CATRION CAPITAL — RECOVERY BUILD
Generated: 2026-08-09

PURPOSE
This package replaces the mixed-version payment/withdrawal files with one consistent build.
Do not upload only crypto-pay.php from this package while leaving the old Naira-only deposit.php in place.
The deposit, callback, schema helper and withdrawal files are designed to work together.

MAIN FIXES
1. WITHDRAW PAGE / HTTP 500
- Added a central backward-compatible schema layer in includes/global-preferences.php.
- Missing country/language/currency preference columns are added individually instead of using one ALTER TABLE that fails when any column already exists.
- Missing withdrawal binding fields are added individually.
- Missing dual-rail withdrawal tracking fields are added individually.
- Removed the prepared SHOW COLUMNS ... LIKE pattern that could fail on shared MySQL/MariaDB installations.
- Withdrawal remains Naira + Crypto with one pending/processing request at a time.
- Withdrawal password remains exactly 6 digits.
- Crypto withdrawal remains USDT on BEP20 only.
- Balance is reserved immediately when a withdrawal request is created.

2. CRYPTO DEPOSIT
- deposit.php now creates gateway='crypto' deposits before opening crypto-pay.php.
- Dollar deposits use USD as the requested price and store the Naira accounting equivalent using the platform rate.
- Only USD-pegged stablecoin choices are exposed so the selected Dollar amount can also be the exact crypto amount requested.
- crypto-pay.php sends an explicit pay_amount equal to the selected Dollar amount.
- The returned payment id, pay address, currency/network and exact amount are validated and stored.
- The callback URL is:
  https://catrion-capital.com.ng/nowpayments-callback.php
- The IPN signature is verified server-side.
- waiting/confirming/confirmed/sending/partially_paid do not credit the wallet.
- Only a matching final finished payment can credit the wallet.
- Duplicate callbacks cannot credit twice.
- Wrong-asset/re-deposit child payments are held for review instead of auto-crediting.

3. NAIRA DEPOSIT
- The existing working Naira API request/signature/callback flow remains in place.
- Naira deposits start from the same compact deposit.php toggle.
- The OPay deposit warning remains visible to customers without exposing the processor name.
- Successful callbacks credit the user's Naira accounting balance exactly once.

4. ADMIN DEPOSITS
- processed_by/admin_note schema compatibility is handled without blind duplicate ALTER statements.
- Existing older deposit tables can be upgraded without the previous duplicate-column error path.

5. FRONTEND / WHITE LABEL
- Customer pages use neutral terms such as Secure Payment, Naira Deposit and Dollar Deposit.
- Payment-provider branding and API implementation details are not displayed to customers.

DEPLOYMENT
Recommended: upload the COMPLETE recovery build so old/new files are not mixed.
If using the smaller core patch, upload every file in it and preserve its folder structure.

CALLBACKS THAT MUST BE PUBLIC
- Dollar/Crypto: https://catrion-capital.com.ng/nowpayments-callback.php
- Naira collection callback: generated by the Naira payment configuration on the live domain.
- Naira transfer callback: generated by the payout configuration on the live domain.

AFTER UPLOAD
1. Log in and open dashboard.php.
2. Open deposit.php and confirm the Naira/Dollar toggle appears.
3. Start a $3 stablecoin deposit and confirm crypto-pay.php generates an address and exact selected amount.
4. Do not test automatic wallet credit by manually posting to the callback; use a real small payment so the signed IPN path is exercised.
5. Open withdraw.php. It should load even on an installation that previously had only the older withdrawal schema.
6. In Profile, set a 6-digit withdrawal password and bind the required destination before testing withdrawal.
7. Test one small Naira withdrawal through admin and one small USDT BEP20 withdrawal through the admin-reviewed flow.
8. Confirm deposits, withdrawals and wallet transactions appear in admin/history exactly once.

SERVER REQUIREMENTS
- PHP 8.x (the existing Catrion codebase already uses PHP 8 syntax).
- PDO MySQL.
- PHP cURL extension for external payment API calls.
- HTTPS production domain reachable from external callback servers.

LOGGING
If any live API request is rejected, check the hosting error log immediately after reproducing it.
Crypto integration messages are prefixed with [USD Payment].
Do not paste or publish secret API keys from protected configuration files.
