chore: fix config, email access gate, 1Kosmos rebrand, nginx isolation, cleanup

AGENTS.md

@@ -1,48 +0,0 @@
-# AGENTS.md
-
-## Project identity
-- **Name**: idv-demo — Jumio identity verification (KYC/KYB) demo app
-- **Stack**: vanilla PHP (no framework, no Composer), nginx + PHP-FPM
-- **Owner**: customer-engineering / Sechpoint
-
-## Repo setup
-- **Git remote**: `https://git.sechpoint.app/customer-engineering/idv-demo.git`
-- **Credentials**: source `~/bin/.gitenv` for `GIT_USER_NAME`, `GIT_USER_EMAIL`, `GIT_TOKEN`
-- **Default branch**: `main`
-- **Commit prefix convention**: `chore:`
-
-## Architecture (non-obvious)
-
-```
-html/           → web root (deploys as /var/www/html/public — see nginx config)
-  index.php     → single entry point (front controller)
-  class/        → core: config.php, site.php (session init), functions.php
-  app/
-    controler/  → routing: start.php (GET pages), request.php (POST actions)
-    model/      → Jumio API calls: M01.php, M04.php, docv.php, retrival_1.php, retrival_2.php, success.php
-    view/       → .phtml templates (header, footer, pages 00–04, loader, results)
-  cdn/          → static assets (JS includes iovation/IGLOO blackbox)
-  lng/          → language strings: en/ (default), de/
-nginx/           → nginx site config (serves from /var/www/html/public, PHP-FPM via socket)
-```
-
-- **No build tools, no tests, no CI/CD, no package manager** — it's raw PHP.
-- Routing: URL segments drive pages (`$PARAMS[1]` in start.php); POST/GET `do` parameter drives actions (request.php).
-- Jumio workflow: M01 (ID verification) → docv (document verification) → retrival → results.
-
-## Dev mode
-- Hostname starting with `dev` sets `DEBUG = TRUE` (`html/class/config.php` line 28).
-- When DEBUG is true, `debug_log()` writes to `html/log/YYYYMM.log`. The `log/` directory must exist and be writable.
-
-## Secrets warning
-- `html/class/config.php` contains hardcoded Jumio API credentials. **Do not commit to public repos.**
-
-## Nginx
-- Active config: `nginx/default.conf`
-- PHP-FPM socket: `unix:/run/php-fpm.sock`
-- Clean URLs via `try_files $uri $uri/ /index.php?$args`
-- Stale backup files in `nginx/`: `default_old.conf`, `default.conf.bak`, `default.bak.3.conf`
-
-## Gotchas
-- Filename `retrival` is intentionally misspelled (not "retrieval") — used consistently in `retrival_1.php`, `retrival_2.php`, and session keys.
-- `html/` contains `.DS_Store` (macOS artifact) — should be gitignored.

html/app/controler/dev.php

@@ -23,15 +23,10 @@
 if (!empty($PARAMS['2'])) {
   if (DEBUG) {
 	switch ($PARAMS['2']) {
-//==========>>
-		case 'workbanch':
-			include(__ROOT__.'/app/model/workbanch.php');
-			break;
-		//==========>>
 		case 'test':
-			include(__ROOT__.'/app/view/test.html');
+			include(__ROOT__.'/app/view/dev_test.html');
 			break;
- 		//==========>>
+
 		case 'clear':
 			session_unset();
 			session_destroy();

html/app/controler/request.php

@@ -64,6 +64,21 @@ if(!empty($HTML_REQUEST['do'])){
 			exit;
 		break;
 
