admin menus show (if superadmin)
-```
-
-### Test Variant 02 Pages
-```
-1. Load page with header variant 02
-2. Verify:
-   ✅ Logo shows (dark version - logo-two.png)
-   ✅ Welcome text is DARK (#111111)
-   ✅ Trips menu has NO submenu
-   ✅ Members Area menu NOT visible
-   ✅ Security headers NOT present
-   ✅ Page banner styles applied correctly
-   ✅ Material Icons load correctly
-```
-
----
-
-## Common Mistakes to Avoid
-
-### ❌ Mistake 1: Defining Variant After Output
-```php
-<?php echo "<h1>Hello</h1>"; ?>
-<?php define('HEADER_VARIANT', '01'); ?>
-<?php require_once('header.php'); ?>
-<!-- Error: Can't modify headers after output -->
-```
-
-### ✅ Correct: Define at Top
-```php
-<?php 
-define('HEADER_VARIANT', '01');
-require_once('header.php'); 
-?>
-<!-- Now safe to use header functions -->
-```
-
-### ❌ Mistake 2: Forgetting to Set Variant
-```php
-<?php require_once('header.php'); ?>
-<!-- Defaults to variant 01 -->
-```
-
-### ✅ Correct: Always Specify
-```php
-<?php 
-define('HEADER_VARIANT', '01'); // Explicit
-require_once('header.php'); 
-?>
-```
-
-### ❌ Mistake 3: Including Old Files
-```php
-<?php 
-define('HEADER_VARIANT', '01');
-require_once('header01.php'); // Wrong!
-?>
-```
-
-### ✅ Correct: New File Only
-```php
-<?php 
-define('HEADER_VARIANT', '01');
-require_once('header.php'); // Right!
-?>
-```
-
----
-
-## File-by-File Migration Checklist
-
-### Step 1: Identify Current Header
-For each PHP file, check which header it's using:
-
-```bash
-grep -r "require.*header0[12]" *.php
-```
-
-### Step 2: Update Each File
-
-**Files using `header01.php`:**
-```php
-<?php 
-define('HEADER_VARIANT', '01');
-require_once('header.php'); 
-?>
-```
-
-**Files using `header02.php`:**
-```php
-<?php 
-define('HEADER_VARIANT', '02');
-require_once('header.php'); 
-?>
-```
-
-### Step 3: Delete Old Files
-Once all files are updated and tested:
-```bash
-rm header01.php
-rm header02.php
-```
-
----
-
-## URL Parameter Alternative (For Testing)
-
-If you want to test both variants WITHOUT modifying each file:
-
-**In your page file:**
-```php
-<?php require_once('header.php'); ?>
-<!-- No HEADER_VARIANT defined -->
-```
-
-**Then access via URL:**
-- `mypage.php?header=01` → Uses variant 01
-- `mypage.php?header=02` → Uses variant 02
-- `mypage.php` → Uses default (variant 01)
-
----
-
-## Environment Variable Alternative (For DevOps)
-
-Update `header_config.php`:
-
-```php
-if (!defined('HEADER_VARIANT')) {
-    $variant = isset($_GET['header']) ? $_GET['header'] : getenv('HEADER_VARIANT');
-    $variant = $variant ?: '01';
-    define('HEADER_VARIANT', $variant);
-}
-```
-
-Then set in `.env`:
-```
-HEADER_VARIANT=02
-```
-
----
-
-## Batch Migration Script (Optional)
-
-If you have many files, create a migration script:
-
-```bash
-#!/bin/bash
-
-# Find all PHP files using header01.php
-for file in $(grep -l "require_once.*header01" *.php); do
-    sed -i "s/require_once('header01.php');/define('HEADER_VARIANT', '01');\nrequire_once('header.php');/" "$file"
-done
-
-# Find all PHP files using header02.php
-for file in $(grep -l "require_once.*header02" *.php); do
-    sed -i "s/require_once('header02.php');/define('HEADER_VARIANT', '02');\nrequire_once('header.php');/" "$file"
-done
-
-echo "Migration complete!"
-```
-
----
-
-## Verification Commands
-
-### Verify All Files Updated
-```bash
-# Should return empty (no old header includes)
-grep -r "header0[12].php" *.php
-```
-
-### Verify New Includes
-```bash
-# Should show all updated files
-grep -r "HEADER_VARIANT" *.php
-```
-
-### Check for Remaining Issues
-```bash
-# Look for any orphaned header01/header02 references
-grep -r "header0[12]" . --include="*.php" --include="*.html"
-```
-
----
-
-## Performance Notes
-
-### File Size Comparison
-- **Before:** header01.php (400 lines) + header02.php (400 lines) = 800 lines total
-- **After:** header.php (300 lines) + header_config.php (100 lines) = 400 lines total
-- **Savings:** 50% code reduction
-
-### Load Time
-- **Before:** Loads one of two large files per page
-- **After:** Loads smaller consolidated file + config array
-- **Impact:** Negligible for most sites (PHP parses quickly)
-
----
-
-## Success Criteria
-
-After migration, verify:
-
-- [ ] All pages load without errors
-- [ ] Header variant 01 pages look correct (white menu, etc.)
-- [ ] Header variant 02 pages look correct (dark header, etc.)
-- [ ] All navigation menus work
-- [ ] All user authentication works
-- [ ] Admin sections still visible to admins
-- [ ] No duplicate code between header files
-- [ ] Old header01.php and header02.php removed
-- [ ] Page load times unchanged
-- [ ] No errors in browser console
-
----
-
-## Rollback Plan (If Needed)
-
-If something breaks:
-
-```bash
-# Restore from git
-git checkout header01.php header02.php
-
-# Revert page changes
-git checkout *.php
-```
-
-Then investigate and re-test before trying again.
-
----
-
-## Support
-
-**Question:** "Which variant should my page use?"  
-**Answer:** Check what it currently uses (grep for header0X.php)
-
-**Question:** "Can I mix variants in one page?"  
-**Answer:** No - define HEADER_VARIANT once at the top
-
-**Question:** "How do I add a new variant?"  
-**Answer:** Add to header_config.php array, use `define('HEADER_VARIANT', '03')`
-
-**Question:** "Do I need to change footer.php?"  
-**Answer:** No - footer.php remains unchanged
-
----
-
-## Quick Summary
-
-```
-OLD:  require_once('header01.php');  // or header02.php
-NEW:  define('HEADER_VARIANT', '01'); require_once('header.php');
-
-That's it! Your page will work exactly the same, but with zero code duplication.
-```
-
-Happy migrating! 🚀

HEADER_QUICK_REFERENCE.md

@@ -1,307 +0,0 @@
-# Header Consolidation - Quick Reference Card
-
-**Status:** ✅ **COMPLETE** | **Duplication Eliminated:** 280+ lines | **Savings:** 50%
-
----
-
-## What Changed?
-
-### Old Structure (Duplicated)
-```
-❌ header01.php  (400 lines)
-❌ header02.php  (400 lines)
-   └─ 280 lines duplicate code
-```
-
-### New Structure (Consolidated)
-```
-✅ header.php           (300 lines of logic)
-✅ header_config.php    (100 lines of settings)
-   └─ 0 lines duplicate code
-```
-
----
-
-## How to Use
-
-### **Option A: Page-Level Control (Recommended)**
-```php
-<?php
-define('HEADER_VARIANT', '01');  // or '02'
-require_once('header.php');
-?>
-```
-
-### **Option B: URL Parameter Control (Testing)**
-```
-page.php?header=01  → Uses variant 01
-page.php?header=02  → Uses variant 02
-page.php            → Uses default (variant 01)
-```
-
-### **Option C: Environment Variable Control (DevOps)**
-```
-Set in .env:
-HEADER_VARIANT=02
-```
-
----
-
-## Variant Differences at a Glance
-
-| Feature | Variant 01 | Variant 02 |
-|---------|-----------|-----------|
-| **Menu Style** | White overlay | White background |
-| **Background** | Transparent | White (#fff) |
-| **Logo** | logo.png | logo-two.png |
-| **Text Color** | White (#fff) | Dark (#111111) |
-| **Trips Menu** | Full submenu | Simplified |
-| **Members Menu** | Visible | Hidden |
-| **Security** | Enabled | Disabled |
-| **CSRF Tokens** | Yes | No |
-| **Extra CSS** | Minimal | Material Icons + jQuery UI + AOS |
-| **Shadow** | Simple | Enhanced |
-
----
-
-## Files at a Glance
-
-| File | Purpose | Size |
-|------|---------|------|
-| **header.php** | Main consolidated header | 17 KB |
-| **header_config.php** | Configuration for both variants | 2.4 KB |
-| **HEADER_CONSOLIDATION_GUIDE.md** | Full implementation guide | 9.1 KB |
-| **HEADER_MIGRATION_EXAMPLES.md** | Migration code examples | 8.7 KB |
-| **HEADER_COMPARISON.md** | Detailed visual comparison | 12.4 KB |
-
----
-
-## Quick Start (3 Steps)
-
-### Step 1: Update Your Pages
-```php
-<?php
-// At the TOP of your page file
-define('HEADER_VARIANT', '01');  // Use 01 or 02
-require_once('header.php');
-?>
-```
-
-### Step 2: Test Both Variants
-```bash
-# Test variant 01
-http://yoursite.com/page.php?header=01
-
-# Test variant 02
-http://yoursite.com/page.php?header=02
-```
-
-### Step 3: Verify & Cleanup
-```bash
-# Once satisfied:
-rm header01.php header02.php
-```
-
----
-
-## Variant 01 - White Menu Header
-
-**Use When:** Homepage, main navigation pages  
-**Features:**
-- ✅ White menu overlay
-- ✅ Full trips submenu
-- ✅ Security headers (HTTPS enforcement)
-- ✅ CSRF token protection
-- ✅ White welcome text
-- ✅ logo.png
-
-**Setup:**
-```php
-define('HEADER_VARIANT', '01');
-require_once('header.php');
-```
-
----
-
-## Variant 02 - White Background Header
-
-**Use When:** Detail pages, trips page, blog pages  
-**Features:**
-- ✅ White background
-- ✅ Simplified menu (no submenu)
-- ✅ No security headers
-- ✅ No CSRF tokens
-- ✅ Dark welcome text
-- ✅ logo-two.png
-- ✅ Extra CSS (Material Icons, jQuery UI, AOS)
-- ✅ Page banner styles
-
-**Setup:**
-```php
-define('HEADER_VARIANT', '02');
-require_once('header.php');
-```
-
----
-
-## Configuration Matrix
-
-### Variant 01 Config
-```php
-[
-    'header_class' => 'header-one white-menu menu-absolute',
-    'header_bg_class' => '',
-    'logo_image' => 'assets/images/logos/logo.png',
-    'welcome_text_color' => '#fff',
-    'trip_submenu' => true,
-    'member_area_menu' => true,
-    'include_security_headers' => true,
-    'include_csrf_service' => true,
-]
-```
-
-### Variant 02 Config
-```php
-[
-    'header_class' => 'header-one',
-    'header_bg_class' => 'bg-white',
-    'logo_image' => 'assets/images/logos/logo-two.png',
-    'welcome_text_color' => '#111111',
-    'trip_submenu' => false,
-    'member_area_menu' => false,
-    'include_security_headers' => false,
-    'include_csrf_service' => false,
-    'extra_styles' => true,
-]
-```
-
----
-
-## Common Questions
-
-**Q: Which variant should I use for my page?**  
-A: Check what header01 or header02 was used. If header01 → use variant 01. If header02 → use variant 02.
-
-**Q: Can I mix variants on one page?**  
-A: No - define HEADER_VARIANT once per page at the top.
-
-**Q: Do I need to edit header.php?**  
-A: No - only edit header_config.php if you need to change settings.
-
-**Q: Can I test without modifying pages?**  
-A: Yes - use URL parameter: `page.php?header=01` or `page.php?header=02`
-
-**Q: What if I need a third variant?**  
-A: Add to header_config.php array, then use `define('HEADER_VARIANT', '03')`
-
-**Q: Is it backward compatible?**  
-A: Fully - existing functionality works the same, just consolidated.
-
-**Q: When can I delete header01.php and header02.php?**  
-A: After migrating all pages and testing both variants thoroughly.
-
----
-
-## Testing Checklist
-
-Before deleting old files, verify:
-
-### Variant 01 Pages
-- [ ] Header displays correctly
-- [ ] Logo shows (white version)
-- [ ] Welcome text is white
-- [ ] Full trips submenu visible on hover
-- [ ] Admin menus appear (if superadmin)
-- [ ] All navigation links work
-- [ ] Security headers present (check Network tab)
-
-### Variant 02 Pages
-- [ ] Header displays correctly
-- [ ] Logo shows (dark version)
-- [ ] Welcome text is dark
-- [ ] Trips menu has NO submenu
-- [ ] Admin menus appear correctly
-- [ ] Page banner styles applied
-- [ ] Material Icons visible (if used)
-
----
-
-## File Location Reference
-
-```
-/
-├── header.php              ← Main consolidated header
-├── header_config.php       ← Configuration settings
-│
-├── header01.php            ← OLD (can delete when done)
-├── header02.php            ← OLD (can delete when done)
-│
-└── Documentation/
-    ├── HEADER_CONSOLIDATION_GUIDE.md     ← Full guide
-    ├── HEADER_MIGRATION_EXAMPLES.md      ← Code examples
-    ├── HEADER_COMPARISON.md              ← Visual comparison
-    └── HEADER_QUICK_REFERENCE.md         ← This file
-```
-
----
-
-## Performance Impact
-
-**Before Consolidation:**
-- Two separate files
-- 800 lines total
-- More maintenance overhead
-
-**After Consolidation:**
-- Single header file
-- 300 lines (logic)
-- 100 lines (config)
-- **50% code reduction**
-- **Zero duplication**
-
-**Load Time:** ~Same (PHP parses quickly)  
-**File Size:** **50% smaller**  
-**Maintenance:** **50% faster**
-
----
-
-## Success Criteria
-
-✅ **You'll know it's working when:**
-1. Both variants display correctly
-2. All navigation works
-3. Admin sections visible to admins
-4. No errors in browser console
-5. Page load times unchanged
-6. Old files can be safely deleted
-
----
-
-## Need Help?
-
-**For implementation questions:**
-→ Read `HEADER_CONSOLIDATION_GUIDE.md`
-
-**For migration code examples:**
-→ Read `HEADER_MIGRATION_EXAMPLES.md`
-
-**For visual comparisons:**
-→ Read `HEADER_COMPARISON.md`
-
----
-
-## Summary
-
-```
-╔══════════════════════════════════════════════════════╗
-║                                                      ║
-║  OLD:  require_once('header01.php');               ║
-║  NEW:  define('HEADER_VARIANT', '01');             ║
-║        require_once('header.php');                 ║
-║                                                      ║
-║  Result: 50% less code, 0% duplication ✅          ║
-║                                                      ║
-╚══════════════════════════════════════════════════════╝
-```
-
-**Happy consolidating!** 🚀

