<?php

/**

 * Guided web installer for NestEggCode.

 *

 * Point your browser at this file (e.g. https://your-site/install.php) and it

 * walks you through creating config.php, testing the database, importing the

 * schema, and matching the URL settings. It is intentionally written in

 * conservative PHP so that even an out-of-date server can still load it and

 * show you a helpful "please upgrade PHP" message instead of a blank page.

 *

 * SECURITY: delete this file once the site works. The admin dashboard will

 * remind you and can delete it for you after you confirm the site is working.

 */

error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT & ~E_NOTICE);

@ini_set('display_errors', '1');

$ROOT         = __DIR__;

$CONFIG_PATH  = $ROOT . '/config.php';

$SCHEMA_PATH  = $ROOT . '/schema.sql';

$HTACCESS     = $ROOT . '/.htaccess';

$UPLOADS_DIR  = $ROOT . '/uploads';

// --------------------------------------------------------------------------

// Small helpers (kept PHP 5.4-compatible on purpose).

// --------------------------------------------------------------------------

function h($s) {

    return htmlspecialchars((string) $s, ENT_QUOTES, 'UTF-8');

}

/** Best guess at the URL prefix the app is served under, e.g. "" or "/pgh5". */

function detect_base_path() {

    $script = isset($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME'] : '';

    $dir    = str_replace('\\', '/', dirname($script));

    $dir    = rtrim($dir, '/');

    return $dir === '' ? '' : $dir;

}

/** Best guess at the site's public origin, e.g. "https://code.example.com". */

function detect_site_url() {

    $https = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')

        || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')

        || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443);

    $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';

    $host = preg_replace('/[^A-Za-z0-9.\-:\[\]]/', '', $host);

    return $host === '' ? '' : (($https ? 'https' : 'http') . '://' . $host);

}

/** Turn a PHP shorthand size like "64M" into bytes (for display only). */

function human_bytes($bytes) {

    $units = array('B', 'KB', 'MB', 'GB');

    $i = 0;

    $n = (float) $bytes;

    while ($n >= 1024 && $i < count($units) - 1) { $n /= 1024; $i++; }

    return ($i === 0 ? $n : round($n, 1)) . ' ' . $units[$i];

}

// --------------------------------------------------------------------------

// Environment pre-flight checks. Each entry: label, ok, detail, fatal.

// --------------------------------------------------------------------------

function preflight_checks($configPath, $schemaPath, $uploadsDir) {

    $checks = array();

    $phpOk = version_compare(PHP_VERSION, '7.4.0', '>=');

    $checks[] = array(

        'label'  => 'PHP version 7.4 or newer',

        'ok'     => $phpOk,

        'detail' => $phpOk

            ? 'Running PHP ' . PHP_VERSION . '.'

            : 'You are on PHP ' . PHP_VERSION . '. Ask your host to switch the PHP '

              . 'version (in cPanel this is "Select PHP Version" / "MultiPHP Manager"), '

              . 'or update your local MAMP/XAMPP.',

        'fatal'  => true,

    );

    $pdo = extension_loaded('pdo_mysql');

    $checks[] = array(

        'label'  => 'PDO MySQL database driver',

        'ok'     => $pdo,

        'detail' => $pdo

            ? 'The pdo_mysql extension is enabled.'

            : 'The pdo_mysql extension is missing. Enable it in your PHP settings '

              . '(cPanel: "Select PHP Version" → tick "pdo_mysql"; MAMP usually has it on).',

        'fatal'  => true,

    );

    $canWriteConfig = file_exists($configPath) ? is_writable($configPath) : is_writable(dirname($configPath));

    $checks[] = array(

        'label'  => 'config.php can be written',

        'ok'     => $canWriteConfig,

        'detail' => $canWriteConfig

            ? (file_exists($configPath) ? 'config.php exists and is writable.' : 'The folder is writable, so config.php can be created.')

            : 'The web server cannot write to this folder. Set the folder\'s permissions to '

              . '755 (and config.php to 644) via your host\'s File Manager or FTP client.',

        'fatal'  => true,

    );

    $uploadsOk = is_dir($uploadsDir) ? is_writable($uploadsDir) : is_writable(dirname($uploadsDir));

    $checks[] = array(

        'label'  => 'uploads/ folder is writable',

        'ok'     => $uploadsOk,

        'detail' => $uploadsOk

            ? (is_dir($uploadsDir) ? 'uploads/ exists and is writable.' : 'uploads/ will be created during install.')

