<<<<<<< HEAD

• About
• Key Highlights
• Getting Started
• Default Accounts
• Features
• Architecture
• Project Structure
• Database Schema
• Order Lifecycle
• Security
• API Reference
• Configuration
• Troubleshooting
• Scalability
• Deployment
• Contributors

SMEIC (School Canteen Management System) is a complete, production-ready web application built for schools to digitize and streamline their canteen operations. It supports four distinct roles — Admin, Student, Parent, and Canteen Staff — each with a dedicated dashboard and role-specific functionality.

The system handles the entire canteen workflow: administrators manage students and parents, students browse menus and place orders with digital wallet payments, parents top up their children's wallets and track spending, and canteen staff process orders with real-time status tracking and pickup token verification.

Built with pure PHP (no framework), MySQL, and TailwindCSS, SMEIC is designed to run on any LAMP/XAMPP stack — including affordable shared hosting — making it accessible for schools with limited IT infrastructure.

• XAMPP (or any Apache + MySQL + PHP setup)
• PHP 8.0 or higher
• MySQL 5.7+ / MariaDB 10.3+
• Composer (optional — for PDF/QR features)

Step 1: Clone or copy the project

git clone https://github.com/your-username/SMEIC.git C:\xampp\htdocs\SMEIC

Or place the project folder directly in C:\xampp\htdocs\SMEIC.

Step 2: Start XAMPP

Launch XAMPP Control Panel and start both Apache and MySQL.

Step 3: Create the database

Open http://localhost/phpmyadmin in your browser:

1. Go to the Import tab
2. Click Choose File and select database.sql from the project root
3. Click Go to import

This creates the smeic_canteen database with all 19 tables and seed data.

Alternatively, use the command line:

mysql -u root < database.sql

Step 4: Generate password hashes (one-time)

Open http://localhost/SMEIC/public/generate_hashes.php in your browser. This sets real bcrypt hashes for all default demo accounts so the login credentials work.

Step 5: Install Composer dependencies (optional)

cd C:\xampp\htdocs\SMEIC
C:\xampp\php\php.exe C:\xampp\composer\composer.phar install

This installs dompdf (PDF export), phpmailer (email), and chillerlan/php-qrcode (offline QR codes). The app works without them — it gracefully falls back to CSV for PDFs and an online QR API.

Step 6: Launch the application

Open http://localhost/SMEIC/public/ in your browser.

Note: Default database credentials are XAMPP defaults — host 127.0.0.1, user root, password empty. If yours differ, update config/database.php.

All accounts force a password change on first login for security.

After logging in with the default password, you will be redirected to set a new password before accessing the dashboard.

• KPI Overview — Total students, today's orders, monthly & all-time revenue, pending order count
• Interactive Charts — Weekly order bar chart, monthly revenue trend line chart (Chart.js)
• Student Management — Full CRUD with auto-generated S##### IDs, random password assignment, soft delete, password reset
• Parent Management — Full CRUD with auto-generated P##### IDs, linked to children
• Wallet Top-Up — Credit parent or student wallets with audit trail
• Order Management — Filterable order list by date range, status, and student
• Transaction Ledger — Filterable wallet transaction history
• Menu Viewer — Read-only access to canteen menu
• Reports — Summary statistics across all metrics
• Audit Log — Complete trail of every admin action
• Data Export — CSV and PDF export for orders, transactions, and menu items

• Smart Dashboard — Wallet balance, monthly spending, behavior score, low-balance warnings (threshold: ₹50)
• Menu Browsing — Category filters (Veg / Non-Veg / Snacks / Drinks / Desserts), search, daily special banner
• AJAX Cart — Add-to-cart with live badge updates, quantity controls, wallet balance check
• Atomic Checkout — Secure order placement with wallet deduction, transaction recording, and instant notifications
• Live Order Tracking — Visual timeline showing real-time order status
• QR Pickup Token — 6-digit token with QR code (offline via chillerlan/php-qrcode or online fallback)
• Transaction History — Complete wallet transaction log
• Notifications — Real-time in-app notifications with 10-second polling
• Order Feedback — 1-5 star rating with comment on completed orders
• Profile — View personal information

