# Project plan — FootprintApp.net

Evidence date: 2026-10-14.

Source repository: `git@bitbucket.org:overdrive/footprintapp.net.git` (clone used `https://bitbucket.org/overdrive/footprintapp.net.git`).

Inspected revision: `master` at `629b199a6850ec4da42a5d72a4223271e89de2ad` (2022-12-13 11:45:56 +0200, `heinrichoverdrive`, "Merge branch 'prod'"). That commit is `origin/HEAD`. `git rev-list --count master` is 1578. `git tag -l` printed nothing.

The scan-host path `~/projects/sonar_scan/repos/FootprintApp.net` was not on this machine. The tree below was read from that git revision.

This plan describes what the repository contains. It does not decide what the product should become.

No `silicon_ark/FootprintApp.net/` directory existed before these files.

## Product

The signed-in web application title is **Footprint**. The logo alt text is `footprintapp.net`. The repository README is a single heading, `# FootprinLive`. Layouts for the union, referee, public, printers, live, app, and admin modules also title the page `Footprint`. The GIR layout title is `Footprint:GIR`. A commented menu item labels that area "Get Into Rugby".

People who can sign in manage organisations, users, tournaments, fixtures, squads, accreditations, assessments, scouting, blue-card cases, news articles, and food sessions. A dashboard counts players, coaches, referees, and medical staff, and lists this week's and last week's fixtures, match officials, completed transfers, and new activations. Selected user ids also see InSight / Superset links and an Efiling area (forms, grants, projects). Another fixed list of user ids sees a "Team Zone" link into the `union` module. Users whose `UnionType` is greater than 2, and who are not flagged `Administrator`, are sent to `/first` while `Status` is 0 and otherwise to `/union/`.

Provenance: **Implemented** in `application/layouts/*.phtml`, `application/modules/default/views/scripts/menu/default.phtml`, and `application/modules/default/controllers/IndexController.php`.

Provenance: **Documented** only as the README heading `# FootprinLive`. There is no other product statement in the repository.

The default MySQL database name in `application/configs/application.ini` is `teamwizz_SARU` on host `db.footprintapp.net`. Mail is sent as Footprint from `support@footprintapp.net`, and accreditation mail is sent as Magus.Events from `accreditation@magus.events`. The hostname `admin.magus.events` hides the InSight menu and the profile link. Whether Footprint, FootprinLive, Teamwizz, Magus.Events, and SARU are one product, successive names, or shared infrastructure is **Unknown / Requires Confirmation**.

## Related Silicon Ark projects

These are separate repositories. They are not this tree.

| Silicon Ark directory | Remote | Relationship visible from evidence |
|---|---|---|
| `FootPrintLive/` | `footprintlive.git` | One commit (2019-09-10). README heading is also `# FootprinLive`. Same product shape (Zend 1 menu, `teamwizz_SARU`). Older and smaller than this repository. |
| `footprintapp-Not-Used/` | `footprintapp-not-used.git` | One commit (2019-09-06). Same Footprint layout and menu family. Checkout of that tree was blocked by invalid paths. |
| `Footprint-Not-Used/` | `footprint-not-used.git` | README heading `Footprint` only. No application. |
| `footprint-lambda/` | `footprint-lambda.git` | `.gitignore` only. |
| `tournaments.footprintapp.net/` | `tournaments.footprintapp.net.git` | `.gitignore` only. |
| `track.mypass.zone/` | documented separately | Silicon Ark for that project records HTTP calls to `footprintapp.net` (`/api/mypass/gettermsandconditions/`, `/pdf/getpermit/id/{id}`, and a commented `/email/send`). Matching action names exist in this repository (`MypassController::gettermsandconditionsAction`, `PdfController::getpermitAction`, `EmailController::sendAction`). Whether track.mypass.zone still calls this deployment is **Unknown / Requires Confirmation**. |

## Branch reality

| Line | Tip seen on 2026-10-14 | What it is |
|---|---|---|
| `master` (`origin/HEAD`) | `629b199a` (2022-12-13) | Inspected tree. Not a Bitbucket Pipelines deploy branch. |
| `prod` | `017d6aa0` (2023-02-20, "Merge branch 'qa' into prod") | Pipelines deploy this branch to production CodeDeploy. |
| `qa` | not diffed | Pipelines deploy this branch to QA CodeDeploy. |
| `dev` | not diffed | Present as a remote branch. No pipeline step in `bitbucket-pipelines.yml`. |

`git rev-list --left-right --count origin/master...origin/prod` returned `5 43`: five commits are reachable from `master` and not from `prod`, and 43 commits are reachable from `prod` and not from `master`. The five master-only commits are merge commits (`629b199a`, `e1e00198`, `8a300f7b`, `77597688`, `e83b825d`).

