# ProInvoice — Release audit (Envato readiness)

Matrix below reflects a static review of this repository. Re-run checks before each upload (especially after code changes).

| Area | Status | Notes |
|------|--------|--------|
| **Web installer** | **Pass** | Routes under `/install`: requirements, DB, license, optional demo data, completion (`routes/installer.php`). |
| **Fresh install / shared hosting** | **Pass** | Standard Laravel deploy: PHP 8.1+, MySQL, `public` as docroot, writable `storage` & `bootstrap/cache`. Installer handles `.env` and migrations. |
| **PHP requirements check** | **Pass** | `App\Installer\Services\RequirementsChecker` (version, extensions, writable dirs). |
| **`.env.example` completeness** | **Pass** | Template documents core app, DB, session, cache, queue, mail, SMS, WhatsApp; production hints included. |
| **`APP_DEBUG` default (runtime)** | **Pass** | `config/app.php` defaults `env('APP_DEBUG', false)`. |
| **`.env.example` debug default** | **Pass** | `APP_DEBUG=false` with comment to enable only for local troubleshooting. |
| **Dev tools in production deps** | **Pass** | Breeze, Sail, Pint, PHPUnit remain `require-dev`; use `composer install --no-dev` on production. |
| **Telescope / Horizon / Debugbar** | **Pass** | Not bundled in `composer.json`. |
| **Public “test” HTTP routes** | **Pass** | No public debug routes; “test” endpoints are authenticated admin settings (email/SMS/WhatsApp/gateway). |
| **Health endpoint** | **Pass** | Laravel `GET /up` registered in `bootstrap/app.php`. |
| **Security headers** | **Pass** | `App\Http\Middleware\SecurityHeaders` on web stack. |
| **CSRF / sessions** | **Pass** | Laravel defaults; `APP_URL` must match browser URL to avoid 419 (documented in `.env.example`). |
| **Rate limiting** | **Partial** | `RateLimitMiddleware` exists but is **not** wired to `routes/web.php` by default; consider attaching to `login`, password reset, and public invoice/quotation routes before high-traffic launch. |
| **Secure uploads** | **Pass** | `SecureFileUploadService` used in parts of admin; keep `storage/app` non-public except `public` disk + symlink. |
| **Installer integrity middleware** | **Pass** | `VerifyInstallerIntegrity` + `INSTALLER_SKIP_INTEGRITY_CHECK` escape hatch in `config/installer.php`. |
| **Licensing / purchase code** | **Pass** | Installer license step + `App\Licensing` services (verify behaviour matches your Envato item policy). |
| **Versioning** | **Pass** | `config/version.php` + `APP_VERSION` env; `updates:check` scheduled in `routes/console.php`. |
| **Update / migration story** | **Partial** | Migrations ship with app; document backup + `php artisan migrate --force` (see `UPDATE_GUIDE.md`). No built-in rollback of DB. |
| **Queue / cron** | **Partial** | `QUEUE_CONNECTION=database` default; document `php artisan queue:work` + cron for `schedule:run` (see `INSTALLATION.md`). |
| **Documentation bundle** | **Pass** | `README.md`, `INSTALLATION.md`, `UPDATE_GUIDE.md`, `ENVATO_SUBMISSION_CHECKLIST.md`, this file. |
| **Packaging / folder layout** | **Pass** | `scripts/build-envato-release.sh` produces `Documentation/`, `Application/`, `License/`. |
| **Demo / seed data** | **Pass** | Optional at installer step; seeders use fictional demo data — do not ship real customer PII. |
| **Production verification CLI** | **Pass** | `php artisan system:security-check` (debug, permissions, `.env` exposure, HTTPS, etc.). |

### Commands buyers should run after deploy

```bash
composer install --no-dev --optimize-autoloader
php artisan key:generate
# Migrations: run via web installer (database step Save) or `php artisan migrate --force` if testing headless
php artisan storage:link
php artisan config:cache
php artisan route:cache
php artisan view:cache
php artisan system:security-check
```

### Fresh install simulation (maintainer)

See `ENVATO_SUBMISSION_CHECKLIST.md` § “Pre-upload verification”.
