# Project plan — checkin.mypass.zone

Evidence date: 2026-10-19.

Source repository: `git@bitbucket.org:overdrive/checkin.mypass.zone.git`.

This plan describes what the repository contains. It does not decide what the product should become.

## Revisions inspected

| Branch | Tip | Date | Message | Role in this repo |
|---|---|---|---|---|
| `master` | `09abf7a` | 2022-07-01 | empty | Default branch. The onboarding brief named this revision |
| `prod` | `a78d45a` | 2022-11-30 | Updated to accreditation id 479 | The branch name Bitbucket Pipelines deploys |
| `ui-changes` | `be0f89bb` | 2022-08-17 | Updated event name | Present on the remote. No pipeline step uses this branch |

There is no remote branch named `qa`. `bitbucket-pipelines.yml` still defines a `qa` step.

Fetches used for `prod` and `ui-changes` were depth 1. Ancestry between the three tips was not established. Earlier history of `master` was not retrieved.

No commits on these tips are later than 2022-11-30.

## Product

**MyPass Check-in** is a venue desk for collecting SA Rugby accreditations. A person who knows the shared PIN opens a list of people for one fixed event, grouped under an organisation name. A row whose service status is ready can be marked collected.

The name of the product depends on the branch:

- On `master`, the application layout title is `SA Rugby - Accreditions Collections` (spelling as in the file) and the page header is the literal string `Kyalami 9 Hour 2020`. The login document title is `SA Rugby - Load-in and Load-out`.
- On `prod`, the layout title and the login title are `MyPASS Checkin`, the footer says `MyPass`, and the page header is the literal string `HSBC Cape Town 7s`.

Provenance: **Implemented** (`application/layouts/default.phtml`, `application/modules/default/views/scripts/login/index.phtml`, `IndexController`, `LoginController`).

The header string is not loaded from the event id stored in the session. See the branch-reality note below.

## What this repository is

A Zend Framework 1 PHP application. Apache document root is `public/`. CodeDeploy copies the tree to `/mnt/data/www/html/mypass.zone/checkin.mypass.zone/`.

The database name in configuration is `teamwizz_SARU`. On `master` the host is `localhost`. On `prod` the host is `db.footprintapp.net`. Many model classes (fixtures, squads, tournaments, food sessions, news) are present and are not called by the check-in controllers. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at the shared database. Whether those tables are still shared with `track.mypass.zone` and other products is **Unknown / Requires Confirmation**.

## Branch reality

The same PIN comparison exists on all three tips. The event id written into the session is not the same:

| Branch | Session `EVENT.EID` | Comment in `LoginController` | Header text in `default.phtml` | Database host |
|---|---|---|---|---|
| `master` | `245` | none | `Kyalami 9 Hour 2020` | `localhost` |
| `ui-changes` | `367` | labelled `PROD`; `245` left commented and labelled `DEV` | not fully diffed beyond the login change | not changed from `master` in the files compared |
| `prod` | `479` | labelled `PROD`; `245` left commented and labelled `DEV` | `HSBC Cape Town 7s` | `db.footprintapp.net` |

The pipeline file deploys branch `prod`, not `master`. Which of these revisions Apache still serves, and which event id is the live one, is **Unknown / Requires Confirmation**.

Unless a sentence says otherwise, behaviour below is the same on `master` and `prod`. Differences are called out.

## Scope that is in this repository

- PIN gate that stores one event id in the `EVENT` session and opens the collection list.
- Collection list for that event: organisation name, person count, collected count, expandable people, status badges, search.
- Collect action that sets an applicant service to status `8` and writes a collected timestamp.
- Company registration, email confirmation, password reset, company profile, and staff screens carried over from the supplier application. The PIN login does not authenticate those screens.
- Vehicle permit read and write actions in `PermitsController`. Writes read an auth identity the PIN does not create.
- Deploy description for AWS CodeDeploy via Bitbucket Pipelines on branches `qa` and `prod`.