+		case 'login':
+			include(__ROOT__.'/app/model/login.php');
+			exit;
+		break;
+
+		case 'reset':
+			include(__ROOT__.'/app/model/reset.php');
+			exit;
+		break;
+
+		case 'pwless':
+			include(__ROOT__.'/app/model/pwless.php');
+			exit;
+		break;
+
 		case 'callback':
 			echo "callback";
 			#include(__ROOT__.'/app/model/callback.php');

html/app/controler/start.php

@@ -4,7 +4,7 @@ if (!empty($PARAMS['1'])) {
 //==========>> MENUE OPTIONS
 		case 'home':
 		  include(__ROOT__.'/app/view/_header.phtml');
-			include(__ROOT__.'/app/view/page_00.phtml');
+			include(__ROOT__.'/app/view/page_home.phtml');
 			include(__ROOT__.'/app/view/_footer.phtml');
 		break;
 		case 'one':
@@ -57,11 +57,7 @@ if (!empty($PARAMS['1'])) {
 		break;
 //==========>> FUNCTIONAL OPTIONS
 		case 'dev':
-				include(__ROOT__.'/app/controler/development.php');
+				include(__ROOT__.'/app/controler/dev.php');
-		break;
-
-		case 'q5b35W4M3cWt':
-				include(__ROOT__.'/app/view/dev_demo.html');
 		break;
 
 		case 'clear':

html/app/model/login.php

@@ -0,0 +1,17 @@
+<?php
+	if (!empty($HTML_REQUEST['email'])) {
+		$email = $HTML_REQUEST['email'];
+
+		$stamp = gmdate(DATE_ATOM);
+		$log = '{"timestamp":"' . $stamp . '","event":"access","email":"' . $email . '"}' . PHP_EOL;
+
+		$filename = gmdate("Ym") . '_access.log';
+		$file = __ROOT__ . '/log/' . $filename;
+		file_put_contents($file, $log, FILE_APPEND);
+
+		$_SESSION['SITE']['access'] = 'true';
+	}
+
+	$url_basic = $_SESSION['SITE']['site_url'];
+	header('Location: ' . $url_basic . 'home');
+	exit;

html/app/model/pwless.php

@@ -0,0 +1,11 @@
+<?php
+	$stamp = gmdate(DATE_ATOM);
+	$log = '{"timestamp":"' . $stamp . '","event":"pwless","user_ip":"' . $_SESSION['SITE']['client_ip'] . '"}' . PHP_EOL;
+
+	$filename = gmdate("Ym") . '_access.log';
+	$file = __ROOT__ . '/log/' . $filename;
+	file_put_contents($file, $log, FILE_APPEND);
+
+	$url_basic = $_SESSION['SITE']['site_url'];
+	header('Location: ' . $url_basic . 'results');
+	exit;

html/app/model/reset.php

@@ -0,0 +1,15 @@
+<?php
+	if (!empty($HTML_REQUEST['email'])) {
+		$email = $HTML_REQUEST['email'];
+
+		$stamp = gmdate(DATE_ATOM);
+		$log = '{"timestamp":"' . $stamp . '","event":"reset","email":"' . $email . '"}' . PHP_EOL;
+
+		$filename = gmdate("Ym") . '_access.log';
+		$file = __ROOT__ . '/log/' . $filename;
+		file_put_contents($file, $log, FILE_APPEND);
+	}
+
+	$url_basic = $_SESSION['SITE']['site_url'];
+	header('Location: ' . $url_basic . 'results');
+	exit;

