# Project plan — SuperHero2020

Evidence date: 2026-10-02.

Source repository: `git@bitbucket.org:overdrive/superhero2020.git`.

Inspected revision: `master` at `ab4effc` (2020-02-07 17:29:49 +0200, "Merge branch 'prod'", author heinrichoverdrive). The scan-host path named in the onboarding task (`~/projects/sonar_scan/repos/SuperHero2020`) was not present on this machine. Evidence comes from a read-only clone of `origin/master`. The clone was shallow (`--depth 1`), so commits before `ab4effc` were not enumerated.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The browser title is **Vodacom Super Hero Sunday (2020) - Accreditation Portal** (`application/layouts/default.phtml`). Outbound mail uses the from-name "Accreditation - Vodacom Super Hero Sunday 2020" and the subject "Vodacom Super Hero Sunday 2020 Notification" (`ApplicationController::sendMail`).

The repository is a public Zend Framework 1 site where a person applies for event accreditation, signs in with an email and a reference number, updates a profile and photo, and confirms or cancels attendance. Event, category, role, and application rows live in a shared MySQL database that also holds SA Rugby / Footprint tables (`tournament`, `Fixture`, `squad`). Photos and one image-update call go to `www.footprintapp.net`.

Provenance: **Implemented**. No README or written product brief exists in the repository. The purpose above is recovered from the layout title, the application wizard, and the mailer.

## Branch reality

`origin/HEAD` is `master`. The only commit retrieved is `ab4effc`, a merge of branch `prod`.

Bitbucket Pipelines are defined for branches `qa` and `prod` only (`bitbucket-pipelines.yml`). `master` has no pipeline step. Whether `qa` and `prod` still exist on the remote, and whether they differ from `master`, is **Unknown / Requires Confirmation** — this inspection did not fetch those branches.

No release tags were inspected. Tag presence is **Unknown**.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from the application, not from a written plan)

No project plan exists in the repository. The following are **Inferred** from the screens and controllers:

- Let an applicant submit an accreditation application for Vodacom Super Hero Sunday 2020.
- Give the applicant a reference number and an email when the event record has `EmailNotes`.
- Let the applicant return, sign in with email plus reference number, and edit the application until it is Confirmed, Declined, or Approved.
- Collect a portrait photo and store it via the Footprint accreditation host.
- Let an applicant confirm attendance or cancel, which declines the application.
- Offer linked events on the same form when `LinkedAccreditations` rows are still open.
- Collect extra media fields (days attending, editor/producer) when the event or category is treated as media.

## Scope

### In scope of this repository

- Zend Framework 1.11.10 applicant portal (`library/Zend/Version.php`).
- One module, `default`, with `IndexController`, `ApplicationController`, and `ErrorController`.
- Twenty Zend_Db models for accreditation tables and views.
- Inspinia / Bootstrap / jQuery assets under `public/assets`.
- AWS CodeDeploy packaging (`appspec.yml`, `codedeploy_deploy.py`) and a Bitbucket Pipeline for `qa` and `prod`.

### Out of scope / not in this repository

- Staff screens that create events, approve applications, or manage zones, gates, permits, and load-in schedules. Models for those tables are present. Controllers and views for them are not. **Inferred** that staff work happens in the Footprint accreditation application at `www.footprintapp.net`. Requires confirmation.
- The MySQL server. The committed backup `application/configs/application.ini.bak` points at host `db.footprintapp.net` and database `teamwizz_SARU`. The live `application.ini` is gitignored.
- Gmail SMTP and the Footprint photo host as operated services. This repo only contains the client calls.
- Automated tests, a README, Composer, and Sonar configuration in git.
- The supplier registration site. The form links to `http://supplier.sarugby.online`. The layout link to `http://supplier.sarugby.online/register` is commented out.

