# Project plan — CCID

Evidence date: 2026-10-19. Source repository: `git@bitbucket.org:overdrive/ccid.git`.

Inspected revision: `master` at `1d3e6bf` (2026-04-16, Joshua G-D, "Add global select checkboxes"). History on `master` is 34 commits, from `2926fa9` (2020-05-28, "initial commit of full repository") to that head. The only remote branch is `master`.

The onboarding issue recorded an older head, `9a7412f` (2025-05-20, "bitbucket-pipelines.yml created online with Bitbucket"). That commit is an ancestor of the current head. This plan describes `1d3e6bf`.

There is no README, project plan, or PRD in the CCID repository, and there was no `silicon_ark/CCID/` set before this document. Statements below are recovered from the tree and Git history.

Secrets that are hardcoded in `system.php` (database passwords, and usernames paired with them) are not copied into this document.

## Product

CCID is the Cape Town Central City Improvement District contact database. The login page links help to `reception@capetownccid.org` with the subject "CCID Contact Database Query". Provenance: **Implemented** (`login.php`).

Staff sign in and maintain companies, people, the link between them, precincts, categories, groups, and saved searches. The screen opened after login is `contact2024.php`. Provenance: **Implemented** (`login.php`).

The visible product name and browser title are settings `Brand` and `Title`, loaded from `sysSettings` at runtime. The strings stored in the live database are **Unknown / Requires Confirmation**.

## What this repository is

A single PHP application on the in-house Nemo framework (`_framework/_nemo*.php`). Each screen is its own script in the repository root (`contact2024.php`, `company.php`, `search.php`, and so on). List and save behaviour lives in `includes/*.cls.php`. Forms for detail screens are built from the live table columns (`NemoDetails::AssimulateTable`). There is no schema migration set in Git. The database is the source of the column list.

## Branch reality

| Branch | Head | Notes |
|---|---|---|
| `master` | `1d3e6bf` (2026-04-16) | Only branch. Bitbucket Pipelines runs SonarQube on `{master}`. |

No `develop`, release, or feature branches were present on the remote at inspection time.

## Scope that is in this repository

- Login, logout, forgot-password, and reset-password for `sysUser`.
- Contact list and detail on `tblContact2024`, including the company fields edited on the same form (`contact2024.php`).
- Company list and detail, including adding and removing contacts (`company.php`).
- Saved searches over the view `vieCompanyContact`, with contact-field, category, and group criteria (`search.php`, `search.result.php`).
- Lookup maintenance: categories, groups, precincts, positions.
- Users, security groups, and per-menu permissions (`sysSecurity`).
- System settings, including a "Create Views" action that runs SQL stored in `sysSettings`.
- My Profile password change (`my.profile.php`).
- Excel-style export of the contact list and the company list (HTML served as `.xls`).

## Scope that is not established

- The live menu. Items, labels, URLs, and which security group can see them are rows in `sysMenuLevel1`, `sysMenuLevel2`, and `sysSecurity`. Those rows are not in Git.
- Whether `contact.php` (the older `tblContact` screen) is still on the menu. The file is in the tree. Login no longer opens it.
- Whether `report.php` is still on the menu. It defaults to `timesheet.rpt` and filters `tblLocation`, `tblStudyType`, and `tblStudy`. Those tables are not used by the contact or company screens. Provenance: **Implemented** in `report.php`, likely inherited from the Nemo template. Use on CCID is **Unknown / Requires Confirmation**.
- Email and email-template administration classes exist (`includes/email.cls.php`, `includes/email.template.cls.php`). No `email.php` or `email.template.php` entry script is in the repository root, so those screens are not reachable from this tree.
- `SendSMS` posts to `http://www.mymobileapi.com/api5/http5.aspx`. Nothing in the CCID pages calls it. Provenance: **Implemented** as a framework function, unused by the contact workflows.
- Deployment steps beyond "files are hosted where `SERVER_NAME` matches a case in `system.php`". No deploy job is in the pipeline.
- Automated tests. None were found.

