# aHUS Pusher deployment package

## What changed
- `small/js/sync.js`: publishes state events through `/pusher-sync.php`.
- `display/js/sync.js`: subscribes to the Pusher channel and forwards received state to the existing `Sync.on()` listener.
- Both `index.html` files load Pusher JS 8.4.0 and use the same channel.
- `display/js/main.js`: removed the old `hello` publish because Display is now listen-only.
- `pusher-sync.php`: signs Pusher REST API requests server-side and saves the latest state for Display reloads.
- `pusher-config.php`: server-side Pusher credentials.

## Configure
1. In Pusher Dashboard, open the app whose App ID is `46779` and copy its **App Secret**.
2. Edit `pusher-config.php` and replace `PUT_YOUR_PUSHER_APP_SECRET_HERE`.
3. Upload the contents of this package so the layout is:
   - `public_html/small/`
   - `public_html/display/`
   - `public_html/pusher-sync.php`
   - `public_html/pusher-config.php`
4. Make sure PHP cURL is enabled in cPanel (Select PHP Version / Extensions).
5. Open `/small/` first, then `/display/`.

## URLs
- `https://YOUR-DOMAIN/small/`
- `https://YOUR-DOMAIN/display/`

## Important
- Do not put the App Secret or a REST API auth_signature in browser JavaScript.
- Both screens use the same Pusher public channel: `ahus-journey`.
- This implementation uses a public Pusher channel. Anyone who knows the channel name can subscribe. Do not send confidential or personal data through it.
- The PHP publisher endpoint validates the fixed channel and event, but for a public internet event you should additionally restrict publishing (for example with a server-side event token or IP/network access controls).
- The latest state is saved one directory above `public_html` when the hosting layout allows it.
- Pusher App Key is public by design. App Secret is not.