## System architecture

```text
Browser
  └─ Apache httpd (CodeDeploy starts the service)
       └─ public/index.php  (Zend_Application, env default "production")
            └─ module default
                 ├─ IndexController        GET /  (hardcoded event code)
                 ├─ ApplicationController  /application/*
                 └─ ErrorController
            └─ MySQL teamwizz_SARU @ db.footprintapp.net
                 shared tables: Accreditation_*, tournament, Fixture, squad, Images
            └─ HTTPS calls
                 ├─ POST photo to www.footprintapp.net/accreditations/application/updateimage
                 ├─ GET photo from www.footprintapp.net/accre/photos/{Ref}.jpg
                 └─ SMTP smtp.gmail.com:587 as accreditation@magus.events
```

CodeDeploy copies the tree to `/mnt/data/www/html/magus.events/superhero2020.magus.events/` and sets owner `apache` (`appspec.yml`). The public hostname that served that path is **Unknown / Requires Confirmation**. The directory name implies `superhero2020.magus.events`.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Application wizard | Personal details, organisation, category, role, optional media fields, photo, linked events, terms | `views/scripts/application/apply.phtml`, `views/scripts/index/index.phtml` |
| Login and profile | Email + reference number session; editable profile while status is unlocked | `loginAction`, `profileAction`, `profile.phtml` |
| Attendance | Confirm or decline from a one-time `AttendanceKey` | `attendanceAction` |
| Mailer | HTML mail through Gmail SMTP, templates stored on the accreditation row | `sendMail`, `EmailApplicant`, `EmailApplicantDeclined` |
| Footprint photo bridge | Forwards the cropped image; profile reads the file back from Footprint | `sendImage`, `remoteFileExists` |
| Shared accreditation schema | Events, applications, categories, roles, zones, services, permits, gates | `application/models/*` |
| Deploy | Zip on Bitbucket, S3, CodeDeploy | `bitbucket-pipelines.yml`, `codedeploy_deploy.py` |

## Milestones

No milestone plan is documented. Git evidence available here is a single merge of `prod` into `master` on 2020-02-07. Earlier delivery dates are **Unknown**.

## Implementation plan

There is no implementation plan in the repository. The code is a deployed Zend 1 application, not a backlog. Work that would change behaviour is not described. Anything after 2020-02-07 is **Unknown**.

## Known dependencies

- PHP with the `mcrypt` extension (`random_id` calls `mcrypt_create_iv`). `mcrypt` was removed from PHP core in 7.2. The PHP version on the server is **Unknown / Requires Confirmation**.
- Zend Framework 1.11.10, vendored under `library/Zend`.
- Apache `httpd` (`scripts/install_dependencies`, `scripts/start_server`).
- MySQL database `teamwizz_SARU` on `db.footprintapp.net`, via `pdo_mysql`.
- AWS CodeDeploy, S3, and Bitbucket pipeline variables `*_AWS_ACCESS_KEY_ID`, `*_AWS_SECRET_ACCESS_KEY`, `*_AWS_DEFAULT_REGION`, `*_APPLICATION_NAME`, `*_DEPLOYMENT_GROUP_NAME`, `*_S3_BUCKET`. `codedeploy_deploy.py` also reads `DEPLOYMENT_CONFIG`. That variable is not set in `bitbucket-pipelines.yml`. Whether the pipeline supplies it another way is **Unknown**.
- `www.footprintapp.net` for photos.
- Gmail SMTP for mail.
- Optional: `supplier.sarugby.online` when a role has `SupplierReg = 1`.

## Current project status

The repository tip is a February 2020 production merge. There is no statement in git that the site is retired or still live. Operational status is **Unknown / Requires Confirmation**.

The homepage and the sign-in action ignore the URL and load accreditation code `5DEB6F11DDA93`. The apply action loads whatever `code` is in the URL. Several views still post to `/accreditations/application/...`, a module this repository does not contain. See the PRD for that discrepancy.

## Human confirmation

- Is `superhero2020.magus.events` the host that served this code, and is it still in use?
- Is accreditation code `5DEB6F11DDA93` the Super Hero Sunday 2020 event, and is pinning `/` and `/application/login` to it intentional?
- Does production `application.ini` match `application.ini.bak`?
- Which PHP version runs the site?
- Do `qa` and `prod` still deploy, and do they differ from `master`?
- Where do staff approve applications?