# Technical documentation — calendar-module

Evidence date: 2026-10-19. Revision: `master` `88c9d8d` (2020-10-07). Source: `git@bitbucket.org:overdrive/calendar-module.git`.

28 tracked files. Two commits, both on 2020-10-07. The application was not installed or executed for this note. Versions below are the pins in `package-lock.json` unless said otherwise.

The database password in `php/db_connection.php` is an empty string for user `root`. No other secret is committed. The SQL dump contains personal test titles; they are not copied here.

## Architecture

Two processes, only one of which this repository can start:

```text
yarn start
  webpack-dev-server (Create React App) :3000
    React 16.13.1
      FullCalendar 5.3
      Axios 0.20.0  ---- HTTP ---->  something on :80 at /php-react/*.php

That second host is not defined in git.
  php/addEvent.php
  php/fetchEvent.php
  php/header.php
  php/functions.php
        |
        mysqli (only if dbconnect.php exists on the server)
        |
  MySQL or MariaDB, table event
```

`src/index.js` mounts `<App />` into `#root` under `React.StrictMode` and calls `serviceWorker.unregister()`.

`App.js` renders `<Calendar />` and imports `App.css`. It does not render the CRA logo or a "learn react" link.

## Application structure

```text
.gitignore                 Atlassian example, commit 5fdec4c
.prettierrc.json           {}
README.md                  Stock Create React App
package.json               name "calendar", private, version 0.1.0
package-lock.json          lockfileVersion 1
yarn.lock
php/addEvent.php
php/fetchEvent.php
php/header.php
php/functions.php
php/db_connection.php      not included by the other PHP files
php/fullcalender.sql
public/index.html          title "React App"
public/manifest.json       "Create React App Sample"
public/favicon.ico
public/logo192.png
public/logo512.png
public/robots.txt          User-agent: * / Disallow empty
src/index.js
src/index.css              CRA font stack
src/App.js
src/App.css                CRA logo styles, unused by App.js
src/App.test.js
src/setupTests.js
src/serviceWorker.js
src/logo.svg               React logo, unused by App.js
src/Components/Calendar.js
src/Components/Modal.js
```

No `src/setupProxy.js`, no `proxy` field in `package.json`, no `.env`, no `Dockerfile`, no CI file.

## Languages and frameworks

| Layer | Choice | Evidence |
|---|---|---|
| UI | React 16.13.1, no TypeScript, no router | `package.json`, `src/**/*.js` |
| Build | `react-scripts` 3.4.3 (Create React App). Not ejected | `package.json` has no `config/` webpack files |
| Calendar | FullCalendar 5 React wrapper | `Calendar.js` |
| HTTP client | Axios 0.20.0 | `Calendar.js` |
| Dialog CSS | styled-components 5.2.0 | `Modal.js` |
| API | PHP, `mysqli`, no framework | `php/*.php` |
| Database | MariaDB 10.4.11 per the dump header. Could also be served by MySQL; only the dump names MariaDB | `php/fullcalender.sql` |
| Format | Prettier config file is empty | `.prettierrc.json` |

`react-bootstrap` 1.3.0, `cors` 2.8.5, and `@fullcalendar/list` 5.3.1 are dependencies and are not imported by application code.

Both `package-lock.json` and `yarn.lock` were added in `88c9d8d`. The README tells the reader to run Yarn. Which tool was used on the author's machine after that commit is **Unknown**.

## Frontend behaviour

`Calendar.js` plugins: `dayGridPlugin`, `interactionPlugin`, `timeGridPlugin`.

Toolbar and flags are in the JSX of `<FullCalendar>`: month initial view, editable, selectable, select mirror, `dayMaxEvents`.

State:

| State | Initial | Set by | Read by |
|---|---|---|---|
| `selectedDate` | `null` | `dateClick` → `Info.date` | Render condition for `Modal` |
| `eventClick` | `""` | `select` → the select info object | `Modal` as `props.eventClick` |

`fetchEvent` and `addEvent` are recreated on every render. They are not wrapped in `useCallback`. `useEffect` is imported and unused.

Hard-coded endpoints:

- POST `http://localhost/php-react/addEvent.php`
- GET `http://localhost/php-react/fetchEvent.php`

`Modal.js` overlay is `position: fixed`, full viewport, `rgba(0,0,0,0.7)`, `z-index: 20`. The panel is 60vw wide, 20vh tall, white, `z-index: 22`. The form is uncontrolled-looking but the input is a controlled React input. Submit builds a FullCalendar event. It does not POST by itself.

Client event id: `let eventGuid = 0` sits inside the function body, so it resets when the component renders. The id is not sent to PHP.

## PHP endpoints

### Shared headers — `php/header.php`

Sent on both scripts, because both `require` it:

- `Access-Control-Allow-Origin: *`
- `Access-Control-Allow-Headers: access` and, in a second call, `Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With`
- `Access-Control-Allow-Methods: POST, OPTIONS`
- `Content-Type: application/json; charset=UTF-8` then `Content-Type: application/x-www-form-urlencoded`

PHP replaces the content type with the second value. There is no `exit` for OPTIONS.

### POST add — `php/addEvent.php`

1. `require 'header.php'`
2. `require 'dbconnect.php'` — this file is not in git
3. `include 'functions.php'` — that file also `include`s `dbconnect.php`
4. `json_decode(file_get_contents("php://input", true))`
5. `var_dump($data)`
6. Read `title`, `start`, `end` with `trim`
7. Call `Insertdata` with columns `eventTitle`, `dtDateStart`, `dtDateEnd`, `time`, `eventDescription` and values `title`, `start`, `end`, `""`, `""`

`Insertdata` (`functions.php`):

```text
INSERT INTO event (eventTitle,dtDateStart,dtDateEnd,time,eventDescription)
VALUES ('<title>','<start>','<end>','','')
```

Field names and values are concatenated. Then `print_r($sql)` and `mysqli_query`. On failure it echoes `Error: ` and `mysqli_error`. The commented lines above the decode show an earlier attempt to read `$_POST['body']`.

