# o2switch Deployment Checklist

## Upload

Upload the deployment zip contents to your Node app root on o2switch.

Do not upload:

- `.env`
- `auth/`
- `node_modules/`

## cPanel Node.js App

Create or edit the Node.js app:

- URL: `wa.toptravel.ma`
- App root: the uploaded `toptravel-wa-automation` folder
- Startup file: `src/server.js`
- Node version: `20+`
- Mode: `production`

Then run:

```bash
npm install --omit=dev
```

## Environment Variables

Set these in cPanel. Generate new secrets; do not use local dev values.

```env
NODE_ENV=production
PUBLIC_BASE_URL=https://wa.toptravel.ma
FORCE_HTTPS=false
JSON_BODY_LIMIT=64kb

WEBHOOK_SECRET=GENERATE_A_LONG_RANDOM_SECRET
REQUIRE_WEBHOOK_SIGNATURE=true
WEBHOOK_SIGNATURE_TOLERANCE_SECONDS=300

ADMIN_USER=GENERATE_A_PRIVATE_ADMIN_USERNAME
ADMIN_PASSWORD=GENERATE_A_LONG_RANDOM_PASSWORD
ADMIN_SESSION_SECRET=GENERATE_ANOTHER_LONG_RANDOM_SECRET

ALLOWED_WEBHOOK_IPS=
DRY_RUN=true
AUTH_DIR=./auth/toptravel
MESSAGE_DELAY_MS=1800
QUEUE_RETRY_DELAY_MS=10000
MAX_MESSAGE_ATTEMPTS=0
MAX_QUEUE_SIZE=100
REQUIRE_OPT_IN=false
WEBHOOK_RATE_LIMIT_PER_MINUTE=60
ADMIN_RATE_LIMIT_PER_MINUTE=30

DEFAULT_COUNTRY_CODE=212
COMPANY_NAME=TopTravel
SUPPORT_PHONE=+212 664 726 044
```

Do not manually add `PORT` or `HOST` in o2switch unless their support panel specifically asks for it. When `NODE_ENV=production` and `PORT` is absent, the app uses Passenger's no-argument `listen()` mode.

Keep `FORCE_HTTPS=false` on o2switch. The public site still uses HTTPS, but Passenger often forwards requests to Node internally as HTTP, so app-level HTTPS enforcement can hide every route behind `404`.

Leave `DRY_RUN=true` for the first production test.

## First Test

1. Restart the Node app.
2. Open `https://wa.toptravel.ma/healthz`.
3. Open `https://wa.toptravel.ma/admin/status`.
4. Open `https://wa.toptravel.ma/admin/qr`.
5. Scan the QR with WhatsApp.
6. Submit one booking from WordPress.
7. Confirm the app returns success and no real message is sent while `DRY_RUN=true`.
8. Set `DRY_RUN=false`.
9. Restart the app.
10. Submit a final test booking and confirm WhatsApp sends.

## Important

Use the exact same `WEBHOOK_SECRET` in:

- o2switch environment variable
- Google Apps Script `WA_WEBHOOK_SECRET`

Keep the WordPress-to-Google `SECRET` separate.

## WordPress Signed-in User Flow

For logged-in WordPress users, the booking form can omit name, email, and phone fields. WordPress should fill those values from the current user profile before saving to Google Sheets and before calling the WhatsApp webhook.

The user should still select the trip and enter `cin`. Send the webhook payload with:

```json
{
  "trip_title": "Akchour randonnée",
  "event_date": "25 mai 2026",
  "full_name": "WordPress User Name",
  "email": "client@example.com",
  "phone": "0660000000",
  "whatsapp": "0660000000",
  "cin": "AB123456",
  "participants": "1",
  "departure_point": "Casablanca",
  "whatsapp_opt_in": "Oui"
}
```

## Client Reconnect Flow

If WhatsApp stops connecting:

1. Open `https://wa.toptravel.ma/admin/qr`.
2. Click **Reset WhatsApp session**.
3. Scan the new QR code from WhatsApp > Linked devices.

The client should not edit environment variables or rename/delete files for normal reconnects.