# Hammerhead Workspace — Phase 1: Auth + Super Admin Backend Panel

This is **Phase 1** of the build, per the approved plan: one login, and a full
Super Admin backend control panel for user/role/department/project access
management. Workspace Home, Departments, and Projects come in Phase 2.

## What's included

- **Unified login** (`/login`) — checks `superadmins`, then `managers`, then
  `employees`, in that order. Matches your login mockup exactly, including the
  math security check.
- **Super Admin Backend Panel** (`/admin/users`) — matches the bottom section
  of your logic diagram:
  - User list (name, role, department access, project access, status)
  - Add New User (manager or employee)
  - Enable / Disable user
  - Manage Access modal — change role, department access, and project access
    in one place
  - Audit Logs (`/admin/audit-logs`) — every create/enable/disable/access
    change is recorded with before/after JSON snapshots
- **Database schema extension** (`database/schema_extension.sql`) — adds:
  - `notifications`, `activity_log` (for Phase 2 Workspace Home)
  - `audit_log` (powers the audit trail now)
  - `dashboard_widgets`, `project_forms`, `project_reports` (for Phase 2
    per-project dashboards, so nothing is hardcoded)
  - `sessions` (unified session table)
  - Login columns added to `employees` (username/email/password_hash/etc.)
  - Seed data for roles, modules, and permissions, with Super Admin granted
    full access automatically

## Setup

1. **Import the database** (run in this order):
   ```bash
   mysql -u root -p hammerheadstaffi_db < database/hammerhead_original.sql
   mysql -u root -p hammerheadstaffi_db < database/schema_extension.sql
   ```

2. **Configure the app** — edit `config/config.php` with your DB credentials
   and the URL you'll deploy to.

3. **Create your first Super Admin login:**
   ```bash
   php database/seed_superadmin.php admin admin@hammerheadsecurity.com YourStrongPassword123
   ```

4. **Point your web server's document root at `/public`.**
   - Apache: the included `public/.htaccess` handles URL rewriting — just
     make sure `mod_rewrite` is enabled and `AllowOverride All` is set for
     that directory.
   - Nginx: add a `try_files $uri /index.php;` rule pointing to `public/`.

5. Visit `/login`, sign in with the Super Admin account you just created,
   and you'll land on the User Management panel.

## Folder structure

```
public/            → web root (index.php front controller, assets)
app/Core/          → Database, Auth, Router, Permission, AuditLog
app/Controllers/   → AuthController, AdminController
app/Models/        → UserManager, Lookup
app/Views/         → login page, admin panel, shared layout
config/            → config.php, autoloader
database/          → original schema, extension schema, seed script
storage/uploads/   → reserved for task/file attachments (Phase 2)
```

## Design notes / decisions made for you

- **Super Admins are protected** — they can't be disabled or have their
  access edited from this panel (only managers/employees can). This matches
  "Full Access to Everything" in your spec and avoids accidental lockout.
- **Security check answer is validated server-side against the session**,
  not a hidden form field, so it can't be bypassed by editing the HTML.
- **Passwords are hashed** with PHP's `password_hash()` (bcrypt) — never
  stored in plain text.
- Role list in the Add User / Manage Access modals excludes "Super Admin" —
  that role is only ever assigned directly in the database, by design.

## What's next (Phase 2, once you approve)

- Workspace Home (welcome, pending items, notifications, recent activity)
- Department → Project navigation exactly as shown in your logic diagram
- Project Dashboard (config-driven via the new `dashboard_widgets` table)
- Migrating your first Google Sheets project (e.g. Hiring & Termination)
  into the new `tasks`/`task_files` structure end-to-end
