Architecture and development

Project layout, data model, Altis Life serialization, code changes, and marketplace packaging.

Directory map

Path	Responsibility
`index.php`, `.htaccess`	Front controller, panel/API routes, and blocking of private paths.
`install/`	First-installation wizard and licensing.
`src/bootstrap.php`	PDO, configuration, sessions, CSRF, auditing, and shared helpers.
`src/Api.php`	HTTP dispatch and API route permissions.
`src/Game.php`	Players, licenses, vehicles, houses, gangs, wanted records, and deletion.
`src/Security.php`	Administrators, roles, permissions, TOTP, and sessions.
`src/Rcon.php`	Simulated/BattlEye providers, commands, and bans.
`src/ServerAllowlist*.php`, `src/BanExpiry.php`	Allowlist, RCON listener, and ban expiry.
`src/Backup.php`, `src/Updater.php`, `src/License.php`, `src/Branding.php`	Backups, releases, licensing, and images.
`assets/`, `lang/`	Interface, styles, icons, and Spanish/English panel strings.
`docs/`	Standalone English HTML documentation, readable without PHP.
`database/panel.sql`, `update/update.sql`	Initial panel schema and publishable migration.
`bin/`	Workers and release builder.

Data model

The game keeps its own players, vehicles, houses, containers, gangs, and wanted tables. The panel uses the 17-digit players.pid Steam ID as a stable reference; players.uid is an internal game identifier. Panel tables use the ac_ prefix for administrators, roles, permissions, sessions, audit logs, settings, bans, RCON queue, allowlist, and notes. The installer does not recreate the Altis Life database.

Altis Life serialized data

Aliases, licenses, and gang members may be SQF arrays, sometimes with extra quotes. Before changing these formats, inspect decode_alias_blob, decode_license_blob, decode_member_blob, and their encoders. Allowed levels come from information_schema rather than hard-coded maxima. Optional columns are detected with has_col.

Operation flow

Browser → /api/... → authentication + license + CSRF → permission → validation → PDO transaction → audit → JSON

The interface uses fetch and section-specific URLs. PHP returns structured HTTP errors. For a new feature, add a key to src/Security.php, validate fields server-side, use prepared SQL, record an audit entry, and expose only authorized actions. Update both panel languages and test with a user lacking the new permission.

Versions and marketplace package

Update VERSION and describe the change in CHANGELOG.md.
Update update/update.sql with idempotent SQL or a comment when the schema is unchanged.
Run relevant checks and build.bat or php bin/build-release.php.
Inspect the dist/ ZIP. It contains the application, installer, static docs, initial SQL, and migration; it excludes config.php, game data, uploads, and tests.
Publish the ZIP with its version and SHA-256 through the chosen update channel.

Customization: preserve the ac_ contract and do not overwrite storage/ during updates. If an Altis Life mission changes field formats, adapt the PHP data layer before changing the browser interface.