# Project plan — VivaInnovations

Evidence date: 2026-09-29.

Source repository: `git@bitbucket.org:overdrive/vivainnovations.git`.

The scan-host path `~/projects/sonar_scan/repos/VivaInnovations` was not on this machine. The trees below were read from git.

Credential values, payment secrets, and key material are omitted.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The application on branch `dev` is **Vivlia**, a React web application for selling and reading digital textbooks, literature, and learning material. Admins manage catalogue, users, vouchers, sales, FAQs, and legal documents. Learners browse, buy (Peach Payments, currency ZAR), redeem vouchers, and read PDF or EPUB titles in a library.

Provenance: **Documented** in `README.md` (product name Vivlia, environments, roles, AWS stack). Behaviour is **Implemented** on `dev` at `71b4967`.

There is no Silicon Ark set for this project before this one. The source README is the in-repo product description. `RDSA.md` is a SovTech self-assessment checklist, not a product plan.

The Bitbucket repository name is `vivainnovations`. The README clone URL is `git@bitbucket.org:sovtech/vivlia.git`. Public hostnames in the README are `dev.vivlia.sovtech.org`, `uat.vivlia.sovtech.org`, `prod.vivlia.sovtech.org`, and `www.vivinnovation.co.za`.

## Branch reality

`git ls-remote` HEAD is `37b1a24`, which is `master`.

| Line | Tip | Date | Commits | What it is |
|---|---|---|---|---|
| `master` (HEAD) | `37b1a24` | 2022-11-21 | 1 | Unrelated history. Author Jaco Brits. Message "Initial commit". Only file: a Bitbucket `.gitignore` template. |
| `dev` | `71b4967` | 2021-12-13 | 1,210 | Latest application tree. Merge of pull request #380 (`chore/RDSA_updates`). |
| `develop` | `c2fc32d` | 2020-08-27 | 960 | Older Lerna monorepo. Merge of pull request #253 (`Fix/pipeline`). |

`master` and `dev` have no common ancestor. `dev` and `develop` share history. `dev` is 301 commits ahead of that merge base. `develop` has 51 commits that are not in `dev`.

No other branches and no tags were present.

History on the application line:

- 2019-06-24 — Alex Tiley added `README.md`, then "feat: Inital clone of the SSAK repo".
- 2019-06 through 2020-08 — SovTech development on what is now `develop` (monorepo: `packages/backend`, `packages/everblue-ui`, `packages/theme`, `packages/web`).
- 2020-08-27 — last commit on `develop`.
- Through 2021-12-13 — the app was flattened to a single Create React App package on `dev` (`package.json` name `@sovtech/web`, version `2.16.3`).
- 2022-11-21 — `master` was created as a new root commit that does not contain the application.

**Discrepancy:** the onboarding scan listed this root:

```text
sonar-project.properties
sonarqube_scan.bat
```

`master` contains only `.gitignore`. `sonar-project.properties` is on `dev` (project key `VIVLIA`). `sonarqube_scan.bat` is not in any branch history. Provenance: **Unknown** — it may have been an untracked file on the scan host.

**Discrepancy:** `RDSA.md` on `dev` marks "default branch is `develop`" and "master and develop are present" as completed. Git HEAD is `master`. Branch `dev` also exists. Whether Bitbucket's default branch setting still matches HEAD is consistent with `ls-remote` HEAD, and conflicts with the RDSA claim.

Which branch should be treated as the product is **Requires Confirmation**. This documentation treats `dev` as the implemented product because it is the newer tree and it matches the README. `develop` is recorded as an older monorepo line. `master` is recorded as an orphan stub.

## Objectives (inferred from the README and the `dev` implementation)

- Let a visitor browse published textbooks, literature, and learning material, and register as a learner.
- Let a learner buy resources, redeem a voucher, and read purchased PDF and EPUB files, including offline copies and annotations.
- Let an admin (including the Agent role; see business rules) manage users, catalogue, vouchers, sales, FAQs, and legal documents.
- Deploy the web app and Amplify backend to AWS in more than one environment.

## Scope

### In scope of `dev` (`71b4967`)

1. React 16 / TypeScript web app under `src/`, built with Create React App and `react-app-rewired`.
2. AWS Amplify backend: Cognito, AppSync GraphQL (`amplify/backend/api/vivlia/schema.graphql`), DynamoDB models, S3 storage `vivliaResources`, S3 + CloudFront hosting.
3. Lambdas: `createUser`, `disableUserAccount`, `makePayment`, `sendEmail`, Cognito post-confirmation `vivliaa1cb2768PostConfirmation`.
4. API Gateway REST APIs in front of those lambdas (except the Cognito trigger).
5. Bitbucket Pipelines definition and SonarQube properties.
6. Operator docs: `README.md`, `CONTRIBUTING.md`, `CHANGELOG.md`, `RDSA.md`.