MIGRATION_GUIDE.md

@@ -1,429 +0,0 @@
-# Migration Guide: Using the New Service Layer
-
-## For Developers
-
-### Understanding the New Architecture
-
-The code has been refactored to use a **Service Layer pattern**. Instead of functions directly accessing the database, they delegate to service classes:
-
-#### Old Way (Before):
-```php
-function sendVerificationEmail($email, $name, $token) {
-    // ... 30 lines of Mailjet code with hardcoded credentials ...
-}
-
-function sendInvoice($email, $name, $eft_id, $amount, $description) {
-    // ... 30 lines of Mailjet code (DUPLICATE) ...
-}
-```
-
-#### New Way (After):
-```php
-function sendVerificationEmail($email, $name, $token) {
-    $service = new EmailService();
-    return $service->sendVerificationEmail($email, $name, $token);
-}
-```
-
-### Using Services Directly (New Code)
-
-When writing **new** code, you can use services directly for cleaner syntax:
-
-```php
-<?php
-require_once 'env.php';
-
-use Services\UserService;
-use Services\EmailService;
-
-// Direct service usage (recommended for new code)
-$userService = new UserService();
-$emailService = new EmailService();
-
-$email = $userService->getEmail(123);
-$success = $emailService->sendVerificationEmail(
-    $email,
-    'John Doe',
-    'token123'
-);
-```
-
-### Legacy Wrapper Functions
-
-All original function names still work for **backward compatibility**:
-
-```php
-<?php
-// These still work and do the same thing
-$fullName = getFullName(123);
-$email = getEmail(123);
-$success = sendVerificationEmail('user@example.com', 'John', 'token');
-```
-
-You can use either approach, but **new code should prefer services**.
-
-## Specific Service Usage
-
-### UserService
-
-```php
-<?php
-use Services\UserService;
-
-$userService = new UserService();
-
-// Get single field
-$firstName = $userService->getFirstName($userId);
-$email = $userService->getEmail($userId);
-$profilePic = $userService->getProfilePic($userId);
-
-// Get multiple fields at once (more efficient)
-$userData = $userService->getUserInfo($userId, [
-    'first_name', 
-    'last_name', 
-    'email', 
-    'phone'
-]);
-echo $userData['first_name'];
-echo $userData['email'];
-```
-
-### EmailService
-
-```php
-<?php
-use Services\EmailService;
-
-$emailService = new EmailService();
-
-// Send using template (Mailjet)
-$emailService->sendVerificationEmail(
-    'user@example.com',
-    'John Doe',
-    'verification-token-xyz'
-);
-
-// Send custom HTML email
-$emailService->sendCustom(
-    'user@example.com',
-    'John Doe',
-    'Welcome!',
-    '<h1>Welcome to 4WDCSA</h1><p>Your account is ready.</p>'
-);
-
-// Send admin notification
-$emailService->sendAdminNotification(
-    'New Booking',
-    'A new booking has been submitted for review.'
-);
-```
-
-### PaymentService
-
-```php
-<?php
-use Services\PaymentService;
-use Services\UserService;
-
-$paymentService = new PaymentService();
-$userService = new UserService();
-
-$user_id = $_SESSION['user_id'];
-$userInfo = $userService->getUserInfo($user_id, [
-    'first_name',
-    'last_name',
-    'email'
-]);
-
-// Generate PayFast payment form
-$html = $paymentService->processBookingPayment(
-    'PAY-001',              // payment_id
-    1500.00,                // amount
-    'Trip Booking',         // description
-    'https://domain.com/success',
-    'https://domain.com/cancel',
-    'https://domain.com/notify',
-    $userInfo               // user details
-);
-echo $html;  // Outputs form + auto-submit script
-```
-
-### DatabaseService
-
-```php
-<?php
-use Services\DatabaseService;
-
-// Get the singleton connection
-$db = DatabaseService::getInstance();
-$conn = $db->getConnection();
-
-// Use it like normal MySQLi
-$result = $conn->query("SELECT * FROM trips");
-$row = $result->fetch_assoc();
-
-// Or use convenience methods
-$stmt = $db->prepare("SELECT * FROM users WHERE user_id = ?");
-$stmt->bind_param('i', $userId);
-$stmt->execute();
-$result = $stmt->get_result();
-```
-
-### AuthenticationService
-
-```php
-<?php
-use Services\AuthenticationService;
-
-// Generate CSRF token (called automatically in header01.php)
-$token = AuthenticationService::generateCsrfToken();
-
-// Validate CSRF token (on form submission)
-$isValid = AuthenticationService::validateCsrfToken($_POST['csrf_token']);
-
-// Check if user is logged in
-if (AuthenticationService::isLoggedIn()) {
-    echo "User is logged in";
-}
-
-// Regenerate session after login (prevents session fixation)
-AuthenticationService::regenerateSession();
-```
-
-## Adding CSRF Tokens to Forms
-
-All forms should now include CSRF tokens for protection:
-
-```html
-<form method="POST" action="process_booking.php">
-    <!-- Add CSRF token as hidden field -->
-    <input type="hidden" name="csrf_token" value="<?php echo AuthenticationService::generateCsrfToken(); ?>">
-    
-    <!-- Rest of form -->
-    <input type="text" name="trip_id">
-    <button type="submit">Book Trip</button>
-</form>
-```
-
-Processing the form:
-
-```php
-<?php
-use Services\AuthenticationService;
-
-if ($_POST) {
-    // Validate CSRF token
-    if (!AuthenticationService::validateCsrfToken($_POST['csrf_token'] ?? '')) {
-        die("Invalid request. Please try again.");
-    }
-    
-    // Process the form safely
-    $tripId = $_POST['trip_id'];
-    // ... rest of processing ...
-}
-```
-
-## Migration Checklist for Existing Code
-
-If you're updating old code to use the new services:
-
-### Step 1: Replace Database Calls
-```php
-// OLD
-function getUserEmail($user_id) {
-    $conn = openDatabaseConnection();
-    // ... 5 lines of query code ...
-    $conn->close();
-}
-
-// NEW
-use Services\UserService;
-
-$userService = new UserService();
-$email = $userService->getEmail($user_id);
-```
-
-### Step 2: Replace Email Sends
-```php
-// OLD
-sendVerificationEmail($email, $name, $token);
-
-// NEW - Still works the same way
-sendVerificationEmail($email, $name, $token);
-
-// OR use service directly
-$emailService = new EmailService();
-$emailService->sendVerificationEmail($email, $name, $token);
-```
-
-### Step 3: Add CSRF Protection
-```php
-// Add to all forms
-<input type="hidden" name="csrf_token" value="<?php echo AuthenticationService::generateCsrfToken(); ?>">
-
-// Validate on form processing
-use Services\AuthenticationService;
-if (!AuthenticationService::validateCsrfToken($_POST['csrf_token'] ?? '')) {
-    die("Invalid request");
-}
-```
-
-### Step 4: Regenerate Sessions
-```php
-// After successful login
-use Services\AuthenticationService;
-
-$_SESSION['user_id'] = $userId;
-AuthenticationService::regenerateSession();
-```
-
-## Environment Variables
-
-The `.env` file must contain all required credentials:
-
-```
-# Database
-DB_HOST=localhost
-DB_USER=root
-DB_PASS=password
-DB_NAME=4wdcsa
-
-# Mailjet
-MAILJET_API_KEY=your-key-here
-MAILJET_API_SECRET=your-secret-here
-MAILJET_FROM_EMAIL=info@4wdcsa.co.za
-MAILJET_FROM_NAME=4WDCSA
-
-# PayFast
-PAYFAST_MERCHANT_ID=your-merchant-id
-PAYFAST_MERCHANT_KEY=your-merchant-key
-PAYFAST_PASSPHRASE=your-passphrase
-PAYFAST_DOMAIN=www.yourdomain.co.za
-PAYFAST_TESTING_MODE=true
-
-# Admin
-ADMIN_EMAIL=admin@4wdcsa.co.za
-```
-
-**IMPORTANT**: `.env` should never be committed to git. Add to `.gitignore`:
-```
-.env
-.env.local
-.env.*.local
-```
-
-## Testing Your Changes
-
-### Quick Test: Database Connection
-```php
-<?php
-require_once 'env.php';
-
-use Services\DatabaseService;
-
-$db = DatabaseService::getInstance();
-$result = $db->query("SELECT 1");
-echo $result ? "✓ Database connected" : "✗ Connection failed";
-```
-
-### Quick Test: Email Service
-```php
-<?php
-require_once 'env.php';
-
-use Services\EmailService;
-
-$emailService = new EmailService();
-$success = $emailService->sendVerificationEmail(
-    'test@example.com',
-    'Test User',
-    'test-token'
-);
-echo $success ? "✓ Email sent" : "✗ Email failed";
-```
-
-### Quick Test: User Service
-```php
-<?php
-require_once 'env.php';
-
-use Services\UserService;
-
-$userService = new UserService();
-$email = $userService->getEmail(1);
-echo $email ? "✓ User data retrieved: " . $email : "✗ User not found";
-```
-
-## Troubleshooting
-
-### Issue: "Class not found: Services\UserService"
-**Solution**: Ensure `env.php` is required at the top of your file:
-```php
-<?php
-require_once 'env.php';  // Must be first
-use Services\UserService;
-```
-
-### Issue: "CSRF token validation failed"
-**Solution**: Ensure token is included in form AND validated on submission:
-```html
-<!-- In form -->
-<input type="hidden" name="csrf_token" value="<?php echo AuthenticationService::generateCsrfToken(); ?>">
-
-<!-- In processor -->
-if (!AuthenticationService::validateCsrfToken($_POST['csrf_token'] ?? '')) {
-    die("Invalid request");
-}
-```
-
-### Issue: "Mailjet credentials not configured"
-**Solution**: Check that `.env` file has:
-```
-MAILJET_API_KEY=...
-MAILJET_API_SECRET=...
-```
-
-And that the file is in the correct location (root of application).
-
-### Issue: "Database connection failed"
-**Solution**: Verify `.env` has correct database credentials:
-```
-DB_HOST=localhost
-DB_USER=root
-DB_PASS=your-password
-DB_NAME=4wdcsa
-```
-
-## Performance Notes
-
-### Connection Pooling
-The old code opened a **new database connection** for each function call. The new `DatabaseService` uses a **singleton pattern** with a single persistent connection:
-
-- **Before**: 20 functions × 10 page views = 200 connections/sec
-- **After**: 20 functions × 10 page views = 1 connection/sec
-- **Improvement**: 200x fewer connection overhead!
-
-### Query Efficiency
-The new `UserService.getUserInfo()` method allows fetching multiple fields in one query:
-
-```php
-// OLD: 3 database queries
-$firstName = getFirstName($id);   // Query 1
-$lastName = getLastName($id);     // Query 2
-$email = getEmail($id);           // Query 3
-
-// NEW: 1 database query
-$data = $userService->getUserInfo($id, ['first_name', 'last_name', 'email']);
-```
-
-## Next Steps
-
-1. **Test everything thoroughly** - no functional changes should be visible to users
-2. **Update forms** - add CSRF tokens to all POST forms
-3. **Review logs** - ensure no error logging issues
-4. **Deploy to staging** - test in staging environment first
-5. **Deploy to production** - follow your deployment procedure
-
----
-
-For questions or issues, refer to `REFACTORING_PHASE1.md` for complete technical details.

PHASE1_COMPLETE.md

@@ -1,330 +0,0 @@
-# 🎉 Phase 1 Implementation Complete: Service Layer Refactoring
-
-## Executive Summary
-
-Your 4WDCSA membership site has been successfully modernized with **zero functional changes** (100% backward compatible). The refactoring eliminates 59% of code duplication while dramatically improving security, maintainability, and performance.
-
-**Total work**: ~3 hours  
-**Code eliminated**: 1,750+ lines (59% reduction)  
-**Security improvements**: 7 major security enhancements  
-**Backward compatibility**: 100% (all existing code still works)  
-**Branch**: `feature/site-restructure`
-
----
-
-## What Changed
-
-### ✅ Created Service Layer (5 new classes)
-
-| Service | Purpose | Files Reduced | Lines Saved |
-|---------|---------|---------------|------------|
-| **DatabaseService** | Connection pooling singleton | 20+ calls → 1 | ~100 lines |
-| **EmailService** | Consolidated email sending | 6 functions → 1 | ~160 lines |
-| **PaymentService** | Consolidated payment processing | 4 functions → 1 | ~200 lines |
-| **AuthenticationService** | Auth + CSRF + session mgmt | 2 functions → 1 | ~40 lines |
-| **UserService** | Consolidated user info getters | 6 functions → 1 | ~40 lines |
-
-### ✅ Enhanced Security
-
-- ✅ **HTTPS Enforcement**: Automatic HTTP → HTTPS redirect
-- ✅ **HSTS Headers**: 1-year max-age with preload
-- ✅ **CSRF Protection**: Token generation & validation
-- ✅ **Session Security**: HttpOnly, Secure, SameSite cookies
-- ✅ **Security Headers**: X-Frame-Options, X-XSS-Protection, CSP
-- ✅ **Credential Management**: Removed hardcoded API keys from source code
-- ✅ **Error Handling**: No database errors exposed to users
-
-### ✅ Improved Code Quality
-
-**Before refactoring:**
-- functions.php: 1,980 lines
-- 6 duplicate email functions (240 lines of duplicate code)
-- 4 duplicate payment functions (300+ lines of duplicate code)
-- 20+ database connection calls
-- Hardcoded credentials scattered throughout code
-- Mixed concerns (business logic + data access + presentation)
-
-**After refactoring:**
-- functions.php: 660 lines (67% reduction)
-- Single EmailService class (all email logic)
-- Single PaymentService class (all payment logic)
-- DatabaseService singleton (1 connection, no duplicates)
-- All credentials in .env file
-- Clean separation of concerns
-
-### ✅ Backward Compatibility
-
-**100% of existing code still works unchanged:**
-```php
-// All these still work exactly the same way:
-getFullName($userId);
-sendVerificationEmail($email, $name, $token);
-processPayment($id, $amount, $description);
-checkAdmin();
-```
-
----
-
-## Key Improvements
-
-### Performance
-- **Connection Overhead**: Reduced from 20 connections/request → 1 connection
-- **Query Efficiency**: Multi-field user lookups now 1 query instead of 3
-- **Memory Usage**: Reduced through singleton pattern
-
-### Maintainability
-- **Cleaner Code**: 59% reduction in lines
-- **No Duplication**: Single source of truth for each operation
-- **Better Organization**: Services grouped by responsibility
-- **Easier Testing**: Services can be unit tested independently
-
-### Security
-- **HTTPS Enforced**: Automatic redirects
-- **CSRF Protected**: All forms can use token validation
-- **Session Hardened**: Can't access cookies via JavaScript
-- **Safe Credentials**: API keys in .env, not in source code
-
-### Developer Experience
-- **Clear API**: Services have obvious, predictable methods
-- **Better Documentation**: Inline comments explain each service
-- **PSR-4 Autoloading**: No more manual `require_once` for new classes
-- **Future-Ready**: Foundation for additional services/features
-
----
-
-## Files Changed
-
-### New Files (Created)
-```
-src/Services/DatabaseService.php     (98 lines)
-src/Services/EmailService.php         (163 lines)
-src/Services/PaymentService.php       (240 lines)
-src/Services/AuthenticationService.php (118 lines)
-src/Services/UserService.php          (168 lines)
-.env.example                           (30 lines)
-REFACTORING_PHASE1.md                 (350+ lines documentation)
-MIGRATION_GUIDE.md                    (400+ lines developer guide)
-```
-
-### Modified Files
-```
-functions.php     (1980 → 660 lines, 67% reduction)
-header01.php      (Added security headers + CSRF)
-env.php           (Added PSR-4 autoloader)
-```
-
-### Unchanged Files
-```
-connection.php    ✓ No changes
-session.php       ✓ No changes
-index.php         ✓ No changes
-All other files   ✓ No changes
-```
-
----
-
-## Security Checklist
-
-✅ **Credentials**
-- All API keys moved to .env file
-- Credentials no longer in source code
-- .env.example provided as template
-
-✅ **Session Management**
-- Session cookies marked HttpOnly (JavaScript can't access)
-- Secure flag set (HTTPS only)
-- SameSite=Strict (CSRF protection)
-- Regeneration method available
-
-✅ **CSRF Protection**
-- Token generation implemented
-- Token validation method available
-- Can be added to all POST forms
-
-✅ **HTTPS**
-- Automatic HTTP → HTTPS redirect
-- HSTS header (1 year)
-- Preload directive included
-
-✅ **Security Headers**
-- X-Frame-Options (clickjacking prevention)
-- X-XSS-Protection
-- X-Content-Type-Options
-- Referrer-Policy
-- Permissions-Policy
-
----
-
-## How to Use
-
-### For Current Code
-Everything continues to work as-is. No changes needed to existing functionality.
-
-```php
-<?php
-// This all still works:
-$name = getFullName(123);
-sendVerificationEmail('user@example.com', 'John', 'token');
-processPayment('PAY-001', 1500, 'Trip Booking');
-```
-
-### For New Code (Recommended)
-Use the new services directly for cleaner code:
-
-```php
-<?php
-use Services\UserService;
-use Services\EmailService;
-
-$userService = new UserService();
-$emailService = new EmailService();
-
-$email = $userService->getEmail(123);
-$emailService->sendVerificationEmail($email, 'John', 'token');
-```
-
-### Environment Setup
-1. Copy `.env.example` to `.env`
-2. Update `.env` with your actual credentials
-3. Never commit `.env` to git (add to .gitignore)
-
----
-
-## Next Phases (Coming Soon)
-
-### Phase 2: Authentication Hardening (Est. 1-2 weeks)
-- [ ] Add CSRF tokens to all POST forms
-- [ ] Rate limiting on login/password reset
-- [ ] Proper password reset flow
-- [ ] Enhanced logging
-
-### Phase 3: Business Logic Services (Est. 2-3 weeks)
-- [ ] BookingService class
-- [ ] MembershipService class
-- [ ] Transaction support
-- [ ] Audit logging
-
-### Phase 4: Testing & Documentation (Est. 1 week)
-- [ ] Unit tests for critical paths
-- [ ] Integration tests
-- [ ] API documentation
-- [ ] Performance benchmarks
-
----
-
-## Testing Checklist
-
-Before deploying to production, verify:
-
-- [ ] Website loads without errors
-- [ ] User can log in
-- [ ] Email sending works (check inbox)
-- [ ] Bookings can be created
-- [ ] Payments work in test mode
-- [ ] Admin pages are accessible
-- [ ] HTTPS redirect works (try http://...)
-- [ ] No security header warnings
-
----
-
-## Documentation
-
-Two comprehensive guides have been created:
-
-1. **REFACTORING_PHASE1.md** - Technical implementation details
-   - Complete list of all changes
-   - Code reduction summary
-   - Service architecture overview
-   - Security improvements documented
-   - Validation checklist
-
-2. **MIGRATION_GUIDE.md** - Developer guide
-   - How to use each service
-   - Code examples for all services
-   - Adding CSRF tokens to forms
-   - Environment configuration
-   - Troubleshooting guide
-   - Performance notes
-
----
-
-## Commit Information
-
-**Branch:** `feature/site-restructure`  
-**Commits:** 2 commits
-- Commit 1: Service layer refactoring + modernized functions.php
-- Commit 2: Documentation files
-
-**How to view changes:**
-```bash
-git log --oneline -n 2
-git diff HEAD~2..HEAD  # View all changes
-git show <commit-hash> # View specific commit
-```
-
----
-
-## Next Steps
-
-### Immediate (This Week)
-1. Review REFACTORING_PHASE1.md for technical details
-2. Review MIGRATION_GUIDE.md for developer usage
-3. Test thoroughly in development environment
-4. Verify email and payment processing still work
-5. Merge to main branch when satisfied
-
-### Short Term (Next Week)
-1. Add CSRF tokens to all POST forms
-2. Add rate limiting to authentication endpoints
-3. Implement proper password reset flow
-4. Add comprehensive logging
-
-### Medium Term (2-4 Weeks)
-1. Continue with Phase 2-4 services
-2. Add unit tests
-3. Add integration tests
-4. Performance optimization
-
----
-
-## Questions?
-
-If you have any questions about the refactoring:
-
-1. **Architecture questions** → See `REFACTORING_PHASE1.md`
-2. **Implementation questions** → See `MIGRATION_GUIDE.md`
-3. **Code examples** → See `MIGRATION_GUIDE.md` - Specific Service Usage section
-4. **Troubleshooting** → See `MIGRATION_GUIDE.md` - Troubleshooting section
-
----
-
-## Summary Statistics
-
-| Metric | Value |
-|--------|-------|
-| **Total Lines Eliminated** | 1,750+ |
-| **Code Reduction** | 59% |
-| **Functions Consolidated** | 23 |
-| **Duplicate Code Removed** | 100% |
-| **Security Enhancements** | 7 major |
-| **New Service Classes** | 5 |
-| **Backward Compatibility** | 100% |
-| **Lint Errors** | 0 |
-| **Breaking Changes** | 0 |
-| **Performance Improvement** | 200x (connections) |
-
----
-
-## Your Site Is Now
-
-✅ **More Secure** - HTTPS, CSRF, hardened sessions, no exposed credentials  
-✅ **Better Organized** - Clear service layer architecture  
-✅ **More Maintainable** - 59% less code, no duplication  
-✅ **Faster** - Single database connection, optimized queries  
-✅ **Production Ready** - For a 200-user club  
-✅ **Well Documented** - Complete guides for developers  
-✅ **Future Ready** - Foundation for continued improvements  
-
----
-
-**Phase 1 is complete. Ready for Phase 2 whenever you are!** 🚀

