# Spond Phase 1: server configuration

The Spond diagnostic page at `/admin/spond-diagnostic.php` is a read-only check for coaches assigned to a connected age group. It does not write to Spond. God mode manages the connection settings.

## Create the server-only configuration

After the first deployment, create `includes/spond.config.local.php` on Hostinger using File Manager. This file is intentionally ignored by Git. It must never be committed, copied into a ticket, or sent by email.

```php
<?php
// A base64-encoded 32-byte random key, kept only on the server.
define('SPOND_ENCRYPTION_KEY', 'replace-with-a-base64-encoded-32-byte-random-key');
```

Generate the key once with `base64_encode(random_bytes(32))` in PHP, then keep the resulting value permanently. PHP's OpenSSL extension must be enabled; changing or losing this key means saved Spond passwords can no longer be decrypted and must be entered again.

Run `sql/2026-10-01-add-spond-connection-settings.sql` and `sql/2026-10-01-add-spond-connection-credentials.sql` after the existing Spond integration migration. In God mode, open **Spond Connections** (or the Spond button on an age group), enter the Spond account email/password, and paste the subgroup URL. To get it: sign in to Spond, choose the Club/Section parent group in the left menu, then its Age Grade subgroup, and copy the browser address. It must contain both IDs in the form `.../groups/{GROUP-ID}-S-{SUBGROUP-ID}`; a parent-group URL alone is rejected.

The account email and encrypted password, group IDs, subgroup IDs, editable display name, core-import choice and home-venue matches are stored per age group in the database. Passwords are never shown after saving. The encryption key remains only in the local file above. This makes the scheduled sync handle several age groups. At season rollover Squad Manager carries the same connection forward with the age group, while its Spond display name can be edited if Spond changes from (for example) Year 7 to Year 8. If Spond creates a new subgroup, paste its new full URL in God mode.

Use a dedicated Spond account with the least permissions needed to view the group. The Spond client currently cannot complete accounts that require TOTP/two-factor authentication.

Check that the file remains present after a GitHub deployment before relying on it. If Hostinger's deployment configuration clears untracked files, store it outside `public_html` and update `loadSpondConfiguration()` with that protected absolute path instead.

## Run the diagnostic

Sign in as the Platform Administrator and open `/admin/spond-diagnostic.php`. Select **Run read-only diagnostic**. The output includes only the current season: 1 September through 31 May. The displayed Year 7 roster is derived from invitation-response IDs on upcoming Year 7 events, avoiding exposure of the whole parent-group roster. Spond subgroups belong to a main group, so their IDs are more reliable than the displayed subgroup name.

Treat the on-screen member names and IDs as personal data. Do not copy the output into public issues or commit it.

## Scheduled Spond sync

The cron task stores source data in the `spond_*` tables. With core import enabled, it also creates and updates the main player, schedule and availability records. Connections are selected from the per-age-group settings in God mode.
In Hostinger, open **Websites → Dashboard → Advanced → Cron Jobs**, choose **PHP**, and select the deployed `cron/spond-sync.php` file. Run it hourly. This is the production sync that creates and refreshes Spond-managed players, schedule sessions and related response data. Check **View Output** after its first run; it reports counts only, not names or credentials.

## Phase 2B: Spond-led player and schedule import

Run `sql/2026-09-30-add-spond-core-links.sql` in phpMyAdmin before enabling this. Then enable **Spond core import** for the relevant age group in God mode.

When enabled, each sync creates a Squad Manager player for a new Spond member and creates a schedule session for a new Spond event. New sessions default to **Event** so a Head Coach chooses the Squad Manager event type. Each later sync updates only Spond-owned fields: player name/status, session date/title, start and end time, venue/address/postcode, home/away classification, and availability. Player positions, teams, assessments, notes, schedule type, result notes, and match-day assignments are never changed by the sync. A player no longer seen in event invitations is not automatically deleted or disabled; that needs a dedicated membership review to avoid treating an event-specific omission as a departure.

Before using Spond times and venue information, run `sql/2026-09-30-add-spond-schedule-details.sql` in phpMyAdmin. The sync remains compatible until it has been run, but cannot populate the new details until then. Enter exact distinctive venue words or postcodes, one per line, in the age group's Spond connection. A non-home venue is marked **Away** only for a Squad Manager session already classified as a Match; training, festivals and events remain **Other**.

## Coach availability on the Coach Sheet

Run `sql/2026-09-30-add-spond-coach-links.sql` and `sql/2026-09-30-add-spond-coach-event-responses.sql` once, then allow the next hourly Spond sync to run. It matches Squad Manager coaches assigned to the age group against Spond group members and stores only the matching IDs. Coach responses are imported from each event's separate Spond organiser/owner response list, rather than the player-subgroup response list. The Coach Sheet can then show each linked coach's Spond response as Confirmed, Awaiting or Declined. It never creates coach or player accounts.

If an exact name match is not available, run `sql/2026-09-30-add-spond-coach-directory.sql` once and wait for the next hourly sync. A Head Coach can then use **API → Map Spond coaches** to make the one-time match between each existing coach and their Spond profile. The stored directory is separate from the U12 player roster and is used only for coach-response interpretation.

## Hosting notes

Hostinger web/cloud hosting supports scheduled PHP jobs, but Python is VPS-only. The production integration therefore calls Spond from PHP over HTTPS through the scheduled `cron/spond-sync.php` job. Keep that job enabled for connected age groups.

## Existing configuration risk

`includes/config.php` is currently committed to Git despite the comment in that file. Rotate its database password and remove the live config from version control in a separately planned, tested deployment change. Do not put Spond credentials in that file while it remains tracked.