NOORRISE PLUS — EGPay MANUAL RENEWAL PACKAGE
===============================================

WHAT THIS DOES
- Keeps the existing NoorRise HTML app and replaces the non-working Plus payment placeholder.
- Sends payment requests from PHP on your hosting server, not from the browser.
- Uses EGPay's create and verify endpoints.
- Converts $1 USD to BDT using the rate in api/config.php.
- One verified payment gives 30 days of Plus access.
- Renewal is manual. No recurring charge is created.
- Stores subscription status server-side, associated with this browser/device ID.

IMPORTANT BEFORE LIVE USE
1. The API key previously exposed in the old HTML must be revoked/rotated in EGPay.
2. Never paste API key, secret key, or brand key into index.html or public chat.
3. Open api/config.php and replace all three PASTE_YOUR... values with your NEW EGPay credentials.
4. Confirm your EGPay account uses the three headers API-KEY, SECRET-KEY, BRAND-KEY and supports the webhook_url field.
5. The WooCommerce sample supplied with the project is older and uses a different integration shape (API-KEY only, transactionId callback). This implementation follows the API request format you separately supplied (three headers, metadata, success_url, cancel_url, amount) and also accepts transactionId/transaction_id callback names. Test with EGPay sandbox/support before accepting real payments.
6. The API sample does not prove that EGPay will append transactionId to success_url or call webhook_url. If it uses another callback field/parameter, the verification return handling will need that exact field name.

UPLOAD
A. In cPanel > File Manager, open the document root for:
   noorriseapp.arohisamiha.xyz
B. Make a backup of the current index.html.
C. Upload this package's index.html, payment-success.php, payment-cancel.php, and .htaccess into that document root.
D. Upload the whole api folder into the same document root. Do not rename it.
E. Edit api/config.php and enter your NEW EGPay API key, Secret key, and Brand key.
F. Check that PHP cURL is enabled in cPanel (usually Select PHP Version > Extensions).
G. Open https://noorriseapp.arohisamiha.xyz and test the Plus button with EGPay's test mode first.

PRICE
- The package uses 1 USD × 124.15 = 124.15 BDT, the XE mid-market reference checked 30 Oct 2026.
- This is a reference conversion, not necessarily the rate/fees EGPay or your bank applies.
- Change USD_BDT_RATE in api/config.php if you want a different fixed BDT amount.
- EGPay may require whole-number BDT. If it rejects decimals, change the amount rounding in api/create-payment.php to round($amount).

SECURITY / LIMITATIONS
- The API credentials stay in api/config.php and are not sent to the browser.
- Keep the api/data directory protected; its .htaccess denies direct web access on Apache/cPanel.
- This lightweight version grants Plus status to the same browser/device that started checkout. It is not a user-account/cloud-sync system.
- It does not implement automatic renewal, refunds, admin dashboard, or cross-device membership.
- Do not treat the site as production-ready until a real EGPay test payment is completed and the provider's callback behaviour is confirmed.
