# WBMCZ — KYC asked for at checkout, not on the product card

The orange **"KYC Required"** button is gone. A member presses **Buy Now** like
on any shop, and whatever the service still needs is asked for on the checkout
page as an ordinary form — the same way an address is asked for.

Two rules run through the whole change:

1. **Anything already saved is locked.** It is shown greyed out, and the server
   ignores it even if the browser sends something different. Only the office can
   correct a saved line.
2. **Name, mobile and email always come from the registration record.** They are
   never editable on a purchase, and they are what gets written into the KYC row.

No database migration is needed — nothing new was added to any table.

---

## 1. Files to upload

| File | New / changed | What changed |
|---|---|---|
| `includes/kyc_checkout.php` | **NEW** | The whole checkout-KYC engine: which fields the basket needs, the form, the save, the lock |
| `includes/shares.php` | changed | Admin approval is no longer a purchase gate; the gate now reports `collect` |
| `includes/kyc.php` | changed | Saved lines can never be re-edited by the member; name / email / phone written from the account |
| `checkout.php` | changed | Verification form on step 1, contact boxes locked, KYC saved before the order is placed |
| `category.php` | changed | Buy Now instead of "KYC Required" — it goes to the checkout page |
| `product.php` | changed | Same, plus a small amber note that details will be asked at checkout |
| `cart.php` | changed | Missing KYC no longer blocks the basket |
| `kyc_extra.php` | changed | An answered extra question is locked |

Upload them over the existing files. Nothing else has to be touched.

---

## 2. What a member now sees

**On the product card**

* Service area is fine → **Buy Now**, always.
* Service area is wrong → *Not available in your area* (unchanged — that one is
  a real block, not something a form can fix).

**On the checkout page, step 1**

* Name, mobile and email — greyed out, with a lock, and a line saying they are
  the ones from registration and support has to change them.
* **Verification details** — every box this service needs:
  * boxes already on the KYC show greyed with *saved*;
  * name / mobile / email inside the KYC show *from your account*;
  * everything still blank is an ordinary, required input (text, date, dropdown
    or file upload), grouped under Personal / Address / Bank / Business exactly
    as the KYC wizard groups them.
* The member cannot reach the payment step until every box is filled, so nothing
  is ever charged for an order that would then be rejected.

**After paying** — the answers land in `kyc_details` (and `kyc_custom_values`
for the admin's own questions), the order is placed, and those lines are locked
everywhere from then on: on the checkout page, on `profile.php#kyc`, and on
`kyc_extra.php`.

---

## 3. What changed about approval

Buying no longer waits for an admin to approve the KYC. Filled in + paid = the
order goes through. Admin → KYC Pending still shows every submission and the
office still verifies them; it simply is not a wall in front of the shop any more.

Service-area checking is untouched.

---

## 4. Worth knowing

* A **Agency & Software** (category 5) product still demands the whole Personal,
  Address and Bank sections — that is set in `product_required_kyc()` in
  `includes/shares.php` and it is the same list the old gate demanded. It makes
  for a long form on the first purchase and a very short one after that, because
  everything is saved and locked.
* For every other category the admin decides field by field in
  **Admin → Service Management → KYC fields**, so a product can ask for nothing
  more than, say, an Aadhaar number and a pin code.
* The office can still correct anything from **Admin → Users → KYC**; the lock
  applies to members only.