            : 'The uploads/ folder is not writable. Create a folder named "uploads" next to '

              . 'this file and set its permissions to 755.',

        'fatal'  => false,

    );

    $schemaOk = is_file($schemaPath) && is_readable($schemaPath);

    $checks[] = array(

        'label'  => 'schema.sql is present',

        'ok'     => $schemaOk,

        'detail' => $schemaOk

            ? 'Found schema.sql (the database table definitions).'

            : 'schema.sql is missing. Re-upload it from the project files — the installer '

              . 'needs it to create the database tables.',

        'fatal'  => false,

    );

    $zip = class_exists('ZipArchive');

    $checks[] = array(

        'label'  => 'Zip extension (optional)',

        'ok'     => $zip,

        'detail' => $zip

            ? 'Zip uploads will work.'

            : 'The zip extension is off. Everything works except "Upload a zip"; you can '

              . 'still upload files and folders. Enable php-zip later if you want it.',

        'fatal'  => false,

    );

    return $checks;

}

/** Build the contents of config.php from validated values. */

function build_config_php($v) {

    $x = function ($s) { return var_export($s, true); };

    $lines   = array();

    $lines[] = '<?php';

    $lines[] = '/**';

    $lines[] = ' * Application configuration. Generated by install.php on ' . date('Y-m-d H:i') . '.';

    $lines[] = ' *';

    $lines[] = ' * This file holds secrets (database password, admin password hash).';

    $lines[] = ' * Keep it OUT of version control and do not share it.';

    $lines[] = ' */';

    $lines[] = '';

    $lines[] = '// ---- Database (PDO / MySQL) -------------------------------------------------';

    $lines[] = "define('DB_HOST', "    . $x($v['db_host']) . ');';

    $lines[] = "define('DB_NAME', "    . $x($v['db_name']) . ');';

    $lines[] = "define('DB_USER', "    . $x($v['db_user']) . ');';

    $lines[] = "define('DB_PASS', "    . $x($v['db_pass']) . ');';

    $lines[] = "define('DB_CHARSET', " . $x('utf8mb4') . ');';

    $lines[] = '';

    $lines[] = '// ---- Admin credentials (single user) ---------------------------------------';

    $lines[] = '// The password is stored as a bcrypt hash, never in plaintext.';

    $lines[] = "define('ADMIN_USER', "      . $x($v['admin_user']) . ');';

    $lines[] = "define('ADMIN_PASS_HASH', " . $x($v['admin_hash']) . ');';

    $lines[] = '';

    $lines[] = '// ---- Paths / routing --------------------------------------------------------';

    $lines[] = '// BASE_PATH is the URL prefix the app is served under';

    $lines[] = "//   Local MAMP subfolder:  '/pgh5'";

    $lines[] = "//   Production domain root: ''";

    $lines[] = "define('BASE_PATH', " . $x($v['base_path']) . ');';

    $lines[] = '';

    $lines[] = '// Public origin of the site — scheme + host, no trailing slash, no BASE_PATH.';

    $lines[] = '// Used to build the absolute URLs that social-share metadata requires.';

    $lines[] = '// Detected during install; correct it here if the site moves.';

    $lines[] = "define('SITE_URL', " . $x(isset($v['site_url']) ? $v['site_url'] : '') . ');';

    $lines[] = '';

    $lines[] = '// Absolute filesystem path to the uploads directory (no trailing slash).';

    $lines[] = "define('UPLOAD_DIR', __DIR__ . '/uploads');";

    $lines[] = '';

    $lines[] = '// Max upload size per file, in bytes (also bounds each file inside a zip).';

    $lines[] = "define('MAX_FILE_SIZE', " . (int) $v['max_file'] . ' * 1024 * 1024); // MB';

    $lines[] = '';

    $lines[] = '// Ceiling on the total uncompressed size of a single zip import, in bytes.';

    $lines[] = "define('MAX_ZIP_TOTAL', " . (int) $v['max_zip'] . ' * 1024 * 1024); // MB';

    $lines[] = '';

    return implode("\n", $lines);

}

/** Translate a raw PDO error into plain-English advice. */

function friendly_db_error($e) {

    $msg  = $e->getMessage();