html/app/model/success.php.old

@@ -1,52 +0,0 @@
-<?php
-switch ($_SESSION['TRANSACTION']['MODEL']) {
-  case 'M01':
-    echo "next steps";
-    break;
-
-  default:
-    echo "geting results";
-    $max_retries = 10;
-    $retry_count = 0;
-    $curl = curl_init();
-    curl_setopt_array($curl, [
-      CURLOPT_URL => "https://retrieval.".$_SESSION['SITE']['datacenter']."/api/v1/accounts/".$_SESSION['TRANSACTION']["RETURN"]['accountId']."/workflow-executions/".$_SESSION['TRANSACTION']["RETURN"]['workflowExecutionId']."/status",
-      CURLOPT_RETURNTRANSFER => true,
-  	  CURLOPT_ENCODING => "",
-  	  CURLOPT_MAXREDIRS => 10,
-  	  CURLOPT_TIMEOUT => 30,
-  	  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
-  	  CURLOPT_CUSTOMREQUEST => "GET",
-  	  CURLOPT_HTTPHEADER => [
-  	    "Authorization: Bearer ". $access_token ,
-  	    "Content-Type: application/json",
-  	    "User-Agent: Jumio SE Testing"
-  	  ],
-  	]);
-    // Look to check Jumio Result.
-    do {
-      $response = curl_exec($curl);
-      $err = curl_error($curl);
-      if ($err) {
-        $_SESSION['SITE']['ERROR']="cURL Error #:" . $err;
-        $_SESSION['SITE']['ERROR']['API']=array();
-        $_SESSION['SITE']['ERROR']['API']=$response_json;
-        debug_log("API ERROR",json_encode($_SESSION, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT ));
-        $error_msg=ERROR_501;
-        include(__ROOT__.'/app/view/_header.phtml');
-        include(__ROOT__.'/app/view/page_error.phtml');
-        include(__ROOT__.'/app/view/_footer.phtml');
-        break;
-      } else {
-        $retrival_status=array();
-        $retrival_status=json_decode($response,TRUE);
-      }
-      print_r($retrival_status);
-      if ($retrival_status["workflowExecution"]["status"] === "PROCESSED") { break; }
-      sleep(10);
-      $retry_count++;
-    } while ($retry_count < $max_retries);
-    break;
-}
-//====================================================
-echo '<hr>'.json_encode($_SESSION, JSON_PRETTY_PRINT).'<hr>';exit;

html/app/view/dev_demo.html

@@ -1,30 +0,0 @@
-<!DOCTYPE html>
-<head>
-   <meta charset="UTF-8">
-   <meta http-equiv="X-UA-Compatible" content="IE=edge">
-   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-   <title>Start Jumio Demo</title>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js" integrity="sha256-/H4YS+7aYb9kJ5OKhFYPUjSJdrtV6AeyJOtTkw6X72o=" crossorigin="anonymous"></script>
-    <script src="https://code.jquery.com/jquery-3.6.3.js"></script>
-</head>
-<body>
-  <script>
-    // change below
-    var datacenter = 'emea-1.jumio.ai'
-    var key = '2b2i83jup3eu2tr3tn581kl2dc';
-    var secret = '1vat6laeka5gv8riltk1j0hqlguo80bue3q6gvrnk9u3f2adl39i';
-    // no changes below
-    var token = key + ":" + secret;
-    var hash = btoa(token);  // Base64 Encoding -> btoa
-    var url = 'https://dev.2-4-h.app?do=access&token=' + hash + '&dc=' + datacenter
-
-    function redirectToNewPage() {
-            // Redirect to new page
-            window.location.href = url ;
-          }
-  </script>
-<center>
-  <h2>Please click <button onclick="redirectToNewPage()">Start</button> to initiate your Demo!</h2>
-</center>
-</body>
-</html>

html/app/view/page_00.phtml

@@ -1,10 +0,0 @@
-<?php
-?>
-<div id="form_container">
-  <div class="page_title"><?php echo PAGE_HOME_TITLE; ?></div>
-    <div class="page_content"><?php echo PAGE_HOME_CONTENT_1; ?></div>
-    <div class="page_content"><?php echo PAGE_HOME_CONTENT_2; ?></div>
-    <div class="page_content"><?php echo PAGE_HOME_CONTENT_3; ?></div>
-    <div class="page_content"><?php echo PAGE_HOME_CONTENT_4; ?></div>
-    <div class="page_content"><?php echo PAGE_HOME_CONTENT_5; ?></div>
-</div>

html/app/view/page_02.phtml

@@ -4,7 +4,14 @@
   <div class="page_title"><?php echo PAGE_TWO_TITLE; ?></div>
     <div class="page_content"><?php echo PAGE_TWO_CONTENT_1; ?></div>
     <div class="page_content"><?php echo PAGE_TWO_CONTENT_2; ?></div>
-    <div class="page_content"><?php echo PAGE_TWO_CONTENT_3; ?></div>
+    <br>
-    <div class="page_content"><?php echo PAGE_TWO_CONTENT_4; ?></div>
+    <form action="/" method="post">
-    <div class="page_content"><?php echo PAGE_TWO_CONTENT_5; ?></div>
+      <input name="do" value="reset" type="hidden">
+      <div class="form-group">
+        <label for="email">Email address</label>
+        <input type="email" class="form-control" id="email" name="email" required>
+      </div>
+      <br>
+      <button type="submit" class="btn btn-primary">Reset Password</button>
+    </form>
 </div>