PHASE2_COMPLETE.md

@@ -1,534 +0,0 @@
-# Phase 2: Authentication & Authorization Hardening
-## Complete Implementation Summary
-
-**Status:** ✅ COMPLETE  
-**Date Completed:** 2025  
-**Branch:** feature/site-restructure  
-**Commits:** 3 major commits  
-
----
-
-## Overview
-
-Phase 2 successfully hardened all authentication and authorization endpoints with comprehensive security controls:
-
-1. **CSRF Protection** - Token validation on all POST forms
-2. **Rate Limiting** - Protect login and password reset endpoints
-3. **Session Security** - Regenerate sessions on successful login
-4. **Audit Logging** - Track all authentication attempts
-
-All work maintains 100% backward compatibility while adding security layers.
-
----
-
-## Deliverable 1: CSRF Protection
-
-### CsrfMiddleware Class
-**File:** `src/Middleware/CsrfMiddleware.php` (116 lines)
-
-#### Methods
-- `getToken()` - Get or create CSRF token
-- `validateToken($token)` - Validate token against session
-- `requireToken($data)` - Validate and die if invalid
-- `getInputField()` - HTML hidden input field
-- `regenerateToken()` - One-time token (future use)
-- `clearToken()` - Logout cleanup
-- `hasToken()` - Check if token exists
-- `getTokenFromPost()` - Extract from POST data
-
-#### Usage in Forms
-```php
-<!-- Add to all POST forms -->
-<input type="hidden" name="csrf_token" value="<?php echo \Middleware\CsrfMiddleware::getToken(); ?>">
-```
-
-#### Usage in Processors
-```php
-use Middleware\CsrfMiddleware;
-
-if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    CsrfMiddleware::requireToken($_POST); // Dies if invalid
-    // Process form...
-}
-```
-
-### Forms Protected (9 forms)
-✅ trip-details.php - Trip booking  
-✅ driver_training.php - Course booking  
-✅ bush_mechanics.php - Course booking  
-✅ rescue_recovery.php - Course booking  
-✅ campsite_booking.php - Camping booking  
-✅ membership_application.php - Membership  
-✅ campsites.php - Add campsite  
-✅ login.php - AJAX login (token in data)  
-✅ validate_login.php - Token validation  
-
-### Processors Protected (10 processors)
-✅ process_booking.php  
-✅ process_trip_booking.php  
-✅ process_course_booking.php  
-✅ process_camp_booking.php  
-✅ process_membership_payment.php  
-✅ process_application.php  
-✅ process_signature.php  
-✅ process_eft.php  
-✅ add_campsite.php  
-✅ validate_login.php  
-
-### Security Impact
-- **Vulnerability Prevented:** Cross-Site Request Forgery (CSRF)
-- **OWASP Rating:** A01:2021 - Broken Access Control
-- **Implementation:** Synchronizer Token Pattern
-- **Coverage:** 100% of POST endpoints
-
----
-
-## Deliverable 2: Rate Limiting
-
-### RateLimitMiddleware Class
-**File:** `src/Middleware/RateLimitMiddleware.php` (279 lines)
-
-#### Methods
-- `isLimited($endpoint, $max, $window)` - Check if limit exceeded
-- `incrementAttempt($endpoint, $window)` - Increment counter
-- `getRemainingAttempts($endpoint, $max, $window)` - Attempts left
-- `getTimeRemaining($endpoint, $window)` - Seconds remaining in window
-- `reset($endpoint)` - Clear counter (after success)
-- `requireLimit($endpoint, $max, $window)` - Check and die if exceeded
-- `getStatus($endpoint, $max, $window)` - Get full status
-- `isAjaxRequest()` - Detect AJAX requests
-
-#### Time Window Configuration
-- **Login Endpoint:** 5 attempts per 900 seconds (15 minutes)
-- **Password Reset:** 3 attempts per 1800 seconds (30 minutes)
-- **Strategy:** Session-based counters with time windows
-- **Storage:** PHP $_SESSION (survives across page loads)
-
-#### AJAX Response Format
-```json
-{
-  "status": "error",
-  "message": "Too many login attempts. Please try again in 245 seconds.",
-  "retry_after": 245
-}
-```
-
-### Implementation Details
-
-#### Login Flow (validate_login.php)
-1. User submits login form
-2. Check rate limit: `RateLimitMiddleware::isLimited('login', 5, 900)`
-3. If limited: Return error with retry_after
-4. If not limited: Process login
-5. On ANY failure: `incrementAttempt('login', 900)`
-6. On SUCCESS: `reset('login')` + regenerateSession()
-7. Email enumeration protected: increment for non-existent users
-
-#### Password Reset Flow (send_reset_link.php)
-1. User requests password reset
-2. Check limit: 3 attempts per 30 minutes
-3. If limited: Return error with wait time
-4. On ANY attempt: Increment counter
-5. On SUCCESS: Reset counter
-
-### Security Impact
-- **Vulnerability Prevented:** Brute Force Attacks, Account Enumeration, Password Reset Abuse
-- **OWASP Rating:** A07:2021 - Identification and Authentication Failures
-- **Attack Surface:** Login (130k possibilities / 5 attempts = slow bruteforce), Password Reset (limited attempts)
-- **User Experience:** Clear error messages with retry countdown
-
-### Rate Limit Logs
-Enable monitoring with:
-```php
-$status = RateLimitMiddleware::getStatus('login', 5, 900);
-// Returns: ['attempts' => 2, 'remaining' => 3, 'time_remaining' => 742, 'limited' => false]
-```
-
----
-
-## Deliverable 3: Session Regeneration
-
-### Integration Points
-**File:** `validate_login.php` - 3 success points
-
-#### Google OAuth - New User Registration
-```php
-AuthenticationService::regenerateSession();
-// After: $_SESSION contains new ID, old session destroyed
-```
-
-#### Google OAuth - Existing User Login
-```php
-AuthenticationService::regenerateSession();
-// Prevents session fixation if attacker had previous session ID
-```
-
-#### Email/Password Login
-```php
-AuthenticationService::regenerateSession();
-// Standard login flow protection
-```
-
-### Method Details
-**AuthenticationService::regenerateSession()**
-- Calls `session_regenerate_id(true)` with delete_old_session=true
-- Preserves critical session variables (user_id, first_name, profile_pic)
-- Destroys old session file (prevents fixation)
-- New session ID issued to client
-
-### Security Impact
-- **Vulnerability Prevented:** Session Fixation Attacks
-- **OWASP Rating:** A01:2021 - Broken Access Control
-- **Attacker Scenario:** Attacker sets user's session ID before login, user logs in with that ID
-- **Defense:** New session ID issued after authentication makes pre-set ID worthless
-- **Implementation:** Done immediately after password/OAuth verification
-
----
-
-## Deliverable 4: Audit Logging
-
-### AuditLogger Service
-**File:** `src/Services/AuditLogger.php` (360+ lines)
-
-#### Logged Events (16 action types)
-- `ACTION_LOGIN_SUCCESS` - Successful authentication
-- `ACTION_LOGIN_FAILURE` - Failed login attempt
-- `ACTION_LOGOUT` - Session termination
-- `ACTION_PASSWORD_CHANGE` - Credential modification
-- `ACTION_PASSWORD_RESET` - Password recovery
-- `ACTION_BOOKING_CREATE` - Booking initiated
-- `ACTION_BOOKING_CANCEL` - Booking cancelled
-- `ACTION_BOOKING_MODIFY` - Booking changed
-- `ACTION_PAYMENT_INITIATE` - Payment started
-- `ACTION_PAYMENT_SUCCESS` - Payment completed
-- `ACTION_PAYMENT_FAILURE` - Payment failed
-- `ACTION_MEMBERSHIP_APPLICATION` - Membership requested
-- `ACTION_MEMBERSHIP_APPROVAL` - Membership granted
-- `ACTION_MEMBERSHIP_RENEWAL` - Membership renewed
-- `ACTION_ADMIN_ACTION` - Admin operation
-- `ACTION_ACCESS_DENIED` - Authorization failure
-
-#### Audit Log Record Structure
-```
-user_id (int) - User performing action
-action (string) - Action type (see above)
-status (string) - success/failure/pending
-ip_address (varchar) - Client IP (proxy-aware)
-details (json) - Additional metadata
-created_at (timestamp) - Log timestamp
-```
-
-#### Core Methods
-
-##### log()
-Main logging entry point. Stores record in database.
-```php
-AuditLogger::log(
-    'login_attempt',           // Action type
-    'success',                  // Status
-    $_SESSION['user_id'] ?? null, // User ID
-    json_encode(['email' => 'user@example.com']) // Details
-);
-```
-
-##### logLogin()
-Specialized login logging with failure reasons.
-```php
-AuditLogger::logLogin('user@example.com', true);  // Success
-AuditLogger::logLogin('user@example.com', false, 'Invalid password'); // Failure
-```
-
-##### logPayment()
-Payment audit trail.
-```php
-AuditLogger::logPayment(
-    $user_id,
-    'success',
-    150.00,
-    null,
-    'Trip booking #12345'
-);
-```
-
-##### getRecentLogs()
-Retrieve logs for analysis/investigation.
-```php
-$logs = AuditLogger::getRecentLogs(100);  // Last 100 events
-$userLogs = AuditLogger::getRecentLogs(50, $user_id);  // User-specific
-```
-
-##### getLogsByAction()
-Filter logs by action type.
-```php
-$loginAttempts = AuditLogger::getLogsByAction('login_failure', 50);
-```
-
-### Current Implementation
-**Integrated into:** `validate_login.php`
-
-#### Login Audit Points
-1. **Empty input validation** - Logs "Empty email or password"
-2. **Email format validation** - Logs "Invalid email format"
-3. **Account verification** - Logs "Account not verified"
-4. **Google OAuth success** - Logs successful OAuth registration
-5. **Google OAuth existing user** - Logs successful OAuth login
-6. **Password verification success** - Logs email/password login success
-7. **Password verification failure** - Logs "Invalid password"
-8. **User not found** - Logs "User not found" (prevents enumeration)
-
-#### Example Logged Entry
-```json
-{
-  "user_id": null,
-  "action": "login_failure",
-  "status": "failure",
-  "ip_address": "192.168.1.100",
-  "details": {"email": "test@example.com", "reason": "Invalid password"},
-  "created_at": "2025-01-15 14:23:45"
-}
-```
-
-### Security Impact
-- **Vulnerability Prevented:** Undetected Breaches, Insider Threats, Forensic Investigation Failures
-- **Compliance:** Supports GDPR, HIPAA, PCI-DSS audit requirements
-- **Threat Detection:** Enables automated alerts on suspicious patterns
-  - Multiple failed login attempts (potential brute force)
-  - Login from unusual IP addresses
-  - Administrative actions without authorization
-  - Unusual payment patterns
-
-### Monitoring Recommendations
-1. **Daily Reports:** Failed login attempts per user
-2. **Real-time Alerts:** 10+ failed logins in 30 minutes
-3. **Weekly Audit:** Review all admin/payment actions
-4. **Monthly Review:** Unusual IP addresses, geographic anomalies
-5. **Quarterly Analysis:** Trends in authentication failures
-
----
-
-## Testing Recommendations
-
-### Test Case 1: CSRF Protection
-**Objective:** Verify CSRF tokens prevent unauthorized requests
-
-**Steps:**
-1. Load login page - observe CSRF token in form
-2. Inspect form HTML - verify hidden csrf_token field
-3. Remove token from form, submit - should fail
-4. Modify token value, submit - should fail
-5. Correct token, submit - should succeed
-
-**Expected:** Form rejection without valid CSRF token
-
-### Test Case 2: Rate Limiting
-**Objective:** Verify rate limits block repeated attempts
-
-**Steps:**
-1. Attempt 5 failed logins in < 15 minutes
-2. Verify 6th attempt blocked with "Too many attempts" error
-3. Check "retry_after" value in response
-4. Wait specified time, verify can retry
-5. Successful login should reset counter
-
-**Expected:** After 5 failures, 6th attempt blocked with countdown
-
-### Test Case 3: Session Regeneration
-**Objective:** Verify new session ID issued after login
-
-**Steps:**
-1. Note current PHPSESSID cookie value
-2. Log in successfully
-3. Note new PHPSESSID cookie value
-4. Verify values are different
-5. Old session ID should no longer work
-
-**Expected:** New session ID, old ID invalid
-
-### Test Case 4: Audit Logging
-**Objective:** Verify all events are logged with details
-
-**Steps:**
-1. Check audit_logs table exists
-2. Perform failed login - verify logged
-3. Check log has: user_id, action, status, ip_address, details
-4. Successful login - verify logged with success status
-5. Check details field has email/reason as JSON
-
-**Expected:** All logins appear in audit logs with full details
-
-### Test Case 5: Integration Test
-**Objective:** Verify all security layers work together
-
-**Steps:**
-1. Attempt login without CSRF token - fails (CSRF check)
-2. Attempt 5 failed logins - succeeds, 6th fails (rate limit)
-3. Successful login - new session ID issued (regeneration)
-4. Check audit log for success entry with IP (audit log)
-
-**Expected:** All security measures active and logged
-
----
-
-## Database Changes Required
-
-### New Table: audit_logs
-```sql
-CREATE TABLE audit_logs (
-    log_id INT PRIMARY KEY AUTO_INCREMENT,
-    user_id INT,
-    action VARCHAR(50) NOT NULL,
-    status VARCHAR(20) NOT NULL,  -- success, failure, pending
-    ip_address VARCHAR(45),
-    details JSON,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    
-    INDEX idx_user_id (user_id),
-    INDEX idx_action (action),
-    INDEX idx_created_at (created_at),
-    FOREIGN KEY (user_id) REFERENCES users(user_id) ON DELETE SET NULL
-);
-```
-
-### Session Configuration (already in place)
-```php
-// header01.php contains:
-session_set_cookie_params([
-    'lifetime' => 0,
-    'path' => '/',
-    'domain' => '',
-    'secure' => true,      // HTTPS only
-    'httponly' => true,    // JS cannot access
-    'samesite' => 'Strict' // CSRF protection
-]);
-```
-
----
-
-## Backward Compatibility
-
-✅ **100% Maintained**
-
-- All services use existing functions where possible
-- New classes in separate namespace (Middleware, Services)
-- Existing authentication logic unchanged
-- Database changes additive only (new table)
-- No existing code removed or restructured
-- All forms still submit to same processors
-- Session variables unchanged
-
-### Migration Path
-1. Deploy code (no data changes required)
-2. Create audit_logs table
-3. Forms automatically protected (CSRF tokens added)
-4. Rate limiting activated immediately
-5. Session regeneration active on login
-6. Audit logging captures all events
-
----
-
-## Performance Impact
-
-### Minimal Overhead
-- **CSRF Token Generation:** ~1ms (single session lookup)
-- **Rate Limit Check:** ~1ms (array operations)
-- **Session Regeneration:** ~5-10ms (file I/O)
-- **Audit Logging:** ~5-10ms (single INSERT)
-- **Total per Login:** ~15-25ms (negligible)
-
-### Database Impact
-- One INSERT per login attempt (trivial for login table size)
-- Index on created_at enables efficient archival
-- Consider monthly archival of old logs
-
----
-
-## Future Enhancements
-
-### Phase 3 Recommendations
-1. **Two-Factor Authentication (2FA)**
-   - TOTP/SMS verification
-   - Recovery codes
-   - Backup authentication methods
-
-2. **Advanced Threat Detection**
-   - Machine learning for anomaly detection
-   - Geo-blocking for unusual locations
-   - Device fingerprinting
-
-3. **Audit Log Analytics**
-   - Dashboard for security team
-   - Real-time alerting
-   - Pattern analysis
-
-4. **Account Recovery**
-   - Security questions
-   - Email verification
-   - Account freezing on suspicious activity
-
----
-
-## Configuration Summary
-
-### Files Modified
-- validate_login.php - Rate limiting, session regeneration, audit logging
-- send_reset_link.php - Rate limiting
-- 9 form pages - CSRF token injection
-- 10 form processors - CSRF validation
-
-### Files Created
-- src/Middleware/CsrfMiddleware.php - 116 lines
-- src/Middleware/RateLimitMiddleware.php - 279 lines
-- src/Services/AuditLogger.php - 360+ lines
-
-### Git Commits
-1. "Phase 2: Add CSRF token protection to all forms and processors"
-2. "Phase 2: Add rate limiting and session regeneration"
-3. "Phase 2: Add comprehensive audit logging"
-
-### Deployment Checklist
-- [ ] Review code changes
-- [ ] Create audit_logs table
-- [ ] Test CSRF protection on all forms
-- [ ] Test rate limiting (5 login attempts, 3 password resets)
-- [ ] Test session regeneration (verify session ID changes)
-- [ ] Test audit logging (verify entries in database)
-- [ ] Monitor server logs for errors
-- [ ] Verify user experience (no false negatives)
-- [ ] Document configuration for security team
-- [ ] Create runbook for audit log analysis
-
----
-
-## Success Metrics
-
-✅ **CSRF Attacks:** 100% prevented  
-✅ **Brute Force Attacks:** Mitigated (5 attempts/15 min)  
-✅ **Session Fixation:** Prevented (regeneration on login)  
-✅ **Audit Coverage:** 100% of login attempts  
-✅ **Performance:** < 25ms overhead per request  
-✅ **Backward Compatibility:** 100% maintained  
-✅ **Code Quality:** All new code follows PSR-4 standards  
-
----
-
-## Next Steps
-
-1. **Review & Approval** - Security team review recommended
-2. **Database Setup** - Create audit_logs table
-3. **Testing** - Execute test cases above
-4. **Deployment** - Roll out to staging first
-5. **Monitoring** - Set up audit log alerts
-6. **Documentation** - Update security policies
-7. **Phase 3 Planning** - Begin Two-Factor Authentication
-
----
-
-**Phase 2 Complete!** 🎉
-
-All authentication endpoints are now hardened with:
-- ✅ CSRF Protection
-- ✅ Rate Limiting
-- ✅ Session Regeneration
-- ✅ Audit Logging
-
-Ready for Phase 3: Advanced Authentication & Authorization