• Dual Wallet View — See own wallet balance alongside each child's wallet and behavior score
• Fund Transfer — Atomic transfer to child's wallet with double transaction record (debit + credit)
• Menu Access — Browse the canteen menu in read-only mode
• Meal Preferences — Send daily meal suggestions/notes to child
• Child Order Tracking — Filterable order history with full timeline and detail view
• Notifications — Stay updated on child's activity
• Profile — View personal information

• Operations Dashboard — Today's earnings, orders completed, pending count, monthly chart, top 5 selling items
• Order Processing — Accept orders (with prep time estimate), mark ready, mark picked up, cancel with auto-refund
• Token Verification — QR scan or manual 6-digit token entry with rate limiting (5 attempts per 15 minutes)
• Menu Management — Full CRUD with image upload (validated MIME type, size, and dimensions)
• Daily Specials — Highlight one menu item per day (auto-deactivates previous)
• Earnings Reports — Today, 7-day, and 30-day breakdowns
• Staff Management — Manager-only: create/edit staff accounts, set granular permissions (verify tokens, complete orders, view pending), toggle active status

• CSRF Protection — Token-based protection on every form submission
• XSS Prevention — All output escaped via htmlspecialchars()
• Session Security — Regenerated on login, HttpOnly, SameSite=Lax
• Security Headers — X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, CSP, HSTS
• File Upload Security — MIME validation, size limits, dimension checks, renamed filenames
• Audit Logging — Every admin action tracked with timestamp and details
• Flash Messages — Auto-dismissing success/error notifications
• Mobile Responsive — Collapsible sidebar, responsive layout for all screen sizes

SMEIC follows a Front Controller pattern — every HTTP request enters through a single public/index.php file, which routes the request to the appropriate controller method.

HTTP Request
    │
    ▼
public/index.php  ──► Extracts "action" parameter
    │
    ├──► AuthController::login()
    ├──► AdminController::dashboard()
    ├──► StudentController::checkout()
    ├──► ParentController::transfer()
    ├──► CanteenController::acceptOrder()
    │
    ▼
Controller Method
    ├──► require_role(['student'])   ◄── Access control
    ├──► CSRF check                  ◄── Security
    ├──► Business logic (PDO queries)
    ├──► Database operations
    ├──► Notifications
    └──► View rendering (header + sidebar + content + footer)

• No Framework — Pure PHP 8.0+ for maximum portability and zero learning curve
• Convention over Configuration — One controller per role, one view file per page
• Security by Default — Prepared statements, CSRF, XSS prevention, role guards on every method
• Atomic Operations — Database transactions with row-level locks for all financial operations
• Graceful Degradation — Works without Composer dependencies (falls back to online services)

