# TokenFlow — Manpower Token Management Panel

A PHP + MySQL + JS web panel for managing hourly-rate token generation and
peer-to-peer token transfers with admin approval.

## What it does

**User Panel** (`dashboard.php`)
- Shows the logged-in user's name at the top
- Stat cards: token balance, hourly rate, scripts running, tokens generated per hour
- Transfer tokens to another user by entering their **User ID** and an amount
- Transfer history table with status: **Pending / Success / Failed**
- Live "generation activity" feed (tokens credited automatically from running scripts)

**Admin Panel** (`admin/dashboard.php`)
- Shows the admin's name at the top
- Add new users
- Set **hourly rate** and **scripts running** (7–14 typically) per user
- Approve or Reject pending transfer requests
- View all users and all transfer requests

## How the token math works

```
Tokens generated per hour = hourly_rate × scripts_running
```

Example: rate = 10 tokens/hour per script, 12 scripts running → 120 tokens/hour credited to that user.

A cron job (`cron/generate_tokens.php`) runs once an hour and credits every active
user's balance based on this formula, and logs it to `token_generation_log`.

## How transfers work

1. User submits a transfer (recipient User ID + amount).
2. Amount is **deducted immediately** from the sender's balance and the transfer
   is recorded as **Pending (status 1)** — this prevents double-spending while it
   waits for review.
3. Admin reviews it in the Admin Panel:
   - **Approve** → recipient is credited, status becomes **Success (2)**.
   - **Reject** → sender is refunded, status becomes **Failed (3)**.

## Installation

1. **Create the database**
   ```bash
   mysql -u root -p < schema.sql
   ```

2. **Configure DB credentials**
   Edit `config.php`:
   ```php
   define('DB_HOST', 'localhost');
   define('DB_NAME', 'token_manpower');
   define('DB_USER', 'your_db_user');
   define('DB_PASS', 'your_db_password');
   ```

3. **Upload the whole folder** to your web server (e.g. `public_html/tokenflow/` on cPanel).

4. **Create the first admin account**
   Visit `https://yourdomain.com/tokenflow/setup_admin.php` in your browser,
   fill in the form, then **delete `setup_admin.php` from the server** immediately
   after (it will also refuse to run again once an admin exists).

5. **Log in** at `login.php` with the admin account you just created.

6. **Add users** from the Admin Panel — set each user's hourly rate and scripts running.

7. **Set up the hourly cron job** so tokens actually accumulate:
   ```
   0 * * * * /usr/bin/php /home/youraccount/public_html/tokenflow/cron/generate_tokens.php >> /home/youraccount/public_html/tokenflow/cron/cron.log 2>&1
   ```
   On cPanel: Cron Jobs → Add New Cron Job → "Once per hour" → paste the command
   (adjust the path to match your actual server path).

## File structure

```
manpower-panel/
├── schema.sql                  Database schema
├── config.php                  DB connection settings
├── setup_admin.php             One-time admin creation (delete after use)
├── login.php / logout.php
├── dashboard.php                User panel
├── includes/
│   ├── auth.php                 Login/role guards
│   └── functions.php            Shared helpers
├── admin/
│   └── dashboard.php             Admin panel
├── api/
│   ├── transfer.php              User: get balance/history, submit transfer
│   ├── admin_users.php            Admin: list/add/update users
│   └── admin_transfers.php       Admin: list transfers, approve/reject
├── cron/
│   └── generate_tokens.php       Hourly token generation job
└── assets/
    ├── css/style.css              Modern dark UI theme
    └── js/
        ├── app.js                 User dashboard logic
        └── admin.js                Admin dashboard logic
```

## Notes / things to double-check before going live

- Passwords are hashed with bcrypt (`password_hash`) — never stored in plain text.
- All DB writes use prepared statements (PDO) to prevent SQL injection.
- Transfer approval/rejection and balance updates run inside a DB transaction
  with row locking (`FOR UPDATE`) to avoid race conditions if two admins click
  at the same time.
- This is a starting, production-lean build — for a real launch you may still
  want to add: HTTPS enforcement, rate limiting on login, CSRF tokens on forms,
  and an audit log of admin actions.