# Bookmark License Manager

A standalone Laravel + MySQL license manager for JavaScript bookmark tools. Upload a `.js` file in the admin panel, generate a protected loader bookmarklet, and issue device-limited license keys.

## cPanel installation

1. Create a MySQL database and user in cPanel.
2. Upload this project. Point the domain/subdomain document root to the `public` folder. Do not point the public web root at the project root.
3. Run `composer install --no-dev --optimize-autoloader` in the project root using cPanel Terminal/SSH.
4. Copy `.env.example` to `.env` and set `APP_URL`, `APP_KEY`, and the MySQL values. Generate an application key with `php artisan key:generate`.
5. Set a strong `ADMIN_EMAIL` and `ADMIN_PASSWORD` in `.env`, then run `php artisan migrate --seed`.
6. Make sure `storage` and `bootstrap/cache` are writable. Run `php artisan storage:link` if your hosting requires it.
7. Visit `/admin/login`, upload a JavaScript tool, and use **Get loader** to copy the generated bookmarklet.

The loader uses a small cross-origin API request because it is launched from whatever page the customer is viewing. The included API CORS middleware is intentional and is limited to the two POST endpoints; no admin session or tool file is exposed by CORS.

## Important security notes

- The original JavaScript is stored outside the public folder and is returned only after a valid activation.
- License keys are stored as SHA-256 hashes. The complete key is displayed only once when created.
- The generated loader includes the full `APP_URL`, so set that correctly before generating loaders.
- Use HTTPS in production. Browser bookmarklets and cross-origin requests are unreliable over plain HTTP.
- A JavaScript tool can always be inspected by a determined user after it runs in their browser. This system controls access and activation; it cannot make client-side JavaScript impossible to copy.
- Expiry and disabling are enforced on every activation and protected-script request. A script already running in an open browser tab cannot be remotely stopped by a server; reopening the loader will be blocked after expiry.

## Included features

- Admin sign-in and multiple admin accounts
- JavaScript upload with version history and SHA-256 checksums
- One-click protected loader generation
- Full-screen license activation prompt inside the current page
- License status, expiry, all-tool or per-tool assignment, and device limits
- Activation and popular-tool statistics
- Telegram support link configured as `@mrzoon75`