## Scope that is not established

- Who uses the desk in production, and whether event `245`, `367`, or `479` is the event that should be shown.
- Whether the header text (`Kyalami 9 Hour 2020` or `HSBC Cape Town 7s`) is still the event name operators expect.
- Whether `Accreditation_Collections` is a table or a view, and what its `ID` column means. The schema is not in this repository.
- Whether supplier registration on this host is used, or only the copy that emails `supplier.sarugby.online`.
- Whether a `qa` deployment group was ever created. The remote has no `qa` branch.
- SonarQube files. The onboarding brief listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master` at `09abf7a`. They may have been untracked on the scan host. Provenance: **Unknown**.

## Architecture (as implemented)

```text
Browser
  → Apache (root .htaccess rewrites into public/)
    → public/index.php (Zend_Application, timezone Africa/Johannesburg)
      → default module controllers
        → Zend_Db_Table against teamwizz_SARU
```

Check-in path:

```text
POST /login (PIN)
  → session EVENT.EID
    → GET /
      → GET /index/getapplicants[?srch=]
        → rows from Accreditation_Collections where AC = EID
      → POST /index/collect/id/{AASID}/status/8
        → update Accreditation_Applicants_Services
```

There is no queue, no background worker, and no API of this application's own. On `prod`, the login page GETs terms HTML from `https://footprintapp.net/api/mypass/gettermsandconditions/`.

## Milestones visible in Git

Only the three branch tips above were read. A full commit log was not rebuilt.

| When | What the tip shows |
|---|---|
| 2022-07-01 | `master` at `09abf7a`. Collection desk, event id `245`, database host `localhost`, header `Kyalami 9 Hour 2020` |
| 2022-08-17 | `ui-changes` at `be0f89bb`. Event id `367`, message "Updated event name" |
| 2022-11-30 | `prod` at `a78d45a`. Event id `479`, database host `db.footprintapp.net`, titles changed to MyPASS Checkin, header `HSBC Cape Town 7s` |

No later commit was found on these branches. No open feature work is visible beyond `ui-changes`, which is older than `prod`.

## Implementation status

The collection desk is **implemented** on `master` and on `prod`. It has not changed in Git since 2022-11-30 on the newest tip. There is no project plan, PRD, or README inside the source repository. This Silicon Ark set is the first project-knowledge write-up found for the slug.

## Dependencies known from the tree

- PHP with the `mcrypt`, `pdo_mysql`, and historically `mysql` extensions implied by Zend 1 and `mcrypt_create_iv` in registration and password reset.
- Zend Framework 1, vendored under `library/Zend`. No Composer file.
- Apache `httpd` (`scripts/install_dependencies`, `start_server`, `stop_server`).
- MySQL database `teamwizz_SARU`.
- AWS CodeDeploy and S3, driven by `codedeploy_deploy.py` and pipeline variables.
- SMTP `mail.sarugby.co.za` for registration and password-reset mail.
- On `prod` only: `https://footprintapp.net/api/mypass/gettermsandconditions/`.
- CDN assets: Google Fonts, Font Awesome 5.3.1, and `https://cdn.ywxi.net/js/1.js` on the login page.

## Human confirmation

1. Which branch is deployed at `checkin.mypass.zone`, and which event id (`245`, `367`, or `479`) is correct now?
2. Should the header show `Kyalami 9 Hour 2020`, `HSBC Cape Town 7s`, or a name loaded from the event record?
3. Is `Accreditation_Collections` a view over `Accreditation_Applicants_Services`, and is column `ID` a company id?
4. Are registration, staff, and permit screens on this host still in use, or only the collection list?
5. Should the hardcoded PIN, database password, and SMTP password be rotated? The values are in Git and are not copied into Silicon Ark.
6. Were `sonar-project.properties` and `sonarqube_scan.bat` ever committed, or only present on the scan host?