# Project plan — Sunmet2020

Evidence date: 2026-10-02.

Source repository: `git@bitbucket.org:overdrive/sunmet2020.git`.

Default branch `master` at `10caee0` (2020-08-04, "Merge branch 'prod'"). Deploy branches `qa` (`cf9251d`, 2020-01-13) and `prod` (`afeb66d`, 2020-01-13) are described under Branch reality.

This plan describes what the repository contains. It does not decide what the product should become.

There is no README, project plan, or requirements document in the source repository, and there was no prior `silicon_ark/Sunmet2020/` set. Statements below are recovered from code, views, deployment files, and Git history. Provenance is labelled.

## Product

**The Sun Met (2020) — Accreditation Portal.** The HTML title in `application/layouts/default.phtml` is exactly that. The application is a public Zend Framework 1 site where a person applies for event accreditation, receives a reference number, and can later sign in with that reference and their email to view or edit the application.

Provenance: **Implemented** (layout title, application wizard in `application/modules/default/views/scripts/application/apply.phtml`, login in `login.phtml`).

The homepage and the sign-in page do not take an event code from the URL. Both hard-code accreditation code `5DA997A51439E` and load that row from the database view `Accreditations_view`. The event name, dates, banner, and terms shown on screen come from that row. Provenance: **Implemented** in `IndexController::indexAction` and `ApplicationController::loginAction`. Whether that code is the Sun Met 2020 record is **Unknown / Requires Confirmation** — the title is hard-coded, the event content is not.

Mail is sent as `accreditation@magus.events` with the display name "Accreditation - The Sun Met". CodeDeploy copies the tree to `/mnt/data/www/html/magus.events/sunmet2020.magus.events/`. Provenance: **Implemented** in `ApplicationController::sendMail` and `appspec.yml`.

## Branch reality

| Branch | Tip | Date | Role in this repository |
|---|---|---|---|
| `master` (default, `origin/HEAD`) | `10caee0` | 2020-08-04 | Merge of `prod`, plus a rename of `application/configs/application.ini` to `application.ini.bak` |
| `prod` | `afeb66d` | 2020-01-13 | Merge of `qa`. Bitbucket Pipelines deploys this branch |
| `qa` | `cf9251d` | 2020-01-13 | "Remove Openfield / Roth media from Sunmet media". Bitbucket Pipelines deploys this branch |

`git diff origin/prod...origin/master` is a rename only: `application/configs/application.ini` on `prod` is `application/configs/application.ini.bak` on `master`. The file contents are the same. `.gitignore` ignores `application/configs/application.ini`, so a checkout of `master` does not contain a file at the path Zend loads (`APPLICATION_PATH . '/configs/application.ini'` in `public/index.php`).

The pipeline in `bitbucket-pipelines.yml` runs only for branches `qa` and `prod`. It does not run for `master`.

**Discrepancy:** the default branch is not the branch the pipeline deploys. Which tree is on `sunmet2020.magus.events` is **Unknown / Requires Confirmation**.

History starts at `176220e` (2019-12-12, author `root`, "initial commit of full repository"). Later commits are by `heinrichoverdrive` (22) and `Heinrich du Plessis` (2). The last product commit on `qa`/`prod` is 2020-01-13. The last commit on `master` is the 2020-08-04 config rename.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is tracked on `master`, `qa`, or `prod`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from the portal, not from a written plan)

No written objective exists in the repository. The following are **Inferred** from the screens and controllers:

- Let a person apply for accreditation to The Sun Met (2020), and optionally to linked events.
- Collect identity, organisation, role, a reason, a headshot, and acceptance of terms that cite SA Rugby policy and the Safety at Sports and Recreational Events Act of 2009.
- Email the applicant a confirmation when the accreditation record has an `EmailNotes` template, and email again when they confirm or cancel attendance.
- Let the applicant return with email plus reference number, see status, and edit the application until it is confirmed, declined, or approved.
- Hand the headshot to the Footprint accreditation service, which also holds the shared MySQL data.

## Scope

### In this repository

- Public application wizard, closed-applications page, attendance confirmation, login, profile edit, and photo update.
- Zend Framework 1.11.10 under `library/Zend`, plus a small `library/PG` and `library/Other` toolkit carried with the app.
- Zend table models for accreditation tables and views. Controllers in this repo use only a subset (see technical documentation).
- AWS CodeDeploy packaging (`appspec.yml`, `scripts/`, `codedeploy_deploy.py`) and a Bitbucket Pipelines file for `qa` and `prod`.
- Inspinia / Bootstrap / jQuery front-end assets under `public/assets`.

### Not in this repository

- The admin screens that approve, decline, or confirm an application. Status values are displayed and one decline path is written here, but no approve/confirm action exists in these controllers. **Inferred** that approval lives in the Footprint accreditation app (`https://www.footprintapp.net/accreditations/...`). **Unknown / Requires Confirmation.**
- Supplier company registration. The form links to `http://supplier.sarugby.online`. The navigation item for that URL is commented out in the layout. The registration system is not in this repo.
- The MySQL server `db.footprintapp.net` and the schema migrations. Tables and views are queried; they are not created here.
- Automated tests, Composer, Docker, and a PHP version pin. None are in the repository.
- `Barcode39.php`, which `barcodeAction` includes. The file is not in the tree.

