# Installer Wizard Design

## /install

### Step 1 — Requirements
Check:
- PHP version
- required PHP extensions
- storage/bootstrap cache write permissions
- APP_KEY support
- HTTPS recommendation
- database drivers
- optional Redis
- optional Python
- optional queue worker capability

### Step 2 — Database
Fields:
- DB host
- port
- database
- username
- password

Actions:
- test connection
- refuse to continue on failure

### Step 3 — Company
- business name
- support email
- phone
- currency
- timezone
- logo (later)

### Step 4 — Super Admin
- full name
- email
- phone
- strong password
- transaction PIN configured after first login

### Step 5 — Install
- write .env safely
- generate APP_KEY
- migrate
- seed roles/settings
- create super admin
- create wallet
- cache config/routes where supported
- run health test

### Step 6 — Lock
Create `storage/app/installed.lock`.

Any future request to `/install` must return 404/locked unless the lock is
deliberately removed by the server owner.

## Security requirements
- Never display database password again after submit.
- CSRF protection.
- Rate limit installer.
- Installation only allowed when lock file absent.
- Do not accept remote arbitrary shell commands.
- Do not store API secrets in source code.