Prod commits that are not in this inspection include, by subject only: FP4 club and squad changes, FP4 transfers and competitions, CR80 photo/zones, accreditation decline-email header, organisation list filters (school/club, country, South African organisations), e-filing menu `union_type`, officials dashboard permissions, and BokSmart on the member quick view. Those subjects are **not** treated as behaviour of `629b199a`.

Many other remote branches exist (dated accreditation, dashboard, snag-list, feature, and bugfix lines, including `feature/FN-*` and `bugfix/FN-*`). Their trees were not inspected. There are no tags.

First commit on `master`: `01971741` (2019-12-18, `root`, "initial commit of full repository").

Authors across all fetched refs (`git shortlog -sn --all`), top of the list: heinrichoverdrive 1356, Uriel Balela 221, Jaco Brits 38, unknown 14, Russel 12, root 1.

The onboarding issue OVER-124 (captured 2026-09-28) recorded the same `master` tip: `629b199a`, 2022-12-13, "Merge branch 'prod'". This clone agrees. It also listed `sonar-project.properties` and `sonarqube_scan.bat` at the scan-host root. Those two files are not in the `master` tree.

## Objectives

No project plan, issue tracker, or product brief is in the repository. `changelog.txt` records two changes in May 2019 (member Excel column; squad checklist document selection). `footprint_changelog.txt` is empty. Commit subjects from late 2022 are the only later change notes, and they describe bug fixes and accreditation/squad work rather than a stated goal.

**Inferred** from the implemented screens: the system is used to run rugby (and related event) operations — people, teams, matches, accreditation, and reporting — for more than one organisation, with a South African locale (`af_ZA`, `Africa/Johannesburg`).

What the business objective is, who the contracting customer is, and whether the product is still operated are **Unknown / Requires Confirmation**.

## Scope

### In scope of the inspected `master` tree

1. A Zend Framework 1.11.10 PHP application under `application/`, `library/`, and `public/`.
2. The modules, menus, models, and HTTP behaviour described in `prd.md`, `features.md`, and `business-rules.md`.
3. AWS CodeDeploy packaging (`appspec.yml`, `scripts/`, `codedeploy_deploy.py`) and Bitbucket Pipelines on `qa` and `prod`.
4. Standalone root scripts `mssql.php` and `boksmartmssql.php`.

### Out of scope of this inspection

- The 43 commits on `origin/prod` after `master` diverged, and every other remote branch.
- Runtime data in MySQL, MSSQL, or on the CodeDeploy host.
- Whether `https://footprintapp.net` still serves this code.
- The contents of `sonar-project.properties` and `sonarqube_scan.bat`. Those names were on the 2026-09-28 scan. They are not in git.

## System shape

```text
Browser / mobile client
        │
        ▼
Apache httpd (CodeDeploy host)
  .htaccess → public/index.php
        │
        ▼
Zend_Application (ZF 1.11.10)
  modules: default, admin, union, union_old, app, gir,
           live, pub, referee, accreditations, printers, api
        │
        ├── MySQL  db.footprintapp.net / teamwizz_SARU
        ├── MySQL  db.footprintapp.net / teamwizz_API   (named apilogs in config; wiring not confirmed)
        ├── SMTP   smtp.gmail.com as support@footprintapp.net
        ├── SMTP   accreditation mail as accreditation@magus.events
        ├── SMS    MyMobileAPI (http://www.mymobileapi.com/api5/http5.aspx)
        ├── MSSQL  standalone scripts only (BokSmart officials query; RDS connectivity script)
        └── Files  public uploads, accreditation photos, TCPDF / dompdf output
```

External callers already named in this tree include Ampath result push (`api/AmpathController::pushresultsAction`) and MyPass-style accreditation, health, and registration actions on `api/MypassController`.

## Major components

| Component | Role on `master` | Evidence |
|---|---|---|
| `default` module | Main Footprint UI: login, dashboard, members, tournaments, squads, accreditation, e-filing, assessments, scout, blue card, CMS, food, cron, PDF, SMS, email | Controllers under `application/modules/default/controllers/`; menu partial |
| `union` module | Team Zone workspace (squads, fixtures, tournaments, permits, members) | Menu link `/union/`; module controllers |
| `api` module | JSON/mobile and partner endpoints: accreditation scans, tournaments, fixtures, players, Ampath, MyPass | `application/modules/api/controllers/` |
| `live` module | Fixture scoring and timer | `Live_ScoreController` |
| `accreditations` module | Application, checkout, collections | Module controllers |
| `gir` module | Get Into Rugby screens; menu link is commented out | `application/layouts/gir.phtml`; commented item in the default menu |
| `admin`, `app`, `pub`, `referee`, `printers` | Alternate layouts and narrower controller sets | Module directories and layouts |
| `union_old` | Earlier copy of union controllers, still in the tree | `application/modules/union_old/` |
| `library/Zend` | Vendored framework 1.11.10 | `library/Zend/Version.php` |
| `library/PG` | Layout picker, mail layout, uploads, PDF helpers | `library/PG/Controller/Plugin/` |
| CodeDeploy + Pipelines | Deploy `qa` and `prod` | `bitbucket-pipelines.yml`, `appspec.yml` |

