# Migration Instructions: Account Number to Username Login

## Overview
This migration switches the login system from using account numbers to usernames while preserving account numbers for reference and display purposes.

## Database Changes Required

### 1. Run the SQL Migration
Execute the SQL script `database_migration_add_username.sql` on your database:

```bash
mysql -u your_username -p your_database < database_migration_add_username.sql
```

Or import it through phpMyAdmin.

### 2. Populate Username Field
You need to assign usernames to all existing accounts. You have several options:

**Option A: Use account numbers as initial usernames**
```sql
UPDATE account SET username = uname WHERE username IS NULL;
```

**Option B: Generate usernames from names**
```sql
UPDATE account 
SET username = LOWER(CONCAT(fname, '.', lname)) 
WHERE username IS NULL;
```

**Option C: Manually assign usernames through admin panel**
- Update each account individually with unique usernames

### 3. Make Username Required (After populating)
Once all accounts have usernames:
```sql
ALTER TABLE account MODIFY COLUMN username VARCHAR(100) NOT NULL;
```

## Code Changes Made

### Files Modified:
1. **user_access.php** - Main login page
   - Changed form field from `uname` to `username`
   - Updated login query to use username
   - Updated labels from "ACCOUNT NUMBER" to "USERNAME"

2. **include/class.user.php** - User class
   - Updated `login()` method to authenticate using username
   - Session still stores account number (uname) for backward compatibility

## Testing Checklist

- [ ] Database migration completed successfully
- [ ] All existing accounts have usernames assigned
- [ ] Test login with username and password
- [ ] Verify OTP email is sent correctly
- [ ] Verify PIN authentication works
- [ ] Check dashboard displays account information correctly
- [ ] Test new account registration (if applicable)

## Rollback Plan

If you need to rollback:

```sql
-- Remove username column
ALTER TABLE account DROP COLUMN username;
```

Then revert the code changes in:
- user_access.php
- include/class.user.php

## Additional Recommendations

1. **Password Security**: Consider hashing passwords with `password_hash()` instead of plain text
2. **SQL Injection**: Use prepared statements consistently (already done in most places)
3. **Session Security**: Consider using `session_regenerate_id()` after login
4. **Username Validation**: Add validation rules for username format (alphanumeric, length, etc.)

## Support

If you encounter issues during migration:
1. Check database error logs
2. Verify all SQL queries executed successfully
3. Test with a single account before rolling out to all users
4. Keep a database backup before making changes