    $code = $e->getCode();

    if (stripos($msg, 'Access denied') !== false) {

        return 'The database refused the username or password. Double-check DB_USER and '

             . 'DB_PASS. On cPanel the username is usually your account name plus an '

             . 'underscore, like "myacct_code".';

    }

    if (stripos($msg, 'Unknown database') !== false) {

        return 'The database name was not found. Create the database first (cPanel → '

             . '"MySQL Databases"), or tick "Create the database if it does not exist" below '

             . 'if your user is allowed to create databases.';

    }

    if (stripos($msg, 'Connection refused') !== false || stripos($msg, "Can't connect") !== false || $code === 2002) {

        return 'Could not reach the database server at that host. Try "localhost" (most '

             . 'shared hosts and MAMP). If MAMP uses a custom port, use "127.0.0.1:8889".';

    }

    if (stripos($msg, 'getaddrinfo') !== false || stripos($msg, 'php_network_getaddresses') !== false) {

        return 'The database host name could not be resolved. Check DB_HOST for typos; it '

             . 'is usually "localhost".';

    }

    return 'Database error: ' . $msg;

}

// --------------------------------------------------------------------------

// Handle the install submission.

// --------------------------------------------------------------------------

$errors  = array();

$warnings = array();

$success = false;

$results = array();

// Sticky form values (also used to prefill on first load).

$f = array(

    'db_host'    => 'localhost',

    'db_name'    => '',

    'db_user'    => '',

    'db_pass'    => '',

    'admin_user' => '',

    'base_path'  => detect_base_path(),

    'max_file'   => 25,

    'max_zip'    => 200,

);

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['do_install'])) {

    foreach (array('db_host','db_name','db_user','db_pass','admin_user','base_path') as $k) {

        if (isset($_POST[$k])) { $f[$k] = trim($_POST[$k]); }

    }

    $f['max_file']  = isset($_POST['max_file']) ? max(1, (int) $_POST['max_file']) : 25;

    $f['max_zip']   = isset($_POST['max_zip'])  ? max(1, (int) $_POST['max_zip'])  : 200;

    $adminPass      = isset($_POST['admin_pass'])  ? (string) $_POST['admin_pass']  : '';

    $adminPass2     = isset($_POST['admin_pass2']) ? (string) $_POST['admin_pass2'] : '';

    $createDb       = !empty($_POST['create_db']);

    $importSchema   = !empty($_POST['import_schema']);

    // Normalise base path: ensure a single leading slash, no trailing slash, or ''.

    $bp = str_replace('\\', '/', $f['base_path']);

    $bp = '/' . trim($bp, '/');

    $f['base_path'] = ($bp === '/') ? '' : $bp;

    // ---- Field validation -------------------------------------------------

    if ($f['db_name'] === '')  { $errors[] = 'Database name is required.'; }

    if ($f['db_user'] === '')  { $errors[] = 'Database username is required.'; }

    if ($f['admin_user'] === '') { $errors[] = 'Admin username is required.'; }

    if (strlen($adminPass) < 8) {

        $errors[] = 'Admin password must be at least 8 characters. Pick something long and hard to guess.';

    } elseif ($adminPass !== $adminPass2) {

        $errors[] = 'The two admin passwords do not match. Re-type them carefully.';

    }

    // ---- Database connection & optional creation --------------------------

    $pdo = null;

    if (!$errors) {

        try {

            if ($createDb) {

                // Connect without a database, create it, then select it.

                $dsn = 'mysql:host=' . $f['db_host'] . ';charset=utf8mb4';

                $pdo = new PDO($dsn, $f['db_user'], $f['db_pass'], array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));

                $safe = str_replace('`', '', $f['db_name']);

                $pdo->exec('CREATE DATABASE IF NOT EXISTS `' . $safe . '` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci');

                $pdo->exec('USE `' . $safe . '`');

                $results[] = 'Database "' . h($f['db_name']) . '" is ready.';

            } else {

                $dsn = 'mysql:host=' . $f['db_host'] . ';dbname=' . $f['db_name'] . ';charset=utf8mb4';

                $pdo = new PDO($dsn, $f['db_user'], $f['db_pass'], array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));

                $results[] = 'Connected to the database successfully.';

            }

        } catch (PDOException $e) {

            $errors[] = friendly_db_error($e);

