major fix

.kilo/plans/1786038462633-db-routes-fix.md

@@ -0,0 +1,75 @@
+# Fix database connection and route navigation
+
+## Context
+
+Two unrelated defects are breaking the app on Laragon (Windows, Apache, PHP, MySQL/MariaDB):
+
+1. **Database connection fails.** `config/database.php` reads `MYSQLHOST`/`MYSQLUSER`/`MYSQLPASSWORD`/etc. via `getenv()`. PHP under Apache/CGI on Laragon does **not** expose a project `.env` file to `getenv()` automatically — only the real OS environment. There is no `vlucas/phpdotenv` or `apache_setenv` call. The `.env` file at the project root is therefore ignored, so `getenv("MYSQLHOST")` returns `false`, and the PDO DSN is malformed (`host=;dbname=unimarket;port=3306;…`).
+2. **Broken navigation links.** `index.php` links to `/public/customer/products/browse.php` and `/public/owner/dashboard.php`, but the actual folders live at `/customer/…` and `/owner/…` (no `public/` prefix). `includes/sidebar.php` references a `BASE_URL` constant that is never defined anywhere. Header/sidebar links will render as `/owner/products/list.php` (no host) or as the literal text `BASE_URLowner/…`.
+
+The `.env` file is otherwise correct: `MYSQLHOST=127.0.0.1`, `MYSQLUSER=root`, `MYSQLPASSWORD=` (empty), `MYSQLPORT=3306`, `MYSQLDATABASE=unimarket`. Database `unimarket` is created by `unimarket.sql`.
+
+## Decisions
+
+- **DB fix approach:** Add a small inline parser for `.env` in `config/database.php` (no new dependency). On first call it loads `/path/to/project/.env`, sets values into `$_SERVER`, `$_ENV`, and `putenv()`, then continues to use `getenv()`. This is the minimum change that keeps `getenv()` calls working everywhere else and avoids pulling in Composer.
+- **Routes approach:** Fix the offending links to use the real paths (`/customer/…`, `/owner/…`, `/admin/…`) and define `BASE_URL` once. Do **not** rename folders or add a `public/` rewrite — that conflicts with the `guide.txt` layout.
+- `Unimarket/includes/sidebar.php` is a duplicate/stale file; we will not edit it (it is not referenced by any page). It is flagged in the risks so the team can delete it.
+
+## Tasks
+
+### 1. `config/database.php` — load `.env` before reading env vars
+- Add a function `loadEnv($path)` that:
+  - Returns silently if file missing or unreadable.
+  - Skips blank lines and `#` comments.
+  - For `KEY=value` lines, calls `putenv("$KEY=$value")`, sets `$_ENV[$KEY]`, and `$_SERVER[$KEY]`.
+  - Honors double-quoted values (strips quotes) and leaves empty values as `""`.
+- Call `loadEnv(__DIR__ . '/../.env')` before the `getenv()` reads.
+- Keep existing `try/catch` so a real connection failure still shows the message.
+
+### 2. `index.php` — fix two hero buttons
+- Line 153: `/public/customer/products/browse.php` → `/customer/products/browse.php`
+- Line 155: `/public/owner/dashboard.php` → `/owner/dashboard.php`
+
+### 3. `includes/sidebar.php` — define `BASE_URL` and fix trailing slashes
+- At the top of the file (before any output), add a guard that defines `BASE_URL` if not already set:
+  ```php
+  if (!defined('BASE_URL')) { define('BASE_URL', '/'); }
+  ```
+- Note: header.php links use absolute paths starting with `/` already, so sidebar is the only place that needs the constant. The current three links render as `/owner/products/list.php` etc., which is what we want.
+- (Optional but recommended) Remove the third link to `owner/reports.php` because `owner/reports.php` does **not** exist in the repo (see Risks). Decision: keep it for now — out of scope; this task is "fix what is broken", not "remove features".
+
+### 4. `Unimarket/includes/sidebar.php` — flag as stale
+- Do not edit. List in Open Questions so the team decides whether to delete it.
+
+## Files to change
+
+- `config/database.php` — add `loadEnv()` and call it
+- `index.php` — two href fixes
+- `includes/sidebar.php` — add `BASE_URL` guard
+
+## Out of scope
+
+- `Unimarket/includes/sidebar.php` (duplicate, not referenced anywhere)
+- Missing `owner/reports.php`, `owner/manage_orders.php`, `admin/reports.php` — those are separate feature gaps, not routing bugs
+- Composer / phpdotenv adoption
+- CSRF enforcement gaps and other security items
+- `.htaccess` or `public/` rewrite
+
+## Validation
+
+Manual smoke test on Laragon (`http://unimarket.test` or `http://localhost/Unimarket/`):
+
+1. Hit `/index.php` — page loads, no `Database connection failed` banner.
+2. Trending Products section renders up to 6 cards from the `products` table.
+3. From a guest session, both header "Login"/"Register" links open the auth pages.
+4. Log in as an owner; click "Go to Dashboard" hero button — lands on `/owner/dashboard.php` (not 404).
+5. Log in as a customer; click "Browse Products" — lands on `/customer/products/browse.php`.
+6. From the owner sidebar, "Products" and "Orders" links open their list pages without "BASE_URL" appearing in the URL or the rendered HTML.
+7. Confirm by viewing source of any owner page that no literal string `BASE_URL` appears in `href` attributes.
+
+## Risks / open questions
+
+- **Stale duplicate file:** `Unimarket/includes/sidebar.php` mirrors `includes/sidebar.php` and still uses `BASE_URL`. Recommend deleting the entire `Unimarket/` subfolder — confirm with team before doing so.
+- **Empty `MYSQLPASSWORD`:** Laragon default MySQL root has no password; the `getenv("MYSQLPASSWORD") ?: ''` works once `.env` is loaded. If a teammate's MySQL root *does* have a password, they must set `MYSQLPASSWORD="theirpass"` in `.env`.
+- **`owner/reports.php` referenced but absent:** clicking the "Reports" sidebar link will 404. Flagged for the team; not fixed here.
+- **No tests exist** in the repo, so validation is manual only.