# Nexo Player backend

The backend requires PHP 8.1+, MySQL 5.7+/MariaDB 10.3+, PDO MySQL, cURL and OpenSSL.

Configuration is read from environment variables. Use the root `.env.example` as the complete
reference; the application intentionally does not commit database, admin or Stripe credentials.

## Commands

```bash
# Existing database
php bin/migrate.php
php bin/encrypt-playlist-secrets.php

# Generate an admin password hash
php -r "echo password_hash('change-me', PASSWORD_DEFAULT), PHP_EOL;"
```

For a new database import `schema.sql` instead of running historical migrations.

Devices created before per-install tokens have a null `device_token_hash`. Keep
`ALLOW_LEGACY_DEVICE_CLAIM=false` normally. Enable it only during a short supervised
migration window while the trusted TV devices reconnect, then disable it again.

## Endpoints

- `api/device.php`: authenticated device registration/status and short-lived tokens.
- `api/playlist.php`: authenticated playlist management.
- `api/sync.php`: synchronized settings, favorites, progress and lock hashes.
- `api/iptv_proxy.php`: restricted text/XML/metadata proxy.
- `api/stream_proxy.php`: restricted paid-access media proxy.
- `api/create_checkout.php`: Stripe Checkout session creation.
- `stripe_webhook.php`: signed and idempotent payment activation.
- `admin.php`: secure administration and audit log.
- `dashboard.php`: temporary signed customer portal.