SMEIC/
│
├── config/                          # Application configuration (NOT web-accessible)
│   ├── constants.php                # App name, URLs, paths, thresholds, currency (₹)
│   ├── database.php                 # PDO database connection singleton
│   └── functions.php                # All global helper functions (394 lines)
│
├── controllers/                     # Business logic — one class per role
│   ├── AuthController.php           # Login, logout, password change/reset
│   ├── AdminController.php          # Dashboard, CRUD, reports, exports
│   ├── StudentController.php        # Menu, cart, checkout, orders, tracking
│   ├── ParentController.php         # Transfers, preferences, child orders
│   └── CanteenController.php        # Order processing, menu CRUD, earnings
│
├── views/                           # PHP + HTML templates (no template engine)
│   ├── layouts/                     # header.php, sidebar.php, footer.php
│   ├── auth/                        # Login, forgot-password, reset-password
│   ├── admin/                       # Admin dashboard, students, parents, etc.
│   ├── student/                     # Student dashboard, menu, cart, orders
│   ├── parent/                      # Parent dashboard, transfers, preferences
│   └── canteen/                     # Canteen dashboard, orders, menu, earnings
│
├── public/                          # Web root — only this folder is HTTP-accessible
│   ├── index.php                    # Front controller / router (348 lines)
│   ├── generate_hashes.php          # One-time password hash generator
│   ├── assets/
│   │   ├── css/style.css            # Custom CSS design system (1,276 lines)
│   │   ├── js/app.js                # AJAX helper, toasts, password toggle
│   │   ├── js/notifications.js      # 10s notification poll + pickup reminder
│   │   ├── img/                     # Favicon, placeholder images
│   │   └── uploads/menu/            # Uploaded menu item images
│   └── api/                         # JSON-only AJAX endpoints
│       ├── _bootstrap.php           # Shared API initialization
│       ├── update-cart.php          # Cart operations
│       ├── transfer-funds.php       # Parent-to-child fund transfer
│       ├── check-notifications.php  # Unread notification count
│       ├── get-order-status.php     # Live order status
│       └── ...                      # Other API endpoints
│
├── database.sql                     # Complete schema + seed data (378 lines)
├── composer.json                    # PHP dependencies
├── .htaccess                        # Root access control rules
├── backend.txt                      # Detailed backend documentation
└── README.md                        # This file

The database smeic_canteen contains 19 tables built on MySQL/InnoDB:

┌─────────┐     ┌──────────┐     ┌───────────┐     ┌─────────┐     ┌────────────┐
│ PENDING │ ──► │ ACCEPTED │ ──► │ PREPARING │ ──► │  READY  │ ──► │ PICKED_UP  │
└─────────┘     └──────────┘     └───────────┘     └─────────┘     └────────────┘
     │               │                │                 │
     └───────────────┴────────────────┴─────────────────┘
                              │
                              ▼
                     ┌────────────┐
                     │ CANCELLED  │  (Full refund to student wallet)
                     └────────────┘

Flow:

1. Pending — Student places the order; wallet is debited; canteen and parent are notified
2. Accepted — Canteen staff acknowledges the order with prep time estimate
3. Preparing — Food is being prepared
4. Ready — Food is done; student receives notification; 3-minute pickup reminder timer starts
5. Picked Up — Student collects food (verified via QR token or manual entry)
6. Cancelled — Available at any stage before pickup; full refund issued to student wallet

3-Minute Pickup Reminder: When an order reaches "ready" status, a background check runs every 60 seconds. If the order remains uncollected for 3+ minutes, the student receives up to 3 pickup reminder notifications.

SMEIC implements a comprehensive security model:

All page routes go through public/index.php?action=<route>.

Authentication:

Admin:

Student:

Parent:

Canteen:

// Database connection (PDO singleton)
host:     127.0.0.1
database: smeic_canteen
charset:  utf8mb4
user:     root
password: (empty for XAMPP defaults)

1. Purchase a domain and hosting plan (Hostinger, DigitalOcean, etc.)
2. Upload public/ contents to the document root (public_html/)
3. Upload all other folders to a non-web-accessible location
4. Create a MySQL database and import database.sql
5. Update config/database.php with production credentials
6. Update config/constants.php → BASE_URL to your public URL
7. Run generate_hashes.php once, then delete it and clear_force_change.php
8. Configure HTTPS with Let's Encrypt (free via certbot)

PHP 8.1+ with extensions: pdo_mysql, mbstring, gd, intl, fileinfo
MySQL 8.0+ or MariaDB 10.6+
Apache with mod_rewrite OR Nginx + PHP-FPM
HTTPS enabled

Developed with dedication and teamwork by:

	Name	Role
	Mr. Rupesh Adhikari	Backend+API Developer
	Mr. Rupesh Adhikari	Frontend Developer
	Mr. Aryan Thapa	Database Developer
	Mrs. Jenisha Chaudhary	Developer

SMEIC — Built as a academic project, designed to production standards.