Cybil CRM — Deployment Package V1 (rebuilt)
Target domain: cybil.musaydai.com
===================================================================

This is a pre-built package: the frontend is already compiled (public/) and the backend is
already compiled from TypeScript (dist/). You do NOT need Node to build anything — you only
need it to install dependencies and run the server.

WHY YOUR SITE SHOWED A FILE LISTING ("Index of /") INSTEAD OF THE APP
-------------------------------------------------------------------
Your files were uploaded and extracted correctly (confirmed from your screenshots — everything
matches this package exactly). The listing happens because LiteSpeed only proxies a domain to a
Node process once you explicitly create that link in cPanel → "Setup Node.js App". Until that
app entry exists, LiteSpeed just serves the raw folder as static files — which is exactly what
you saw. Step 3 below is the fix. This is a one-time setup step, not a re-upload problem.

Also fixed in this rebuild: the previous package.json required "openai" version 7, which in turn
requires Node.js 22+. Most shared cPanel hosts only offer Node up to 18-20, so the app would have
failed to start even after Setup Node.js App was configured. This package now uses openai v6,
which has no Node version requirement above 18.

-------------------------------------------------------------------
1. UPLOAD
-------------------------------------------------------------------
Upload the entire contents of this folder (not the V1 folder itself, its contents: dist/,
public/, seed/, uploads/, package.json, package-lock.json, .env) to the SAME location you used
before — the public_html/cybil.musaydai.com folder shown in your cPanel File Manager screenshot.
Overwrite the existing files (in particular package.json, package-lock.json, and dist/ must be
replaced — the old ones referenced the incompatible openai version).

-------------------------------------------------------------------
2. DATABASE
-------------------------------------------------------------------
The database (ontijvsb_cybil) must already exist in cPanel's MySQL Databases screen, with the
user ontijvsb_cybil already added to it with ALL PRIVILEGES — the .env file included here
already has these credentials filled in. If you haven't created the database yet, do that first
in cPanel before continuing.

-------------------------------------------------------------------
3. CREATE THE NODE.JS APP IN CPANEL (this is the step that was missing)
-------------------------------------------------------------------
In cPanel, open "Setup Node.js App" and click "Create Application". Fill in:

  - Node.js version:        the highest available 18.x, 20.x, or 22.x (pick the newest offered —
                             this package no longer requires 22+, but a newer version is fine too)
  - Application mode:       Production
  - Application root:       the exact folder you uploaded to (the one from your screenshot,
                             e.g. cybil.musaydai.com or public_html/cybil.musaydai.com)
  - Application URL:        cybil.musaydai.com
  - Application startup file: dist/server.js

Click "Create". cPanel will provision the app and show you an "Enter to the virtual environment"
command — you'll use that in the next step. It also automatically wires up the LiteSpeed proxy,
which is what makes the "Index of /" listing go away.

-------------------------------------------------------------------
4. INSTALL DEPENDENCIES
-------------------------------------------------------------------
In "Setup Node.js App" → your new app → click "Enter to the virtual environment" (this gives you
a command to paste into an SSH/Terminal session, or use cPanel's Terminal app directly). From
inside that environment, cd to the application root if you're not already there, then run:

    npm install

(Only production dependencies are listed in package.json — this will be quick. If you had run
npm install against the OLD package.json before, delete the node_modules folder first so the
old openai v7 doesn't linger: rm -rf node_modules && npm install)

-------------------------------------------------------------------
5. CREATE THE DATABASE SCHEMA AND SEED DATA
-------------------------------------------------------------------
This is a brand new database, so it needs its tables created. Still inside the virtual
environment, from the same folder, run:

    npm run migrate
    npm run seed

"migrate" creates every table. "seed" adds the initial Super Admin and staff accounts (the same
ones already set up: admin@cybilsolutions.com and the @althario.com staff accounts, all with
password 123@) and opens the bulk company-import feature for its first 7 days.

Only run "seed" ONCE, on the very first deployment — running it again later is safe for the
accounts (it won't duplicate them) but there's no need to repeat it. If you already ran migrate/
seed against this database during a previous attempt, you can skip this step.

