# Business rules — blindside (BlindSide)

Evidence date: 2026-10-19. Source: `git@bitbucket.org:overdrive/blindside.git`, `master` at `25a8c70`.

Rules are taken from behaviour and from visible copy. Each rule is marked **Documented** (text on a screen), **Implemented** (what the code does), or **Inferred**.

There is no policy document, terms file, or database constraint in the repository. The Terms & Conditions and Cookie Policy links on the login card are `href="#"` and do not open a document.

The dashboard numbers and the provincial rows were committed as "fake data" (`a9ecc7e`). They are recorded as what the screen shows. They are not recorded as approved reporting policy.

## Identity and access

**BR-001 — Opening the site shows a login card.**

- Provenance: **Implemented**. `userSession` starts false. On ready the flag is set true and `core/view/login/login.html` is loaded into `#pageContent`.
- The flag is not stored. A reload runs the same path again.

**BR-002 — The sign-in button does not check credentials.**

- Provenance: **Implemented**. The `login` case loads the dashboard and returns before it reads email or password.
- This contradicts the unreachable block in the same case, which refuses empty username or password and posts to `api/login.php`.
- The visible rule is BR-002. The unreachable checks are BR-003 and are not in force.

**BR-003 — Unreachable credential checks.**

- If that block ran, an empty `#indexEmail` or `#indexPassword` would show `#loginErrorEmpty`.
- A JSON `error` equal to `Encorrect Usename or Password` would show the same element.
- Any other success payload would copy `name`, `surname`, `id`, and `role` into cookies `bsUserName`, `bsSurname`, `bsid`, and `bsrole` for 365 days.
- Provenance: **Implemented** source, not executed. The form has no ids `indexEmail` / `indexPassword` and no `#loginErrorEmpty`. The API file is not in the repository.
- Do not treat BR-003 as the product's login rule unless a human confirms the early `return false` was a mistake.

**BR-004 — No signed-in session is enforced.**

- A commented check would have redirected to `./login.html` when `checkSession()` was false. It is not active.
- After BR-002, a reload of `index.html` shows the login card again. Dashboard, member, and organisation fragments are not URLs of their own.
- Provenance: **Implemented**.

**BR-005 — Cookie helpers use a different prefix from the unreachable login.**

- `setCookie` / `getCookie` are generic.
- `checkLoggedinCookie` and `logOut` use `ffUserName`, `ffUsersurname` or `ffSurname`, `ffid`, and `ffrole`.
- The unreachable login writes `bs*`.
- Nothing on the screens calls `checkLoggedinCookie` or `logOut`. The Logout menu item is a `#` link.
- Provenance: **Implemented** unused code. **Inferred** that the `ff*` helpers were copied from another page. What `ff` means is **Unknown**.

**BR-006 — Remember me, forgot password, terms, and cookie policy are not rules the code applies.**

- Remember is a checked checkbox with no reader.
- Forgot password links to a file that is not in git.
- Terms and cookie policy links do not navigate.
- Provenance: **Documented** as labels only.

**BR-007 — No access-control rule is implemented.**

- Settings includes "Access Contol". The action is `project`, which has no route case.
- No role hides a menu. The unreachable login stored `role` and never read it back to allow or deny a screen.
- Provenance: **Menu label only**. A permission model is **Unknown / Requires Confirmation**.

**BR-008 — CSRF header is configured and has no token.**

- Every jQuery AJAX call would send `CsrfToken` from `meta[name="csrf-token"]`.
- `index.html` does not define that meta tag.
- The only AJAX call in the application is the unreachable login POST.
- Provenance: **Implemented** setup. It does not protect a request that runs.

## Navigation labels

**BR-009 — Spelling on the menus is part of the interface.**

The secondary nav uses these strings, including the misspellings: Personel, Organisastions, Efilling Forms, Access Contol.

- Provenance: **Documented** in `core/view/headerDesctiption.html`.
- Routes repeat `listOrganisastion` and `addOrganisastion`. The folders match that spelling.

**BR-010 — Dashboard in the secondary nav restarts the shell.**

- That item is `href="index.html"`, not `action="dashboard"`.
- A click reloads the document. BR-001 shows the login card again.
- Provenance: **Implemented**.

**BR-011 — Forms, plan, grants, and settings items do not open a screen.**

- Their actions are not cases in the switch. The default uses the variable `loadUrl`, which is never assigned.
- Provenance: **Implemented**.
- **Inferred:** the labels describe areas someone intended to build. There is no written rule for how a grant, a project, or an e-filing form should behave.

