# Project plan — bluecard.footprintapp.net

Evidence date: 2026-10-19.

Source repository: `git@bitbucket.org:overdrive/bluecard.footprintapp.net.git`.

The task metadata named `~/projects/sonar_scan/repos/bluecard.footprintapp.net` on branch `master` at `3e123e6` (2022-03-10, "Initial commit"). That path was not on this host. The remote was cloned and inspected instead. `origin/master` is still `3e123e6`. That commit is the initial import, not the branch Bitbucket Pipelines deploys.

Deployed lines:

| Branch | Tip | Date | Subject |
|---|---|---|---|
| `origin/master` | `3e123e6` | 2022-03-10 | Initial commit |
| `origin/bluecard-11-03-2022` | `f990a10` | 2022-10-18 | Added additional fields for players |
| `origin/qa` | `a5caf1a` | 2022-10-18 | Merge branch `bluecard-11-03-2022` into qa |
| `origin/prod` | `aa2cc42` | 2022-10-19 | Merge branch `qa` into prod |

`bitbucket-pipelines.yml` defines deploy steps only for `qa` and `prod`. Product behaviour below is **Implemented on prod** unless a line says otherwise. `qa` matches `prod` except the database host (see technical documentation). `master` still contains the pre-split Footprint tree, including a `bluecard` module and a second tree at `website/`.

No `silicon_ark/bluecard.footprintapp.net/` directory existed before this document set. The source repository has no README and no product requirements document.

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

Credentials that appear in tracked source are not copied into this file.

## Objectives

**Inferred from the implementation, not from a written objective.**

The deployed application is a public SA Rugby / BokSmart form for logging a Blue Card concussive injury. The page heading is "Blue Card Incident" (`application/modules/default/views/scripts/index/index.phtml`). The layout title is "SA Rugby - Official Home of the Springboks" and the header image is `/wp-content/SARugbyTopBannerWebsite.jpg` (`application/layouts/default.phtml`).

What the prod code does:

- Show a five-step form (four steps when the reporter is the player).
- Email the reporter, BokSmart union representatives, and extra contacts, with concussion documents attached.
- Insert the posted fields into MySQL table `BlueCard_Consents`.
- Show a thank-you panel that includes a reference number and links to the same documents.

A written product objective, owner, or success measure was not found. **Unknown / Requires Confirmation.**

Wording sources sit in the tree and were not extracted: `public/archives/new_changes/16-05-2022/1 SA Rugby Online Blue Card App wording update.docx` and `2 Blue Card Research consent - disclaimer.docx` (and a PDF of the disclaimer). Whether the live view matches those files word for word was not compared.

## Scope

### In this repository, on `origin/prod`

**Implemented:**

- Zend Framework 1 application (`library/Zend/Version.php` reports `1.11.10`).
- One module, `application/modules/default`, whose index action is the Blue Card form.
- MySQL through `Zend_Db` (`application/configs/application.ini`).
- Mail through `Zend_Mail` to `mail.sarugby.co.za`.
- AWS CodeDeploy packaging for the `qa` and `prod` Bitbucket branches (`bitbucket-pipelines.yml`, `appspec.yml`, `codedeploy_deploy.py`).
- 10,760 tracked paths. 7,809 of those are under `public/`, mostly theme and editor assets. `public/archives` on prod is 23 files: the Blue Card PDFs and spreadsheets, a 16 May 2022 backup and wording folder, `image.png`, and `lastupdate.txt`.

### On `origin/master` only

**Implemented as code on master, not on prod/qa:**

- Modules `bluecard`, `menu`, `companiesold`, `companyonl`, plus a `default` module that still contains match-centre controllers (`TournamentsController`, `CronController`, `LoginController`, `AjaxController`).
- Layouts `bluecard.phtml`, `menu.phtml`, `food.phtml`, `admin.phtml`, `repo.phtml`.
- A second tree at `website/` (26,740 tracked paths).
- A `test/` directory of hosting probe pages (PHP, FastCGI, SSI), not an application test suite.
- The clone of `master` contains on the order of 54,000 files, including long vendor paths under `public/` and `website/public/`.