        }

    }

    // ---- Import the schema ------------------------------------------------

    if (!$errors && $pdo && $importSchema) {

        if (!is_file($SCHEMA_PATH)) {

            $errors[] = 'schema.sql is missing, so the tables could not be created. Re-upload it and try again.';

        } else {

            try {

                $sql   = file_get_contents($SCHEMA_PATH);

                $sql   = preg_replace('/^\s*--.*$/m', '', $sql); // strip comment lines

                $parts = array_filter(array_map('trim', explode(';', $sql)));

                foreach ($parts as $stmt) {

                    $pdo->exec($stmt);

                }

                $results[] = 'Database tables created (repositories, files, folders).';

            } catch (PDOException $e) {

                $errors[] = 'Could not create the tables: ' . h($e->getMessage())

                          . ' — you can also import schema.sql manually via phpMyAdmin.';

            }

        }

    }

    // ---- Write config.php -------------------------------------------------

    if (!$errors) {

        $vals = array(

            'db_host'    => $f['db_host'],

            'db_name'    => $f['db_name'],

            'db_user'    => $f['db_user'],

            'db_pass'    => $f['db_pass'],

            'admin_user' => $f['admin_user'],

            'admin_hash' => password_hash($adminPass, PASSWORD_DEFAULT),

            'base_path'  => $f['base_path'],

            'site_url'   => detect_site_url(),

            'max_file'   => $f['max_file'],

            'max_zip'    => $f['max_zip'],

        );

        $written = @file_put_contents($CONFIG_PATH, build_config_php($vals));

        if ($written === false) {

            $errors[] = 'Could not write config.php. Check the folder is writable (permissions 755) '

                      . 'and try again. Nothing else was changed.';

        } else {

            @chmod($CONFIG_PATH, 0644);

            $results[] = 'config.php written with your settings.';

        }

    }

    // ---- Make sure uploads/ exists ---------------------------------------

    if (!$errors) {

        if (!is_dir($UPLOADS_DIR)) {

            if (@mkdir($UPLOADS_DIR, 0755, true)) {

                $results[] = 'Created the uploads/ folder.';

            } else {

                $warnings[] = 'Could not create the uploads/ folder automatically. Create a folder '

                            . 'named "uploads" next to install.php (permissions 755) before uploading files.';

            }

        }

    }

    // ---- Best-effort: match .htaccess RewriteBase to BASE_PATH ------------

    if (!$errors && is_file($HTACCESS) && is_writable($HTACCESS)) {

        $ht = file_get_contents($HTACCESS);

        $rewriteBase = ($f['base_path'] === '') ? '/' : $f['base_path'] . '/';

        $newHt = preg_replace('/^(\s*RewriteBase\s+).*$/m', '${1}' . $rewriteBase, $ht, 1, $count);

        if ($count > 0 && $newHt !== null && $newHt !== $ht) {

            if (@file_put_contents($HTACCESS, $newHt) !== false) {

                $results[] = 'Updated .htaccess RewriteBase to "' . h($rewriteBase) . '".';

            } else {

                $warnings[] = 'Could not update .htaccess. If pretty URLs 404, set "RewriteBase '

                            . h($rewriteBase) . '" in .htaccess by hand.';

            }

        }

    } elseif (!$errors && is_file($HTACCESS)) {

        $rewriteBase = ($f['base_path'] === '') ? '/' : $f['base_path'] . '/';

        $warnings[] = '.htaccess is not writable, so its RewriteBase was left as-is. If pretty URLs '

                    . '404, set "RewriteBase ' . h($rewriteBase) . '" in .htaccess by hand.';

    }

    if (!$errors) {

        $success = true;

    }

}

// Public login / home URLs for the success screen.

