# Flora and Creations API — clean deployment bundle

This archive contains the full PHP API source with the contact-form patch merged.

## Included update

- `api/Routes/ApiRoutes.php` registers `POST /api/contact`.
- `api/Controllers/PublicApi/ContactController.php` validates and rate-limits contact submissions.
- `api/Utils/Email.php` sends contact messages through the existing mail configuration.

## Upload procedure

1. Back up the existing cPanel `api/` directory.
2. Upload the `api/` directory from this archive over the existing API directory, preserving paths.
3. Keep the existing live `config/config.php` at `config/config.php`. Do not move it into `api/`; the source code explicitly loads it from that location.
4. Keep the existing database, migrations, uploads, payment-proof files, and `.htaccess` unless you are deliberately managing them separately.
5. If the existing config lacks `mail.contact_to`, add a valid recipient email to the `mail` section. Otherwise the patch falls back to the configured `mail.from_addr` mailbox.
6. Add the production and Vercel Preview origins to the backend CORS allow-list if browser requests need them.
7. After upload, test the contact form with a real submission only when you are ready to send an email.

## Deliberately excluded

- `config/config.php` and all credentials/secrets
- database seed data and migrations
- API logs
- product uploads and payment-proof uploads
- `.env` files and customer data

The accompanying `config/config.example.php` contains placeholders only. Never upload it as the live config without replacing every placeholder.