## Milestones visible in git

| When | Commit | What landed |
|---|---|---|
| 2019-12-18 | `01971741` | Initial commit of the full repository |
| 2019-05 (file, not a commit date) | `changelog.txt` | Member Excel gender/age column; squad checklist uses the last uploaded document for the current year |
| 2022-11-30 to 2022-12-13 | commits through `629b199a` | Accreditation import/hospitality, applicant API dates, access-rights display, FP3 squad default position, CR80 terms spelling, fixture timer fields on `api/fixtures/getdetails`, repeated `application.ini` updates. Merged via `qa` into `prod`, then `prod` into `master`. |
| 2022-12-13 to 2023-02-20 | `origin/prod` only | Further FP4, CR80, e-filing, and organisation work. Not in the inspected tree. |

No release tags exist. There is no maintained changelog after May 2019.

## Implementation plan

No forward plan is written in the repository. The delivery path that is implemented is: commit to `qa` or `prod`, Bitbucket Pipelines zips the tree, `codedeploy_deploy.py` uploads it to S3 and starts CodeDeploy, and `appspec.yml` copies the tree to `/mnt/data/www/html/footprintapp.net/footprintapp.net/` owned by `apache`. `scripts/install_dependencies` installs `httpd`. `scripts/start_server` starts `httpd`. `scripts/stop_server` stops `httpd` when a process matches `pgrep httpd` (the script assigns with spaces around `=`, which is invalid bash). `scripts/remove_archives.sh` deletes older CodeDeploy revision directories.

`master` is not in `bitbucket-pipelines.yml`. A merge to `master` does not, by itself, deploy.

## Known dependencies

- PHP with the `pdo_mysql` extension, and historically the `mssql` extension for the root scripts (`mssql_connect`).
- Apache `httpd` on Amazon Linux (`yum install httpd`).
- MySQL databases `teamwizz_SARU` and `teamwizz_API` on `db.footprintapp.net`.
- Gmail SMTP for Footprint mail.
- MyMobileAPI for SMS.
- AWS CodeDeploy, S3, and Bitbucket Pipelines variables `QA_*` and `PROD_*` (access key, secret, region, application name, deployment group, bucket). The values are not in git.
- Vendored libraries: Zend Framework 1.11.10, TCPDF, dompdf, html2pdf, jQuery UI 1.12.1, a SparkPost directory under `public/SparkPost` (mail send path that was read uses Zend_Mail SMTP, not that directory).
- `composer.json` is an empty JSON object. Dependencies are vendored, not installed by Composer in the pipeline.

Credentials for the database, SMTP, and MSSQL scripts are hardcoded in the tree. They are omitted from this documentation. See `technical-documentation.md`.

## Current project status

| Item | State on 2026-10-14 |
|---|---|
| `master` tip | Unchanged since 2022-12-13 (`629b199a`), matching OVER-124 |
| `prod` tip | 2023-02-20, 43 commits not in `master` |
| Tags | None |
| README | One line, name `FootprinLive` |
| Automated tests | No PHPUnit configuration or `tests/` directory in the tree |
| Pipelines | Defined for `qa` and `prod` only. Image `python:3.5.7`. Last pipeline result was not read (Bitbucket API returned 401). |
| Live traffic | **Unknown / Requires Confirmation** |

## Human confirmation

1. Is `origin/prod` at `017d6aa0` the code that should be treated as current, rather than `master` at `629b199a`?
2. Is Footprint still operated, and at which hostnames (`footprintapp.net`, `admin.magus.events`, others)?
3. Are Footprint, FootprinLive, Teamwizz, SARU, and Magus.Events one product or several customers on one codebase?
4. Should the hardcoded database, SMTP, MSSQL, and login-bypass secrets be rotated? They are in git. Values are not repeated here.
5. What do the labels FP3 and FP4 mean to the business? Commit subjects use them; the code does not define them.
6. Are the fixed numeric user ids in the menu still the right people for InSight, Efiling, and Team Zone?