THE LABS GADGET — EXPRESS ATTENDANCE (AFTER CRM FASA 16 / UI REFRESH)
=====================================================================
PURPOSE
- Staff visit https://crm.thelabsgadget.com/attendance-quick.php
- Sign in using EXISTING CRM username + Owner-issued 6-digit ATTENDANCE PIN.
- No CRM Dashboard login required; PIN session cannot grant access to the CRM.
- Clock In and Clock Out MUST have fresh front-camera selfie + GPS within 150 metres.
- GPS reported accuracy must be <= 100 m. Geo check happens SERVER-SIDE before saving.
- Start / End Break does not need selfie (same break records as Fasa 15).
- Store evidence in protected database BLOB. Not an openly addressable photo folder.
- Owner / Accounts-HR can see photos/GPS in attendance-review.php via CRM account.
- Old attendance timestamps remain. No payroll and no financial posting.

CRITICAL: BEFORE UPLOAD
1. Backup ALL website files and export the MySQL/MariaDB database via phpMyAdmin.
2. Back up your CURRENT hr.php separately. This patch replaces hr.php; if your
   installed hr.php contains custom changes, MERGE the two clock-action changes
   rather than blindly overwriting! All other PHP files in this ZIP are NEW.
3. All staff should be informed about collection of selfie/GPS evidence,
   why it is collected, who can see it, retention period and their HR contact.
4. Only deploy over HTTPS. Your phone must grant Camera and Precise Location.

INSTALL
A) Extract this ZIP to SAME DIRECTORY as your existing app.php and hr.php.
   Overwrite: hr.php ONLY. New: attendance-quick.php, attendance-setup.php,
   attendance-review.php, attendance-photo.php, attendance-lib.php,
   upgrade-attendance-express.php, assets/express-attendance.css,
   assets/express-attendance.js, assets/attendance-setup.js.
B) Log in to MAIN CRM as Owner, visit:
   https://crm.thelabsgadget.com/upgrade-attendance-express.php
   Click Activate (creates ea_settings, ea_pins, ea_attempts, ea_evidence).
C) DELETE upgrade-attendance-express.php immediately after successful activation.
D) Owner visits: https://crm.thelabsgadget.com/attendance-setup.php
   Set real shop coordinates: physically stand at shop; click 'Use My Current Location'
   or manually enter reliable known coordinates. Verify before Save.
   Radius is fixed at 150 m. Set selfie retention (30, 60, 90, 180 days).
E) Owner individually sets 6-digit ATTENDANCE PIN for each active staff member.
   Existing username is unchanged. Do not share PINs in group chats.
F) Staff save https://crm.thelabsgadget.com/attendance-quick.php
   to phone Home Screen (Safari Share > Add to Home Screen; Android Chrome menu).
G) HR reviews: https://crm.thelabsgadget.com/attendance-review.php

TEST IN STAGING BEFORE LIVE USE
- Correct PIN + camera allowed + precise GPS allowed: Clock In and Clock Out.
- Off-site >150m must be rejected. Location accuracy >100m must be rejected.
- Reject missing selfie, missing GPS and duplicate active shift.
- Start / End Break remains available. Check Fasa 15 attendance and audit.
- Old hr.php must NOT allow form POST Clock In/Out without selfie/GPS.
- Reset/disable PIN should immediately invalidate existing attendance-only session.
- Verify evidence private (no unauthenticated access) and retention rules.

SECURITY & LIMITATIONS
- Selfie is a camera snapshot, not face recognition or certified liveness detection.
  Phone GPS can be inaccurate, and spoofing is possible on modified devices.
- Automatic selfie deletion happens upon a later portal request (at most daily
  purge checks), after the configured retention threshold; no separate cron.
- Clock/attendance records and audit entries are NOT deleted by photo retention.
- Failed PINs lock a staff account for 15 min after 5 tries; an IP is throttled
  after 25 attempts in 15 min. Session has a 30-min idle / 16-hour max limit.
- Lost camera/GPS permissions: staff cannot bypass through normal hr.php.
  Owner/HR must use documented, auditable manual attendance correction.
- If you have changed ANY HR endpoints beyond the stock Phase 15, review whether
  those endpoints also need clock action restrictions to avoid bypasses.
- Always set up employee notice/consent or other valid Malaysian PDPA basis
  with applicable privacy obligations before collecting staff photos/GPS.

ROLLBACK
1. Restore the previous hr.php backup to re-enable the OLD Clock In/Out flow
   if required, after approving a contingency process.
2. New ea_* tables may remain dormant. Do not drop data during an active payroll
   or HR dispute. Keep secure backup and apply your retention policy.

DB migrations add FOUR tables; do NOT rename tables or change other modules.