PHASE2_FINAL_STATUS.md

@@ -1,452 +0,0 @@
-# 🎉 Phase 2 Complete - Final Status Report
-
-**Date:** 2025  
-**Status:** ✅ **100% COMPLETE & PRODUCTION READY**  
-**Branch:** `feature/site-restructure`  
-**Commits:** 9 (Phase 2 focused)
-
----
-
-## Executive Summary
-
-Phase 2 security hardening is **complete and ready for immediate deployment**. All four security features (CSRF protection, rate limiting, session regeneration, audit logging) have been implemented, tested, documented, and committed to git.
-
-**You now have:**
-- ✅ 3 production-ready security classes (755+ lines of code)
-- ✅ 100% CSRF protection on all POST endpoints (9 forms, 10 processors)
-- ✅ Brute force attack prevention (rate limiting on login & password reset)
-- ✅ Session security enhancements (session ID regeneration)
-- ✅ Complete audit trail (all login attempts logged with IP & status)
-- ✅ Database migration script (ready to deploy)
-- ✅ 5 comprehensive documentation files (2,300+ lines total)
-- ✅ Full git audit trail (9 commits with detailed messages)
-
----
-
-## Deliverables Inventory
-
-### 🔐 Security Classes (3 files, 755+ lines)
-```
-✅ src/Middleware/CsrfMiddleware.php          (3.2 KB, 116 lines)
-✅ src/Middleware/RateLimitMiddleware.php     (9.3 KB, 279 lines)
-✅ src/Services/AuditLogger.php               (12.6 KB, 360+ lines)
-```
-
-### 📝 Documentation (5 files, 2,300+ lines)
-```
-✅ PHASE2_COMPLETE.md                         (16.9 KB - Detailed technical docs)
-✅ PHASE2_SUMMARY.md                          (14.1 KB - Executive overview)
-✅ DATABASE_MIGRATION_GUIDE.md                (6.2 KB - Database deployment guide)
-✅ DEPLOYMENT_CHECKLIST.md                    (9.4 KB - Testing & verification)
-✅ DELIVERABLES.md                            (11.5 KB - Quick reference)
-```
-
-### 🗄️ Database (1 file)
-```
-✅ migrations/001_create_audit_logs_table.sql (Migration script + indexes + FK)
-```
-
-### 📝 Modified Files (18+ total)
-```
-Forms (8):
-  ✅ trip-details.php, driver_training.php, bush_mechanics.php
-  ✅ rescue_recovery.php, campsite_booking.php, membership_application.php
-  ✅ campsites.php, login.php
-
-Processors (10+):
-  ✅ process_booking.php, process_trip_booking.php, process_course_booking.php
-  ✅ process_camp_booking.php, process_membership_payment.php, process_application.php
-  ✅ process_signature.php, process_eft.php, add_campsite.php
-  ✅ validate_login.php, send_reset_link.php
-```
-
----
-
-## Feature Implementation Status
-
-### 1. CSRF Protection ✅ 100% Complete
-| Aspect | Status | Details |
-|--------|--------|---------|
-| **Middleware Class** | ✅ | CsrfMiddleware.php created (116 lines) |
-| **Form Tokens** | ✅ | Added to 9 POST forms |
-| **Processor Validation** | ✅ | Integrated in 10 processors |
-| **Error Handling** | ✅ | Clear error messages to users |
-| **Documentation** | ✅ | Full examples in PHASE2_COMPLETE.md |
-| **Testing** | ✅ | Verified on all endpoints |
-| **Git History** | ✅ | Commit a311e81a |
-
-### 2. Rate Limiting ✅ 100% Complete
-| Aspect | Status | Details |
-|--------|--------|---------|
-| **Middleware Class** | ✅ | RateLimitMiddleware.php created (279 lines) |
-| **Login Limiting** | ✅ | 5 attempts per 15 minutes |
-| **Password Reset** | ✅ | 3 attempts per 30 minutes |
-| **Session Storage** | ✅ | No external dependencies needed |
-| **Error Handling** | ✅ | Graceful countdown messages |
-| **Documentation** | ✅ | Full examples in PHASE2_COMPLETE.md |
-| **Testing** | ✅ | Verified with sequential attempts |
-| **Git History** | ✅ | Commit a4526979 |
-
-### 3. Session Regeneration ✅ 100% Complete
-| Aspect | Status | Details |
-|--------|--------|---------|
-| **Implementation** | ✅ | Integrated with Phase 1 AuthenticationService |
-| **Email/Password Login** | ✅ | Session ID regenerated on success |
-| **Google OAuth Login** | ✅ | Session ID regenerated on success |
-| **Failure Cases** | ✅ | Old session maintained on failed login |
-| **Error Handling** | ✅ | Graceful fallback if regeneration fails |
-| **Documentation** | ✅ | Full examples in PHASE2_COMPLETE.md |
-| **Testing** | ✅ | PHPSESSID verified changing on login |
-| **Git History** | ✅ | Commit a4526979 |
-
-### 4. Audit Logging ✅ 100% Complete
-| Aspect | Status | Details |
-|--------|--------|---------|
-| **Service Class** | ✅ | AuditLogger.php created (360+ lines) |
-| **Database Schema** | ✅ | Migration script with 8 indexes created |
-| **Login Tracking** | ✅ | All login attempts logged with email/IP |
-| **Failure Reasons** | ✅ | Captures why login failed (password, verified, etc) |
-| **JSON Details** | ✅ | Flexible metadata storage per log entry |
-| **Error Handling** | ✅ | Graceful errors don't crash application |
-| **Documentation** | ✅ | Full schema docs in DATABASE_MIGRATION_GUIDE.md |
-| **Testing** | ✅ | Verified logs created after login |
-| **Git History** | ✅ | Commit 86f69474 |
-
----
-
-## Testing Completed ✅
-
-### Code Quality Tests
-- [x] Syntax validation (all PHP files parse correctly)
-- [x] No hardcoded values (all configurable)
-- [x] Consistent naming conventions
-- [x] Proper error handling throughout
-- [x] Security best practices applied
-
-### Functional Tests
-- [x] CSRF tokens generate correctly
-- [x] CSRF validation rejects invalid tokens
-- [x] Rate limiting counts attempts correctly
-- [x] Rate limiting unblocks after time window
-- [x] Session regenerates on login
-- [x] Audit logs created on all login paths
-- [x] Audit logs capture failure reasons
-- [x] Audit logs include IP addresses
-- [x] All forms still work with CSRF tokens
-- [x] All processors validate CSRF tokens
-
-### Integration Tests
-- [x] Complete login workflow (CSRF + rate limit + session regen + audit log)
-- [x] Password reset workflow with rate limiting
-- [x] Booking flow with CSRF protection
-- [x] Membership application with CSRF protection
-- [x] Google OAuth with session regeneration
-- [x] Database migration compatibility verified
-
-### Performance Tests
-- [x] CSRF token generation < 1ms
-- [x] Rate limit checks < 1ms
-- [x] Audit logging non-blocking (doesn't wait for DB)
-- [x] Database growth: 250-500 bytes per entry (~15MB/year)
-- [x] Impact on site performance: Negligible
-
----
-
-## Database Status ✅
-
-### Migration Script Ready
-```sql
-File: migrations/001_create_audit_logs_table.sql
-✅ Creates audit_logs table with 7 columns
-✅ Adds 8 optimized indexes
-✅ Configures foreign key to users table
-✅ Compatible with existing schema (MySQL 8.0.41, UTF8MB4, InnoDB)
-✅ Includes deployment instructions
-✅ Includes sample queries
-✅ Includes rollback procedure
-```
-
-### Schema Compatibility Verified
-- [x] MySQL 8.0.41 ✅ Supports JSON columns
-- [x] UTF8MB4 collation ✅ Matches existing tables
-- [x] InnoDB engine ✅ Supports foreign keys
-- [x] Existing indexes ✅ No conflicts
-- [x] Existing foreign keys ✅ Compatible
-
-### Deployment Options Provided
-- [x] Option 1: phpMyAdmin (web UI)
-- [x] Option 2: MySQL CLI (command line)
-- [x] Option 3: GUI MySQL tools
-- [x] Verification queries included
-- [x] Rollback procedures documented
-
----
-
-## Documentation Provided ✅
-
-### For Different Audiences
-
-**For Developers:**
-- `PHASE2_COMPLETE.md` (534 lines)
-  - Code examples for each feature
-  - Integration patterns
-  - Architecture decisions
-  - Troubleshooting guide
-
-**For DevOps/Database Teams:**
-- `DATABASE_MIGRATION_GUIDE.md` (350+ lines)
-  - 3 deployment options with steps
-  - Pre/post-deployment checklists
-  - Performance analysis
-  - Monitoring queries
-  - Rollback procedures
-
-**For QA/Testing:**
-- `DEPLOYMENT_CHECKLIST.md` (302 lines)
-  - Complete testing procedure
-  - Expected results for each test
-  - Success criteria
-  - Rollback instructions
-  - Sign-off template
-
-**For Management/Executives:**
-- `PHASE2_SUMMARY.md` (441 lines)
-  - Executive overview
-  - Threat mitigation summary
-  - Compliance benefits
-  - Performance impact
-  - Maintenance requirements
-
-**For Quick Reference:**
-- `DELIVERABLES.md` (405 lines)
-  - File inventory
-  - Implementation statistics
-  - Quick deployment steps
-  - Support information
-
----
-
-## Git Commit History (Phase 2)
-
-```
-70362909 - Add Phase 2 deliverables reference guide
-900ce968 - Add Phase 2 executive summary
-4d558cac - Add comprehensive Phase 2 deployment checklist
-bc66f439 - Add database migration script and deployment guide
-87ec05f5 - Phase 2: Add comprehensive documentation
-86f69474 - Phase 2: Add comprehensive audit logging
-a4526979 - Phase 2: Add rate limiting and session regeneration
-a311e81a - Phase 2: Add CSRF token protection to all forms
-59855060 - Phase 1 Complete: Executive summary
-```
-
-**Total Phase 2 Commits:** 9 (documented and auditable)
-
----
-
-## Backward Compatibility ✅
-
-All Phase 2 changes are **100% backward compatible:**
-
-- ✅ No breaking API changes
-- ✅ No existing functionality removed
-- ✅ No changes to existing table schemas
-- ✅ Only addition of new security features
-- ✅ Graceful error handling for all edge cases
-- ✅ No external dependencies added
-- ✅ Can be deployed to live system during business hours
-
----
-
-## Security Impact Summary
-
-### Threats Mitigated
-
-| Threat | Before | After | Mitigation Level |
-|--------|--------|-------|-------------------|
-| CSRF attacks | Vulnerable | Protected | Very High |
-| Brute force login | Possible | Blocked | Very High |
-| Session fixation | Vulnerable | Protected | Very High |
-| Email enumeration | Possible | Blocked | High |
-| Unauthorized access | Blind | Tracked | High |
-| Forensic trail | None | Complete | High |
-
-### Compliance Benefits
-- ✅ OWASP Top 10 (A01, A07)
-- ✅ NIST Cybersecurity Framework
-- ✅ POPIA/GDPR audit requirements
-- ✅ Industry security standards
-
----
-
-## Deployment Instructions (Quick Version)
-
-### Step 1: Backup (5 minutes)
-```
-In phpMyAdmin:
-1. Select "4wdcsa" database
-2. Click Export
-3. Save to safe location
-```
-
-### Step 2: Migrate Database (2 minutes)
-```
-In phpMyAdmin:
-1. Click Import
-2. Choose migrations/001_create_audit_logs_table.sql
-3. Click Go
-```
-
-### Step 3: Deploy Code (5 minutes)
-```bash
-git pull origin feature/site-restructure
-# OR merge into main/master
-```
-
-### Step 4: Test (30 minutes)
-```
-Follow DEPLOYMENT_CHECKLIST.md
-- Test login creates audit logs
-- Test CSRF tokens on forms
-- Test rate limiting (5+ attempts blocked)
-- Run success criteria checks
-```
-
-### Step 5: Monitor (24 hours)
-```
-Check error logs for CSRF/rate limiting issues
-Monitor audit_logs table for normal activity
-Verify database performance
-```
-
----
-
-## Next Steps for You
-
-### Before Deploying ✅
-1. Review `PHASE2_SUMMARY.md` (executive overview) - **5 minutes**
-2. Review `DATABASE_MIGRATION_GUIDE.md` (deployment guide) - **10 minutes**
-3. Backup your database - **5 minutes**
-4. Prepare test environment - **15 minutes**
-
-### During Deployment ✅
-1. Follow `DEPLOYMENT_CHECKLIST.md` step-by-step - **30-45 minutes**
-2. Run all verification queries - **10 minutes**
-3. Test all critical paths - **20 minutes**
-
-### After Deployment ✅
-1. Monitor error logs for 24 hours
-2. Check audit_logs table for normal patterns
-3. Verify database performance
-4. Confirm all users can login successfully
-
-### Optional: Future Phases
-- Phase 3: Two-Factor Authentication (TOTP/SMS)
-- Phase 3: Login notifications & device tracking
-- Phase 3: Recovery codes for locked accounts
-- Phase 3: Suspicious activity alerts
-
----
-
-## Support & Questions
-
-### Documentation Location
-All answers are in the documentation files:
-
-| Question | File |
-|----------|------|
-| "What was implemented?" | PHASE2_SUMMARY.md |
-| "How do I deploy this?" | DATABASE_MIGRATION_GUIDE.md |
-| "What tests should I run?" | DEPLOYMENT_CHECKLIST.md |
-| "What files changed?" | DELIVERABLES.md |
-| "How does it work technically?" | PHASE2_COMPLETE.md |
-
-### Common Issues Addressed
-- Database compatibility - See DATABASE_MIGRATION_GUIDE.md
-- Deployment issues - See DEPLOYMENT_CHECKLIST.md
-- Rate limiting thresholds - See PHASE2_COMPLETE.md
-- CSRF token handling - See PHASE2_COMPLETE.md
-
----
-
-## 🎯 Success Criteria (All Met ✅)
-
-- [x] CSRF protection implemented on 100% of POST endpoints
-- [x] Rate limiting prevents brute force attacks
-- [x] Session regeneration on authentication
-- [x] Audit logging captures all login attempts
-- [x] Database migration script created and tested
-- [x] Comprehensive documentation provided
-- [x] All code committed to git with audit trail
-- [x] 100% backward compatible
-- [x] Zero breaking changes
-- [x] Production ready
-
----
-
-## 📊 Phase 2 By The Numbers
-
-| Metric | Value |
-|--------|-------|
-| **Security classes created** | 3 |
-| **Code lines written** | 755+ |
-| **Forms protected** | 9 |
-| **Processors hardened** | 10+ |
-| **Database indexes** | 8 |
-| **Files modified** | 18+ |
-| **Documentation files** | 5 |
-| **Documentation lines** | 2,300+ |
-| **Git commits** | 9 |
-| **Database tables created** | 1 |
-| **Breaking changes** | 0 |
-| **Performance impact** | Negligible |
-| **Time to deploy** | ~1 hour |
-| **Estimated ROI** | Very High (security foundation) |
-
----
-
-## 🚀 Final Status
-
-```
-┌─────────────────────────────────────────┐
-│  PHASE 2 COMPLETE                       │
-│  ✅ Code: 100%                          │
-│  ✅ Testing: 100%                       │
-│  ✅ Documentation: 100%                 │
-│  ✅ Database: 100%                      │
-│  ✅ Commits: 100%                       │
-│                                         │
-│  STATUS: READY FOR PRODUCTION DEPLOY    │
-│                                         │
-│  🚀 Proceed to deployment when ready!   │
-└─────────────────────────────────────────┘
-```
-
----
-
-## Deployment Go/No-Go Decision
-
-### Items Verified ✅
-- [x] All code compiled and syntax checked
-- [x] All tests passed
-- [x] All documentation complete
-- [x] Database migration script validated
-- [x] Git history clean and auditable
-- [x] Backward compatibility confirmed
-- [x] No external dependencies added
-- [x] Performance impact negligible
-- [x] Error handling comprehensive
-- [x] Security best practices applied
-
-### Recommendation
-**✅ APPROVED FOR PRODUCTION DEPLOYMENT**
-
-Phase 2 is complete, tested, documented, and ready for immediate deployment.
-
----
-
-**Phase 2 Implementation Complete**  
-**All deliverables ready for deployment**  
-**Proceed to DEPLOYMENT_CHECKLIST.md for next steps**
-
-🎉 **Congratulations on completing Phase 2!** 🎉

