# Admin & Access Guide

## Access model
Cloudflare Access is the front door. The PHP application is the business authorization layer. Do not create a shared password. Configure Cloudflare One-Time PIN with an Include rule restricted to the exact approved email addresses.

## Client workflow
1. Admin creates client in Admin Portal.
2. Admin sets status to approved and sends an invitation.
3. Client opens the one-use invitation and accepts it.
4. Cloudflare Access authenticates the approved email by OTP.
5. PHP reads `CF-Access-Authenticated-User-Email` and maps it to the client database record.
6. Admin controls status/expiry in the database.

## Admin sections
Dashboard, Clients, Services, Orders, Appointments, Messages, Settings, Audit.

## Documents
Put private files outside `public/` in `PRIVATE_STORAGE_PATH`. Clients can only download files through `document.php` after authorization.

## Important
The origin should not be publicly reachable except through Cloudflare/Tunnel. If an attacker can bypass Cloudflare and reach PHP directly, they may be able to spoof the identity header. Use Cloudflare Tunnel or a firewall rule that only permits Cloudflare-origin traffic.