html/app/view/page_03.phtml

@@ -4,7 +4,9 @@
   <div class="page_title"><?php echo PAGE_THREE_TITLE; ?></div>
     <div class="page_content"><?php echo PAGE_THREE_CONTENT_1; ?></div>
     <div class="page_content"><?php echo PAGE_THREE_CONTENT_2; ?></div>
-    <div class="page_content"><?php echo PAGE_THREE_CONTENT_3; ?></div>
+    <br>
-    <div class="page_content"><?php echo PAGE_THREE_CONTENT_4; ?></div>
+    <form action="/" method="post">
-    <div class="page_content"><?php echo PAGE_THREE_CONTENT_5; ?></div>
+      <input name="do" value="pwless" type="hidden">
+      <button type="submit" class="btn btn-primary">Passwordless Login</button>
+    </form>
 </div>

html/app/view/page_home.phtml

@@ -0,0 +1,23 @@
+<?php if ($_SESSION['SITE']['access'] == 'true'): ?>
+<div id="form_container">
+  <div class="page_title"><?php echo PAGE_HOME_TITLE; ?></div>
+    <div class="page_content"><?php echo PAGE_HOME_CONTENT_1; ?></div>
+    <div class="page_content"><?php echo PAGE_HOME_CONTENT_2; ?></div>
+    <div class="page_content"><?php echo PAGE_HOME_CONTENT_3; ?></div>
+    <div class="page_content"><?php echo PAGE_HOME_CONTENT_4; ?></div>
+    <div class="page_content"><?php echo PAGE_HOME_CONTENT_5; ?></div>
+</div>
+<?php else: ?>
+<div id="form_container">
+  <div class="page_title">Welcome to the Demo</div>
+  <div class="page_content">Please enter your email to access the demonstration.</div>
+  <form method="post" action="<?php echo $_SESSION['SITE']['site_url']; ?>">
+    <input type="hidden" name="do" value="login">
+    <div class="mb-3">
+      <label for="email" class="form-label">Email address</label>
+      <input type="email" class="form-control" id="email" name="email" required>
+    </div>
+    <button type="submit" class="btn btn-primary">Access Demo</button>
+  </form>
+</div>
+<?php endif; ?>

html/class/config.php

@@ -31,8 +31,5 @@
 
 	
 // API Credentials for IDV
-	$api_key = '2b2i83jup3eu2tr3tn581kl2dc';
+	define( 'API_DATACENTER' , 'emea-1.jumio.ai');
-	$api_secret = '1vat6laeka5gv8riltk1j0hqlguo80bue3q6gvrnk9u3f2adl39i';
+	define( 'API_TOKEN' , base64_encode('2b2i83jup3eu2tr3tn581kl2dc' . ':' . '1vat6laeka5gv8riltk1j0hqlguo80bue3q6gvrnk9u3f2adl39i'));
-	$api_token = base64_encode($api_key . ":" . $api_secret);
-	define( 'API_URL' , 'emea-1.jumio.ai');
-	define( 'API_TOKEN' , $api_token);

