# Baco Beauty Hub — Unified Directory Blueprint (Phase 1)

Brand: **Baco Beauty Hub** (logo: hot pink + black circular mark)  
Stack: Native PHP 8.2+ · MySQL · TailwindCSS storefront · Flutter app · Shared CMS/API

---

## cPanel / subdomain / add-on domain strategy

Point the **document root** of the subdomain or add-on domain to:

```text
baco-beauty-hub/public/
```

Everything outside `public/` (config secrets, includes, storage logs, Flutter source) stays non-web-accessible when the host supports a custom document root.  
On hosts that force `public_html` as root, deploy the contents of `public/` into `public_html/` and place `../config`, `../includes`, etc. one level above (installer will document both paths).

---

## Root tree

```text
baco-beauty-hub/
├── sql/
│   └── schema.sql                 # Phase 1 MySQL schema (this deliverable)
│
├── docs/
│   ├── DIRECTORY_BLUEPRINT.md     # This file
│   └── INSTALL.md                 # (Phase 2+) cPanel install notes
│
├── brand-assets/                  # Source logo + hero photography (not public)
│   ├── logo.png
│   ├── hero-circle-frame.png
│   ├── hero-flatlay-1.png
│   ├── hero-skincare-marble.png
│   ├── hero-skinn-products.png
│   ├── hero-wood-flatlay.png
│   ├── hero-blue-flatlay.png
│   └── hero-white-luxury.png
│
├── config/                        # Outside web root
│   ├── env.example.php
│   ├── env.php                    # (gitignored) DB + JWT + payment secrets
│   └── app.php                    # Paths, timezone, CORS origins
│
├── includes/                      # Shared PHP core (CMS + storefront + API)
│   ├── bootstrap.php
│   ├── Database.php               # PDO singleton, prepared statements only
│   ├── Auth/
│   │   ├── Jwt.php
│   │   ├── Password.php
│   │   └── Csrf.php
│   ├── Security/
│   │   ├── Input.php
│   │   └── HtmlSanitizer.php
│   ├── Models/                    # Lightweight OOP repositories
│   │   ├── User.php
│   │   ├── Product.php
│   │   ├── Order.php
│   │   ├── Cart.php
│   │   ├── CmsSetting.php
│   │   ├── CmsMenu.php
│   │   ├── CmsBlock.php
│   │   ├── CmsPage.php
│   │   ├── CmsMedia.php
│   │   └── SkinTag.php
│   ├── Services/
│   │   ├── SettingsService.php    # Cached CMS settings for web + /api/config
│   │   ├── RecommendationService.php  # /api/recommendations engine
│   │   ├── CartService.php
│   │   ├── OrderService.php
│   │   └── Payments/
│   │       ├── PaymentGatewayInterface.php
│   │       ├── PaystackGateway.php
│   │       └── FlutterwaveGateway.php
│   └── helpers.php
│
├── storage/                       # Outside web root where possible
│   ├── logs/
│   ├── cache/
│   └── sessions/
│
├── public/                        # ★ DOCUMENT ROOT for subdomain / add-on
│   ├── index.php                  # Storefront front controller
│   ├── .htaccess                  # HTTPS, rewrite, security headers
│   ├── robots.php
│   ├── favicon.ico
│   ├── assets/
│   │   ├── css/
│   │   │   └── app.css            # Tailwind build / CDN bridge
│   │   ├── js/
│   │   │   ├── cart.js
│   │   │   ├── checkout-paystack.js
│   │   │   └── checkout-flutterwave.js
│   │   └── icons/                 # Generated brand icons (SVG)
│   │       ├── cart.svg
│   │       ├── whatsapp.svg
│   │       ├── user.svg
│   │       ├── search.svg
│   │       ├── brush.svg
│   │       ├── droplet.svg
│   │       ├── palette.svg
│   │       ├── lips.svg
│   │       ├── eye.svg
│   │       └── sparkles.svg
│   ├── uploads/                   # CMS-writable media (symlink or direct)
│   │   ├── branding/
│   │   ├── heroes/
│   │   ├── products/
│   │   └── icons/
│   ├── admin/                     # Web Admin CMS dashboard
│   │   ├── index.php              # Dashboard home
│   │   ├── login.php
│   │   ├── logout.php
│   │   ├── .htaccess
│   │   ├── assets/
│   │   ├── branding/              # Logo, favicon, brand colors
│   │   ├── menus/                 # Header / footer / mobile nav
│   │   ├── blocks/                # Homepage heroes & sections
│   │   ├── pages/                 # Privacy, terms, custom pages
│   │   ├── media/                 # Media library (CMS images)
│   │   ├── seo/                   # Global + per-page SEO
│   │   ├── whatsapp/              # Phone + prefilled message
│   │   ├── payments/              # Paystack + Flutterwave keys
│   │   ├── categories/
│   │   ├── products/              # Incl. AI skin-tag mapping UI
│   │   ├── skin-tags/
│   │   ├── customers/
│   │   ├── orders/
│   │   ├── settings/              # Footer, social, store, app version
│   │   └── partials/
│   │       ├── header.php
│   │       ├── sidebar.php
│   │       └── footer.php
│   └── api/                       # Shared JSON API (web + Flutter)
│       ├── index.php              # Router
│       ├── .htaccess
│       ├── auth/
│       │   ├── login.php
│       │   ├── register.php
│       │   └── refresh.php
│       ├── config.php             # Live CMS config (WhatsApp, branding, payments public keys)
│       ├── products.php
│       ├── categories.php
│       ├── cart.php
│       ├── checkout.php
│       ├── orders.php
│       ├── recommendations.php    # POST skin tags → curated products
│       └── webhooks/
│           ├── paystack.php
│           └── flutterwave.php
│
├── views/                         # Storefront PHP templates (outside public)
│   ├── layouts/
│   │   ├── header.php             # Dynamic logo + cms_menu_items
│   │   ├── footer.php             # Dynamic footer + social
│   │   └── whatsapp-widget.php
│   ├── home.php
│   ├── shop.php
│   ├── product.php
│   ├── cart.php
│   ├── checkout.php
│   ├── account/
│   │   ├── login.php
│   │   ├── register.php
│   │   └── orders.php
│   └── page.php                   # CMS pages by slug
│
└── mobile/                        # Flutter app (Baco Beauty Hub)
    ├── pubspec.yaml
    ├── analysis_options.yaml
    ├── lib/
    │   ├── main.dart
    │   ├── app.dart
    │   ├── core/
    │   │   ├── api/
    │   │   │   ├── api_client.dart      # Bearer JWT
    │   │   │   └── endpoints.dart
    │   │   ├── config/
    │   │   ├── theme/                   # Brand pink #FF007F, black, gold
    │   │   └── widgets/
    │   ├── features/                    # Feature-first
    │   │   ├── auth/
    │   │   ├── catalog/
    │   │   ├── cart/
    │   │   ├── checkout/                # Paystack + Flutterwave
    │   │   ├── orders/
    │   │   ├── account/
    │   │   ├── cms_config/              # Fetches /api/config (WhatsApp, branding)
    │   │   └── skin_scanner/            # google_mlkit_face_detection
    │   │       ├── presentation/
    │   │       ├── domain/
    │   │       └── data/
    │   └── l10n/
    ├── assets/
    │   ├── images/
    │   │   └── logo.png
    │   └── icons/
    ├── android/
    └── ios/
```