## Architecture (as implemented)

```text
Browser
  -> root PHP script (contact2024.php, company.php, ...)
       -> system.php (host switch, mysqli, load sysSettings, session)
       -> Nemo (session required, menu + blnView check)
       -> includes/*.cls.php (SQL against MariaDB/MySQL)
       -> layouts/layout.back.incl.php
```

Production host named in code: `www.ccid-database.co.za` (bare `ccid-database.co.za` is rewritten to the `www` name). Database name in that case: `ccidddmshv_db1` on `sql28.jnb1.host-h.net`. QA-style cases (`ccid.php8`, `ccid.local`, `dev.overdrive.co.za`) use database `ccid_qa`. Provenance: **Implemented** (`system.php`). Whether each host is still serving traffic is **Unknown / Requires Confirmation**.

`.htaccess` redirects HTTP to HTTPS. Provenance: **Implemented**.

## Milestones visible in Git

| When | Commit | What it shows |
|---|---|---|
| 2020-05-28 | `2926fa9` | Full repository committed |
| 2020-07-07 | `92ed055`, `2df9f89` | Session handling changes |
| 2020-08-26 | `7ab3236` | Last user removed from the contacts listing |
| 2020-10-22 | `39b0e54` | `_nemo.details.cls.php` NULL/enum handling for a MariaDB upgrade on Hetzner |
| 2022-09-25 | `ee56d91` | "ccid updates" |
| 2023-11-03 | `aadc3f9`, `370d935` | "CCID updates"; database connection added for a vhost |
| 2024-era PHP 8 fixes | `461f6b1` through `54a5047` | Dynamic properties, NULL arguments, mail class, PHPMailer |
| 2025-05-20 | `37dc665`, `98138d4`, `9a7412f` | Sonar project key and both pipeline files added from the Bitbucket UI |
| 2025–2026 | `e0fe645` through `1d3e6bf` | Contact and company layout, positions CRUD, search, pagination, category filters combined with OR, global select checkboxes |

Dates between the 2023-11-03 commit and the PHP 8 fix series were not re-listed one by one. The themes above are the commit subjects.

## Implementation status

The contact database on `contact2024.php` / `company.php` / `search.php` is the current application. The older `contact.php` screen, the timesheet-style report, the PDF "active projects" helper, and the SMS helper are still in the tree and are not what login opens.

There is no documented roadmap in the repository. Nothing in Git is labelled as a planned feature. Provenance of "what comes next": **Unknown / Requires Confirmation**.

## Dependencies known from the tree

- PHP with mysqli, sessions, and OpenSSL (`openssl_random_pseudo_bytes` for password salt). Comments dated 2022-08-29 call the work "PHP 8 Upgrades". The exact PHP version on the host is **Unknown / Requires Confirmation**.
- MariaDB or MySQL. A 2020 commit names a MariaDB upgrade. The engine of the current host is **Unknown / Requires Confirmation**.
- Composer package `phpmailer/phpmailer` `^6.9`, vendored in the tree.
- Bundled libraries that the current contact screens do not call: `mpdf/`, `dompdf/`, `PHPExcel/`, `Excel/`, `fpdi/`, `html2pdf/`. `project.functions.inc.php` still contains `ActiveProjectListPDF`, which loads Dompdf. No CCID page calls that function.
- Bitbucket Pipelines SonarQube scan (`sonarsource/sonarqube-scan:3.0.2`) on `master`. `sonar.projectKey` is `overdrive_ccid_37f93f0e-e455-4d3f-a532-73936b39392a`.
- jQuery and the scripts in `js/` (select-all, category dropdown refresh).

## Human confirmation

- Which hostnames are still live, and which database each one points at.
- The menu and the names of the security groups, especially group id `4`.
- Whether precinct id `5` is the intended default when a contact is saved with precinct `0`.
- Whether saving a contact is allowed to replace every category on that company and every company link on that contact.
- How the site is deployed. The pipeline only runs SonarQube.
- Whether `phpinfo.php` is present on the public host. It calls `phpinfo()` with no login check.
- Rotation of the database credentials stored in `system.php`. They are in Git. This document does not repeat them.