## Dashboard content

**BR-012 — Tournament chart series and competitions are fixed in script.**

- Series names rendered: Black, Colored, White, Indian.
- The horizontal axis is the competition list in `dashboard.js` (HSBC sevens stops, Super Rugby, Currie Cup, age-group weeks, and named 2019 provincial sides, among others).
- Values are numeric literals. The commit message calls them fake data.
- Provenance: **Implemented** display. **Not** a confirmed business taxonomy. Whether those series names were meant as a reporting standard is **Unknown / Requires Confirmation**.

**BR-013 — Get Into Rugby is an empty static table.**

- Title: Get Into Rugby.
- Columns: Total, Generic, African, Colerd, Indian, White.
- Six rows, each named Boys, each value 0.
- Provenance: **Documented** headings and **Implemented** zeros. No calculation exists. "Colerd" is the heading spelling.

**BR-014 — Plan & Budgets is the theme calendar, not a budget.**

- Card title: Plan & Budgets.
- Events are the 2014 FullCalendar sample set shipped with the theme (meetings, lunch, "Click for Google", and similar). `defaultDate` is `2014-11-12`. Events are `editable: true` in the browser only. Edits are not saved.
- Provenance: **Implemented**. No budget amount, project, or grant rule is enforced.

**BR-015 — Provincial EPG rows are a fixed list with display statuses.**

- Title: SARU Provincial EPG 2016 Form.
- Status strings that appear: `DRAFT`, `IN PROGRESS`, `APPROVE`, `APPROVED`. Both `APPROVE` and `APPROVED` are used. Nothing changes a row from one status to another.
- Organisations listed: Limpopo Blue Bulls, South Western Districts, Western Province, Pumas, Leopards, Kwazulu-Natal, Griquas, Griffons, Golden Lions, Free State, Valke Rugby Union, Eastern Province, Boland, Border, Blue Bulls.
- Provenance: **Documented** on the dashboard. **Inferred** that these names refer to South African provincial rugby unions, because that is what the labels say. The meaning of EPG, and whether a 2016 form workflow existed outside this file, are **Unknown / Requires Confirmation**.

**BR-016 — Header identity is not the signed-in user.**

- The greeting is always "Good morning, Eugene".
- The user menu name is always "Heinrich".
- Neither value is read from a cookie or an API.
- Provenance: **Implemented** literals.

## Members and organisations

**BR-017 — The member list is four sample cards.**

- Names and job titles: James Alexander, Lead developer; Nathan Jacobson, Lead UX designer; Margo Baker, Sales manager; Barbara Walden, SEO specialist.
- There is no add, edit, delete, duplicate check, or search.
- Provenance: **Implemented** HTML. **Inferred** theme sample content, not a BlindSide directory.

**BR-018 — Add member, list organisation, and add organisation do not capture data.**

- Each page shows its own path as an `h2`. Controllers are empty.
- No required field, format, or uniqueness rule exists for a person or an organisation.
- Provenance: **Implemented** absence of rules.

## Deployment rules visible in scripts

**BR-019 — Only `master` is described by the pipeline.**

- Provenance: **Implemented** in `bitbucket-pipelines.yml` (`branches.master`). No other branch exists in the remote that was cloned.

**BR-020 — The published tree is the repository root on Apache.**

- `appspec.yml` copies `/` to `/var/www/html/`.
- BeforeInstall installs `httpd` with `yum` as root.
- ApplicationStart runs `service httpd start` after `chmod 755` on the document root.
- Provenance: **Implemented**.
- Which host, and whether the hook still runs, is **Unknown / Requires Confirmation**.

**BR-021 — ApplicationStop forces permissions and is allowed to fail.**

- `stop_server` attempts to stop `httpd` and runs `chmod 777` on `/var/www/html`.
- The process check is written `isExistApp = `pgrep httpd`` with spaces around `=`, which is not a valid bash assignment.
- `codedeploy_deploy.py` sets `ignoreApplicationStopFailures` true.
- Provenance: **Implemented**. This is script behaviour, not a product permission rule for end users.

## Rules that are not in this repository

The following are named on screen and have no rule behind them. Do not invent one:

- How an e-filing form is validated or submitted.
- How a form template is approved.
- How a project, grant category, or grant classification is created or limited.
- Who may see Emails Sent or edit Email Templates.
- How "APPROVE" differs from "APPROVED".
- Any age, gender, or population-group rule for Get Into Rugby or the tournament chart beyond the static labels in BR-012 and BR-013.