### In scope of `develop` only (`c2fc32d`)

A Lerna monorepo (`lerna.json`) with packages `backend`, `everblue-ui`, `theme`, and `web`. This line stopped in August 2020. It was not re-documented screen by screen. It is not the tree the README at `dev` describes as the current app layout (the README paths are repo-root `src/` and `amplify/`, which is the `dev` layout).

### Out of scope / not in this repository

- A mobile client. The README says end users register with the mobile app. `dev` implements web registration at `/register`. No iOS or Android project is in git.
- Push notifications. The README names them. No push implementation was found on `dev`.
- Mailgun. The README services table names Mailgun for marketing email. `sendEmail` uses Amazon SES. No Mailgun client was found on `dev`.
- `sonarqube_scan.bat`.
- A written backlog or a statement of which Amplify environment is production today.

## System architecture (`dev`)

```text
Browser (React, Ant Design, Apollo, Amplify)
   |  Cognito user pool (email username) + identity pool (unauthenticated identities allowed)
   |  AppSync GraphQL, auth type AWS_IAM, credentials from Auth.currentCredentials()
   |  API Gateway (IAM) -> Lambda
   v
DynamoDB (one table per @model)
S3 vivliaResources (documents and media)
S3 + CloudFront (web hosting)
Peach Payments (card debit, ZAR) via makePayment
Amazon SES via sendEmail
Bugsnag + Google Analytics in the web app
```

Region in `deploy.sh`, lambda code, and `amplify/team-provider-info.json`: `eu-west-1`.

Amplify environment names present in `team-provider-info.json`:

| Amplify env | Stack name |
|---|---|
| `dev` | `vivlia-dev-20190815133508` |
| `uat` | `vivlia-uat-20191003120311` |
| `staging` | `amplify-vivlia-staging-151956` |

There is no `prod` key in that file. The README names a production environment. Whether production is `staging`, `uat`, or an environment that is not in this file is **Unknown / Requires Confirmation**.

## Milestones visible in git

| When | What |
|---|---|
| 2019-06-24 | Repository started; SSAK starter cloned in. |
| 2019-08 | Changelog entries through 2.16.1 (learning material, profile). `package.json` on `dev` is 2.16.3. |
| 2019-08-15 | Amplify stack `vivlia-dev-20190815133508` (stack name timestamp). |
| 2019-10-03 | Amplify stack `vivlia-uat-20191003120311`. |
| 2020-08-27 | Last `develop` commit. |
| 2021-11-18 | SonarQube config merged (pull request #379). |
| 2021-12-13 | Last application commit (RDSA update, pull request #380). |
| 2022-11-21 | Orphan `master` initial commit. |

No release tags exist. `package.json` configures semantic-release on branch `develop`. `bitbucket-pipelines.yml` leaves `npx semantic-release` commented with `TODO: Implement semantic-release`.

## Current project status

**Implemented** application code last changed on 2021-12-13 on `dev`. **Implemented** default git HEAD is an empty application: `master` at 2022-11-21.

Whether the AWS stacks are still deployed, whether the public URLs still resolve, and whether Overdrive or SovTech operates them is **Unknown / Requires Confirmation**.

## Known dependencies

- Node. README says Node >= 10. `.nvmrc` contains `lts/*`. Exact version used in the last deploy is **Unknown**.
- Yarn (`yarn.lock`). Package name `@sovtech/web`.
- AWS Amplify CLI pinned in the pipeline to `@aws-amplify/cli@5.2.0`.
- Create React App `react-scripts` 3, React 16.8, TypeScript 3.5, Ant Design 3, Apollo Client 2, `aws-amplify` 3.
- Peach Payments host documented as `https://oppwa.com/v1/payments`.
- Pipeline image `sovtech/bitbucket-pipelines-node-aws:latest` and `sonarsource/sonar-scanner-cli:4.5`.
- SonarQube project key `VIVLIA`. Host and token come from `SONARQUBE_URL` and `SONARQUBE_TOKEN`.

## Human confirmation

1. Which branch is the product: `dev`, `develop`, or should `master` be rebuilt from one of them?
2. Are the Amplify stacks `dev`, `uat`, and `staging` still live, and which one is production?
3. Are `www.vivinnovation.co.za` and the `vivlia.sovtech.org` hosts still in use?
4. Should the committed payment private key and the credential values in `README.md` be rotated and removed from history?
5. Was a mobile app ever a separate repository?
6. Should `sonarqube_scan.bat` on the scan host be ignored?