# Features — coreUnit

Evidence date: 2026-10-18.

Source: `git@bitbucket.org:overdrive/coreunit.git`, `master` at `e424b25` (2019-08-05). Side branch `origin/trev` at `5f44176` (2019-09-02) is noted where it differs. Nothing in git describes a roadmap after that date.

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Removed**.

## Current features

### F-001 — Unity login screen (Fuse)

**Implemented.** Route `/login` is the default redirect from `/`.

- File: `frontend/src/app/main/login/Login.js`
- Config: `frontend/src/app/main/login/LoginConfig.js`
- Mount: `frontend/src/app/configs/routesConfig.js`
- Copy: "Welcome to the UNITY!" and the startup-to-SME sentence.
- Posts email and password to `http://local.unity/api/public/api/v1/login`.
- Does not store the token or change the Redux user. Initial role stays `[]` (`frontend/src/app/auth/store/reducers/user.reducer.js`).

### F-002 — Second login screen

**Implemented.** Route `/pages/auth/login-2`.

- File: `frontend/src/app/main/pages/auth/login-2/Login2Page.js`
- Config: `Login2PageConfig.js`
- Posts to `.../api/v1/loginlogin` and reads `response.data.code`.

### F-003 — Passport registration (v1)

**Implemented.** `POST /api/v1/register`.

- File: `api/app/Http/Controllers/API/AuthController.php` (`register`)
- Route: `api/routes/api.php`
- Token name `AppName`. Validation failure is HTTP 401.

### F-004 — Passport registration (unversioned)

**Implemented.** `POST /api/register`.

- File: `api/app/Http/Controllers/API/RegisterController.php`
- Token name `MyApp`. Validation failure is HTTP 404 via `BaseController`.

### F-005 — Passport login

**Implemented.** `POST /api/v1/login`.

- File: `AuthController::login`
- Success token name `AppName`. Failure HTTP 401 `Unauthorised`.
- README documents the URL `http://localhost/coreUnit/api/public/api/v1/login`.

### F-006 — Current user

**Implemented.**

- `POST /api/v1/getUser` → `AuthController::getUser`, body `{success: user}`
- `GET /api/user` → closure in `routes/api.php`, the user model
- Both use middleware `auth:api` (Passport driver in `api/config/auth.php`).

### F-007 — Products API

**Implemented.** Resource `products` behind `auth:api`.

- Controller: `api/app/Http/Controllers/API/ProductController.php`
- Model: `api/app/Product.php`
- Table: `api/database/migrations/2019_07_13_213211_create_products_table.php`
- Fields: `name` (string), `detail` (text), timestamps.
- Messages: retrieved, created, updated, deleted, and `Product not found.`

### F-008 — Shared JSON envelope

**Implemented** for the unversioned register action and all product actions.

- File: `api/app/Http/Controllers/API/BaseController.php`
- Success: `{success: true, data, message}` at HTTP 200.
- Error: `{success: false, message, data?}` at HTTP 404 unless a code is passed. No caller passes a code.

`AuthController` does not use this envelope.

### F-009 — CORS

**Implemented.**

- Global: `Spatie\Cors\Cors` in `api/app/Http/Kernel.php`, profile in `api/config/cors.php`.
- Route middleware `cors`: `api/app/Http/Middleware/Cors.php`, applied only to `v1/login` and `v1/register`.
- Apache: root `.htaccess`, `api/.htaccess`, and `frontend/.htaccess` set `Access-Control-Allow-Origin: *` when `mod_headers` is on.

### F-010 — API throttle

**Implemented.** `api` middleware group uses `throttle:60,1`.

### F-011 — Laravel welcome page

**Implemented.** `GET /` returns `resources/views/welcome.blade.php`. Route: `api/routes/web.php`.

### F-012 — Small React app

**Implemented** under `public/`.

- `public/package.json` — React 16.8.6, React Router 5, Axios, Formik, Yup, `email-validator`.
- `public/src/index.js` — `/` login, `/dashboard` dashboard, otherwise not found.
- `public/src/components/LoginForm.js` — client-side Yup checks. No API call.
- `public/src/components/Dashboard.js` — four hardcoded clients and a GET to `/api/client/list`.
- `public/src/components/Notfound.js` — heading "Not found".
- `email-validator` is a dependency and is not imported. **Inferred** unused.

### F-013 — Fuse application shell

**Implemented** as the vendored Fuse React 3.0.0 theme, with these local edits found by inspection:

- Navigation reduced to one Example item (`frontend/src/app/configs/navigationConfig.js`).
- `Auth.js` comments out `jwtCheck`, `auth0Check`, and `firebaseCheck`.
- Login copy and the Axios post in F-001 and F-002.
- `frontend/.env` committed. `.gitignore` ignores `.env.local` and the other CRA local env names. It does not ignore `.env`.