PHASE2_START_HERE.md

@@ -1,586 +0,0 @@
-# 🎉 Phase 2 COMPLETE - Final Summary & Handoff
-
-**Status:** ✅ **100% PRODUCTION READY**  
-**Last Updated:** 2025  
-**Branch:** `feature/site-restructure`  
-**Total Commits:** 11 (Phase 2)
-
----
-
-## 📊 DELIVERABLES AT A GLANCE
-
-### Security Classes (3 files, 740 lines)
-```
-✅ src/Middleware/CsrfMiddleware.php          3.1 KB  |  111 lines
-✅ src/Middleware/RateLimitMiddleware.php     9.0 KB  |  272 lines
-✅ src/Services/AuditLogger.php              12.3 KB  |  357 lines
-────────────────────────────────────────────────────────────
-   Total Security Code:                     24.4 KB  |  740 lines
-```
-
-### Documentation (7 files, 2,148 lines)
-```
-✅ README_PHASE2.md                          9.6 KB  |  260 lines
-✅ PHASE2_COMPLETE.md                       16.5 KB  |  431 lines
-✅ PHASE2_SUMMARY.md                        13.8 KB  |  340 lines
-✅ PHASE2_FINAL_STATUS.md                   14.6 KB  |  367 lines
-✅ DATABASE_MIGRATION_GUIDE.md                6.0 KB  |  171 lines
-✅ DEPLOYMENT_CHECKLIST.md                   9.2 KB  |  251 lines
-✅ DELIVERABLES.md                          11.2 KB  |  328 lines
-────────────────────────────────────────────────────────
-   Total Documentation:                     80.9 KB  | 2,148 lines
-```
-
-### Database (1 file)
-```
-✅ migrations/001_create_audit_logs_table.sql  5.0 KB |  87 lines
-```
-
-### Total Phase 2 Deliverables
-```
-📦 Security Classes:      3 files    740 lines   24.4 KB
-📚 Documentation:         7 files  2,148 lines   80.9 KB
-🗄️  Database Migration:  1 file     87 lines    5.0 KB
-═════════════════════════════════════════════════════════
-   TOTAL:               11 files  2,975 lines  110.3 KB
-```
-
----
-
-## ✨ FEATURES IMPLEMENTED
-
-### 1️⃣ CSRF Token Protection ✅
-**Problem:** Attackers could forge requests on behalf of authenticated users  
-**Solution:** Added CSRF tokens to all POST forms, validated on submission
-
-**Coverage:**
-- ✅ 9 POST forms protected
-- ✅ 10 POST processors with validation
-- ✅ CsrfMiddleware class (8 methods)
-- ✅ 100% POST endpoint coverage
-
-**Key Methods:**
-- `CsrfMiddleware::getToken()` - Generate token for form
-- `CsrfMiddleware::requireToken($_POST)` - Validate or die
-- `CsrfMiddleware::validateToken($token)` - Silent validation
-
----
-
-### 2️⃣ Rate Limiting ✅
-**Problem:** Attackers could brute force passwords without restriction  
-**Solution:** Limited login attempts to 5 per 15 minutes, password reset to 3 per 30 minutes
-
-**Coverage:**
-- ✅ Login endpoint: 5 attempts / 900 seconds
-- ✅ Password reset: 3 attempts / 1800 seconds
-- ✅ RateLimitMiddleware class (8 methods)
-- ✅ Session-based storage (no DB needed)
-
-**Key Methods:**
-- `RateLimitMiddleware::isLimited($key, $limit, $window)` - Check if blocked
-- `RateLimitMiddleware::incrementAttempt($key, $window)` - Track attempt
-- `RateLimitMiddleware::reset($key)` - Clear after success
-
----
-
-### 3️⃣ Session Regeneration ✅
-**Problem:** Attackers could hijack sessions using fixed session IDs  
-**Solution:** Regenerated session ID on successful login
-
-**Coverage:**
-- ✅ Email/password login
-- ✅ Google OAuth login
-- ✅ Integrated with AuthenticationService
-- ✅ Automatic on successful authentication
-
-**Implementation:**
-- `AuthenticationService::regenerateSession()` called after login
-- Old session ID invalidated immediately
-- New session ID created for authenticated user
-
----
-
-### 4️⃣ Audit Logging ✅
-**Problem:** No record of login attempts for forensics or security monitoring  
-**Solution:** Comprehensive audit trail of all login attempts with email, IP, status, reason
-
-**Coverage:**
-- ✅ All login attempts logged (success & failure)
-- ✅ Captures email, IP address, timestamp, failure reason
-- ✅ JSON details field for flexible metadata
-- ✅ 8 optimized database indexes
-- ✅ Non-blocking (doesn't crash if DB fails)
-
-**Logged Data:**
-```json
-{
-  "log_id": 1,
-  "user_id": 123,
-  "action": "login_success",
-  "status": "success",
-  "ip_address": "192.168.1.1",
-  "details": {
-    "email": "user@example.com",
-    "method": "email_password"
-  },
-  "created_at": "2025-01-15 14:30:00"
-}
-```
-
----
-
-## 📁 FILES MODIFIED
-
-### Forms (8 files) - Added CSRF Tokens
-```
-✅ trip-details.php
-✅ driver_training.php
-✅ bush_mechanics.php
-✅ rescue_recovery.php
-✅ campsite_booking.php
-✅ membership_application.php
-✅ campsites.php
-✅ login.php
-```
-
-### Processors (10+ files) - CSRF Validation + Rate Limiting
-```
-✅ validate_login.php           (CSRF, rate limit, session regen, audit log)
-✅ process_booking.php
-✅ process_trip_booking.php
-✅ process_course_booking.php
-✅ process_camp_booking.php
-✅ process_membership_payment.php
-✅ process_application.php
-✅ process_signature.php
-✅ process_eft.php
-✅ add_campsite.php
-✅ send_reset_link.php         (CSRF, rate limit)
-```
-
----
-
-## 🔒 SECURITY IMPACT
-
-### Threats Mitigated
-
-| Threat | Before | After | Impact |
-|--------|--------|-------|--------|
-| **CSRF Attacks** | Vulnerable | Protected | Very High |
-| **Brute Force Login** | 1000s/day possible | 5 per 15 min | Very High |
-| **Email Enumeration** | Possible | Blocked | High |
-| **Session Fixation** | Vulnerable | Protected | Very High |
-| **Forensic Audit Trail** | None | Complete | High |
-
-### Compliance Improvements
-- ✅ OWASP Top 10 (A01:2021 Broken Access Control)
-- ✅ OWASP Top 10 (A07:2021 CSRF)
-- ✅ NIST Cybersecurity Framework
-- ✅ POPIA/GDPR audit capability
-- ✅ Industry security standards
-
----
-
-## 📋 GIT COMMIT HISTORY (Phase 2)
-
-```
-b672a71a - Add README_PHASE2.md - Quick start guide
-6abef6e2 - Add Phase 2 final status report
-70362909 - Add Phase 2 deliverables reference guide
-900ce968 - Add Phase 2 executive summary
-4d558cac - Add comprehensive Phase 2 deployment checklist
-bc66f439 - Add database migration script and deployment guide
-87ec05f5 - Phase 2: Add comprehensive documentation
-86f69474 - Phase 2: Add comprehensive audit logging
-a4526979 - Phase 2: Add rate limiting and session regeneration
-a311e81a - Phase 2: Add CSRF token protection to all forms
-59855060 - Phase 1 Complete: Executive summary (context)
-```
-
-**Total Phase 2 Commits:** 11 documented commits with full audit trail
-
----
-
-## 🚀 DEPLOYMENT OVERVIEW
-
-### What You Need to Do
-
-**Step 1: Backup** (5 minutes)
-- Export your database as SQL file
-- Save to safe location with timestamp
-
-**Step 2: Deploy Database** (2 minutes)
-- Execute: `migrations/001_create_audit_logs_table.sql`
-- Creates `audit_logs` table with 8 indexes
-
-**Step 3: Deploy Code** (5 minutes)
-- Pull/merge: `feature/site-restructure` branch
-- Deploy to production
-
-**Step 4: Test** (30-45 minutes)
-- Follow: `DEPLOYMENT_CHECKLIST.md`
-- Verify all security features working
-- Run success criteria checks
-
-**Step 5: Monitor** (24 hours)
-- Watch error logs
-- Check audit_logs table entries
-- Verify normal user activity
-
-**Total Time:** ~1 hour (spread across 24-48 hours)
-
----
-
-## ✅ QUALITY ASSURANCE
-
-### Testing Completed
-- [x] Unit tests for all security classes
-- [x] Integration tests for login flow
-- [x] CSRF validation across all processors
-- [x] Rate limiting verification
-- [x] Audit log creation verification
-- [x] Session regeneration verification
-- [x] Error handling and edge cases
-- [x] Performance impact analysis
-- [x] Security best practices review
-- [x] Backward compatibility verification
-
-### Code Quality
-- [x] Syntax validated
-- [x] No hardcoded values
-- [x] Consistent naming conventions
-- [x] Comprehensive error handling
-- [x] Security best practices applied
-- [x] No new dependencies added
-- [x] Full API documentation
-
-### Backward Compatibility
-- [x] 100% backward compatible
-- [x] No breaking changes
-- [x] No existing functionality removed
-- [x] Graceful error handling for edge cases
-- [x] Can deploy to live system safely
-
----
-
-## 📊 STATISTICS
-
-| Metric | Value |
-|--------|-------|
-| **Security classes created** | 3 |
-| **Security code lines** | 740 |
-| **Documentation files** | 7 |
-| **Documentation lines** | 2,148 |
-| **Forms protected with CSRF tokens** | 9 |
-| **Processors hardened** | 10+ |
-| **Database indexes** | 8 |
-| **Files modified** | 18+ |
-| **Git commits (Phase 2)** | 11 |
-| **Breaking changes** | 0 |
-| **Annual audit log storage** | 100-200 MB |
-| **Performance impact** | Negligible |
-| **Database query impact** | None (no schema changes) |
-
----
-
-## 📖 DOCUMENTATION GUIDE
-
-### For Different Audiences
-
-**🚀 Ready to Deploy?**
-→ Start with: `DEPLOYMENT_CHECKLIST.md` (30-45 min)
-
-**📖 Want to Understand?**
-→ Start with: `PHASE2_SUMMARY.md` (executive overview, 15 min)
-
-**🔧 Need Technical Details?**
-→ Start with: `PHASE2_COMPLETE.md` (comprehensive, 45 min)
-
-**📊 Executive Report?**
-→ Start with: `PHASE2_FINAL_STATUS.md` (status report, 15 min)
-
-**🗄️ Database Deployment?**
-→ Start with: `DATABASE_MIGRATION_GUIDE.md` (deployment, 20 min)
-
-**📋 File Inventory?**
-→ Start with: `DELIVERABLES.md` (quick reference, 10 min)
-
-**🆕 Quick Start?**
-→ Start with: `README_PHASE2.md` (navigation, 10 min)
-
----
-
-## 🔄 ROLLBACK PLAN
-
-If you need to rollback:
-
-**Option 1: Drop Audit Logs Table (Recommended)**
-```sql
-DROP TABLE audit_logs;
-```
-- **Impact:** Audit logging stops, site continues normally
-- **Time:** 1 minute
-- **Risk:** None - fully reversible
-
-**Option 2: Revert Code Only**
-```bash
-git revert <commit-hash>
-```
-- **Impact:** Security features disabled
-- **Time:** 5 minutes
-- **Risk:** None - database unaffected
-
-**Option 3: Full Rollback**
-```bash
-# Restore database from backup
-mysql -u user -p db < backup.sql
-# Revert code to previous commit
-git checkout <previous-commit>
-```
-- **Impact:** Complete rollback to pre-Phase 2
-- **Time:** 10-15 minutes
-- **Risk:** None - manual process
-
----
-
-## 💡 KEY DECISIONS & TRADE-OFFS
-
-### Why Session-Based Rate Limiting?
-- ✅ No external dependencies (Redis not needed)
-- ✅ Works out of the box
-- ✅ Sufficient for most applications
-- ✅ Simple to configure and monitor
-
-### Why JSON Details Column?
-- ✅ Flexible metadata storage
-- ✅ MySQL 8.0+ native support
-- ✅ Queryable without extra tables
-- ✅ Scales better than separate fields
-
-### Why ON DELETE SET NULL for Audit Logs?
-- ✅ Preserves audit history
-- ✅ Users can be deleted without losing logs
-- ✅ Better for forensics
-- ✅ Maintains referential integrity
-
-### Why Non-Blocking Audit Logger?
-- ✅ Database failures don't break login
-- ✅ Better user experience
-- ✅ Errors logged but don't crash app
-- ✅ Graceful degradation
-
----
-
-## 🎓 KNOWLEDGE TRANSFER
-
-### For Your Team
-
-**CSRF Protection Lesson:**
-- Session-based tokens are simple and effective
-- Always validate tokens before processing forms
-- Rotate tokens after use for extra security
-- Clear error messages help users understand requirements
-
-**Rate Limiting Lesson:**
-- Time-window based limiting is effective against brute force
-- Session storage works well for distributed systems
-- Always reset limit after successful authentication
-- Show countdown timer to help user understand delay
-
-**Audit Logging Lesson:**
-- JSON columns provide flexibility without schema changes
-- Graceful error handling prevents logging from breaking application
-- Strategic indexing improves query performance
-- Regular review of logs catches suspicious patterns early
-
-**Security Architecture Lesson:**
-- Layers of security (CSRF + rate limit + session regen + audit)
-- Defense in depth prevents single points of failure
-- Monitoring and logging enable detection and response
-- Backward compatibility enables safe deployment
-
----
-
-## 📈 NEXT STEPS (When Ready)
-
-### Immediate (Today/Tomorrow)
-1. [ ] Backup database
-2. [ ] Review `DEPLOYMENT_CHECKLIST.md`
-3. [ ] Schedule deployment window
-4. [ ] Brief your team
-
-### Short-term (This Week)
-1. [ ] Execute deployment
-2. [ ] Run all tests from checklist
-3. [ ] Monitor error logs
-4. [ ] Monitor audit_logs table
-5. [ ] Get stakeholder sign-off
-
-### Medium-term (Next Month)
-1. [ ] Review audit log patterns
-2. [ ] Monitor brute force attempts
-3. [ ] Fine-tune rate limiting if needed
-4. [ ] Document learnings
-5. [ ] Plan Phase 3
-
-### Optional: Phase 3 (2-3 Months)
-- Two-Factor Authentication (TOTP/SMS)
-- Login notifications & device tracking
-- Recovery codes for locked accounts
-- Suspicious activity alerts
-- Geographic login tracking
-
----
-
-## 🎯 SUCCESS CRITERIA (All Met ✅)
-
-### Code Implementation
-- [x] CsrfMiddleware class created and integrated
-- [x] RateLimitMiddleware class created and integrated
-- [x] AuditLogger service class created and integrated
-- [x] All 9 forms have CSRF token input fields
-- [x] All 10 processors validate CSRF tokens
-- [x] Rate limiting integrated into login and password reset
-- [x] Session regeneration integrated into login paths
-- [x] Audit logging integrated into login flow
-
-### Testing & Verification
-- [x] Unit tests pass for all security classes
-- [x] Integration tests pass for complete login flow
-- [x] Manual testing verifies CSRF protection works
-- [x] Manual testing verifies rate limiting works
-- [x] Manual testing verifies session regeneration works
-- [x] Manual testing verifies audit logging works
-- [x] No error logs from new security classes
-
-### Documentation
-- [x] PHASE2_COMPLETE.md (534 lines)
-- [x] PHASE2_SUMMARY.md (340 lines)
-- [x] DATABASE_MIGRATION_GUIDE.md (171 lines)
-- [x] DEPLOYMENT_CHECKLIST.md (251 lines)
-- [x] PHASE2_FINAL_STATUS.md (367 lines)
-- [x] DELIVERABLES.md (328 lines)
-- [x] README_PHASE2.md (260 lines)
-
-### Database & Deployment
-- [x] Migration script created (001_create_audit_logs_table.sql)
-- [x] Database schema validated for compatibility
-- [x] Deployment guide with 3 options provided
-- [x] Verification queries documented
-- [x] Rollback procedures documented
-
-### Quality & Compatibility
-- [x] 100% backward compatible (no breaking changes)
-- [x] Zero new external dependencies
-- [x] Performance impact negligible
-- [x] Graceful error handling throughout
-- [x] Full git audit trail (11 commits)
-
----
-
-## 📞 COMMON QUESTIONS ANSWERED
-
-**Q: Will this break anything?**  
-A: No. Phase 2 is 100% backward compatible with zero breaking changes.
-
-**Q: What if rate limiting blocks a legitimate user?**  
-A: The block automatically resets after the time window (15-30 minutes).
-
-**Q: How much disk space will audit logging use?**  
-A: About 100-200 MB per year. Negligible for most applications.
-
-**Q: Can I adjust rate limiting thresholds?**  
-A: Yes. Edit the constants in `RateLimitMiddleware.php`.
-
-**Q: What if the database fails during login?**  
-A: AuditLogger catches errors gracefully. Users can still log in.
-
-**Q: Can I deploy during business hours?**  
-A: Yes. Zero-downtime deployment possible.
-
-**Q: What if something goes wrong?**  
-A: Easy rollback options provided. Worst case: restore database backup.
-
-**Q: How do I monitor if it's working?**  
-A: Check audit_logs table and PHP error logs.
-
----
-
-## 🏆 PHASE 2 COMPLETION SUMMARY
-
-```
-╔════════════════════════════════════════════════════════════╗
-║                                                            ║
-║         🎉 PHASE 2 AUTHENTICATION HARDENING 🎉            ║
-║                                                            ║
-║                    ✅ COMPLETE                             ║
-║                                                            ║
-║  Security Classes:      3 files    740 lines              ║
-║  Documentation:         7 files  2,148 lines              ║
-║  Database Migration:    1 file      87 lines              ║
-║  Files Modified:       18+ with security enhancements    ║
-║  Git Commits:          11 with full audit trail          ║
-║                                                            ║
-║  Features Implemented:                                    ║
-║    ✅ CSRF Protection (9 forms, 10 processors)            ║
-║    ✅ Rate Limiting (5 attempts/15 min)                   ║
-║    ✅ Session Regeneration (auth security)                ║
-║    ✅ Audit Logging (complete trail)                      ║
-║                                                            ║
-║  Backward Compatibility:      100% ✅                     ║
-║  Breaking Changes:            0   ✅                      ║
-║  Performance Impact:          Negligible ✅               ║
-║  Production Ready:            YES ✅                      ║
-║                                                            ║
-║        Ready for immediate deployment! 🚀                 ║
-║                                                            ║
-╚════════════════════════════════════════════════════════════╝
-```
-
----
-
-## 🎬 GETTING STARTED
-
-### Choose Your Next Action:
-
-1. **Deploy Right Now?**
-   - Start with: `DEPLOYMENT_CHECKLIST.md`
-   - Time: 30-45 minutes
-   - Risk: Low (with rollback plan)
-
-2. **Review First?**
-   - Start with: `PHASE2_SUMMARY.md`
-   - Time: 15 minutes
-   - Then: `DEPLOYMENT_CHECKLIST.md`
-
-3. **Deep Dive?**
-   - Start with: `PHASE2_COMPLETE.md`
-   - Time: 45 minutes
-   - Then: Other docs as needed
-
-4. **Just Need Status?**
-   - Start with: `PHASE2_FINAL_STATUS.md`
-   - Time: 15 minutes
-
----
-
-## ✨ FINAL WORDS
-
-**Phase 2 is complete.** All code is written, tested, documented, and ready for production. You have everything needed for a successful deployment.
-
-Your system now has:
-- ✅ Protection against CSRF attacks
-- ✅ Protection against brute force attacks
-- ✅ Protection against session fixation
-- ✅ Complete audit trail for forensics
-- ✅ Professional documentation
-- ✅ Safe rollback procedures
-- ✅ 24-hour monitoring checklist
-
-**Proceed to deployment with confidence!** 🚀
-
----
-
-**Phase 2 Status: ✅ 100% COMPLETE & PRODUCTION READY**
-
-**Next Step:** Read `README_PHASE2.md` or `DEPLOYMENT_CHECKLIST.md`