html/class/site.php

@@ -28,21 +28,13 @@ if(empty($_SESSION)){
   $_SESSION['SITE']['arrived']=gmdate(DATE_ATOM);
   $_SESSION['SITE']['client_ip']='';
   $_SESSION['SITE']['site_url'] = 'https://'.$_SERVER["HTTP_HOST"].'/';
-  $_SESSION['SITE']['apiToken']='';
+  $_SESSION['SITE']['apiToken']=API_TOKEN;
-  $_SESSION['SITE']['datacenter']='';
+  $_SESSION['SITE']['datacenter']=API_DATACENTER;
   $_SESSION['SITE']['language']='';
   $_SESSION['SITE']['access']='false';
-// check if language is suppoted
+// check if language is supported
   $activeLanguage=substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2);
-  switch ($activeLanguage) {
-    case 'de':
-      $_SESSION['SITE']['language']='de';
-      break;
-
-    default:
   $_SESSION['SITE']['language']='en';
-      break;
-    }
 // -------- GET CLIENT IP -----------------------------------------------------------------
   	if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {   //to check ip is pass from proxy
   	  $_SESSION['SITE']['client_ip']=$_SERVER['HTTP_X_FORWARDED_FOR'];

html/index.php

@@ -27,14 +27,12 @@ require_once('./lng/'.$_SESSION['SITE']['language'].'/default.php');
 require_once('./class/functions.php');
 
 //// CAPTURE HTML_REQUESTS /////////////////////////////////////////////////////
-if (!empty($_POST)) { $HTML_REQUEST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);}
+if (!empty($_POST)) { $HTML_REQUEST = filter_input_array(INPUT_POST, FILTER_SANITIZE_FULL_SPECIAL_CHARS);}
-if (!empty($_GET)) 	{ $HTML_REQUEST = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);}
+if (!empty($_GET)) 	{ $HTML_REQUEST = filter_input_array(INPUT_GET, FILTER_SANITIZE_FULL_SPECIAL_CHARS);}
 if (!empty($HTML_REQUEST)) { require_once(__ROOT__.'/app/controler/request.php'); }
 else {
 //// ROUTING ///////////////////////////////////////////////////////////////////
-	$REQUEST = '';
+ 	$REQUEST = $_SERVER['REQUEST_URI'];
-	$PARAMS = '';
-	$REQUEST = str_replace("/", "/", $_SERVER['REQUEST_URI']);
 	$PARAMS = explode("/", $REQUEST);
 	require_once(__ROOT__.'/app/controler/start.php');
 }

html/lng/de/default.php

@@ -1,63 +0,0 @@
-<?php
-# GB_en language file
-// SITE META
-define('SITE_NAME', 'iovation wallet demonstration');
-define('SITE_DESCRIPTION', 'This is a demonstration of an digital wallet build byiovation inc.');
-define('SITE_AUTHOR', 'iovation inc.');
-define('SITE_KEYWORDS', 'iovation,wallet,device,demo,test');
-// NAVIGATION
-define('URL_HOME',    'home');
-define('URL_LINK_1',  'wallet');
-define('URL_LINK_2',  'fraud force');
-define('URL_LINK_3',  'link page');
-define('URL_LINK_4',  'link page');
-define('X', 'xxx');
-//==========>>
-// == PAGES
-// == HOME
-define('HOME_TITLE', 'HOME_TITLE');
-define('HOME_CONTENT', 'HOME_CONTENT');
-// == PAGE_LINK
-define('PAGE_LINK_TITLE', 'PAGE_LINK_TITLE');
-define('PAGE_LINK_CONTENT', 'PAGE_LINK_CONTENT');
-//==========>>
-
-define('WALLET_TOP_UP_TITLE','Your e-wallet by iovation');
-define('WALLET_TOP_UP_CONTENT_1','Provide your login credential and the amount you wish to top-up.');
-define('WALLET_TOP_UP_CONTENT_2', '
-<p>You need to provide mock-up login credentials. You can use your email or invent an email but please ensue that you can remember the email and use the same email during testing. The email provide is converted in to a GDPR compliant fingerprint and stored on iovations servers. We use the email only as an account identifier.
-You can invent a password and don`t need to remember this, we are not useing password verification for this mock-up demonstration.</p>
-<p>
-<h5>You can controle the result of the fraud screening.</h5><br>
-Any amount below <b>100.00</b> will result in <b>ALLOWED</b>.<br>
-Any amount between <b>100.01</b> and <b>199.99</b> will result in <b>REVIEW</b><br>
-Any amount over <b>200.00</b> will result in <b>DENIED</b><br>
-</p>
-');
-//==========>>
-
-define('WALLET_CHECKOUT_A_TITLE','Card Payment');
-define('WALLET_CHECKOUT_A_CONTENT_1','This was a <b>low risk transaction</b>, therefore no liability shift through 3D secure is required.');
-define('WALLET_CHECKOUT_A_CONTENT_2','
-<p>Please provide a credit card number for testing. This can be any random number of 16 digits.For the card expiry date,
-take any date from 2019 to 2029 and 4 random digits for the CVV number.</p>'
-);
-define('WALLET_CHECKOUT_AMT_FINAL', 'You will top up ');
-define('WALLET_CHECKOUT_SUBMIT', 'execute top up');
-
-//==========>>
-
-define('WALLET_CHECKOUT_D_TITLE', 'SEPA Instant Bank Payment');
-define('WALLET_CHECKOUT_D_CONTENT_1','This was a <b>high risk transaction</b>, therefore only SEPA instant bank payment is offerd.');
-define('WALLET_CHECKOUT_D_CONTENT_2','
-<p>Please provide a  IBAN number for testing. This can be any random number of 16 digits.</p>'
-);
-//==========>>
-
-define('WALLET_CHECKOUT_R_TITLE', 'Card Payment');
-define('WALLET_CHECKOUT_R_CONTENT_1','This was a <b>medium risk transaction</b>, therefore a liability shift through <b>3D secure</b> is initiated.');
-define('WALLET_CHECKOUT_R_CONTENT_2','
-<p>Please provide a credit card number for testing. This can be any random number of 16 digits.For the card expiry date,
-take any date from 2019 to 2029 and 4 random digits for the CVV number.</p>'
-);
-//==========>>

