One Hat Cyber Team

View File Name : AGENTS.md

# Barbearia Prime — AGENTS.md

## Stack
- PHP 8.2 + MySQL (MariaDB 10.4), XAMPP
- DB: `barbearia_db` on localhost root / no password
- AdminLTE 4 + Bootstrap 5 + custom glassmorphism dark/light CSS
- FullCalendar 6 (drag & drop, `locale: 'pt-br'`)
- PHPMailer (`includes/phpmailer/`)
- Meta WhatsApp Business API (per-empresa credentials)

## Structure
- `config/database.php` — DB connection + `getEmpresaId()` (supports super_admin impersonation via `$_SESSION['admin_empresa_id']`)
- `includes/` — `header.php` (sidebars, theme inline script), `footer.php`, `functions.php`, `auth.php` (role checks), `email.php`, `whatsapp.php`
- `public/` — per-feature pages (admin/barber dashboard)
- `admin/` — super admin only (backup, planos, empresas, email_config)
- `api/` — AJAX endpoints (CRUD, AI, WhatsApp webhook, lembretes cron)
- `sql/schema.sql` — full DB schema. Run `setup.php` after schema changes to add tables/columns
- `assets/css/modern.css` — all custom styling (components, animations, light/dark overrides)

## Theme
- `localStorage` key `tema` (`'dark'` / `'light'`). Inline `<script>` in `<head>` applies before first paint.
- `data-bs-theme` on `<html>`. `modern.css` uses `[data-bs-theme="light"]` selectors for overrides.

## Access Control
- `includes/auth.php`: `requireAuth()`, `requireAdmin()`, `requireSuperAdmin()`, `requirePermissao('chave')`
- Types: `super_admin` (cross-company), `admin` (per-company), `profissional`, `cliente`
- `hasPermissao('financeiro')` etc — permissions come from `grupos` table JSON column

## Authentication
- `login.php`, `logout.php`, `register.php`
- Forgot password: `recuperar.php` → email token → `redefinir.php`
- SMTP: super admin configures global at `admin/email_config.php`; per-empresa SMTP at `config_empresa.php`
- New accounts need admin approval (`empresas.aprovado`); super admin can auto-release via webhook

## AI
- `public/prompts.php` + `api/ia_executar.php`
- Per-empresa API keys in `configuracoes` (OpenAI, Gemini, Claude)
- Model selection per prompt via `ia_prompts.modelo` column; JS `atualizarModelos()` populates select dynamically

## What to Always Run
- **After any PHP edit**: `php -l "C:\xampp\htdocs\barbearia\{path}"` to check syntax
- **After DB schema changes**: visit `http://localhost/barbearia/setup.php` to apply new tables/columns

## Currency / Mask
- All Brasucas `mascara-valor` fields use `R$` prefix with `.` thousand sep and `,` decimal
- JS mask in each page's inline `<script>` — centavo-based (`"30000"` → R$ 300,00)
- Backend parsing: `str_replace(',', '.', str_replace(['R$', ' ', '.'], ['', '', ''], $value))` — remove mask chars **first**, then convert comma to dot

## Modal Patterns
- `abrirModal('id')` to show; `data-bs-dismiss="modal"` to close
- Nested PHP + JS: build row HTML in PHP, `json_encode()` into JS variable (`PARCELA_HTML`), never put `<?php` inside nowdoc JS strings

## Forms & Validation
- Agendamentos overlap: server-side check `hora < ? AND hora_fim > ?` in INSERT/UPDATE endpoints
- Caixa/PDV: `$_SESSION['caixa_ativo_id']` tracks active caixa; single-open-per-user; minimize unsets without closing
- Venda split payment: `formas_pagamento_id[]` + `valor_parcela[]` arrays; sum must equal total
- Suporte responses: static HTML with `display:none` toggle (not dynamic innerHTML); attachments stored with `modelo='suporte_resposta'`

## Cron / Scheduled
- Lembretes: `api/lembretes_processar.php?token=seu-token` — dispatches email/WhatsApp reminders based on `lembretes_config` rules
- Campaigns: `api/campanhas_enviar.php` — loops active clients, sends via per-empresa SMTP

## Meta WhatsApp API
- Per-empresa: `waba_phone_id`, `waba_token`, `waba_business_id`, `waba_webhook_token` in `configuracoes`
- Webhook: `webhook/whatsapp.php` (GET verify + POST receive)
- Helpers in `includes/whatsapp.php`: `enviarWhatsAppMeta()`, `enviarTemplateWhatsApp()`

## Key Conventions
- **No inline comments in code** unless asked
- **No emojis** in code or communication unless asked
- ALL dates use `DateTime` + `formatarData()` / `formatarDataHora()` helpers
- `sanitize()` wraps `htmlspecialchars()` for output
- Redirects use `redirect($url)` helper (calls `exit`)
- Sidebar links in `includes/header.php`