---

## How the four parts connect

| Layer | Path | Role |
|--------|------|------|
| Shared backend + CMS | `includes/`, `public/admin/`, `public/api/` | One MySQL DB; admin edits branding, menus, media, products, payments; API serves web + app |
| Web storefront | `public/index.php` + `views/` | Tailwind storefront; dynamic logo, nav, footer, WhatsApp from CMS |
| Flutter app | `mobile/` | Catalog/checkout parity; reads `/api/config`; exclusive AI scanner |
| AI recommendations | `mobile/.../skin_scanner` → `POST /api/recommendations` | Tags matched via `product_skin_tags` |

---

## Payment gateways (schema + code homes)

| Gateway | CMS keys (`cms_settings` group `payments`) | Runtime |
|---------|--------------------------------------------|---------|
| Paystack | `payment_paystack_*` | `includes/Services/Payments/PaystackGateway.php` + `public/api/webhooks/paystack.php` |
| Flutterwave | `payment_flutterwave_*` | `includes/Services/Payments/FlutterwaveGateway.php` + `public/api/webhooks/flutterwave.php` |

Public keys are exposed via `/api/config` for web JS and Flutter; secret keys never leave the server.

---

## CMS tables → admin screens (quick map)

| Table | Admin area |
|-------|------------|
| `cms_settings` | Branding, SEO, WhatsApp, Payments, Footer, App |
| `cms_menu_items` | Menus |
| `cms_pages` | Pages |
| `cms_media` | Media library |
| `cms_blocks` | Homepage / storefront blocks |
| `categories` / `products` / `product_images` / `product_skin_tags` | Catalog |
| `skin_tags` / `skin_scans` | AI tags + scan history |
| `orders` / `order_items` / `payments` | Orders & fulfillment |
| `users` | Customers + admins |

---

## Phase gate

**Step 1 (this deliverable):** `sql/schema.sql` + this blueprint + brand assets staged.  
**Next (awaiting your review):** database PDO layer + admin CMS layout shell.