$base       = $f['base_path'];

$loginUrl   = ($base === '' ? '' : $base) . '/admin/login.php';

$homeUrl    = ($base === '' ? '/' : $base . '/');

$checks     = preflight_checks($CONFIG_PATH, $SCHEMA_PATH, $UPLOADS_DIR);

$fatalBlock = false;

foreach ($checks as $c) { if ($c['fatal'] && !$c['ok']) { $fatalBlock = true; } }

$alreadyInstalled = is_file($CONFIG_PATH) && !$success;

?>

<!doctype html>

<html lang="en">

<head>

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1">

<title>Install NestEggCode</title>

<style>

    :root { color-scheme: light dark; }

    * { box-sizing: border-box; }

    body {

        margin: 0; padding: 2rem 1rem;

        font: 15px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;

        background: #f4f5f7; color: #1c1e21;

    }

    .wrap { max-width: 760px; margin: 0 auto; }

    .card {

        background: #fff; border: 1px solid #e2e4e8; border-radius: 12px;

        padding: 1.5rem 1.75rem; margin-bottom: 1.25rem;

        box-shadow: 0 1px 3px rgba(0,0,0,.05);

    }

    h1 { font-size: 1.6rem; margin: 0 0 .25rem; }

    h2 { font-size: 1.15rem; margin: 0 0 1rem; }

    .lede { color: #616a75; margin: 0 0 1.5rem; }

    label { display: block; margin: 0 0 1rem; font-weight: 600; }

    label .hint { display: block; font-weight: 400; color: #6b7280; font-size: .86rem; margin-top: .15rem; }

    input[type=text], input[type=password], input[type=number] {

        width: 100%; margin-top: .4rem; padding: .6rem .7rem; font-size: 1rem;

        border: 1px solid #c7ccd3; border-radius: 8px; background: #fff; color: inherit;

    }

    input:focus { outline: 2px solid #3b82f6; outline-offset: 1px; border-color: #3b82f6; }

    .row { display: flex; gap: 1rem; flex-wrap: wrap; }

    .row > label { flex: 1 1 200px; }

    .check-row { display: flex; gap: .6rem; align-items: flex-start; margin: 0 0 .9rem; font-weight: 400; }

    .check-row input { margin-top: .25rem; }

    button {

        font: inherit; font-weight: 600; cursor: pointer;

        background: #2563eb; color: #fff; border: 0; border-radius: 8px;

        padding: .7rem 1.4rem; font-size: 1rem;

    }

    button:hover { background: #1d4ed8; }

    ul.checks { list-style: none; padding: 0; margin: 0; }

    ul.checks li { display: flex; gap: .6rem; padding: .55rem 0; border-bottom: 1px solid #f0f1f3; }

    ul.checks li:last-child { border-bottom: 0; }

    .mark { flex: 0 0 1.3rem; font-weight: 700; }

    .ok    { color: #15803d; }

    .bad   { color: #b91c1c; }

    .warn  { color: #b45309; }

    .detail { color: #6b7280; font-size: .88rem; }

    .banner { padding: .9rem 1rem; border-radius: 8px; margin: 0 0 1rem; }

    .banner.err  { background: #fee2e2; border: 1px solid #fca5a5; color: #7f1d1d; }

    .banner.ok   { background: #dcfce7; border: 1px solid #86efac; color: #14532d; }

    .banner.warn { background: #fef3c7; border: 1px solid #fcd34d; color: #78350f; }

    .banner ul { margin: .4rem 0 0; padding-left: 1.2rem; }

    code { background: rgba(0,0,0,.06); padding: .1rem .35rem; border-radius: 5px; font-size: .9em; }

    ol.checklist { padding-left: 1.3rem; }

    ol.checklist li { margin: .5rem 0; }

    a.btn-link {

        display: inline-block; margin-top: .5rem; padding: .55rem 1rem; border-radius: 8px;

        background: #eef2ff; color: #1d4ed8; text-decoration: none; font-weight: 600;

    }

    a.btn-link:hover { background: #e0e7ff; }

    .muted { color: #6b7280; font-size: .9rem; }

    @media (prefers-color-scheme: dark) {

        body { background: #16181d; color: #e6e8eb; }

        .card { background: #1f2228; border-color: #2c3038; box-shadow: none; }

        .lede, .detail, .muted, label .hint { color: #9aa3ad; }

        input[type=text], input[type=password], input[type=number] { background: #14161a; border-color: #3a3f48; }

        code { background: rgba(255,255,255,.1); }

        ul.checks li { border-bottom-color: #262a31; }

        a.btn-link { background: #1e2740; color: #93c5fd; }

    }

</style>

</head>

<body>

<div class="wrap">

<?php if ($success): ?>

    <div class="card">

        <h1>&#127881; Installation complete</h1>

        <p class="lede">NestEggCode is set up. Here is what the installer did:</p>

        <div class="banner ok">

            <ul>

                <?php foreach ($results as $r): ?><li><?= $r /* already escaped where needed */ ?></li><?php endforeach; ?>