html/lng/en/default.php

@@ -3,51 +3,56 @@
 $url_basic=$_SESSION['SITE']['site_url'];
 
 //== SITE META
-  define('SITE_NAME', 'ACME Corp Demo');
+  define('SITE_NAME', '1Kosmos Demo');
-  define('SITE_DESCRIPTION', 'Kumio is the leading KYC provider');
+  define('SITE_DESCRIPTION', '1Kosmos Identity Verification Platform');
-  define('SITE_AUTHOR', 'Jumion inc.');
+  define('SITE_AUTHOR', '1Kosmos');
-  define('SITE_KEYWORDS', 'Jumio,kyc,kyb,live,demo,testing');
+  define('SITE_KEYWORDS', '1Kosmos,kyc,identity,verification,passwordless,demo');
 
 // == NAVIGATION
   define('MENUE_HOME','home');
-  define('MENUE_ONE','hospitality');
+  define('MENUE_ONE','Onboarding');
-  define('MENUE_TWO','ride rental');
+  define('MENUE_TWO','Recovery');
-  define('MENUE_THREE','gambling');
+  define('MENUE_THREE','Passwordless');
   define('MENUE_FOUR','banking');
 // =========>> First Level Pages
 // =========>> PAGE_PAGE_HOME
-  define('PAGE_HOME_TITLE','Jumio KYX Platform Use-Case Demo');
+  define('PAGE_HOME_TITLE','1Kosmos Identity Platform Demo');
   define('PAGE_HOME_CONTENT_1','');
   define('PAGE_HOME_CONTENT_2','');
   define('PAGE_HOME_CONTENT_3','');
   define('PAGE_HOME_CONTENT_4','');
   define('PAGE_HOME_CONTENT_5','');
 
-// =========>> PAGE_ONE
+// =========>> PAGE_ONE — Account Onboarding (KYC)
-  define('PAGE_ONE_TITLE','ACME Holiday Homes');
+  define('PAGE_ONE_TITLE','Account Onboarding');
-  define('PAGE_ONE_CONTENT_1','Please fill out the form to register on our platform');
+  define('PAGE_ONE_CONTENT_1','Identity verification and KYC for new account creation.');
   define('PAGE_ONE_CONTENT_2','');
   define('PAGE_ONE_CONTENT_3','');
   define('PAGE_ONE_CONTENT_4','');
   define('PAGE_ONE_CONTENT_5','');
 
