# Lightweight Login / Dashboard Fix

## What was fixed
- Replaced the login page with a lightweight responsive page using no jQuery, Toastr, Tailwind runtime, or login background image.
- Login uses `fetch()` and waits for the server-side session to be saved before redirecting.
- Authentication regenerates the session after successful login to prevent session fixation.
- Login history no longer waits for the external ipinfo service, so login is not delayed by a third-party request.
- Logout now reliably destroys the session and clears the session cookie.
- Dashboard queries run in parallel and safely handle NULL balances/missing agents.
- Dashboard is protected against stale/deleted sessions and redirects super-admin agents to `/app/agent`.
- MySQL connection pool reduced from 1000 to 20 connections.
- Expired session cleanup changed from every 5 seconds to every 60 seconds.
- API CORS preflight (`OPTIONS`) is allowed through authentication middleware.
- Trailing-slash login URLs are handled correctly.
- Fixed the model-loader filename check.
- All JavaScript files pass `node --check`; endpoint audit passes with 61 API endpoints.

## cPanel deployment
1. Upload/extract the ZIP.
2. Run `npm install --omit=dev`.
3. Copy `.env.example` to `.env`.
4. Generate secrets with `npm run generate:secrets` and put the generated values into `.env`.
5. Set the real MySQL values in `.env` and make sure the database user has permission to create/use the configured database.
6. Set `AAS_ENDPOINT` to the real API endpoint.
7. Set `CORS_ORIGINS` only if requests will come from a different browser origin.
8. Run `npm run check`.
9. Start the application with `npm start` or configure the cPanel Node.js application to run `index.js`.

## Important
The ZIP does not contain a real production `.env`, database password, or external provider credentials. Those values must be supplied on the server.