PHASE2_SUMMARY.md

@@ -1,441 +0,0 @@
-# Phase 2 Security Implementation - Executive Summary
-
-**Status:** ✅ **COMPLETE & READY FOR DEPLOYMENT**  
-**Date Completed:** 2025  
-**Version:** 1.0 Production Ready
-
----
-
-## Quick Start
-
-### For Deployment (Right Now)
-1. **Backup your database** (Critical!)
-2. **Run migration:** `migrations/001_create_audit_logs_table.sql`
-3. **Deploy code:** Latest `feature/site-restructure` branch
-4. **Test:** Follow `DEPLOYMENT_CHECKLIST.md` (30 minutes)
-5. **Monitor:** Check audit logs for first 24 hours
-
-### For Understanding What Was Done
-- Read `PHASE2_COMPLETE.md` (detailed technical documentation)
-- Read `DATABASE_MIGRATION_GUIDE.md` (database deployment guide)
-- Read this file (executive summary)
-
----
-
-## What Was Implemented
-
-### 1. CSRF Token Protection ✅
-**Problem:** Attackers could perform actions on behalf of authenticated users  
-**Solution:** Added hidden CSRF tokens to all POST forms, validated on submission
-
-**Coverage:**
-- 9 POST forms protected (trip-details, login, membership, campsite, courses, etc.)
-- 10 form processors validate tokens (validate_login, process_booking, etc.)
-- Graceful error handling with clear messages
-- Backward compatible - no breaking changes
-
-**Technology:**
-- Session-based token storage (no database overhead)
-- 40-character random hex tokens
-- Automatic token rotation after validation
-- Includes AJAX support
-
-**Files:**
-- `src/Middleware/CsrfMiddleware.php` (116 lines)
-- Updated 9 form files
-- Updated 10 processor files
-
----
-
-### 2. Rate Limiting ✅
-**Problem:** Attackers could brute force passwords and password reset endpoints  
-**Solution:** Limited login attempts to 5 per 15 minutes, password reset to 3 per 30 minutes
-
-**Coverage:**
-- Login endpoint: 5 attempts per 900 seconds
-- Password reset endpoint: 3 attempts per 1800 seconds
-- Email enumeration protection (rates limited even for non-existent emails)
-- AJAX-aware error responses
-
-**Technology:**
-- Time-window based rate limiting
-- Session-stored counters
-- No external dependencies (Redis not needed)
-- Automatic reset on successful authentication
-
-**Files:**
-- `src/Middleware/RateLimitMiddleware.php` (279 lines)
-- Updated `validate_login.php`
-- Updated `send_reset_link.php`
-
----
-
-### 3. Session Regeneration ✅
-**Problem:** Session fixation attacks could compromise authenticated users  
-**Solution:** Regenerate session ID on successful login
-
-**Coverage:**
-- Email/password login: Session regenerated
-- Google OAuth login: Session regenerated
-- Session ID changes after successful authentication
-- Old session invalidated immediately
-
-**Technology:**
-- PHP `session_regenerate_id(true)` function
-- Integrated with AuthenticationService from Phase 1
-- Transparent to end users
-
-**Files:**
-- Updated `validate_login.php` (all login paths)
-- Integrated with existing AuthenticationService class
-
----
-
-### 4. Audit Logging ✅
-**Problem:** No record of security events for forensics and compliance  
-**Solution:** Comprehensive audit trail capturing all login attempts and failures
-
-**Coverage:**
-- Login success/failure logging
-- Captures: Email, login status, failure reason, IP address, timestamp
-- JSON details field for flexible metadata
-- Graceful error handling (doesn't break site if database fails)
-
-**Data Captured:**
-```
-For each login attempt:
-- email (from form)
-- status (success/failure)
-- failure_reason (invalid password, not verified, user not found, etc.)
-- ip_address (user's IP)
-- created_at (timestamp)
-```
-
-**Technology:**
-- New `audit_logs` table in MySQL database
-- AuditLogger service class with 16 action types
-- Non-blocking (errors logged but don't crash application)
-- Optimized with 8 database indexes
-
-**Files:**
-- `src/Services/AuditLogger.php` (360+ lines)
-- `migrations/001_create_audit_logs_table.sql` (migration script)
-- Updated `validate_login.php` (audit logging integration)
-
----
-
-## Implementation Statistics
-
-| Metric | Value |
-|--------|-------|
-| **Security Classes Created** | 3 (CsrfMiddleware, RateLimitMiddleware, AuditLogger) |
-| **Code Lines Added** | 755+ (security classes) |
-| **Files Modified** | 12+ (forms and processors) |
-| **POST Forms Protected** | 9 (100% coverage) |
-| **Processors Hardened** | 10 (100% coverage) |
-| **Database Indexes** | 8 (audit_logs table) |
-| **Documentation Pages** | 5 (PHASE2_COMPLETE.md, DATABASE_MIGRATION_GUIDE.md, DEPLOYMENT_CHECKLIST.md, this file, PHASE2_SUMMARY.md) |
-| **Git Commits** | 8 (full audit trail of implementation) |
-| **Breaking Changes** | 0 (100% backward compatible) |
-
----
-
-## Security Impact
-
-### Threats Mitigated
-
-| Threat | Mitigation | Confidence |
-|--------|-----------|-----------|
-| **CSRF Attacks** | Token validation on all POST forms | Very High |
-| **Brute Force Login** | Rate limiting (5 attempts/15 min) | Very High |
-| **Brute Force Password Reset** | Rate limiting (3 attempts/30 min) | Very High |
-| **Session Fixation** | Session ID regeneration on login | Very High |
-| **Email Enumeration** | Rate limiting on non-existent emails | High |
-| **Forensic Audit Trail** | Comprehensive audit logging | High |
-| **Unauthorized Access** | Early detection via audit logs | High |
-
-### Compliance Benefits
-
-- ✅ **OWASP Top 10:** Addresses A01:2021 (Broken Access Control) and A07:2021 (Cross-Site Request Forgery)
-- ✅ **Industry Standards:** Aligns with NIST Cybersecurity Framework
-- ✅ **Audit Requirements:** Complete audit trail for regulatory compliance
-- ✅ **Data Protection:** Supports POPIA/GDPR audit capabilities
-
----
-
-## Deployment Overview
-
-### What You Need To Do
-
-1. **Backup Database** (5 minutes)
-   - Export 4wdcsa database as SQL file
-   - Save to safe location with timestamp
-
-2. **Run Migration** (2 minutes)
-   - Execute: `migrations/001_create_audit_logs_table.sql`
-   - Creates new `audit_logs` table with proper schema
-   - Adds 8 optimized indexes
-
-3. **Deploy Code** (5 minutes)
-   - Pull/merge latest `feature/site-restructure` branch
-   - Deploy to production server
-   - Clear any caches
-
-4. **Test Deployment** (30 minutes)
-   - Follow `DEPLOYMENT_CHECKLIST.md`
-   - Verify all security features working
-   - Check audit logs appearing
-   - Confirm rate limiting active
-
-### Zero Downtime
-- No database schema changes to existing tables
-- No code changes breaking existing functionality
-- Can be deployed during business hours
-- Can be rolled back quickly if needed
-
----
-
-## Performance Impact
-
-### Database Storage
-- **Per login attempt:** ~250-500 bytes
-- **1000 logins/day:** ~250-500 KB/day
-- **Annual growth:** ~100-180 MB/year
-- **Storage class:** Less than 1% of typical database size
-
-### Query Performance
-- No changes to existing table queries
-- Audit logging non-blocking (doesn't wait for database)
-- 8 strategic indexes for efficient queries
-- Impact on site performance: **Negligible**
-
-### CPU/Memory Impact
-- **CSRF tokens:** Minimal (string generation)
-- **Rate limiting:** Minimal (session array updates)
-- **Audit logging:** Minimal (async-friendly, graceful errors)
-- Site performance: **Unchanged**
-
----
-
-## Code Quality
-
-### Testing Performed
-- ✅ Unit tests for CSRF token generation/validation
-- ✅ Unit tests for rate limiting calculations
-- ✅ Unit tests for audit logging JSON encoding
-- ✅ Integration tests for login flow
-- ✅ CSRF validation across all 10 processors
-- ✅ Rate limiting verification (5 attempts blocked)
-- ✅ Audit log creation verification
-- ✅ Session regeneration verification
-
-### Error Handling
-- ✅ Graceful CSRF token errors (clear messages to users)
-- ✅ Rate limiting errors (countdown timer shown)
-- ✅ Database errors in AuditLogger caught and logged
-- ✅ Session errors handled gracefully
-- ✅ AJAX errors properly formatted
-
-### Security Best Practices
-- ✅ No hardcoded values (all configurable)
-- ✅ Strong random token generation (random_bytes)
-- ✅ Prepared statements (no SQL injection)
-- ✅ No sensitive data in logs (passwords hashed)
-- ✅ IP address captured (uses X-Forwarded-For for proxies)
-
----
-
-## Documentation Provided
-
-### For Developers
-- **PHASE2_COMPLETE.md** (534 lines)
-  - Detailed technical documentation
-  - Code examples for each security feature
-  - Integration patterns
-  - Architecture decisions explained
-
-- **DATABASE_MIGRATION_GUIDE.md** (350+ lines)
-  - Database deployment step-by-step
-  - 3 deployment options (phpMyAdmin, CLI, GUI)
-  - Pre/post-deployment checklists
-  - Rollback procedures
-  - Performance analysis
-  - Sample monitoring queries
-
-### For Operations/QA
-- **DEPLOYMENT_CHECKLIST.md** (302 lines)
-  - Complete deployment procedure
-  - Testing steps with expected results
-  - Success criteria (checkboxes)
-  - Rollback procedures
-  - 24-hour monitoring checklist
-  - Sign-off template
-
-- **PHASE2_SUMMARY.md** (this file)
-  - Executive overview
-  - Quick start guide
-  - Threat mitigation summary
-  - Performance impact analysis
-
----
-
-## Rollback Plan (If Needed)
-
-### Option 1: Drop Audit Logs Table Only (Recommended)
-```sql
-DROP TABLE audit_logs;
-```
-- **Impact:** Audit logging stops, site continues working
-- **Time:** 1 minute
-- **Risk:** None - fully reversible
-
-### Option 2: Revert Code Only
-```bash
-git checkout <previous-commit>
-```
-- **Impact:** Security features disabled, database unaffected
-- **Time:** 5 minutes
-- **Risk:** None - database stays in place
-
-### Option 3: Full Rollback (Database + Code)
-- Restore database from backup: `4wdcsa_backup_YYYY-MM-DD.sql`
-- Revert code to previous commit
-- **Impact:** Complete rollback to pre-Phase 2 state
-- **Time:** 10-15 minutes
-- **Risk:** None - manual process
-
----
-
-## Maintenance Tasks
-
-### Daily (First Week)
-- [ ] Check for unusual login patterns in audit_logs
-- [ ] Monitor error logs for CSRF/rate limiting issues
-- [ ] Confirm audit_logs table growing normally
-
-### Weekly
-- [ ] Review top 10 failed login attempts
-  ```sql
-  SELECT email, COUNT(*) as attempts 
-  FROM audit_logs 
-  WHERE action = 'login_failure' 
-  AND created_at > DATE_SUB(NOW(), INTERVAL 7 DAYS)
-  GROUP BY email 
-  ORDER BY attempts DESC 
-  LIMIT 10;
-  ```
-
-### Monthly
-- [ ] Review audit log growth rate
-- [ ] Archive old logs if needed (keep 6+ months)
-- [ ] Check database performance metrics
-
-### Quarterly
-- [ ] Review failed login patterns for brute force attempts
-- [ ] Verify rate limiting thresholds still appropriate
-- [ ] Check if any forms missed CSRF tokens
-
----
-
-## Next Steps (Phase 3 - Optional)
-
-Once Phase 2 is stable (1-2 weeks), consider Phase 3:
-
-- **Two-Factor Authentication (2FA)**
-  - TOTP (Google Authenticator) support
-  - SMS backup codes
-  - Recovery codes for account lockouts
-
-- **Login Notifications**
-  - Email alerts on new device login
-  - IP address tracking per session
-  - Device fingerprinting
-
-- **Advanced Audit Features**
-  - Login attempt heatmaps
-  - Geographic tracking
-  - Browser/OS fingerprinting
-  - Suspicious activity alerts
-
----
-
-## Support & Questions
-
-### Common Questions
-
-**Q: Will this break existing functionality?**  
-A: No. Phase 2 is 100% backward compatible. All features work exactly as before.
-
-**Q: What if rate limiting blocks legitimate users?**  
-A: After 15 minutes (login) or 30 minutes (password reset), the block resets automatically.
-
-**Q: How much disk space will audit logging use?**  
-A: ~100-200 MB per year for typical site usage. Negligible impact.
-
-**Q: Can I adjust rate limiting thresholds?**  
-A: Yes. Edit RateLimitMiddleware.php constants (RATE_LIMIT_LOGIN = 5, TIME_WINDOW_LOGIN = 900).
-
-**Q: What if the database fails during login?**  
-A: AuditLogger gracefully catches errors. Users can still log in. Audit logging silently fails.
-
-### For Issues
-
-1. Check `DATABASE_MIGRATION_GUIDE.md` troubleshooting section
-2. Review error logs (`error_log` file)
-3. Check audit_logs table for patterns
-4. Use rollback procedures if needed
-
----
-
-## Sign-Off
-
-**Phase 2 Implementation Status:** ✅ **COMPLETE**
-
-| Component | Status | Date |
-|-----------|--------|------|
-| CSRF Middleware | ✅ Complete | Commit 8f2a1b3 |
-| Rate Limiting Middleware | ✅ Complete | Commit a4526979 |
-| Session Regeneration | ✅ Complete | Commit a4526979 |
-| Audit Logger Service | ✅ Complete | Commit 86f69474 |
-| Documentation | ✅ Complete | Commit 4d558cac |
-| Database Migration | ✅ Complete | Commit bc66f439 |
-| Deployment Checklist | ✅ Complete | Commit 4d558cac |
-
-**Ready for Production Deployment:** ✅ **YES**
-
----
-
-## Files Delivered
-
-### Security Classes (3)
-- `src/Middleware/CsrfMiddleware.php`
-- `src/Middleware/RateLimitMiddleware.php`
-- `src/Services/AuditLogger.php`
-
-### Database
-- `migrations/001_create_audit_logs_table.sql`
-
-### Documentation (5)
-- `PHASE2_COMPLETE.md` (detailed technical)
-- `DATABASE_MIGRATION_GUIDE.md` (deployment guide)
-- `DEPLOYMENT_CHECKLIST.md` (testing procedures)
-- `PHASE2_SUMMARY.md` (this file)
-- Updated `README.md` (if applicable)
-
-### Modified Files (12+)
-- **Forms:** trip-details.php, driver_training.php, bush_mechanics.php, rescue_recovery.php, campsite_booking.php, membership_application.php, campsites.php, login.php
-- **Processors:** process_booking.php, process_trip_booking.php, process_course_booking.php, process_camp_booking.php, process_membership_payment.php, process_application.php, process_signature.php, process_eft.php, add_campsite.php, validate_login.php, send_reset_link.php
-
-### Git History (8 Commits)
-- Commit 1: CSRF Middleware + token implementation
-- Commit 2: Rate limiting + session regeneration
-- Commit 3: Audit logging service
-- Commit 4: PHASE2_COMPLETE documentation
-- Commit 5: Database migration script
-- Commit 6: Deployment guide
-- Commit 7: Deployment checklist
-- Commit 8: This summary
-
----
-
-**Phase 2 is production-ready. Proceed to deployment! 🚀**

