LOCAL XAMPP PASSWORD RECOVERY PROCEDURE
=======================================

Use this only on the barangay's XAMPP computer. This file is blocked from web access by the project's .htaccess rules.

Preferred procedure: email reset
--------------------------------
1. Ask the resident to use Forgot Password on the sign-in page.
2. If local SMTP/email delivery is configured, the resident opens the one-time link and creates a new password.
3. Reset links expire after one hour and become invalid after use or after a newer request.

Offline procedure: verified in-person recovery
----------------------------------------------
1. The administrator verifies the resident's identity using the barangay's approved in-person procedure. Do not rely only on a name or email stated over chat or phone.
2. Open PowerShell in C:\xampp\htdocs\tupsan.
3. Run:

   C:\xampp\php\php.exe tools\security\reset_user_password.php user@example.com

4. Give the displayed temporary password directly to the verified resident. Do not email it from a personal account and do not save it in the project, checklist, screenshots, or chat.
5. Ask the resident to sign in immediately. The system forces a new password before any other page can be used.
6. Close the PowerShell window or clear the screen after the password has been handed over.

Security behavior
-----------------
- Only active accounts can be reset.
- All existing sessions and unused email reset links are invalidated.
- The recovery is recorded in the audit log without storing the temporary password.
- Repeated web reset requests are limited per email hash and IP address.