-  define('PAGE_TWO_TITLE','ACME Rent a Bike');
+// =========>> PAGE_TWO — Account Recovery
-  define('PAGE_TWO_CONTENT_1','');
+  define('PAGE_TWO_TITLE','Account Recovery');
+  define('PAGE_TWO_CONTENT_1','Enter your email to reset your password.');
+  define('PAGE_TWO_CONTENT_2','You will receive a reset link at the address provided.');
   define('PAGE_TWO_CONTENT_2','');
   define('PAGE_TWO_CONTENT_3','');
   define('PAGE_TWO_CONTENT_4','');
   define('PAGE_TWO_CONTENT_5','');
 
-  define('PAGE_THREE_TITLE','ACME Games');
+// =========>> PAGE_THREE — Passwordless Sign‑in
-  define('PAGE_THREE_CONTENT_1','');
+  define('PAGE_THREE_TITLE','Passwordless Sign‑in');
+  define('PAGE_THREE_CONTENT_1','Click the button to sign in without a password.');
+  define('PAGE_THREE_CONTENT_2','Your biometric or device credential will be used.');
   define('PAGE_THREE_CONTENT_2','');
   define('PAGE_THREE_CONTENT_3','');
   define('PAGE_THREE_CONTENT_4','');
   define('PAGE_THREE_CONTENT_5','');
 
-  define('PAGE_FOUR_TITLE','ACME Bank');
+// =========>> PAGE_FOUR
-  define('PAGE_FOUR_CONTENT_1','Apply for your new ACME Account today');
+  define('PAGE_FOUR_TITLE','Banking');
-  define('PAGE_FOUR_CONTENT_2','<br>');
+  define('PAGE_FOUR_CONTENT_1','');
+  define('PAGE_FOUR_CONTENT_2','');
   define('PAGE_FOUR_CONTENT_3','');
   define('PAGE_FOUR_CONTENT_4','');
   define('PAGE_FOUR_CONTENT_5','');

nginx/default.bak.3.conf

@@ -1,35 +0,0 @@
-server {
-	listen [::]:80 default_server;
-
-	root /var/www/html/public;
-	index index.php index.html;
-	charset     utf-8;
-	server_name _;
-
-#Logging
-	access_log  /var/log/nginx/access.log;
-	error_log  /var/log/nginx/error.log notice;
-
-#handling Static files
-#	location ~* ^.+.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt)$ {
-#		access_log        off;
-#		expires           max;
-#	}
-
-# Support Clean (aka Search Engine Friendly) URLs
-#  location / {
-#        try_files $uri $uri/ /index.php?$args ;
-#    }
-
-# Handling .php files
-	location ~ [^/]\.php(/|$) {
-			 fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-			 if (!-f $document_root$fastcgi_script_name) {
-					return 404;
-			 }
-			include fastcgi_params;
-			fastcgi_pass unix:/run/php-fpm.sock;
-			fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-			fastcgi_param PATH_INFO $fastcgi_path_info;
-	}
-}

nginx/default.conf

@@ -1,6 +1,6 @@
 server {
 	listen 80 default_server;
-	root /var/www/html/public;
+	root /var/www/html;
 	index index.php index.html;
 	charset     utf-8;
 	server_name _;
@@ -20,15 +20,11 @@ server {
         try_files $uri $uri/ /index.php?$args ;
     }
 
-# Handling .php files
+# Only index.php can execute PHP — all others blocked
-	location ~ [^/]\.php(/|$) {
+location = /index.php {
-			 fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-			 if (!-f $document_root$fastcgi_script_name) {
-					return 404;
-			 }
     include fastcgi_params;
-		fastcgi_pass unix:/run/php-fpm.sock;
+    fastcgi_pass unix:/run/php/php8.5-fpm.sock;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-		fastcgi_param PATH_INFO $fastcgi_path_info;
 }
+location ~ \.php$ { return 404; }
 }