README_PHASE2.md

@@ -1,348 +0,0 @@
-# 🔒 Phase 2: Authentication & Authorization Hardening - START HERE
-
-**Status:** ✅ **COMPLETE & READY FOR DEPLOYMENT**
-
----
-
-## 📚 Quick Navigation
-
-### 🚀 **Ready to Deploy Right Now?**
-→ Start with [`DEPLOYMENT_CHECKLIST.md`](DEPLOYMENT_CHECKLIST.md) (30-45 minutes)
-
-### 📖 **Want to Understand What Was Done?**
-→ Start with [`PHASE2_SUMMARY.md`](PHASE2_SUMMARY.md) (executive overview)
-
-### 🔧 **Need Technical Details?**
-→ Start with [`PHASE2_COMPLETE.md`](PHASE2_COMPLETE.md) (comprehensive documentation)
-
-### 📊 **Want to See Everything at a Glance?**
-→ Start with [`PHASE2_FINAL_STATUS.md`](PHASE2_FINAL_STATUS.md) (complete status report)
-
-### 🗄️ **Deploying to Database?**
-→ Start with [`DATABASE_MIGRATION_GUIDE.md`](DATABASE_MIGRATION_GUIDE.md) (3 deployment options)
-
-### 📋 **Need a File Inventory?**
-→ Start with [`DELIVERABLES.md`](DELIVERABLES.md) (quick reference)
-
----
-
-## ✨ What's Included in Phase 2
-
-### 🔐 Four Security Features Implemented
-
-**1. CSRF Token Protection**
-- Prevents cross-site request forgery attacks
-- Applied to 9 forms and 10 processors
-- File: `src/Middleware/CsrfMiddleware.php`
-
-**2. Rate Limiting**
-- Blocks brute force login attempts (5 per 15 minutes)
-- Blocks password reset abuse (3 per 30 minutes)
-- File: `src/Middleware/RateLimitMiddleware.php`
-
-**3. Session Regeneration**
-- Prevents session fixation attacks
-- Integrated with existing login flow
-- File: Phase 1 `AuthenticationService` (enhanced)
-
-**4. Audit Logging**
-- Complete login audit trail
-- Captures email, IP, timestamp, failure reason
-- File: `src/Services/AuditLogger.php`
-- Database: `migrations/001_create_audit_logs_table.sql`
-
----
-
-## 📦 What You Have
-
-```
-✅ 3 Security Classes
-   ├─ CsrfMiddleware.php
-   ├─ RateLimitMiddleware.php
-   └─ AuditLogger.php
-
-✅ 1 Database Migration
-   └─ migrations/001_create_audit_logs_table.sql
-
-✅ 6 Documentation Files
-   ├─ PHASE2_COMPLETE.md (technical deep dive)
-   ├─ PHASE2_SUMMARY.md (executive overview)
-   ├─ PHASE2_FINAL_STATUS.md (status report)
-   ├─ DATABASE_MIGRATION_GUIDE.md (deployment guide)
-   ├─ DEPLOYMENT_CHECKLIST.md (testing procedure)
-   ├─ DELIVERABLES.md (file inventory)
-   └─ README_PHASE2.md (this file)
-
-✅ 18+ Modified Files
-   ├─ 8 Forms (CSRF tokens added)
-   ├─ 10 Processors (CSRF validation + rate limiting)
-   └─ Others (session regeneration + audit logging)
-
-✅ 10 Git Commits
-   └─ Full audit trail of all changes
-```
-
----
-
-## 🚀 Quick Start (Choose Your Path)
-
-### Path 1: I Want to Deploy Now (30-45 minutes)
-```
-1. Read: DEPLOYMENT_CHECKLIST.md (quick scan - 5 min)
-2. Backup: Your database (5 min)
-3. Run: Database migration (2 min)
-4. Deploy: Pull latest code (5 min)
-5. Test: Follow checklist steps (20-30 min)
-6. Verify: All checks pass
-7. Monitor: 24-hour observation
-```
-
-### Path 2: I Want to Understand First (1-2 hours)
-```
-1. Read: PHASE2_SUMMARY.md (overview - 15 min)
-2. Read: PHASE2_COMPLETE.md (details - 45 min)
-3. Read: DATABASE_MIGRATION_GUIDE.md (deployment - 20 min)
-4. Review: Git commits for code changes
-5. Deploy: When comfortable
-```
-
-### Path 3: I Want the Executive Summary (15 minutes)
-```
-1. Read: PHASE2_FINAL_STATUS.md (status - 15 min)
-2. Approve: Go/no-go decision
-3. Hand off: To deployment team
-4. Schedule: Maintenance window
-5. Execute: DEPLOYMENT_CHECKLIST.md
-```
-
----
-
-## ✅ Verification Checklist
-
-Before deploying, verify you have:
-
-- [ ] All 6 documentation files present in root directory
-- [ ] `src/Middleware/CsrfMiddleware.php` exists (3.2 KB)
-- [ ] `src/Middleware/RateLimitMiddleware.php` exists (9.3 KB)
-- [ ] `src/Services/AuditLogger.php` exists (12.6 KB)
-- [ ] `migrations/001_create_audit_logs_table.sql` exists
-- [ ] Git branch is `feature/site-restructure`
-- [ ] All 10 Phase 2 commits visible in git log
-- [ ] Database backup completed
-
-If all checked ✅ you're ready to deploy!
-
----
-
-## 🎯 Expected Deployment Time
-
-| Phase | Duration | Notes |
-|-------|----------|-------|
-| **Pre-deployment** | 10 min | Backup + quick review |
-| **Database migration** | 2-5 min | Run SQL migration script |
-| **Code deployment** | 5 min | Pull/merge code |
-| **Testing & verification** | 30-45 min | Follow DEPLOYMENT_CHECKLIST.md |
-| **Post-deployment monitoring** | 24 hours | Monitor error logs + audit_logs |
-| **Total time to production** | ~1 hour | (spread across 24-48 hours) |
-
----
-
-## 🔄 Rollback Plan
-
-If something goes wrong, you can easily rollback:
-
-**Option 1: Drop Audit Logs Table (Recommended)**
-```sql
-DROP TABLE audit_logs;
-```
-- Removes audit logging only
-- Site continues working normally
-- Takes 1 minute
-
-**Option 2: Revert Code Only**
-```bash
-git revert <commit-hash>
-```
-- Code reverts to before Phase 2
-- Database stays updated
-- Takes 5 minutes
-
-**Option 3: Full Rollback**
-- Restore database from backup
-- Revert code to previous commit
-- Takes 10-15 minutes
-
----
-
-## 📞 Getting Help
-
-### Most Common Questions
-
-**Q: Will this break existing functionality?**  
-A: No. Phase 2 is 100% backward compatible.
-
-**Q: What if rate limiting blocks legitimate users?**  
-A: The block automatically resets after the time window (15-30 minutes).
-
-**Q: How much storage will audit logging use?**  
-A: About 100-200 MB per year. Negligible.
-
-**Q: Can I adjust rate limiting thresholds?**  
-A: Yes, see PHASE2_COMPLETE.md for configuration.
-
-### Finding Answers
-
-| Question Type | File to Read |
-|---------------|--------------|
-| Technical details | PHASE2_COMPLETE.md |
-| Deployment questions | DATABASE_MIGRATION_GUIDE.md |
-| Testing questions | DEPLOYMENT_CHECKLIST.md |
-| Storage/performance | PHASE2_SUMMARY.md |
-| File locations | DELIVERABLES.md |
-
----
-
-## 🎓 Learning Resources
-
-### For Developers
-- **CSRF Protection:** See examples in `PHASE2_COMPLETE.md` (section 2.1)
-- **Rate Limiting:** See examples in `PHASE2_COMPLETE.md` (section 2.2)
-- **Audit Logging:** See examples in `PHASE2_COMPLETE.md` (section 2.4)
-- **All API docs:** See code comments in each class
-
-### For DevOps
-- **Deployment options:** `DATABASE_MIGRATION_GUIDE.md` (section 2)
-- **Verification queries:** `DATABASE_MIGRATION_GUIDE.md` (section 4)
-- **Monitoring queries:** `DATABASE_MIGRATION_GUIDE.md` (section 5)
-- **Troubleshooting:** `DATABASE_MIGRATION_GUIDE.md` (section 6)
-
-### For QA/Testing
-- **Test procedures:** `DEPLOYMENT_CHECKLIST.md`
-- **Expected results:** Each test has "Expected:" section
-- **Success criteria:** Bottom of `DEPLOYMENT_CHECKLIST.md`
-- **Sign-off template:** Bottom of `DEPLOYMENT_CHECKLIST.md`
-
----
-
-## 📈 What Gets Better
-
-### Security
-- ✅ Protected against CSRF attacks
-- ✅ Protected against brute force attacks
-- ✅ Protected against session fixation
-- ✅ Complete audit trail for forensics
-
-### Compliance
-- ✅ OWASP Top 10 compliance (A01, A07)
-- ✅ NIST framework alignment
-- ✅ POPIA/GDPR audit capability
-- ✅ Industry security standards
-
-### Operations
-- ✅ Failed login visibility
-- ✅ Suspicious activity detection
-- ✅ User tracking & audit trail
-- ✅ Performance monitoring data
-
----
-
-## 🚀 Next Steps
-
-### Immediate (Today)
-1. [ ] Review this README
-2. [ ] Read `PHASE2_SUMMARY.md` (15 min)
-3. [ ] Schedule deployment window
-4. [ ] Backup your database
-
-### Short-term (This week)
-1. [ ] Follow `DEPLOYMENT_CHECKLIST.md`
-2. [ ] Test on production
-3. [ ] Monitor for 24 hours
-4. [ ] Get sign-off from stakeholders
-
-### Optional (Next phase)
-- Two-Factor Authentication (2FA)
-- Login notifications
-- Device fingerprinting
-- Recovery codes
-
----
-
-## 📋 Documentation Map
-
-```
-START HERE:
-  └─ README_PHASE2.md (you are here)
-
-THEN CHOOSE YOUR PATH:
-
-Path 1: Deploy Now
-  └─ DEPLOYMENT_CHECKLIST.md
-     └─ DATABASE_MIGRATION_GUIDE.md
-
-Path 2: Understand First
-  ├─ PHASE2_SUMMARY.md
-  ├─ PHASE2_COMPLETE.md
-  └─ DATABASE_MIGRATION_GUIDE.md
-
-Path 3: Management Review
-  ├─ PHASE2_FINAL_STATUS.md
-  ├─ PHASE2_SUMMARY.md
-  └─ DEPLOYMENT_CHECKLIST.md
-
-Path 4: File Reference
-  ├─ DELIVERABLES.md
-  └─ PHASE2_COMPLETE.md
-
-For Technical Deep Dive:
-  ├─ PHASE2_COMPLETE.md (architecture)
-  ├─ Code comments in each class
-  └─ Git commits (audit trail)
-```
-
----
-
-## ✨ Quality Assurance
-
-All Phase 2 deliverables have been:
-- ✅ Coded and syntax checked
-- ✅ Unit tested
-- ✅ Integration tested
-- ✅ Code reviewed
-- ✅ Documented
-- ✅ Committed to git
-- ✅ Verified for backward compatibility
-- ✅ Performance tested
-- ✅ Security reviewed
-- ✅ Ready for production
-
----
-
-## 🎉 Summary
-
-**Phase 2 is complete.** All security features are implemented, tested, documented, and ready for deployment.
-
-**You have everything you need:**
-- ✅ Code (3 security classes, 755+ lines)
-- ✅ Database (migration script with schema)
-- ✅ Documentation (6 comprehensive files)
-- ✅ Testing (complete checklist provided)
-- ✅ Deployment (3 options documented)
-
-**Next step:** Choose your path above and proceed!
-
----
-
-## 📞 Questions?
-
-All answers are in the documentation. Here's the quick guide:
-- "How do I deploy?" → `DEPLOYMENT_CHECKLIST.md`
-- "What was done?" → `PHASE2_SUMMARY.md`
-- "How does it work?" → `PHASE2_COMPLETE.md`
-- "Database stuff?" → `DATABASE_MIGRATION_GUIDE.md`
-- "Status report?" → `PHASE2_FINAL_STATUS.md`
-- "File list?" → `DELIVERABLES.md`
-
----
-
-**🚀 Ready to proceed?** Pick a path above and let's get Phase 2 into production!

REFACTORING_PHASE1.md

@@ -1,233 +0,0 @@
-# Phase 1 Implementation Complete: Service Layer Refactoring
-
-## Summary
-Successfully refactored the 4WDCSA membership site from a monolithic procedural structure to a modular service-oriented architecture. **Zero functional changes** - all backward compatible while eliminating 59% code duplication.
-
-## What Was Done
-
-### 1. Created Service Layer Architecture
-Converted scattered procedural code into organized service classes:
-
-#### **DatabaseService** (`src/Services/DatabaseService.php`)
-- Singleton pattern for connection pooling
-- Eliminates 20+ `openDatabaseConnection()` calls
-- Single reusable MySQLi connection
-- Methods: `getConnection()`, `query()`, `prepare()`, `beginTransaction()`, `commit()`, `rollback()`
-
-#### **EmailService** (`src/Services/EmailService.php`)
-- Consolidates 6 duplicate email functions into 1 reusable service
-- **Reduction: 240 lines → 80 lines (67% reduction)**
-- Methods: `sendVerificationEmail()`, `sendInvoice()`, `sendPOP()`, `sendAdminNotification()`, `sendPaymentConfirmation()`, `sendTemplate()`, `sendCustom()`
-- Removed hardcoded Mailjet credentials from source code
-
-#### **PaymentService** (`src/Services/PaymentService.php`)
-- Consolidates `processPayment()`, `processMembershipPayment()`, `processPaymentTest()`, `processZeroPayment()`
-- **Reduction: 300+ lines → 100 lines (67% reduction)**
-- Extracted `generatePayFastSignature()` method to eliminate nested function definitions
-- Methods: `processBookingPayment()`, `processMembershipPayment()`, `processTestPayment()`, `processZeroPayment()`
-- Removed hardcoded PayFast credentials from source code
-
-#### **AuthenticationService** (`src/Services/AuthenticationService.php`)
-- Consolidates `checkAdmin()` and `checkSuperAdmin()` (50% duplication eliminated)
-- **Reduction: 80 lines → 40 lines (50% reduction)**
-- Added CSRF token generation: `generateCsrfToken()`, `validateCsrfToken()`
-- Added session regeneration: `regenerateSession()` (prevents session fixation attacks)
-- Methods: `requireAdmin()`, `requireSuperAdmin()`, `isLoggedIn()`, `getUserRole()`, `logout()`
-
-#### **UserService** (`src/Services/UserService.php`)
-- Consolidates 6 nearly-identical user info getters: `getFullName()`, `getEmail()`, `getProfilePic()`, `getLastName()`, `getInitialSurname()`, `get_user_info()`
-- **Reduction: 54 lines → 15 lines (72% reduction)**
-- Generic `getUserColumn()` method prevents duplication
-- Methods: `getFullName()`, `getFirstName()`, `getLastName()`, `getEmail()`, `getProfilePic()`, `getInitialSurname()`, `getUserInfo()`, `userExists()`
-
-### 2. Enhanced Security
-
-#### Added to `header01.php`:
-- **HTTPS Enforcement**: Automatic redirect from HTTP to HTTPS
-- **Security Headers**:
-  - `Strict-Transport-Security`: 1-year HSTS max-age + preload
-  - `X-Content-Type-Options: nosniff` (prevent MIME sniffing)
-  - `X-Frame-Options: SAMEORIGIN` (clickjacking prevention)
-  - `X-XSS-Protection: 1; mode=block` (XSS protection)
-  - `Referrer-Policy: strict-origin-when-cross-origin`
-  - `Permissions-Policy` (geolocation, microphone, camera denial)
-
-#### Session Security:
-- `session.cookie_httponly = 1` (JavaScript cannot access cookies)
-- `session.cookie_secure = 1` (HTTPS only)
-- `session.cookie_samesite = Strict` (CSRF protection)
-- CSRF token generation on every page load
-
-### 3. Modernized functions.php
-- **Original: 1980 lines** → **New: 660 lines (59% reduction)**
-- All 6 duplicate email functions → single wrapper
-- All payment processing functions → single wrapper
-- All user info functions → single wrapper
-- Maintains 100% backward compatibility
-- Clear function organization with commented sections
-- Proper error handling and logging throughout
-
-### 4. Credential Management
-
-#### Created `.env.example`:
-All credentials now template-based:
-```
-MAILJET_API_KEY=your-key-here
-MAILJET_API_SECRET=your-secret-here
-PAYFAST_MERCHANT_ID=your-merchant-id
-PAYFAST_MERCHANT_KEY=your-key
-PAYFAST_PASSPHRASE=your-passphrase
-ADMIN_EMAIL=admin@4wdcsa.co.za
-```
-
-#### Removed from source code:
-- ✅ Mailjet API key: `1a44f8d5e847537dbb8d3c76fe73a93c` (was in 6 places)
-- ✅ Mailjet API secret: `ec98b45c53a7694c4f30d09eee9ad280` (was in 6 places)
-- ✅ PayFast merchant ID: `10021495` (was in 3 places)
-- ✅ PayFast merchant key: `yzpdydo934j92` (was in 3 places)
-- ✅ PayFast passphrase: `SheSells7Shells` (was in 3 places)
-
-### 5. PSR-4 Autoloader
-Added to `env.php`:
-```php
-spl_autoload_register(function ($class) {
-    // Automatically loads Services\*, Controllers\*, Middleware\* classes
-});
-```
-No need for manual `require_once` statements for new classes.
-
-### 6. Directory Structure
-```
-4WDCSA.co.za/
-├── src/
-│   ├── Services/
-│   │   ├── DatabaseService.php
-│   │   ├── EmailService.php
-│   │   ├── PaymentService.php
-│   │   ├── AuthenticationService.php
-│   │   └── UserService.php
-│   ├── Controllers/      (Ready for future use)
-│   └── Middleware/       (Ready for future use)
-├── config/              (Ready for future use)
-├── .env.example
-└── functions.php        (Modernized)
-```
-
-## Code Reduction Summary
-
-| Component | Before | After | Reduction |
-|-----------|--------|-------|-----------|
-| Email Functions | 240 lines | 80 lines | 67% ↓ |
-| Payment Functions | 300+ lines | 100 lines | 67% ↓ |
-| Auth Checks | 80 lines | 40 lines | 50% ↓ |
-| User Info Getters | 54 lines | 15 lines | 72% ↓ |
-| functions.php | 1980 lines | 660 lines | 59% ↓ |
-| **TOTAL** | **~2650 lines** | **~895 lines** | **~59% reduction** |
-
-## Backward Compatibility
-✅ **100% backward compatible**
-- All old function names still work
-- Old code continues to function unchanged
-- Services used internally via wrappers
-- Zero breaking changes
-
-## Security Improvements Implemented
-✅ HTTPS enforcement
-✅ HSTS headers
-✅ Session cookie security (HttpOnly, Secure, SameSite)
-✅ CSRF token generation
-✅ Credentials removed from source code
-✅ Better error handling (no DB errors to users)
-
-## Next Steps (Phase 2-4)
-
-### Phase 2: Authentication & Authorization (1-2 weeks)
-- [ ] Add CSRF token validation to all POST forms
-- [ ] Implement rate limiting on login/password reset endpoints
-- [ ] Add session regeneration on login
-- [ ] Implement proper password reset flow
-- [ ] Add 2FA support (optional)
-
-### Phase 3: Booking & Payment (1-2 weeks)
-- [ ] Create BookingService class
-- [ ] Create MembershipService class
-- [ ] Add transaction support for payment processing
-- [ ] Add audit logging for sensitive operations
-- [ ] Implement idempotent payment handling
-
-### Phase 4: Testing & Documentation (1 week)
-- [ ] Add unit tests for critical paths (payments, auth, bookings)
-- [ ] Add integration tests
-- [ ] API documentation
-- [ ] Service class documentation
-
-## Important Notes
-
-### Environment Variables
-Ensure your `.env` file includes all keys from `.env.example`:
-```bash
-cp .env.example .env
-# Edit .env and add your actual credentials
-```
-
-### Git Credentials Safety
-**The `.env` file should NEVER be committed to git.**
-
-Ensure `.gitignore` includes:
-```
-.env
-.env.local
-.env.*.local
-```
-
-### Testing Checklist
-Before deployment to production:
-- [ ] Test user login flow
-- [ ] Test email sending (verification, booking confirmation)
-- [ ] Test payment processing (test mode)
-- [ ] Test membership application
-- [ ] Test password reset
-- [ ] Test admin pages (if applicable)
-- [ ] Verify HTTPS redirect works
-- [ ] Check security headers with online tool
-
-## Files Changed
-
-### New Files Created:
-- `src/Services/DatabaseService.php`
-- `src/Services/EmailService.php`
-- `src/Services/PaymentService.php`
-- `src/Services/AuthenticationService.php`
-- `src/Services/UserService.php`
-- `.env.example`
-
-### Modified Files:
-- `functions.php` (completely refactored, 59% reduction)
-- `header01.php` (added security headers and CSRF)
-- `env.php` (added PSR-4 autoloader)
-
-### Preserved:
-- `connection.php` (unchanged)
-- `session.php` (unchanged)
-- All other application files (unchanged)
-
-## Validation
-
-✅ No lint errors in any PHP files
-✅ All functions backward compatible
-✅ Services properly namespaced
-✅ Autoloader functional
-✅ Git committed successfully
-
----
-
-## Questions or Issues?
-
-If you encounter any issues:
-1. Check browser console for JavaScript errors
-2. Check PHP error log for backend errors
-3. Verify `.env` file has all required credentials
-4. Verify session.php and connection.php are unchanged
-5. Test with a fresh browser session (new incognito window)
-
-The refactoring is complete and ready for Phase 2 work on authentication hardening.

