# Developer Guide

## Design rule
Keep controllers thin. Platform-specific API code belongs in `app/Services`. UI code must never receive App Secrets or raw long-lived tokens.

## Modules
- Facebook: pages, post/video publishing, comments, Messenger
- YouTube: channels, upload, videos, comments
- WhatsApp: numbers, inbox, messages
- Ads: campaigns, ad sets, ads, creatives, reports
- Core: auth, RBAC, employees, audit logs, settings

## Permissions
Every sensitive route must use `permission:<key>` middleware. Add a permission to the seeder when adding a new capability.

## Token storage
`social_accounts.token_ciphertext` is reserved for encrypted-at-rest token material. Use Laravel Crypt before saving tokens. Do not log tokens.

## Suggested next implementation order
1. Meta OAuth and account discovery
2. Google OAuth and channel discovery
3. Facebook publishing/comments
4. YouTube upload/comments
5. WhatsApp webhooks/inbox
6. Meta Ads campaign/ad set/ad workflows
7. Queue jobs, retries and webhook event processing
8. Analytics sync jobs

## Testing
Add feature tests for permission denial (403), employee account isolation, OAuth callback state validation, webhook signatures, campaign budget validation, and audit log creation.