-------------------------------------------------------------------
6. START THE APP
-------------------------------------------------------------------
Back in "Setup Node.js App", click "Restart" on your application.

-------------------------------------------------------------------
7. VERIFY
-------------------------------------------------------------------
Visit https://cybil.musaydai.com — you should now see the actual login page, not a file listing.
Log in with:
  admin@cybilsolutions.com / 123@

If the page loads but API calls fail, double check CORS_ORIGIN in .env matches the exact URL
you're visiting the site from (including http vs https). If the app won't start at all, check
"Setup Node.js App" → your app → the log file it links to for the actual startup error.

-------------------------------------------------------------------
8. FILE UPLOADS FOLDER
-------------------------------------------------------------------
An empty "uploads" folder is included — this is where company documents get stored when staff
upload them. Make sure this folder is writable by the Node.js application (cPanel's Node.js App
setup normally handles this automatically; if uploads fail, check folder permissions).

-------------------------------------------------------------------
9. IMPORTANT — CHANGE THE SHARED PASSWORD
-------------------------------------------------------------------
Every seeded account currently shares the password "123@". This was fine for internal setup,
but now that this is going live at a real domain, each person's password should be changed.
There isn't a self-service "change my password" page yet — for now, the Super Admin can set a
new password for anyone from Settings → Team Management → edit the user.

-------------------------------------------------------------------
10. OPTIONAL: READ-ONLY DATABASE USER (recommended hardening)
-------------------------------------------------------------------
The AI Analytics feature works out of the box using the main database user above. For extra
protection, you can create a second MySQL user with SELECT-only access, so even a future bug in
that feature's code could never write to your data:

  1. cPanel → MySQL Databases → "Add New User". Create e.g. ontijvsb_cybilro with a strong
     password (a password manager's random generator is fine — it's never typed by a person).
  2. Under "Add User To Database", add that new user to the ontijvsb_cybil database.
  3. On the privileges screen, grant ONLY "SELECT" (uncheck everything else, including INSERT/
     UPDATE/DELETE). cPanel applies this at the whole-database level, which is still a large
     improvement over using the full-access app user for these queries.
  4. Edit .env and uncomment/fill in:
         DB_READONLY_USER=ontijvsb_cybilro
         DB_READONLY_PASSWORD=<the password you set>
  5. Restart the app in "Setup Node.js App".

If you skip this, nothing breaks — the app already falls back to the main database user.

-------------------------------------------------------------------
WHAT CHANGED IN THIS REBUILD
-------------------------------------------------------------------
- Downgraded the "openai" package from v7 (requires Node.js 22+) to v6 (works on Node 18+), so
  the app can actually start on typical shared-hosting Node versions.
- .env loading no longer depends on the process's working directory being the app root, which
  isn't guaranteed under cPanel's Node.js Selector/Passenger — it now loads .env by an explicit
  path next to package.json.
- Added an "engines" field to package.json (node >=18.0.0) so npm/cPanel will flag a Node version
  mismatch clearly instead of failing in a confusing way.

-------------------------------------------------------------------
WHAT CHANGED SINCE THE ORIGINAL DEPLOYMENT (security notes)
-------------------------------------------------------------------
- JWT_SECRET here is a freshly generated, strong random value — never reuse it elsewhere, and
  don't put it back into git.
- CORS_ORIGIN is locked to this domain only (previous deployments used a wildcard/different
  domain — that config is not reused here).
- Rate limiting is now enabled on login (10 attempts / 15 min per IP) and on the API generally.
- Company documents are no longer served as plain public files — every download now goes
  through an authenticated, ownership-checked endpoint.
- File uploads are now capped at 15MB and restricted to PDF/Word/Excel/image files.
- A previous deployment's real database password ended up committed to this project's git
  history (in an old /deploy folder). That old database is unrelated to this one, but if it's
  still active anywhere, its password should be rotated — it cannot be un-leaked from git
  history by deleting the file today.
