# Straddle Staffing — WebSpaceKit installation

This ZIP contains a prebuilt, independent health and social care staffing and training PWA. You do not need ChatGPT, Node.js or a build command on your hosting account. It is ready to configure and upload; it is not already connected to your hosting database or mailbox.

## 1. Prepare hosting

You need a WebSpaceKit hosting plan with PHP 8.2 or newer, MySQL/MariaDB, Apache-compatible .htaccess and HTTPS. Domain registration alone is not hosting. Enable PDO MySQL, GD, fileinfo and OpenSSL in the hosting PHP selector. Set upload_max_filesize to at least 3M, post_max_size to at least 4M and memory_limit to 128M or more. Use a supported PHP release offered by your host.

Add straddlestaffing.org to hosting and enable its SSL certificate. If moving from the earlier ChatGPT-hosted site, use the website DNS targets supplied by WebSpaceKit, not the earlier Sites hosting records. Keep your email MX records intact. This package expects installation at the domain root, not a subfolder.

## 2. Create an empty database

In cPanel, open MySQL Databases. Create a database and a separate database user with a strong password. Add that user to this database with all database privileges. Note the complete database name and username, including any cPanel prefix. Do not use a database containing another application.

Official hosting references:
- https://webspacekit.com/client/knowledgebase/46/
- https://webspacekit.com/client/knowledgebase/67/How-to-change-PHP-version.html

## 3. Upload the files

Extract the ZIP locally. In cPanel File Manager enable “Show Hidden Files”. Back up any existing website before changing its files.

Upload the CONTENTS of this package's public_html folder into the domain's actual document root. Include .htaccess, api.php, install.php, assets, icons, manifest, service worker and index.html.

Upload straddle-private beside that document root, OUTSIDE the public website folder. Typical layout:
- /home/YOUR_CPANEL_USER/public_html/index.html
- /home/YOUR_CPANEL_USER/public_html/api.php
- /home/YOUR_CPANEL_USER/straddle-private/core.php

If your domain has a different document root, straddle-private must be its sibling. Alternatively adjust the bootstrap require path in api.php and install.php, and the schema path in install.php, to the actual private directory. Never put the private configuration inside the public website. Do not upload frontend, tests or these instructions into the public document root. Use standard 755 directories/644 public files; restrict config.php to 600 or 640 where your host permits PHP to read it. Never use 777.

## 4. Configure database and email

Inside straddle-private copy config.example.php to config.php. Edit only the values, retaining valid PHP syntax:
- app_url: https://straddlestaffing.org (no trailing slash). If you use another domain, enter its exact HTTPS origin.
- db: your host, port, full database name, user and password.
- install_key: replace the placeholder with a unique random secret of at least 32 characters, generated by a password manager. Keep it private.
- agency_email: keep admin@straddlehealth.com.
- smtp: enable by changing false to true once your mailbox settings are entered. Use the SMTP host, username, password, port and encryption provided by the actual email host. For port 587 typically use tls; for port 465 typically ssl. Keep from and username as admin@straddlehealth.com unless your mail provider specifies a different authentication username. The mailbox must exist and permit authenticated sending.

All agency enquiries and reply addresses use admin@straddlehealth.com. Verification, recovery and status notices are addressed to the relevant registered user. Configure the sending domain's SPF/DKIM through your email provider. No email credentials are included in the ZIP. Do not send passwords to site visitors.

## 5. Install

Visit https://straddlestaffing.org/install.php. Enter your private install key and choose a strong administrator password of at least 12 characters. The installer creates the tables and administrator account. Delete public_html/install.php once it reports success.

Open the website, choose My account, and sign in as admin@straddlehealth.com with the password you chose. There is no default password. Existing accounts or data from the earlier hosted Site are not automatically migrated; this is a fresh independent installation.

## 6. Configure the mail worker

In cPanel Cron Jobs add a task every five minutes. Replace paths with those from your hosting account and confirm the PHP CLI path with WebSpaceKit:

    */5 * * * * /usr/local/bin/php /home/YOUR_CPANEL_USER/straddle-private/cron.php

The worker retries queued mail. The app can also send one queued message after a submission. SMTP failures do not discard saved enquiries. Administrators can see pending/failed counts and process a batch from Agency admin. After six failed attempts, an administrator/maintainer must investigate and reset affected outbox rows to pending to retry. Never mark an email delivered unless the mail transport accepts it. The app does not independently verify inbox delivery.

