# StoreWeb - E-commerce Platform

StoreWeb is a full-featured e-commerce platform built with HTML, CSS, vanilla JavaScript, PHP, and MySQL.

## Features

- Product catalog with categories
- User registration and authentication
- Shopping cart functionality
- Checkout process
- Admin panel for managing products
- Role-based access control (RBAC)

## Role-Based Access Control (RBAC)

This implementation includes a role-based permission system with the following features:

1. **Database Changes**:
   - Added a `role` column to the `users` table (ENUM with values 'user' and 'admin')
   - Default value is 'user' for all new registrations

2. **User Registration & Admin Creation**:
   - Regular users register normally and automatically receive the 'user' role
   - First admin account can be created using the `create_admin.php` script
   - **Important**: Delete `create_admin.php` after creating your first admin user for security

3. **Authentication & Authorization Logic**:
   - User role is stored securely in the session (`$_SESSION['role']`)
   - Created reusable PHP function `requireAdmin()` for protecting admin-only pages
   - Created middleware file `includes/require_admin.php` for consistent protection

4. **Admin Panel**:
   - Dedicated admin dashboard at `/admin/` accessible only to users with 'admin' role
   - Dashboard includes links to:
     - Add/Edit/Delete products
     - Manage user accounts
     - View orders (coming soon)

5. **Security Considerations**:
   - All permission logic is implemented server-side in PHP
   - Direct URL access to admin pages is prevented without proper role validation
   - Uses prepared statements (PDO) for all database queries

6. **UI Feedback**:
   - "Admin Panel" link only appears in navigation for logged-in admin users
   - PHP conditions in the header control visibility of admin links

## Installation

1. Import `storeweb.sql` into your MySQL database
2. Update database credentials in `includes/config.php`
3. Run the application in your web server
4. Create your first admin user by visiting `create_admin.php`
5. **Important**: Delete `create_admin.php` after creating your admin user

## File Structure

```
.
├── admin/
│   ├── add_product.php
│   ├── edit_product.php
│   ├── index.php
│   ├── login.php
│   ├── manage_users.php
│   └── products.php
├── assets/
│   ├── css/
│   │   └── style.css
│   └── js/
│       ├── admin.js
│       └── main.js
├── auth/
│   ├── login.php
│   └── register.php
├── cart/
│   ├── checkout.php
│   └── index.php
├── includes/
│   ├── config.php
│   ├── db.php
│   ├── footer.php
│   ├── functions.php
│   ├── header.php
│   └── require_admin.php
├── products/
│   ├── index.php
│   └── view.php
├── create_admin.php
├── index.php
└── storeweb.sql
```

## Security Notes

- Always use prepared statements for database queries
- Never rely on frontend-only checks for permissions
- Delete `create_admin.php` after setting up your first admin user
- Validate all user inputs