# NADIPLAY · Browser Admin Panel (PHP)

A lightweight, **zero-dependency** PHP admin panel that lives on your cPanel server next to the API. Use it from any browser to manage users, settings, the update popup, and the new **delay timer** — without ever opening the mobile app.

---

## What you get

| Page | What it does |
|---|---|
| **Dashboard** | Subscriber counts, devices, current app version + popup status. |
| **Update Popup** | The whole reason you asked for this. Edit the **Latest version**, **Min supported version**, **APK / Play Store URL**, **Changelog**, and the **Popup delay timer (10–14s default)** — exactly what you wanted so you can log in even when a forced update is set. |
| **Settings** | WhatsApp number/message, support email, privacy policy, shared Xtream credentials, external player toggle, creator/about info. |
| **Users** | Create subscribers, change passwords, extend expiries, set per-user Xtream, delete. |

Everything reads/writes the **same database** as your Android/TV app — changes appear in the app instantly (the app polls `/api/public/app-info` every 5 minutes; reload the app to see them right away).

---

## 5-minute install on cPanel

1. **Upload** the entire `admin_panel/` folder to:
   ```
   public_html/<your-domain>/nadiplayer/admin_panel/
   ```
   It should sit right next to your existing `api/` folder, like this:
   ```
   public_html/4kmovies.vip/nadiplayer/
       ├── api/                ← already there (your PHP backend)
       ├── admin_panel/        ← this new folder
       │   ├── index.php
       │   ├── views/
       │   ├── assets/
       │   └── .htaccess
       ├── index.html
       └── …
   ```
   ⚠️ **Make sure to upload hidden files** (`.htaccess`) — toggle "Show Hidden Files" in cPanel File Manager.

2. **No DB setup needed.** It uses the SAME `koreama_nadiplayer` database as your API and the SAME credentials from `api/config.php`.

3. **Open it** in your browser:
   ```
   https://4kmovies.vip/nadiplayer/admin_panel/
   ```

4. **Log in** with the values from `api/config.php`:
   - Username: `admin`
   - Password: `admin123`
   - Change them by editing `api/config.php` — the panel reads from the same place.

That's it. 🎉

---

## How the new "delay timer" fixes your locked-out problem

Before: when admin set `min_supported_version` higher than the bundled APK version, the forced popup appeared immediately on every device — including your phone — and the dialog covered the login form.

Now:

1. The mobile app reads `popup_delay_seconds` from `/api/public/app-info`.
2. It waits **that many seconds** after launch before showing the popup.
3. Default is **10s**. Bump it to **14s** (or more) any time from this admin panel → **Update Popup** → **Popup delay (seconds)** → Save.
4. You'll always have a window to tap **Login** → **admin** → fix anything.

You can also fully disable the popup via the **"Enable update popup"** checkbox while you sort things out.

---

## Security checklist

- [ ] Change `ADMIN_PASSWORD` in `api/config.php` (the admin panel re-uses it).
- [ ] Make sure `.htaccess` got uploaded — protects `views/*.php` from direct access.
- [ ] Optional: add HTTP basic-auth on the folder via cPanel → "Directory Privacy" for an extra layer.
- [ ] Optional: rename the folder from `admin_panel` to something obscure like `admin_panel_x9q2/` and update bookmarks.

---

## Troubleshooting

**"Database connection failed"**
- Confirm `api/config.php` has the correct DB creds. The admin panel reads from there directly.

**"500 Internal Server Error"**
- Check `api/error.log` (created automatically once an error occurs).
- Common cause: missing PHP `pdo_mysql` extension. cPanel → Select PHP Version → Extensions → enable it.

**Login keeps failing**
- Default creds are in `api/config.php` (`ADMIN_USERNAME` / `ADMIN_PASSWORD`). If you changed them there, use the new value here too.

**Popup still appearing instantly after I set 14s**
- The mobile app caches `/api/public/app-info` for up to 5 minutes. Force-quit and reopen the app, or wait 5 min.

---

## File map

```
admin_panel/
├── index.php          ← front controller, routes, POST handlers, login check
├── .htaccess          ← protects views/ and sets DirectoryIndex
├── README.md          ← this file
├── assets/
│   └── style.css      ← gold-on-dark theme matching the app
└── views/
    ├── layout.php     ← sidebar + main shell
    ├── login.php      ← login form
    ├── dashboard.php  ← stats + quick links
    ├── update.php     ← UPDATE POPUP + DELAY TIMER (the new thing!)
    ├── settings.php   ← WhatsApp, privacy, shared Xtream, creator info
    └── users.php      ← create/edit/delete subscribers
```

No Composer. No Node. No build step. Pure vanilla PHP + one CSS file.