## 7. Complete your launch checks

1. Register a test staff account, receive its verification email and follow the link.
2. Sign in, save a profile, then upload a photo. Approve it from Agency admin.
3. Register and verify an organisation account. Approve it as administrator. Confirm only approved, consenting staff profiles/photos are visible.
4. Shortlist staff, submit a staffing request and register training interest. Confirm the admin dashboard receives each item and status changes appear in the user's account.
5. Set actual EUR course fees, dates, delivery format and availability in Agency admin. Fees initially remain “On enquiry”; no prices have been invented.
6. Test password recovery and confirm SMTP messages arrive. Check spam folders.
7. On supported browsers use Install app; on iPhone use Safari → Share → Add to Home Screen. HTTPS is required. Offline mode provides a reconnect screen; submissions and private records need an internet connection.

## Included features

Independent email/password accounts, verification and password recovery; staff and organisation roles; administrator approval; staff photos and profiles; directory filters and shortlists; staffing requests with dates/headcount; ten training offerings and enquiries; EUR fees; agency status tracking and notes; queued SMTP notifications; mobile responsive layout; installable PWA and offline fallback. The supplied Straddle logo and blue/pink styling are included.

Training: Mental Health First Aid, Psychological First Aid, Cultural Awareness Training, Critical Incident Stress Management, Mental Health Awareness, Lifestyle Medicine, EDI in Practice, Workplace Wellbeing, Stress Management Workshops, Leadership Coaching.

This is an enquiry and placement-management portal. It does not take card payments, run payroll, provide e-learning lessons/certificates, automatically verify qualifications or replace agency safeguarding/credential checks. Staff rates are guides; staffing requests and training enquiries require agency confirmation.

## Operations and maintenance

Back up the MySQL database and private configuration securely. Photos are stored in the database, so database backups contain personal information. Test restoration before relying on backups. Keep PHP and third-party libraries updated. Review and tailor the website's privacy/terms information to your actual company, retention rules and processing before launch. Do not collect patient information or identity documents through the profile forms.

Publication approval is not professional credential verification. Independently verify qualifications, registration, right to work and suitability before placement. Administrators can manually confirm email ownership only after independently checking ownership.

The current dashboard loads at most 2,000 records. Arrange pagination and database query tuning before growing beyond that size. Audit records are stored in the database; the first release has no audit export screen. Full account erasure/export requires administrator database maintenance; the staff UI deletes profiles/photos only. Keep appropriate backup retention and process data requests through admin@straddlehealth.com.

Sessions expire after 30 minutes idle or 12 hours absolute. Password resets revoke existing sessions. Private API responses and photos are not cached for offline use. Image uploads are checked, resized and converted to JPEG. Profile edits and new photos return publication status to Pending.

## Troubleshooting

- Configuration missing: check that config.php exists in the private sibling folder and PHP can read it.
- Database error: check host/name/user/password and database privileges. Use the full cPanel names.
- Invalid request origin: app_url must match the exact HTTPS address visitors use. Choose either www or the bare domain and redirect the other to it in your hosting panel.
- Session expired: refresh and sign in again; verify cookies are allowed.
- Upload failed: save the profile first, use JPG/PNG/WebP under 3 MB and 12 megapixels, and check PHP upload limits and GD support.
- HTTP 500: inspect hosting PHP/Apache logs. Confirm required extensions and .htaccess support. Do not expose diagnostic errors or credentials to visitors.
- No email: confirm SMTP enabled, mailbox credentials, outbound port availability and cron path. Check pending/failed counts. Password recovery needs working email.
- Redirect loop: SSL must terminate correctly for PHP/Apache; ask WebSpaceKit to configure HTTPS detection if using a reverse proxy.

## Source and validation

frontend contains editable React/TypeScript source; public_html contains the prebuilt assets. To rebuild locally, use Node 22.13+ and npm install followed by npm run build inside frontend. Back up your deployed files first; build writes public_html assets. Hosting itself needs only PHP/MySQL.

Validation performed: production frontend build; TypeScript check; PHP syntax checks; 23 executable backend checks using PHP and an in-memory SQLite test adapter covering access controls, requests, token reuse, password reset, image processing and rate limits. MySQL installation, actual WebSpaceKit configuration, real SMTP delivery and device installation have not been tested on your hosting account. Complete the launch checks above before inviting real staff.

Tests: php tests/lint.php and php tests/run.php (test runner additionally needs PDO SQLite and GD). Test data stays in memory.