# Quorla: handoff (21 Oct 2026)

Where things stand and what's next. Live app: https://app.quorlasocial.com (HestiaCP server, `~/APPS/quorlasocial`,
Docker behind the Hestia nginx proxy on 127.0.0.1:4310). Hosting steps: `docs/hosting.html`.

## Live and working
- Dashboard on the server: team logins, admin can add teammates and reset passwords, scheduler runs there.
- Meta (Facebook + Instagram) through the system user. Infini is Instagram-only (no Facebook Page by choice).
- Connections page with quotas (`data/quota.json`; YouTube 10,000 units/day Pacific time, rolling 24 h for others).
- **TikTok:** Sandbox app "Quorla testing" connected (test user @metatron_digitalagency). Domain verified
  (two DNS TXT records, both must stay). Details: `docs/tiktok-app.md`.
- **Google:** connecting works now.
  - YouTube → Cloud project **Quorla**. GBP → project **GMB Audit** (gmb-audit-489406, GBP API already approved).
  - Both are in Testing mode. Only test users can connect: dev@metatroncubesolutions.com and
    metatroncubesoftwaresolutions@gmail.com. Add more under Google Auth Platform → Audience → Test users.
  - Testing-mode tokens expire after 7 days, so reconnect weekly until the app is verified. Details: `docs/google-app.md`.
- Search Console: quorlasocial.com verified. Legal pages: /privacy and /terms.

## Deploy (server, as `dev`)
```bash
cd ~/APPS/quorlasocial && git pull && docker compose up -d --build
# Homepage for quorlasocial.com (replaces Hestia's "Coming Soon" page):
sudo cp -r ~/APPS/quorlasocial/site/. /home/user/web/quorlasocial.com/public_html/   && sudo chown -R user:user /home/user/web/quorlasocial.com/public_html
```
Google verification and TikTok review both check that quorlasocial.com explains the app and links to the privacy policy.
Request-access buttons email support@quorlasocial.com: make sure that mailbox exists (Hestia → Mail).

## To do next
1. **TikTok, YouTube and Google Business Profile are on the wrong client** (C2C Agricorp India). After the next
   deploy, open Connections → C2C Agricorp India and click **Move** on each card, then pick
   MetatronCube Software Solutions Canada. No reconnecting needed. Then choose the Metatroncube location for GBP.
2. First test posts (21 Oct): YouTube (private) and Google Business Profile posted fine. TikTok Direct Post is blocked
   until TikTok reviews the app (public accounts); use **"Send to the TikTok app to finish"** in the TikTok options until
   then (tested, works on the public business account). See `docs/tiktok-app.md`.
   LinkedIn: app "Quorla" created and verified; Community Management API requested 21 Oct (watch info@ for
   Microsoft Vetting Services). Keys are saved in Connections; Connect works once approved.
3. TikTok Production: record the demo video (script in `docs/tiktok-app.md`), fill in the listing, and submit for review.
4. Google: submit the OAuth app for verification (YouTube also needs its API audit before the quota goes above the default).
5. Still to set up: LinkedIn, Pinterest, Threads (Meta permissions) and Reddit apps (`docs/platforms.md`).
6. Later: marketing site, Stripe. (The dashboard now uses the Quorla logo and colours; PDF reports keep the agency branding.)
7. Optional: on the server, run `git stash drop` (left over from the branding CRLF fix).

## Built on branch feature/internal-pages (23 Oct 2026)
Published page (results per post) · Content calendar (plan → production → ready, drag to reschedule) · Competitors ·
Client approval portal (/p/<token>) · Notifications (bell, email, 8:00 summary) · Monthly client report (auto + email) ·
Team task flow (assign → notify/Odoo task → upload links to card) · Inbox: Google reviews + YouTube comments ·
Best time to post · Brand kit + caption checks · Link-in-bio pages (/l/<address>) · Bulk scheduling ·
Admin: system health + audit log · Getting-started checklist · White-label workspace · Hosted Quorla (sign-up, Stripe,
one container per agency; docs/multi-tenant.md).

After merging and deploying:
- Add SMTP_* to the server .env (support@ mailbox) so emails go out; check Admin → System health.
- docker-compose now mounts ./backups read-only: run `docker compose up -d` once so health sees the backups.
- Hosted plan stays off until QUORLA_CONTROL=true and the steps in docs/multi-tenant.md are done.

## Rules that don't change
- Nothing publishes without a person approving the exact caption and media.
- White-label: no Metatroncube mention on client posts.
- Keys and secrets live only in `.env` or the encrypted Connections vault, never in chat, Git, or docs.
- Tests: `node --test connector/test/platforms.test.mjs connector/test/quota.test.mjs`. On Windows, list the files by name;
  passing the folder fails.