# Phase 16 — System Settings, Customization and Administration

Phase 16 adds airline-scoped configuration and protected operational administration without weakening the modular-monolith or tenant-security boundaries.

## Files created

- `database/migrations/2026_07_19_000017_create_system_administration_tables.php`
- `app/Core/AirlineSettings.php` and `app/Core/NumberSequence.php`
- Administration controller, repository, and service under `app/Modules/Administration/`
- Settings, health, logs, sessions, and audit views under `resources/views/administration/`

## Files modified

- Web routes, helpers, application and authentication layouts, Tailwind source, upload enforcement, authentication/session behavior, user password validation, crew settings lookup, RBAC seed data, tests, README, and compiled assets
- Expense creation now allocates the configured expense sequence when no number is supplied

## Database migration added

Migration `2026_07_19_000017` creates `airline_settings`, `number_sequences`, `issued_numbers`, `data_export_requests`, and `backup_status_records`. It also adds the optional unique `defect_number` to `aircraft_defects` and seeds eight airline-specific sequences.

## Security controls added

- Every administration operation has both route- and service-level permission enforcement.
- Settings are allowlisted and typed; unsafe accent values, arbitrary CSS, invalid time zones, malformed numbers, and unsupported sequence tokens are rejected.
- Settings are validated before a transactional update and every change is audited.
- Branding uploads use MIME inspection, configured size limits, randomized private-storage paths, and traversal-safe asset delivery.
- Number issuance locks the sequence row on MySQL, records every issued value, and enforces airline-wide number uniqueness.
- Log filenames are allowlisted, log content is escaped, output is capped, and log access is permission protected.
- Session revocation, cache clearing, audit search, health information, and exports are permission protected and audited where state or data disclosure is involved.
- Business exports require a stronger permission than personal-record export and every export request is recorded.

## Tests performed

- `php tests/run.php`: 59 passed, 0 failed.
- Verified transactional setting persistence, airline currency/time-zone synchronization, crew-rest setting consumption, and unsafe theme rejection.
- Verified sequence formatting, incrementing, issuance history, and duplicate-number collision rejection.
- Verified health and migration status, storage usage, cache clearing, logs, sessions, audit filters, CSV exports, RBAC denial, and all administration pages.
- Existing Phase 1–15 behavior remains covered by the full regression suite.

## Remaining known limitations

- The workspace has no configured MySQL connection, so the migration cannot be executed against live MySQL here. Run `php cli migrate` and `php cli seed` in the deployment environment.
- Backup execution is intentionally a status placeholder. A deployment-specific backup provider must populate `backup_status_records`.
- Audit retention is configured but destructive retention cleanup is not run automatically; production should add a reviewed scheduled retention command.
- Branding files are local private uploads. Cloud-backed branding can use the Phase 15 storage-provider interface later.
- Sequence settings and the allocator are available for all eight requested categories. Existing workflows that require an externally assigned reference continue accepting that reference rather than silently replacing it.