SMM PANEL LICENSE SYSTEM - STARTER KIT
======================================

REQUIREMENTS
- PHP 8.1+ recommended
- MySQL/MariaDB
- PDO MySQL extension
- HTTPS on the license server and customer panels

IMPORTANT LIMITATION
This starter kit is a basic working license manager. The API response is not digitally signed yet, so a technically skilled attacker controlling a customer server could potentially tamper with the client response. Before selling this as commercial copy-protection, add Ed25519/OpenSSL response signatures and verify them in the client, rate limiting, API abuse protection, and a tested offline grace policy. This system helps with ordinary licensing, but no PHP-only client can be made impossible to modify by a server administrator.

SERVER INSTALL
1. Create a separate database and database user in cPanel. Grant that user access only to this database.
2. Upload the contents of the server folder to a dedicated HTTPS subdomain, e.g. license.example.com.
3. Import schema.sql using phpMyAdmin.
4. Copy config.sample.php to config.php and enter database credentials. Keep config.php private and do not publish it.
5. Generate an admin password hash locally with PHP:
   php -r "echo password_hash('YOUR-LONG-PASSWORD', PASSWORD_DEFAULT), PHP_EOL;"
   If SSH is unavailable, create a temporary local PHP file containing that one line, run it once, then delete it.
6. Insert the first admin using phpMyAdmin, replacing username and HASH:
   INSERT INTO admins (username, password_hash) VALUES ('your-admin', 'PASTE_HASH_HERE');
7. Open https://license.example.com/admin/login.php and sign in.
8. Create a license with customer name, domain, and optional expiry. Copy the key immediately; the full key is intentionally not stored in the database.
9. Restrict access to server/config.php and schema.sql where practical. Remove public access to schema.sql after installation or move it outside the document root.

CLIENT INTEGRATION
1. Copy client/license_check.example.php into your own script and edit LICENSE_API_URL and LICENSE_KEY.
2. Ensure the cache directory is writable by PHP, but not directly downloadable. Prefer storing the cache outside public_html.
3. Test the API with a valid key, wrong domain, suspended key, revoked key, and expired key.
4. Integrate the check into your own app bootstrap after core initialization and before protected app routes. Do not replace your entire index.php or disrupt existing routing.
5. Keep a manual admin recovery route and backup before enabling enforcement. Consider warning-only mode for initial rollout.

SECURITY NOTES
- Use unique strong passwords and HTTPS.
- Keep server credentials out of the client script.
- This starter kit stores only a SHA-256 hash of the license key and displays the last four characters in the dashboard.
- Add rate limiting and signed responses before production/commercial deployment.
- Be aware that domain checks cannot stop all spoofing, DNS tricks, or local edits to PHP source.