# Mobile data collection

Field team interface: **list → add/edit members you captured**, minimal chrome, phone-friendly.

## URLs

- **Sign in (recommended):** `/mobile/login` (pretty URL via `index.php`).
- **Sign in (direct file):** `/mobile/login.php` also works — loads `init.php` so config + DB are available.
- **App home (direct folder):** `/mobile/`, `/mobile/index.php`, or `/mobile/app.php` — all load the same router as `/mobile`.
- Desktop `/login` still blocks mobile devices for other roles.
- **App (routed):** `/mobile` — **directory of all active members** (search by name, phone, membership no.). Tap a row to open **details**; use **Edit** in the header (or the button at the bottom) to open the form. Rows you created are labelled **Your entry**.
- **New:** `/mobile/new`
- **View:** `/mobile/view/{id}` — full summary for an active member.
- **Edit:** `/mobile/edit/{id}` — opened from the view screen via **Edit** (any **active** member; not deceased).

## Admin setup

1. **Users → Add user** → role **Data collection (mobile field app)**.
2. Share the **mobile login URL** with the team: `{your-site}/mobile/login`.
3. Default password is the same as other restricted roles (see Users page / `DEFAULT_USER_PASSWORD` in code); they must change it on first login if `must_change_password` is set.

## Database

`members.created_by` and `members.updated_by` reference `users.id`. They are added automatically on first use (see `includes/members_audit_columns.php`).

Records entered before this feature have `created_by` NULL and **will not appear** in the mobile “My entries” list until a clerk/admin updates them or you re-enter them.

## Security

- **Session cookie:** The app uses a **browser session cookie** (no fixed expiry). PWAs often **keep that cookie** after the app is swiped away, so we add a **PWA gate**: in **standalone / fullscreen** mode, each screen checks for `sessionStorage` key `naz_m_pwa`. After a successful login, **`/mobile/establish`** sets it; when the OS clears storage (typical after a full app close), the next open hits **`session-end.php`** and clears the server session so users must sign in again. **Safari/iOS** may sometimes keep storage longer than the cookie—behaviour varies by OS version. **Regular mobile browser** (not installed PWA) is unchanged. Idle timeout from **System → Security** still applies.
- `data_collector` users are **redirected to `/mobile`** if they try to open other app pages.
- **Edit** is allowed for **any active member** in the directory. `created_by` is set on **new** records only; updates set `updated_by`. Deceased members cannot be edited on mobile.

## Progressive Web App (PWA)

The mobile screens register as an installable app (Add to Home Screen / Install app):

- **`mobile/manifest.php`** — Web App Manifest (`name`, `short_name`, `scope` `/mobile/`, `standalone`, theme colours, icons from **`mobile/assets/img/192.png`** and **`512.png`**).
- **`mobile/sw.js`** — Service worker (scope `/mobile/`): precaches **`offline.html`** and shows it when a **navigation** request fails (e.g. no network).
- **`mobile/pwa-head.php`** — Shared manifest link, `theme-color`, Apple web-app meta, and SW registration (included from login, list, form, view).

**Install:** Open **`/mobile/login`** in Chrome or Edge (Android) or Safari (iOS 16.4+), then use **Install app** / **Add to Home Screen**.

**Production:** PWAs require **HTTPS** (or `localhost` for development). App / install icons live in **`mobile/assets/img/`** (`192.png`, `512.png`). Splash and on-screen church crest still use **`public/img/logo.png`** where applicable.
