# Nadiplayer cPanel Upgrade Kit — v1.0.6

This kit upgrades your existing cPanel install with:
* admin-controlled **in-app update** popup
* **Help & About** card, **WhatsApp contact**
* editable **privacy policy** and **creator info**
* **Inline Preview Player** toggle (Live TV)
* **External / Internal player** mode switch
* **NEW in v1.0.6** — full **Stalker / MAC portal** support (admin can now
  save shared Stalker portals next to Xtream / M3U; users can also add
  their own personal Stalker profiles in the AddServer dialog).

**No database change required.** Your `settings` table already stores
JSON, so the new fields are added on first read automatically.

---

## What's inside

```
nadiplayer-update-kit/
├── index.html                      ← new web bundle entry
├── assets/                         ← new web bundle (CSS + JS)
└── api/
    ├── index.php                   ← routes /api/public/app-info AND /api/stalker/*
    └── routes/
        ├── admin.php               ← saves the new fields when you click Save
        ├── public.php              ← serves /api/public/app-info
        └── stalker.php             ← NEW · Stalker / MAC portal proxy
                                       (handshake, channels, VOD, resolve)
```

---

## How to upload (5 minutes)

Assuming your existing install lives at:
`public_html/4kmovies.vip/nadiplayer/`

### Option A — File Manager (easiest)

1. Open **cPanel → File Manager** → navigate to
   `public_html/4kmovies.vip/nadiplayer/`
2. **Backup first** (right-click `api` folder → Compress → download the
   `.zip`). Optional but smart.
3. Delete the existing `nadiplayer/assets/` folder.
4. Upload the contents of this kit, **preserving folder structure**:
   - `index.html` → overwrites the old one
   - `assets/` → upload the whole folder
   - `api/index.php` → overwrites the old one
   - `api/routes/admin.php` → overwrites the old one
   - `api/routes/public.php` → overwrites the old one
   - `api/routes/stalker.php` → **NEW · upload this file** (didn't exist
     before v1.0.6)
5. **Do NOT touch** `api/config.php` — it has your DB credentials.
6. **Do NOT touch** `api/.htaccess`, `api/lib/`, the rest of `api/routes/`.

### Option B — FTP / SFTP

Same idea — sync only the 5 files above. Don't sync the whole folder
or you'll wipe `config.php`, `.htaccess`, etc.

### Option C — Git pull (if you `git clone`d the repo on the server)

```bash
cd public_html/4kmovies.vip/nadiplayer
git pull origin main
# then re-copy api/ + assets/ + index.html from the cpanel_build_php/
# folder of the repo
```

---

## How to verify it worked

### 1. Public endpoint should respond (no login)

```bash
curl https://4kmovies.vip/nadiplayer/api/public/app-info
```

Expected JSON shape:

```json
{
  "update": {
    "enabled": false,
    "latest_version": "1.0.0",
    "min_supported_version": "1.0.0",
    "apk_url": "",
    "play_url": "",
    "changelog": ""
  },
  "creator": {"name": "", "role": "", "avatar_url": "", "bio": ""},
  "support": {
    "whatsapp_number": "+1234567890",
    "whatsapp_message": "Hi, I need help with Nadiplayer.",
    "email": ""
  },
  "privacy_policy_text": "Nadiplayer respects your privacy..."
}
```

If you see this → backend upgrade is done.

### 2. Admin save round-trip

```bash
# Get an admin token
TOKEN=$(curl -s -X POST https://4kmovies.vip/nadiplayer/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}' \
  | php -r 'echo json_decode(file_get_contents("php://stdin"),true)["access_token"];')

# Save a test value
curl -X PUT https://4kmovies.vip/nadiplayer/api/admin/settings \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"app_version":"1.5.0","update_enabled":true,"creator_name":"Vlog Nadi"}'

# Confirm it stuck
curl https://4kmovies.vip/nadiplayer/api/public/app-info
# → should now return "latest_version":"1.5.0", "name":"Vlog Nadi"
```

### 3. Open the admin web UI

Go to `https://4kmovies.vip/nadiplayer/admin` (or wherever your admin
URL is) → log in → you should now see three new editor sections:

- **In-App Update** (latest version, min supported, APK URL, Play
  Store URL, changelog, Enabled toggle)
- **Creator Info** (name, role, avatar URL, bio)
- **Support & Privacy** (support email, WhatsApp message, privacy
  policy text)

Fill them, click **Save Settings**, refresh the page, fields persist.

---

## Troubleshooting

### "When I click Save, nothing changes / error 500"
Check `api/error.log` (created in the same folder as `config.php`)
or cPanel → Errors. Most likely: file permissions. The web server
needs read access to `routes/admin.php` (644 is fine).

### "POPUP doesn't show on my Android APK"
- Make sure you set **Enabled = ON** in admin AND
- `Latest version` is greater than the version baked into the APK
  (read from `frontend/package.json#version` at build time, currently `1.0.0`)
- For the APK to also be able to **auto-install** the update (instead
  of just opening the URL), you need to rebuild the APK from the
  current repo `main` branch — the new `ApkInstallerPlugin.java` is
  not in your old APK.

### "I want to revert the upgrade"
Replace the 5 modified files with the backup zip you took before
upload. Database is unchanged, so your data is safe.

---

## What's new for users (post-upgrade)

When `update_enabled = true` AND user's installed version < admin's
`latest_version`:

- **Optional update** (installed ≥ `min_supported_version`):
  popup with **"Download update"** button + **"Later"** to dismiss
- **Forced update** (installed < `min_supported_version`):
  blocking popup, no close, no Later — user must update to continue

On Android (rebuilt APK only) the **"Update now"** button downloads
the APK in-app with a progress bar and triggers the system installer.
On web/iOS/TV the popup opens the URL in the browser.

The Account page also now shows **Help & About** with the app version,
a Privacy Policy link, the creator card, and a small floating
**WhatsApp** button using the number + prefilled message you set in
admin.