Commit `85d79d4` (2022-03-11, "Moved bluecard into top level domain") deletes those modules from the working application and makes the default module the form. Later commits land on `bluecard-11-03-2022`, then merge to `qa` and `prod`.

### Not established

- Whether the site is still deployed or still receiving submissions. Last commit on `origin/prod` is 2022-10-19.
- The live host name. The repository slug is `bluecard.footprintapp.net`. CodeDeploy copies files to `/mnt/data/www/html/footprintapp.net/bluecard.footprintapp.net/`. No vhost file is in the repository.
- The PHP version on the server. Reference numbers use `mcrypt_create_iv`, which current PHP does not provide. **Requires Confirmation.**
- A product roadmap. Nothing in the repository describes future work. Nothing in this document is **Planned**.
- `sonar-project.properties` and `sonarqube_scan.bat` were named in the task's top-level scan. They are not in the root tree of `master`, `qa`, `prod`, or `bluecard-11-03-2022`. **Unknown** whether they existed only as untracked files on the scan host.

## System architecture

**Implemented on prod.**

```text
Browser
  -> Apache httpd (CodeDeploy ApplicationStart runs `service httpd start`)
  -> root .htaccess rewrite into public/
  -> public/index.php (Zend_Application, env default production, timezone Africa/Johannesburg)
  -> application/modules/default/IndexController
  -> MySQL teamwizz_SARU on db.footprintapp.net (prod) or qadb.footprintapp.net (qa)
  -> SMTP mail.sarugby.co.za as bluecard@sarugby.co.za
  -> PDF and spreadsheet files under public/archives/bluecard/
```

`LayoutPicker` sets the layout name to the module name. The only module is `default`, and the only layout file on prod is `application/layouts/default.phtml`.

The root `index.php` is an empty file. It is not the front controller.

## Major components

| Component | Role | Evidence | Status |
|---|---|---|---|
| Default module | Blue Card wizard, submit, mail, thank-you | `application/modules/default` | **Implemented** on prod |
| `Model_Bluecard` | Insert into `BlueCard_Consents`; look up BokSmart rep emails | `application/models/Bluecard.php` | **Implemented** |
| `Model_Unions` | Union dropdown from `ef_unions` | `application/models/Unions.php` | **Implemented** |
| `Model_Ethnicity` | Ethnicity dropdown from `Ethnicity` where country is South Africa | `application/models/Ethnicity.php` | **Implemented** |
| Other models | Accreditation, fixtures, menus, profiles, and similar | `application/models/*.php` | **Implemented** as files on prod. Not referenced by the default module. **Inferred** leftover from the Footprint import |
| Mail and attachments | HTML mail plus seven concussion files | `IndexController::sendMail`, `public/archives/bluecard/` | **Implemented** |
| CodeDeploy pipeline | Zip the tree and deploy the `qa` or `prod` branch | `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `appspec.yml` | **Implemented** |
| `library/PG` | Layout picker and other Footprint plugins | `library/PG/Controller/Plugin/` | Layout picker is wired. The other plugins are not called by the default module |
| `website/`, match-centre controllers, company and menu modules | Earlier Footprint tree | `master` only | Removed from the prod module tree by `85d79d4` |

## Milestones visible in git

There is no project plan in the repository. The dates below are commit dates, not an agreed schedule.