### GET list — `php/fetchEvent.php`

Same includes. Then `SELECT * FROM event` and a manual map to `title`, `start`, `end`. Echoes JSON. Does not echo an error when the query fails. Does not set a JSON content type of its own; `header.php` has already set form-urlencoded.

### Connection file that nothing loads — `php/db_connection.php`

| Setting | Value |
|---|---|
| Host | `localhost` |
| User | `root` |
| Password | empty string |
| Database | `login` |
| API | `mysqli_connect` |
| Failure | `die("Connection failed: " . mysqli_connect_error())` |

A commented `echo "Connected successfully";` remains.

## Database

Dump header (text in the file, not a live probe):

| Item | Value |
|---|---|
| Tool | phpMyAdmin 5.0.1 |
| Host | `127.0.0.1` |
| Generated | 2020-10-07 16:41 |
| Server | MariaDB 10.4.11 |
| PHP used by phpMyAdmin | 7.2.0 |
| Comment database name | `fullcalender` (spelled that way) |
| `CREATE DATABASE` / `USE` | Absent |

Table `event`:

| Column | Type | Null | Key |
|---|---|---|---|
| `eventID` | `int(11)` | NOT NULL | PRIMARY, `AUTO_INCREMENT` (dump sets next value 17) |
| `eventTitle` | `varchar(255)` | NOT NULL | |
| `dtDateStart` | `varchar(255)` | YES | |
| `dtDateEnd` | `varchar(255)` | YES | |
| `time` | `time` | YES | |
| `eventDescription` | `text` | YES | |

Engine InnoDB, charset `utf8mb4`. Thirteen `INSERT` rows. Ids present: 2, 4, 6–16.

`functions.php` also mentions tables `user` (`username`, `email`, `password`, `id`) and `loguser` (`refUser_id`, `log_key`, `log_oldData`, `log_newData`, `timestamp`). Those `CREATE TABLE` statements are not in the dump. `selectUser` uses `$conn` without `global $conn`. `SaveLog` reads `$_SESSION['id']` and nothing calls `session_start`.

## Auth

None on the calendar path. CORS allows any origin. No CSRF token. No API key.

`functions.php` contains password fields in SQL for the unused `user` helpers. Those statements concatenate values the same way `Insertdata` does. They are not the calendar's login.

## Background work, queues, storage, monitoring

Not present. No cron, no queue, no object storage, no log library, no metrics. PHP errors from a failed include or a fatal on null go to the PHP host's default logging, which is not configured here. The browser logs Axios failures to the console.

`public/robots.txt` allows all crawlers (`Disallow` with an empty path).

## Security notes (from the tree, not a pentest)

- SQL is built by string concatenation in `Insertdata` and in the unused user helpers.
- `addEvent.php` prints the payload and the SQL to the client.
- Database user in the unused connection file is `root` with an empty password, host `localhost`.
- `Access-Control-Allow-Origin: *` on both endpoints.
- Axios 0.20.0 and `react-scripts` 3.4.3 are the 2020 pins. This document does not list advisory numbers. Whether anyone rebuilt `node_modules` since 2020 is **Unknown**.
- The SQL dump is committed and includes real-looking personal appointment titles from the author of `88c9d8d`. **Requires Confirmation** whether that file should stay in git history.

## Environment and local run

What the README says:

| Command | Effect, as documented by Create React App |
|---|---|
| `yarn start` | Dev server, reload, lint in the console, `http://localhost:3000` |
| `yarn test` | Jest watch mode |
| `yarn build` | Production bundle in `build/` |
| `yarn eject` | Copies webpack config out. Not done in this repo |

What the README does not say, and the tree does not provide:

- How to start PHP, or that the scripts must be reachable as `http://localhost/php-react/`.
- That `dbconnect.php` must exist. A checkout only has `db_connection.php`.
- Which database to create (`login` versus `fullcalender`) and that `fullcalender.sql` must be imported into the one PHP connects to.
- PHP version required by the scripts. The dump only proves phpMyAdmin ran on 7.2.0.

`.gitignore` does not ignore `build/`. No `build/` directory is tracked. `node_modules/` is ignored and is not in git.

## Testing

`src/setupTests.js` imports `@testing-library/jest-dom/extend-expect`.

`src/App.test.js` renders `App` and expects a node matching `/learn react/i`. `App.js` renders the calendar and does not contain that text. **Inferred** that `yarn test` fails this case. The test was not run during this investigation.

No PHPUnit, no browser test, no fixture for the PHP scripts.

## Deployment

Not described for this project. The README points at the Create React App deployment page. There is no server name, no Dokploy/Docker compose, no Bitbucket Pipeline, and no `homepage` field in `package.json`.

The PHP files would need a separate PHP host. Nothing in the React build copies `php/` into `build/`.

## Sonar files named at onboarding

The task that created this documentation listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root on the scan host. Neither name appears in `git ls-tree` or in history. Treat them as **Unknown** untracked files, not as part of `master`.

## Development history

| Commit | Author | Date | Content |
|---|---|---|---|
| `5fdec4c` | Jaco Brits `<jaco@overdrive.co.za>` | 2020-10-07 14:59 UTC | `.gitignore` only |
| `88c9d8d` | Uriel Balela `<uriel@overdrive.co.za>` | 2020-10-07 17:33 +0200 | The application, dump, lockfiles, README |

Branch `master` only. No tags were present at inspection.