            </ul>

        </div>

        <?php if ($warnings): ?>

        <div class="banner warn">

            <strong>Heads-up:</strong>

            <ul><?php foreach ($warnings as $w): ?><li><?= $w ?></li><?php endforeach; ?></ul>

        </div>

        <?php endif; ?>

        <a class="btn-link" href="<?= h($loginUrl) ?>">Go to the admin login &rarr;</a>

         

        <a class="btn-link" href="<?= h($homeUrl) ?>">View the public site &rarr;</a>

    </div>

    <div class="card">

        <h2>&#9989; Post-launch checklist</h2>

        <p class="muted">Run through this to confirm everything works. Once it all checks out,

        delete <code>install.php</code> (the dashboard will offer to do this for you).</p>

        <ol class="checklist">

            <li><strong>Log in.</strong> Open the <a href="<?= h($loginUrl) ?>">admin login</a> and sign in

                with the username and password you just chose.</li>

            <li><strong>Create a repository.</strong> On the dashboard, add one (e.g. slug <code>demo</code>,

                name <code>Demo</code>). It should appear in the list.</li>

            <li><strong>Upload a file.</strong> Click <em>Upload</em>, drop in a small text or code file,

                and confirm it saves without an error.</li>

            <li><strong>Browse it publicly.</strong> Visit <a href="<?= h($homeUrl) ?>">the home page</a>,

                open your repo, and click the file — it should show with line numbers and highlighting.</li>

            <li><strong>Check a README renders.</strong> Upload a <code>README.md</code>; it should render

                as formatted text on the repo's front page (headings, code blocks, links).</li>

            <li><strong>Try Raw &amp; Download.</strong> On a file page, both buttons should work.</li>

            <li><strong>Confirm secrets are protected.</strong> Visit <code><?= h(($base === '' ? '' : $base)) ?>/config.php</code>

                directly — you should get a "Forbidden" error, not the file contents.</li>

            <li><strong>Delete this installer.</strong> Return to the dashboard and use the

                "Remove installer" prompt, or delete <code>install.php</code> via FTP/File Manager.</li>

        </ol>

        <p class="muted">Tip: also add <code>config.php</code>, <code>uploads/</code> and <code>*.zip</code>

        to a <code>.gitignore</code> before pushing this project anywhere public.</p>

    </div>

<?php else: ?>

    <div class="card">

        <h1>Install NestEggCode</h1>

        <p class="lede">This sets up your self-hosted code browser. Have your database name,

        username and password ready (create the database in your host's control panel first if you can).</p>

        <?php if ($errors): ?>

        <div class="banner err">

            <strong>Please fix the following, then submit again:</strong>

            <ul><?php foreach ($errors as $er): ?><li><?= $er ?></li><?php endforeach; ?></ul>

        </div>

        <?php endif; ?>

        <?php if ($alreadyInstalled): ?>

        <div class="banner warn">

            <strong>config.php already exists.</strong> This looks installed already. Submitting the form

            will <em>overwrite</em> config.php with new settings. If the site works, you can skip the

            installer and just delete this file instead.

        </div>

        <?php endif; ?>

        <h2>Server checks</h2>

        <ul class="checks">

            <?php foreach ($checks as $c): ?>

            <li>

                <span class="mark <?= $c['ok'] ? 'ok' : ($c['fatal'] ? 'bad' : 'warn') ?>">

                    <?= $c['ok'] ? '&#10003;' : ($c['fatal'] ? '&#10007;' : '!') ?>

                </span>

                <span>

                    <strong><?= h($c['label']) ?></strong><br>

                    <span class="detail"><?= h($c['detail']) ?></span>

                </span>

            </li>

            <?php endforeach; ?>

        </ul>

        <?php if ($fatalBlock): ?>

        <div class="banner err" style="margin-top:1rem">

            Fix the items marked <span class="bad">&#10007;</span> above before installing —

            the app cannot run until they pass.

