# Royal Hotel Self-Hosted Payment Platform

## Overview
This is YOUR payment system. No third-party APIs like Razorpay, Stripe, or PayPal.
You are the primary authority. You control everything.

## Key Features
- **No Third-Party Dependency**: Everything is self-hosted
- **API Key Management**: Generate and revoke keys for external access
- **Internal Transaction Verification**: SHA-256 token-based security
- **Manual & Online Payment Support**: Cash, Card, UPI, Net Banking, Wallet, Cheque
- **Refund Processing**: Full and partial refunds
- **Transaction History**: Complete audit trail
- **Owner Controlled**: Only you can generate API keys and manage the platform

## Security
- Transaction tokens (48-byte random hex) prevent tampering
- API keys are hashed with SHA-256 + secret salt
- API secrets use bcrypt hashing
- All payments verified with internal token matching
- CSRF protection on all forms

## How It Works
1. Admin creates a payment order (generates unique order ID + transaction token)
2. Staff/guest confirms payment with reference ID
3. System verifies transaction token matches
4. Payment is recorded and bill is updated
5. Admin can view all transactions and process refunds

## API Access (Optional)
As the owner, you can generate API keys for:
- Mobile apps
- POS terminals
- Third-party integrations
- Partner hotels

Each API key has:
- Read / Write / Admin permissions
- Expiry date
- Usage tracking
- Revocation capability

## Database Setup
```bash
mysql -u your_username -p your_database < payment_schema.sql
```

## Color Theme
- Primary: #0d7377 (Deep Teal)
- Secondary: #0a5c5f (Dark Teal)
- Accent: #14ffec (Bright Cyan)