| When | Commit | What changed |
|---|---|---|
| 2022-03-10 | `3e123e6` on `master` | Initial import of a multi-module Footprint tree. Blue Card is `application/modules/bluecard` |
| 2022-03-11 | `85d79d4` | Blue Card becomes the default module. Other modules and their layouts are deleted |
| 2022-03-11 | `761c258`, `dfe231a` | `application.ini` updated. A commit message says testing email settings were removed. The prod controller still has a `testAction` that sends mail |
| 2022-03-11 | `e48e386` | `wp-content` and `wp-includes` added for CSS the layout uses |
| 2022-03-22 | `f154dd0` | "Commit to PROD" |
| 2022-05-05 | `4cc360d` | Download and email files updated |
| 2022-05-16 | `4b7c3a9` | Research-consent file updated. Backup copies dated `16-05-2022` are in `public/archives` |
| 2022-05-25 | `eb445ff` | Email body gains the SARU privacy paragraph. Zipped concussion register added |
| 2022-05-25 | `d6bc607` | Email banner background set to `lightblue` |
| 2022-05-26 | `4e9ba84` | `IndexController` links forced to `https` (six lines). The layout still loads two Google Fonts stylesheets over `http` |
| 2022-10-18 | `f990a10` | Player step gains School/Club, Town/City, and Province. The step legend text becomes "Who was involved1" |
| 2022-10-19 | `aa2cc42` | That commit is merged to `prod` |

Authors on `origin/prod`: `heinrichoverdrive` (24 commits) and Heinrich du Plessis (1). That is git metadata, not an application role.

## Implementation plan

No roadmap, ticket list, or open branch newer than October 2022 was found.

**Inferred** delivery path, from the branch names and the pipeline file:

1. Work on `bluecard-11-03-2022`.
2. Merge to `qa`. The `qa` pipeline deploys that branch.
3. Merge `qa` into `prod`. The `prod` pipeline deploys that branch.

`master` is not a pipeline branch. Nothing was found that says this sequence is still the required process.

## Known dependencies

| Dependency | Evidence | Notes |
|---|---|---|
| PHP with the `mcrypt` extension | `IndexController::random_id` | Version **Unknown**. `mcrypt` is absent from PHP 7.2 onward |
| Zend Framework 1.11.10 | `library/Zend` | Vendored in the repository |
| MySQL database `teamwizz_SARU` | `application.ini` | Prod host `db.footprintapp.net`. QA host `qadb.footprintapp.net`. Schema is not in the repository |
| Tables `BlueCard_Consents`, `ef_unions`, `Ethnicity`, `profile` | models | Column list is **Unknown**. Insert passes the whole posted array |
| Apache httpd | `scripts/install_dependencies`, `scripts/start_server` | Hook installs httpd only. PHP install is not in the hook |
| AWS CodeDeploy, S3, Bitbucket Pipelines | pipeline and `appspec.yml` | Account, application name, and deployment group come from pipeline variables |
| SMTP `mail.sarugby.co.za` port 25 | `IndexController::sendMail` | From address `bluecard@sarugby.co.za`. Password is in source and is not reproduced here |
| jQuery, jQuery Steps, jQuery Validate, Bootstrap datepicker | `default.phtml` and `index.phtml` | Served from `/wp-includes`, `/assets`, `/bootstrap2` |
| Sportsline / WooCommerce CSS copied under `public/wp-content` | layout links | No `wp-config.php` at the repository root. **Inferred** static copies, not a running WordPress site |
| Third-party script `https://cdn.ywxi.net/js/1.js` | `default.phtml` | Purpose is not documented in the repository |

## Current project status

**Implemented** and last changed on 19 October 2022 on `origin/prod`. No later commit exists on the remote branches that were listed.

The running behaviour, if this tree is what is deployed, is the Blue Card form described in the PRD. The match centre, food menu, and company/permit modules are not in the prod module directory.

Operational status (still live, still monitored, database still reachable) is **Unknown / Requires Confirmation**.

## Human confirmation

1. Is `origin/prod` (`aa2cc42`) the tree that should be treated as the product, rather than `master`?
2. Is the site still deployed, and is the live vhost `bluecard.footprintapp.net`?
3. Which PHP version serves it? `mcrypt_create_iv` must exist or reference numbers fatal before the form renders.
4. Does table `BlueCard_Consents` contain a column for every posted field, including `PlayerSchoolClub`, `PlayerTownCity`, and `PlayerProvince` added in October 2022?
5. Should the SMTP and database secrets that are committed in source be rotated? This document set does not copy them.
6. Is `IndexController::testAction` (`/index/test`) still an acceptable public route? It sends a real email.
7. Were `sonar-project.properties` and `sonarqube_scan.bat` ever part of this repository, or only present on the scan host?