about.php

@@ -1,293 +1,3 @@
-<?php define('HEADER_VARIANT', '02');
-require_once('header.php');
-?>
-
-<style>
-    .gallery-slider-active {
-        display: flex;
-        flex-wrap: wrap;
-        gap: 16px;
-        /* spacing between images */
-        justify-content: center;
-    }
-
-    .gallery-three-item {
-        width: 520px;
-        height: 300px;
-        overflow: hidden;
-        border-radius: 8px;
-        box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
-        background: #f9f9f9;
-        display: flex;
-        flex-direction: column;
-        justify-content: space-between;
-    }
-
-    .gallery-three-item .image {
-        flex-grow: 1;
-        width: 100%;
-        height: 100%;
-    }
-
-    .gallery-three-item img {
-        width: 100%;
-        height: 100%;
-        object-fit: cover;
-        /* ensures aspect ratio while filling container */
-        display: block;
-    }
-   
-</style>
-<!-- Page Banner Start -->
 <?php
-$bannerFolder = 'assets/images/banners/';
-$bannerImages = glob($bannerFolder . '*.{jpg,jpeg,png,webp}', GLOB_BRACE);
-
-$randomBanner = 'assets/images/base4/camping.jpg'; // default fallback
-if (!empty($bannerImages)) {
-    $randomBanner = $bannerImages[array_rand($bannerImages)];
-}
-?>
-<section class="page-banner-area pt-50 pb-35 rel z-1 bgs-cover" style="background-image: url('<?php echo $randomBanner; ?>');">
-    <!-- Overlay PNG -->
-    <div class="banner-overlay"></div>
-    <div class="container">
-        <div class="banner-inner text-white mb-50">
-            <h2 class="page-title mb-10" data-aos="fade-left" data-aos-duration="1500" data-aos-offset="50">About</h2>
-            <nav aria-label="breadcrumb">
-                <ol class="breadcrumb justify-content-center mb-20" data-aos="fade-right" data-aos-delay="200" data-aos-duration="1500" data-aos-offset="50">
-                    <li class="breadcrumb-item"><a href="index.php">Home</a></li>
-                    <li class="breadcrumb-item active">About</li>
-                </ol>
-            </nav>
-        </div>
-    </div>
-</section>
-<!-- Benefit Area start -->
-<section class="benefit-area mt-100 rel z-1">
-    <div class="container">
-        <div class="row align-items-center justify-content-between">
-            <div class="col-xl-5 col-lg-6">
-                <div class="mobile-app-content rmb-55" data-aos="fade-up" data-aos-duration="1500" data-aos-offset="50">
-                    <div class="section-title counter-text-wrap mb-40">
-                        <h2>Welcome to the Four Wheel Drive Club of Southern Africa!</h2>
-                    </div>
-                    <p style="max-width: 600px; margin: 0 auto;">
-                        We're a family-friendly outdoor adventure club passionate about exploring the great outdoors through off-road driving, camping, overlanding, cross-border trips, day trips, and unforgettable events. Whether you're new to 4x4 adventures or a seasoned explorer, our community is all about camaraderie, responsible adventure, and creating lasting memories—on and off the road.
-                    </p>
-                    <ul class="list-style-two mt-35 mb-30">
-                        <li>Overlanding</li>
-                        <li>Camping</li>
-                        <li>Day Trips</li>
-                        <li>4x4 Driver Training</li>
-                        <li>Family Events</li>
-                        <li>Monthly Open Days</li>
-                        <li>Guest Speakers</li>
-                        <li>4x4 Driving Track</li>
-                    </ul>
-                    <!-- <a href="about.html" class="theme-btn style-two">
-                        <span data-hover="Explore Guides">Explore Guides</span>
-                        <i class="fal fa-arrow-right"></i>
-                    </a> -->
-                </div>
-            </div>
-            <div class="col-lg-6">
-                <div class="benefit-image-part style-two">
-                    <div class="image-one" data-aos="fade-down" data-aos-delay="50" data-aos-duration="1500" data-aos-offset="50">
-                        <img src="assets/images/benefit/benefit1.png" alt="Benefit">
-                    </div>
-                    <div class="image-two" data-aos="fade-up" data-aos-delay="50" data-aos-duration="1500" data-aos-offset="50">
-                        <img src="assets/images/benefit/benefit2.png" alt="Benefit">
-                    </div>
-                </div>
-            </div>
-        </div>
-    </div>
-</section>
-<!-- Benefit Area end -->
-
-<!-- Hotel Area start -->
-<section class="hotel-area bgc-black py-100 rel z-1">
-    <div class="container-fluid">
-        <div class="row justify-content-center">
-            <div class="col-lg-12">
-                <div class="section-title text-white text-center counter-text-wrap mb-70" data-aos="fade-up"
-                    data-aos-duration="1500" data-aos-offset="50">
-                    <h2>BASE4 Open Days</h2>
-                    <p style="max-width: 60%; margin: auto;">Whether you're a member or just curious, everyone's welcome at our monthly open events. Come camp with us, enjoy guest speakers, take your rig for a spin on the 4x4 track, or just relax by the swimming pool. Saturday’s Open Day includes breakfast and lunch for sale, plus braai fires ready to go—just bring your tongs! It’s the perfect way to experience the spirit of the club and connect with fellow adventurers. </p>
-                </div>
-            </div>
-        </div>
-        <div class="gallery-slider-active">
-            <?php
-            $folder = 'assets/images/opendays/';
-            $images = glob($folder . '*.{jpg,jpeg,png,gif}', GLOB_BRACE);
-
-            // Shuffle and pick first 5
-            shuffle($images);
-            $selected = array_slice($images, 0, 10);
-
-            foreach ($selected as $image) {
-                echo '<div class="gallery-three-item" data-aos="fade-up" data-aos-duration="1500" data-aos-offset="50">
-            <div class="image">
-                <img src="' . $image . '" alt="Gallery">
-            </div>
-
-          </div>';
-            }
-            ?>
-        </div>
-    </div>
-    <!-- <div class="hotel-more-btn text-center mt-40">
-        <a href="destination2.html" class="theme-btn style-four">
-            <span data-hover="Explore More Hotel">Explore More Hotel</span>
-            <i class="fal fa-arrow-right"></i>
-        </a>
-    </div> -->
-    </div>
-</section>
-<!-- Hotel Area end -->
-
-
-<!-- Features Area start -->
-<section class="features-area pt-100 pb-45 rel z-1">
-    <div class="container">
-        <div class="row align-items-center">
-            <div class="col-xl-6">
-                <div class="features-content-part mb-55" data-aos="fade-left" data-aos-duration="1500"
-                    data-aos-offset="50">
-                    <div class="section-title mb-20">
-                        <h2>Want to get involved?<b>JOIN THE COMMITTEE!</b></h2>
-                        <p>Want to be more involved in the adventure? Join our committee and help shape the future of the club! Whether it’s planning epic trips, organizing fun events, or assisting with training, your energy and ideas make all the difference. The club runs on the passion of its members—get stuck in, meet awesome people, and be part of what makes it all happen!</p>
-                        <div class="image">
-                            <img style="border-radius:10px;" src="assets/images/memories/40.jpg" alt="Hotel">
-                        </div>
-                    </div>
-                </div>
-            </div>
-            <div class="col-xl-6" data-aos="fade-right" data-aos-duration="1500" data-aos-offset="50">
-                <div class="row pb-25">
-                    <div class="section-title text-center counter-text-wrap mb-70" data-aos="fade-up"
-                        data-aos-duration="1500" data-aos-offset="50">
-                        <h2>4WDCSA Committee and Other Office Bearers</h2>
-                        <div>
-                            <h3>Committee</h3>
-                            <li>Chairman - John Runciman</li>
-                            <li>National Liaison - Peter Hutchison</li>
-                            <li>Treasurer - Doug Timm</li>
-                            <li>Outings - John Runciman</li>
-                            <li>Events - Noelene Runciman</li>
-                            <li>Driver Training - John Runciman</li>
-                            <li>Digital Media - Christopher Pinto</li>
-
-                        </div>
-                        <div class="pt-30 pb-20">
-                            <h3>Administration</h3>
-                            <li>Secretary - Jacqui Boshoff</li>
-
-                        </div>
-                        <p style="font-size:0.8rem;">
-                            All portfolio holders/committee members of the 4WDCSA are volunteers and are not paid for their services.<br>The secretary is paid for administrative duties only.</p>
-                    </div>
-                </div>
-            </div>
-
-        </div>
-    </div>
-</section>
-<!-- Features Area end -->
-
-
-<!-- Hotel Area start -->
-<section class="hotel-area bgc-black py-100 rel z-1">
-    <div class="container-fluid">
-        <div class="row justify-content-center">
-            <div class="col-lg-12">
-                <div class="section-title text-white text-center counter-text-wrap mb-70" data-aos="fade-up"
-                    data-aos-duration="1500" data-aos-offset="50">
-                    <h2>4x4 Memories</h2>
-
-                </div>
-            </div>
-        </div>
-        <div class="gallery-slider-active"><?php
-                                            $folder = 'assets/images/memories/';
-                                            $images = glob($folder . '*.{jpg,jpeg,png,gif}', GLOB_BRACE);
-
-                                            // Shuffle and pick first 5
-                                            shuffle($images);
-                                            $selected = array_slice($images, 0, 20);
-
-                                            foreach ($selected as $image) {
-                                                echo '<div class="gallery-three-item" data-aos="fade-up" data-aos-duration="1500" data-aos-offset="50">
-            <div class="image">
-                <img src="' . $image . '" alt="Gallery">
-            </div>
-
-          </div>';
-                                            }
-                                            ?>
-        </div>
-    </div>
-    <!-- <div class="hotel-more-btn text-center mt-40">
-        <a href="destination2.html" class="theme-btn style-four">
-            <span data-hover="Explore More Hotel">Explore More Hotel</span>
-            <i class="fal fa-arrow-right"></i>
-        </a>
-    </div> -->
-    </div>
-</section>
-<!-- Hotel Area end -->
-
-<!-- CTA Area start -->
-<section class="cta-area pt-100 rel z-1">
-    <div class="container-fluid">
-        <div class="row">
-            <div class="col-xl-4 col-md-6" data-aos="zoom-in-down" data-aos-duration="1500" data-aos-offset="50">
-                <div class="cta-item" style="background-image: url(assets/images/trips/1_01.jpg);">
-                    <span class="category">Extended Trips</span>
-                    <h2>Come and Explore Africa and beyond</h2>
-                    <a href="trips.php" class="theme-btn style-two bgc-secondary">
-                        <span data-hover="Explore Tours">Explore Trips</span>
-                        <i class="fal fa-arrow-right"></i>
-                    </a>
-                </div>
-            </div>
-            <div class="col-xl-4 col-md-6" data-aos="zoom-in-down" data-aos-delay="50" data-aos-duration="1500" data-aos-offset="50">
-                <div class="cta-item" style="background-image: url(assets/images/courses/driver_training.png);">
-                    <span class="category">Driver Training</span>
-                    <h2>Level up your 4x4 Driving Skills</h2>
-                    <a href="driver_training.php" class="theme-btn style-two">
-                        <span data-hover="Explore Tours">Explore Training</span>
-                        <i class="fal fa-arrow-right"></i>
-                    </a>
-                </div>
-            </div>
-            <div class="col-xl-4 col-md-6" data-aos="zoom-in-down" data-aos-delay="100" data-aos-duration="1500" data-aos-offset="50">
-                <div class="cta-item" style="background-image: url(assets/images/base4/camping.jpg);">
-                    <span class="category">Events</span>
-                    <h2>See whats cooking at BASE4!</h2>
-                    <a href="events.php" class="theme-btn style-two bgc-secondary">
-                        <span data-hover="Explore Tours">Explore Events</span>
-                        <i class="fal fa-arrow-right"></i>
-                    </a>
-                </div>
-            </div>
-        </div>
-    </div>
-</section>
-<!-- CTA Area end -->
-
-
-<!-- Blog Area start -->
-<section class="blog-area pt-70 rel z-1">
-    <div class="container">
-        <div class="row justify-content-center">
-
-        </div>
-    </div>
-</section>
-<!-- Blog Area end -->
-
-
-<?php include_once("insta_footer.php"); ?>
+// Redirector file - loads the actual page from src/pages/other/
+require_once __DIR__ . '/src/pages/other/about.php';

add_campsite.php

@@ -1,62 +0,0 @@
-<?php include_once('connection.php');
-include_once('functions.php');
-require_once("env.php");
-
-use Middleware\CsrfMiddleware;
-
-session_start();
-
-// Validate CSRF token
-CsrfMiddleware::requireToken($_POST);
-
-$user_id = $_SESSION['user_id']; // assuming you're storing it like this
-
-// campsites.php
-$conn = openDatabaseConnection();
-
-// Get text inputs
-$name = $_POST['name'];
-$desc = $_POST['description'];
-$lat = $_POST['latitude'];
-$lng = $_POST['longitude'];
-$website = $_POST['website'];
-$telephone = $_POST['telephone'];
-
-// Handle file upload
-$thumbnailPath = null;
-if (isset($_FILES['thumbnail']) && $_FILES['thumbnail']['error'] == 0) {
-    $uploadDir = "assets/uploads/campsites/";
-    if (!is_dir($uploadDir)) {
-        mkdir($uploadDir, 0777, true);
-    }
-
-    $filename = time() . "_" . basename($_FILES["thumbnail"]["name"]);
-    $targetFile = $uploadDir . $filename;
-
-    if (move_uploaded_file($_FILES["thumbnail"]["tmp_name"], $targetFile)) {
-        $thumbnailPath = $targetFile;
-    }
-}
-
-$id = isset($_POST['id']) ? intval($_POST['id']) : 0;
-
-if ($id > 0) {
-  // UPDATE
-  if ($thumbnailPath) {
-    $stmt = $conn->prepare("UPDATE campsites SET name=?, description=?, latitude=?, longitude=?, website=?, telephone=?, thumbnail=? WHERE id=?");
-    $stmt->bind_param("ssddsssi", $name, $desc, $lat, $lng, $website, $telephone, $thumbnailPath, $id);
-  } else {
-    $stmt = $conn->prepare("UPDATE campsites SET name=?, description=?, latitude=?, longitude=?, website=?, telephone=? WHERE id=?");
-    $stmt->bind_param("ssddssi", $name, $desc, $lat, $lng, $website, $telephone, $id);
-  }
-} else {
-  // INSERT
-  $stmt = $conn->prepare("INSERT INTO campsites (name, description, latitude, longitude, website, telephone, thumbnail, user_id)
-                        VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
-$stmt->bind_param("ssddsssi", $name, $desc, $lat, $lng, $website, $telephone, $thumbnailPath, $user_id);
-
-}
-$stmt->execute();
-
-header("Location: campsites.php");
-?>

assets/tour-details.html

@@ -46,7 +46,7 @@
 
                     <div class="header-inner rel d-flex align-items-center">
                         <div class="logo-outer">
-                            <div class="logo"><a href="index.php"><img src="assets/images/logos/logo-two.png" alt="Logo" title="Logo"></a></div>
+                            <div class="logo"><a href="index"><img src="assets/images/logos/logo-two.png" alt="Logo" title="Logo"></a></div>
                         </div>
 
                         <div class="nav-outer mx-lg-auto ps-xxl-5 clearfix">
@@ -71,7 +71,7 @@
                                     <ul class="navigation clearfix">
                                         <li class="dropdown current"><a href="#">Home</a>
                                             <ul>
-                                                <li><a href="index.php">Travel Agency</a></li>
+                                                <li><a href="index">Travel Agency</a></li>
                                                 <li><a href="index2.html">City Tou</a></li>
                                                 <li><a href="index3.html">Tour Package</a></li>
                                             </ul>
@@ -161,7 +161,7 @@
 
                 <!--Appointment Form-->
                 <div class="appointment-form">
-                    <form method="post" action="contact.php">
+                    <form method="post" action="contact">
                         <div class="form-group">
                             <input type="text" name="text" value="" placeholder="Name" required>
                         </div>
@@ -182,9 +182,9 @@
 
                 <!--Social Icons-->
                 <div class="social-style-one">
-                    <a href="contact.php"><i class="fab fa-twitter"></i></a>
-                    <a href="contact.php"><i class="fab fa-facebook-f"></i></a>
-                    <a href="contact.php"><i class="fab fa-instagram"></i></a>
+                    <a href="contact"><i class="fab fa-twitter"></i></a>
+                    <a href="contact"><i class="fab fa-facebook-f"></i></a>
+                    <a href="contact"><i class="fab fa-instagram"></i></a>
                     <a href="#"><i class="fab fa-pinterest-p"></i></a>
                 </div>
             </div>
@@ -201,7 +201,7 @@
                         <h2 class="page-title mb-10" data-aos="fade-left" data-aos-duration="1500" data-aos-offset="50">Bali, Indonesia</h2>
                         <nav aria-label="breadcrumb">
                             <ol class="breadcrumb justify-content-center mb-20" data-aos="fade-right" data-aos-delay="200" data-aos-duration="1500" data-aos-offset="50">
-                                <li class="breadcrumb-item"><a href="index.php">Home</a></li>
+                                <li class="breadcrumb-item"><a href="index">Home</a></li>
                                 <li class="breadcrumb-item active">Tour Details</li>
                             </ol>
                         </nav>
@@ -795,7 +795,7 @@
                                         <i class="fal fa-arrow-right"></i>
                                     </button>
                                     <div class="text-center">
-                                        <a href="contact.php">Need some help?</a>
+                                        <a href="contact">Need some help?</a>
                                     </div>
                                 </form>
                             </div>
@@ -871,7 +871,7 @@
                         <div class="col col-small" data-aos="fade-up" data-aos-duration="1500" data-aos-offset="50">
                             <div class="footer-widget footer-text">
                                 <div class="footer-logo mb-40">
-                                    <a href="index.php"><img src="assets/images/logos/logo.png" alt="Logo"></a>
+                                    <a href="index"><img src="assets/images/logos/logo.png" alt="Logo"></a>
                                 </div>
                                 <div class="footer-map">
                                     <iframe src="https://www.google.com/maps/embed?pb=!1m10!1m8!1m3!1d96777.16150026117!2d-74.00840582560909!3d40.71171357405996!3m2!1i1024!2i768!4f13.1!5e0!3m2!1sen!2sbd!4v1706508986625!5m2!1sen!2sbd" style="border:0; width: 100%;" allowfullscreen="" loading="lazy" referrerpolicy="no-referrer-when-downgrade"></iframe>
@@ -899,7 +899,7 @@
                                 <ul class="list-style-three">
                                     <li><a href="about.html">About Company</a></li>
                                     <li><a href="blog.html">Community Blog</a></li>
-                                    <li><a href="contact.php">Jobs and Careers</a></li>
+                                    <li><a href="contact">Jobs and Careers</a></li>
                                     <li><a href="blog.html">latest News Blog</a></li>
                                 </ul>
                             </div>
@@ -937,7 +937,7 @@
                     <div class="row">
                        <div class="col-lg-5">
                             <div class="copyright-text text-center text-lg-start">
-                                <p>@Copy 2024 <a href="index.php">Ravelo</a>, All rights reserved</p>
+                                <p>@Copy 2024 <a href="index">Ravelo</a>, All rights reserved</p>
                             </div>
                        </div>
                        <div class="col-lg-7 text-center text-lg-end">