# StatusSphere Architecture and Audit

## Application Structure

- `app/Http/Controllers/StatusController.php`: status feed, multi-format publishing, interstitial reward endpoint, reactions, and comments.
- `app/Http/Controllers/WalletController.php`: wallet dashboard, points purchase stubs, cashout requests, and boost spending.
- `app/Http/Controllers/AdminController.php`: admin dashboard, settings, wallet adjustment, cashout review, milestones, CMS pages, and ad test endpoint.
- `app/Services/CaptchaFactory.php`: dynamic Google reCAPTCHA or Cloudflare Turnstile verification.
- `app/Services/SmsFactory.php`: dynamic Twilio or Infobip OTP dispatch.
- `app/Services/ReferralService.php`: 5-generation referral points distribution.
- `database/migrations`: complete MySQL schema for users, sessions, wallets, statuses, comments, transactions, cashouts, site settings, milestones, premium packages, CMS pages, security logs, cache, and queues.
- `public/assets`: PWA manifest, service worker, vibrant theme CSS tokens, interstitial JavaScript, and app icon.
- `install.php` plus `public/install.php`: Plesk/cPanel installer entrypoints.

## Database Schema Summary

- `users`: authentication, roles, referral tree, phone verification, premium state.
- `wallets`: current and locked point balances.
- `statuses`: text/image/voice/video posts, messaging CTAs, SHA-256 integrity signature, boost metadata, moderation flags.
- `status_comments`: authenticated comments.
- `wallet_transactions`: immutable wallet ledger events for purchases, rewards, boosts, referrals, and admin adjustments.
- `cashout_requests`: encrypted payout destinations with review status.
- `site_settings`: branding, SEO, SMS, captcha, ads, currency, and referral-level configuration.
- `milestone_tasks`: configurable gamification targets and rewards.
- `premium_packages`: subscription package definitions and feature JSON.
- `pages`: CMS pages and blog/articles.
- `security_logs`: append-only login, profile, payment, and admin-sensitive event trail.

## Security Audit

- SQL injection: all app database access uses Eloquent/query builder parameter binding.
- XSS: Blade escaped output is used by default; admin custom code fields are intentionally stored for controlled header/ad injection and should remain super-admin only.
- CSRF: all POST forms and AJAX reward calls require Laravel CSRF tokens.
- Passwords: user passwords use Laravel hashing; installer requires at least 12 characters for the first admin password.
- Payment safety: payment gateways are stubs and do not credit points until live gateway webhook signature verification is implemented.
- Payout safety: cashout destinations are encrypted at rest with Laravel encryption.
- File upload safety: status uploads are constrained by MIME type and size and stored on the public disk, not executed as PHP.
- Captcha/SMS: factories isolate active providers and are configured from admin settings.
- Logging: authentication and sensitive financial/admin actions are written to `security_logs`.
- Production deployment: keep `APP_DEBUG=false`, delete/rename `install.php` after install, and keep write permissions limited to `storage` and `bootstrap/cache`.

## Known Integration Points

- Gemini caption assistant is represented as a UI/API hook and should be connected with server-side API credentials.
- Stripe, PayPal, M-Pesa, MTN MoMo, and USDT payment flows require provider SDK/webhook implementation before real charging.
- Twilio/Infobip and captcha keys must be configured in Admin Core before forcing real traffic through those providers.