        </div>

        <?php endif; ?>

    </div>

    <form method="post" autocomplete="off">

        <div class="card">

            <h2>Database</h2>

            <p class="muted" style="margin-top:-.5rem">On shared hosting, create the database and a user in your

            control panel (cPanel &rarr; "MySQL Databases"), then paste those exact values here.</p>

            <label>Database host

                <input type="text" name="db_host" value="<?= h($f['db_host']) ?>" placeholder="localhost">

                <span class="hint">Almost always <code>localhost</code>. MAMP with a custom port: <code>127.0.0.1:8889</code>.</span>

            </label>

            <div class="row">

                <label>Database name

                    <input type="text" name="db_name" value="<?= h($f['db_name']) ?>" required>

                </label>

                <label>Database username

                    <input type="text" name="db_user" value="<?= h($f['db_user']) ?>" required>

                </label>

            </div>

            <label>Database password

                <input type="password" name="db_pass" value="<?= h($f['db_pass']) ?>">

                <span class="hint">Leave blank only if your database truly has no password (rare in production).</span>

            </label>

            <div class="check-row">

                <input type="checkbox" name="create_db" id="create_db" value="1">

                <label for="create_db" style="margin:0">Create the database if it doesn't exist

                    <span class="hint">Works locally (MAMP). On shared hosting the database usually must exist already.</span>

                </label>

            </div>

            <div class="check-row">

                <input type="checkbox" name="import_schema" id="import_schema" value="1" checked>

                <label for="import_schema" style="margin:0">Create the tables now (import schema.sql)

                    <span class="hint">Leave checked for a fresh install. Uncheck if the tables already exist.</span>

                </label>

            </div>

        </div>

        <div class="card">

            <h2>Admin account</h2>

            <p class="muted" style="margin-top:-.5rem">The single login for managing repositories. The password is

            stored as a secure bcrypt hash — never in plain text.</p>

            <label>Admin username

                <input type="text" name="admin_user" value="<?= h($f['admin_user']) ?>" required>

            </label>

            <div class="row">

                <label>Admin password

                    <input type="password" name="admin_pass" required>

                    <span class="hint">At least 8 characters. Longer is better.</span>

                </label>

                <label>Confirm password

                    <input type="password" name="admin_pass2" required>

                </label>

            </div>

        </div>

        <div class="card">

            <h2>Site settings</h2>

            <label>Base path (URL prefix)

                <input type="text" name="base_path" value="<?= h($f['base_path']) ?>" placeholder="(blank for a domain root)">

                <span class="hint">Auto-detected. Blank for <code>https://yoursite.com/</code>; use

                <code>/pgh5</code> for <code>https://yoursite.com/pgh5/</code>.</span>

            </label>

            <div class="row">

                <label>Max file size (MB)

                    <input type="number" name="max_file" min="1" value="<?= h($f['max_file']) ?>">

                </label>

                <label>Max zip total (MB)

                    <input type="number" name="max_zip" min="1" value="<?= h($f['max_zip']) ?>">

                    <span class="hint">Uncompressed size limit for a single zip import.</span>

                </label>

            </div>

            <p class="muted">Your server also caps uploads via PHP settings

            (<code>upload_max_filesize</code> is currently <?= h(human_bytes(return_bytes(ini_get('upload_max_filesize')))) ?>,

            <code>post_max_size</code> <?= h(human_bytes(return_bytes(ini_get('post_max_size')))) ?>). Raise those in

            <code>.user.ini</code> or <code>php.ini</code> if you need bigger uploads.</p>

        </div>

        <div class="card">

            <button type="submit" name="do_install" value="1"<?= $fatalBlock ? ' disabled' : '' ?>>Install NestEggCode</button>

            <?php if ($fatalBlock): ?>

                <p class="muted" style="margin-top:.6rem">Resolve the failed server checks above to enable this button.</p>

            <?php endif; ?>

        </div>

    </form>

<?php endif; ?>

    <p class="muted" style="text-align:center">NestEggCode installer &middot; delete <code>install.php</code> when you're done.</p>

</div>

</body>

</html>

<?php

/** Convert a PHP ini size shorthand (e.g. "64M") to bytes. Defined last; PHP hoists it. */

function return_bytes($val) {

    $val  = trim((string) $val);

    if ($val === '') { return 0; }

    $unit = strtolower($val[strlen($val) - 1]);

    $num  = (int) $val;

    switch ($unit) {

        case 'g': $num *= 1024; // fall through

        case 'm': $num *= 1024; // fall through

        case 'k': $num *= 1024;

    }

    return $num;

}