# Features — checkin.mypass.zone Evidence date: 2026-10-19. Source: `master` at `09abf7a` (2022-07-01) and `prod` at `a78d45a` (2022-11-30). `ui-changes` at `be0f89bb` (2022-08-17) is included where it changes behaviour. Status words mean: - **Active in the PIN flow** — reachable after the shared PIN sets the session event. - **Present, disconnected** — code and screens exist, but they require `Zend_Auth` identity or are not linked from the PIN login. - **Unused in this app** — files exist and no check-in controller calls them. - **Removed / inactive** — left in the tree commented out or replaced. ## Current features ### F-01 — PIN login and logout Active in the PIN flow. `/login` posts a password field labelled as a PIN. A match stores `EVENT.EID` and redirects to `/`. Any other value shows "Bad entered credentials". `/login/logout` destroys the session. Event id: - `master`: `245` - `ui-changes`: `367` - `prod`: `479` Evidence: `application/modules/default/controllers/LoginController.php` (`indexAction`, `logoutAction`), `views/scripts/login/index.phtml`. ### F-02 — Accreditation collection list Active in the PIN flow. `/` shows "Accreditations By Company", a search box, and a table of company, total, collected, and an expand control. The table body is loaded from `/index/getapplicants`. People rows show status, reference, full name, role, service text, and a Collect button when status is `7`. Evidence: `IndexController::indexAction`, `getapplicantsAction`, `views/scripts/index/index.phtml`, `getapplicants.phtml`, `Model_AccreditationList::getApplications`. `indexAction` itself assigns no data. The list is entirely the AJAX fragment. ### F-03 — Search Active in the PIN flow. Search sends `srch` to `/index/getapplicants`. Matching columns are first name, surname, full name, organisation, ID number, role, barcode (`LIKE`) and reference (equality). Empty search returns the whole event. Evidence: `index/index.phtml`, `AccreditationList::getApplications`. ### F-04 — Collect Active in the PIN flow. Collect POSTs `/index/collect/id/{AASID}/status/8`. The service row's `Status`, `LastUpdate`, and `Collected` are updated. The button is removed in the browser and the badge becomes Collected. The company collected total is not refreshed until the next load. Evidence: `IndexController::collectAction`, `getapplicants.phtml` function `collectionAction`. On `prod` the button class is `btn-primary`. On `master` it is `btn-success`. ### F-05 — Hardcoded event title in the shell Active in the PIN flow. The layout prints a fixed event name and a fixed user label `Administrator`. - `master` header: `Kyalami 9 Hour 2020`. Document title: `SA Rugby - Accreditions Collections`. - `prod` header: `HSBC Cape Town 7s`. Document title: `MyPASS Checkin`. Evidence: `application/layouts/default.phtml`. The name is not read from `Accreditation_List` and is not the session event id. ### F-06 — Terms on the login page Active before login. Behaviour differs by branch. - `master`: link to `http://www.sarugby.co.za/`. Footer "SA RUGBY". - `prod`: link opens a modal and GETs `https://footprintapp.net/api/mypass/gettermsandconditions/`, then writes `termsandconditions` into the modal. Footer "MyPass". The Accept button is hidden and `accept_Terms` is not defined in the view. Evidence: `views/scripts/login/index.phtml` on each tip. ### F-07 — Sidebar Active in the PIN flow as navigation chrome. Dashboard goes to `/`. Company Profile goes to `/organisation/profile`. Employees and Events are placeholder `#` links. Evidence: `views/scripts/menu/main_menu.phtml`. ## Present, disconnected ### F-08 — Company registration and email confirmation `/register` and POST `/register/newcompany` create `Company_Members` and `Companies_Profile`, attach `Company_Events` for event id `44`, and email a confirmation link on `supplier.sarugby.online`. `/register/validateemail` on this host can still confirm a key if something calls it. Evidence: `RegisterController`. Not linked from the collection home page. ### F-09 — Forgot and reset password `/login/forgot` and `/login/reset/user/{key}` update `Company_Members`. Not linked from the PIN form. Evidence: `LoginController::forgotAction`, `resetAction`. ### F-10 — Email and password login `LoginNow` authenticates `CompaniesLogin` and would set event id `22`. Nothing in the login view calls it. Evidence: `LoginController::LoginNow`, `getAuthAdapter`. ### F-11 — Company profile and logo upload `/company/profile` reads and updates `Companies_Profile` for `identity->CID`. `/company/upload` writes `{CID}_image.jpg` under `UPDATE_PATH/companies/`. `/company/getmembers` is an empty action. Requires `Zend_Auth`. The PIN does not create that identity. Evidence: `CompanyController`. ### F-12 — Staff list and profile `/users` lists `Company_Members` for `identity->CID`. `/users/add` and `/users/profile` insert or update a member, optionally write `{MID}_image.jpg` under `UPDATE_PATH/accreditation/`, and may set an `md5` password when `AllowLogin` is posted. Role choices are a fixed list. Requires `Zend_Auth`. Evidence: `UsersController`. ### F-13 — Vehicle permits `/permits/profile/key/{id}` loads one permit for any company after the event session exists. FAQ is `/permits/questions`. `create`, `addpermit`, `savepermit`, `duplicatepermit`, `cancel`, and `profiletest` use `$this->identity`, which `init` does not set. `createAction` calls `Model_AccreditationList::getEvent`. That method is not defined on the model. Evidence: `PermitsController`, `Model_AccreditationPermits`. ### F-14 — Organisation profile page `/organisation/profile` has an empty action and renders a static Limitless user-profile demo. Evidence: `OrganisationController::profileAction`, `views/scripts/organisation/profile.phtml`. The sidebar links here (F-07). ### F-15 — Remote company image `/login/companypic` returns a company JPEG or a built-in placeholder. `/login/uploadremotecompany` writes a posted image for a `cid` parameter. Neither action checks the PIN session. `LoginController::init` only disables the layout. Evidence: `LoginController::companypicAction`, `uploadremotecompanyAction`. ### F-16 — Debug member dump `/index/test` queries `Company_Members` for one hardcoded identity number and prints the row. It is behind the event-session gate. The identity number is not repeated here. Evidence: `IndexController::testAction`. ## Unused in this app ### F-17 — Tournament and content models Present under `application/models/` and not referenced by the controllers that implement check-in, registration, or permits: `Unions`, `Tournament`, `TournamentFoodSession`, `Squad`, `Profile`, `Positions`, `Nutritions`, `NewsArticles`, `MenuVenues`, `MatchReport`, `Logs`, `GirProfile`, `FoodSessionItems`, `Fixture`, `FixtureScores`, `Ethnicity`, `Copy of Fixture.php`, `ComentryAndCiting`, `Allergens`. `BBEELevel`, `BBEETypes`, `Country`, and `AccreCompanyTypes` are used by registration and company profile. `AccreVehicleTypes`, loading zones, gates, and load services are used by permit screens. ### F-18 — PG plugins other than the layout picker `library/PG/Controller/Plugin/` contains upload, PDF, email, and match-report helpers. `application.ini` registers only `PG_Controller_Plugin_LayoutPicker`. ### F-19 — Alternate layouts named in configuration `application.ini` names layouts `admin`, `union`, `referee`, `gir`, and `accreditations`. The layout files on disk are `default.phtml`, `layout.phtml`, and two `default.phtml.bak.*` copies. The plugin forces the layout name to the module name `default`. ### F-20 — Static theme dumps `public/wp-content`, `public/wp-includes`, `public/assets_old`, `public/bootstrap2`, `public/starters`, `public/html`, `public/FILESTO DOWNLOAD`, and `public/files/Results_*.json` are in the tree. The front controller is `public/index.php`, not WordPress. Purpose of the JSON result files was not established. **Unknown**. ### F-21 — Controllers whose class names do not match the file `EventsController.php` is class `Companies_EventsController` and calls `getEvents`, which is not on `Model_AccreditationList`. `OrgController.php` is class `Company_OrgController`. `AuthonController` actions are empty. ## Removed / inactive ### F-22 — Maintenance splash `public/index.php` contains a commented block that would print a technical-difficulties message and `Background4_2018_maintenance.jpg`, then exit. It does not run. ### F-23 — HTTPS redirect class in the wrong file `application/modules/default/controllers/Bootstrap.php` defines `Default_Bootstrap::_initForceSSL`, which redirects to HTTPS when the port is not 443. Zend module bootstraps are loaded from `modules/{module}/Bootstrap.php`, not from `controllers/`. **Inferred:** this redirect does not run. ### F-24 — Pipeline branch `qa` `bitbucket-pipelines.yml` deploys branch `qa` and branch `prod`. The remote has `master`, `prod`, and `ui-changes`. It does not have `qa`. ## Changed across branches | Item | `master` `09abf7a` | `ui-changes` `be0f89bb` | `prod` `a78d45a` | |---|---|---|---| | Session event id | `245` | `367` | `479` | | Database host | `localhost` | unchanged from `master` in the diff | `db.footprintapp.net` | | Memory limit on index and login | `180M` | not in the login diff | `1024M` | | Product title | SA Rugby collections / load-in title | login title not fully quoted here | `MyPASS Checkin` | | Header event name | `Kyalami 9 Hour 2020` | not in the small login diff | `HSBC Cape Town 7s` | | Pipeline image | `python:3.5.1` | `python:3.5.7` in the diff stat | `python:3.5.7` | Collection status rules (`7` ready, `8` collected) are the same on `master` and `prod`. ## Planned features No TODO, roadmap, or ticket inside the repository describes future work. Nothing in this tree is marked planned. ## Deprecated No feature is labelled deprecated. F-22 and F-23 are inactive code, not a stated product decision.