## System architecture

One PHP application.

```text
Browser
  → Apache (httpd) on the CodeDeploy host
  → public/index.php (Zend_Application, env production)
  → Application module (default)
       → MySQL teamwizz_SARU on db.footprintapp.net
       → SMTP smtp.gmail.com as accreditation@magus.events
       → HTTPS POST of the headshot to
         www.footprintapp.net/accreditations/application/updateimage
       → HTTPS HEAD/GET of the stored photo from
         www.footprintapp.net/accre/photos/{Ref}.jpg
```

CodeDeploy destination: `/mnt/data/www/html/magus.events/sunmet2020.magus.events/`. Owner `apache`. BeforeInstall runs `yum install -y httpd`. ApplicationStart runs `service httpd start`.

Root `.htaccess` rewrites every URI that is not already under `/public/` into `public/`. `public/.htaccess` sends non-file requests to `public/index.php`.

## Major components

| Component | Path | What it does |
|---|---|---|
| Front controller | `public/index.php` | Bootstraps Zend, timezone `Africa/Johannesburg`, environment `production` unless `APPLICATION_ENV` is set |
| Application controller | `application/modules/default/controllers/ApplicationController.php` | Apply, login, profile, attendance, mail, photo forward |
| Home controller | `application/modules/default/controllers/IndexController.php` | Same hard-coded event as the home page; includes a POST path that calls methods this class does not define |
| Models | `application/models/Accreditation*.php` | `Zend_Db_Table` wrappers. Application rows use table `AccreditationApplycation` (spelled that way in code) |
| Layout and views | `application/layouts/default.phtml`, `application/modules/default/views/scripts/` | Inspinia wizard UI |
| Deploy | `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `appspec.yml`, `scripts/` | Zip the tree, upload to S3, create a CodeDeploy deployment |

## Milestones visible in Git

There is no milestone document. The history that exists:

1. 2019-12-12 — full repository imported (`176220e`).
2. 2019-12-20 — a run of unmessaged commits on the application, then `.gitignore` and an online edit of `application.ini`.
3. Through 2020-01-13 — repeated `qa` → `prod` merges, appspec/script updates, a favicon update, and removal of Openfield / Roth media choices (`cf9251d`).
4. 2020-08-04 — `master` merges `prod` and renames the ini file to `application.ini.bak`.

No release tags are in the clone.

## Implementation plan

No forward plan is written in the repository. Current status is a finished public portal whose last product change was January 2020 and whose default branch drifted from the deploy branch in August 2020.

## Known dependencies

- PHP with the `mcrypt` extension (`random_id` uses `mcrypt_create_iv`). `mcrypt` was removed from PHP in 7.2. The PHP version on the host is **Unknown / Requires Confirmation**.
- Apache `httpd` (Amazon Linux style `yum` / `service` in the hook scripts).
- Zend Framework 1.11.10, vendored.
- MySQL database `teamwizz_SARU` on `db.footprintapp.net`, including views `Accreditations_view`, `AccreditationRoles_view`, and `AccreditationCategory_view`.
- Gmail SMTP (`smtp.gmail.com`, port 587, TLS) for `accreditation@magus.events`.
- `https://www.footprintapp.net` for photo storage and, by inference, accreditation administration.
- jQuery 3.1.1, Bootstrap, Inspinia, jQuery Steps, jQuery Validate, Cropper (files under `public/assets`).
- AWS account credentials supplied as Bitbucket pipeline variables (`QA_*` and `PROD_*`). Values are not in git.
- `boto3==1.3.0` inside the pipeline image `python:3.5.1`.

## Current project status

**Implemented and last changed in 2020.** The portal can collect an application, email the applicant, accept an attendance link, and show a profile. It does not contain the back-office that moves an application to Confirmed or Approved.

**Not active development.** No commits after 2020-08-04. No open work is described in the tree.

## Human confirmation

- Is `sunmet2020.magus.events` still deployed, and from `prod` or from `master`?
- Is accreditation code `5DA997A51439E` the Sun Met 2020 event?
- Should a POST after `CloseDate` be rejected? The closed screen is only a view change; the insert still runs.
- Should a duplicate email be rejected on the server? The check is in the browser only.
- Does role flag `photo = 1` mean the headshot is optional? The wizard removes `required` when that flag is 1.
- Is category id `1` the media category? Category change shows the media block only when the event's `MediaOnly` is 0 and the selected category value is `1`.
- Credentials are stored in git (`application.ini.bak` / `application.ini` on `prod`, and `sendMail`). They are not copied into this document. Confirm rotation.
- Do approval and zone assignment happen only in Footprint?
- PHP version on the CodeDeploy host.
- Whether the scan-host files `sonar-project.properties` and `sonarqube_scan.bat` belong to this project.