Demo modules still registered in `frontend/src/app/main/apps/appsConfigs.js`: analytics dashboard, project dashboard, mail, todo, file manager, contacts, calendar, chat, e-commerce, scrumboard, academy, notes. Pages, documentation, register, logout, and callback configs are also mounted. Their data calls target Fuse paths. `@fake-db` is not in the tree.

### F-014 — Example page, unmounted

**Implemented** files, not mounted.

- `frontend/src/app/example/Example.js` renders `FusePageSimple` and `DemoContent`.
- `frontend/src/app/example/ExampleConfig.js` declares path `/example`.
- No other file imports `ExampleConfig`. The nav item still points at `/example`.

### F-015 — Web auth scaffold

**Implemented** files, no routes.

- `api/app/Http/Controllers/Auth/LoginController.php` redirects to `/home`.
- `RegisterController`, `ForgotPasswordController`, `ResetPasswordController`, `VerificationController` are the Laravel 5.8 stubs.
- `routes/web.php` only registers the welcome closure.
- Password broker expiry is 60 minutes (`api/config/auth.php`). Nothing calls the broker.

### F-016 — User factory and seed hook

**Implemented** factory, unused seeder.

- `api/database/factories/UserFactory.php` builds a user whose password comment is the Laravel scaffold word `password`.
- `api/database/seeds/DatabaseSeeder.php` has the users seeder call commented out.

## Completed features

These landed in git and are still the behaviour at `e424b25`, except where a later bullet says they were replaced.

| When | Commit | What landed |
|---|---|---|
| 2019-06-17 | `5702b68` | First README |
| 2019-07-09 | `33c4548` | Laravel 5.8 app under `api/` |
| 2019-07-14 | `5cf8a13` | Product model, product CRUD, unversioned register, first `public/` CRA |
| 2019-08-05 | `afd65d0` | Passport, Spatie CORS, `AuthController`, Fuse tree, small-app login and dashboard |
| 2019-08-05 | `e424b25` | README replaced with the Unity / WAMP / Passport note |

## In development

No branch of `master` is ahead of `e424b25`. No TODO, FIXME, or ticket id in the application PHP or the two login pages was treated as an active task. The README line "If branch is in development mode" does not name a branch.

`origin/trev` (2019-09-02, Trevor Mararike) is the only other line. It moves the small app from `public/` to the repository root and adds `package-lock.json` plus a root `.gitignore`. It does not add API behaviour. The message on `bdd1846` says the cloned app still needs cleanup to run smoothly. That cleanup is not in the diff.

## Planned

No planned-feature list exists.

The README's unfinished development-mode sentence is **Documented** and incomplete. It is not a specification.

Login buttons for Google and Facebook, and the links to forgot-password and register-2, are visible controls. Their handlers are the theme defaults or empty. They are not a written plan.

## Recently changed (inside this repository's history)

Relative to the 2019-07-14 tree, commit `afd65d0` (2019-08-05):

- Added `AuthController` and the `v1` login, register, and getUser routes.
- Switched the `api` guard and `User` to Passport (`HasApiTokens`, `Passport::routes()`).
- Added Spatie CORS and `App\Http\Middleware\Cors`.
- Added the Fuse app under `frontend/`.
- Replaced the first `public/` CRA entry files with `LoginForm`, `Dashboard`, and the Smart Admin asset tree.

`e424b25` then rewrote `README.md` only.

## Removed or no longer present at `e424b25`

| Item | Last seen | Evidence |
|---|---|---|
| `tymon/jwt-auth` `dev-develop` | `ab83b3c` / `5cf8a13` composer files | Absent from `api/composer.json` at HEAD |
| `api/config/jwt.php` | `33c4548`, still in `5cf8a13` | Not in `git ls-files` at HEAD |
| `api/app/Http/Middleware/jwtMiddleware.php` | `ab83b3c`, still in `5cf8a13` | Not in `git ls-files` at HEAD |
| `xethron/migrations-generator` | `ab83b3c` require-dev | Absent from HEAD `composer.json` |
| `api/satisfiable` | `33c4548` and `5cf8a13` | Not in `git ls-files` at HEAD |
| `public/src/App.test.js`, `public/src/serviceWorker.js`, `public/README.md` | `5cf8a13` | Not in `git ls-files` at HEAD |
| `public/src/App.js` as the mounted root | `5cf8a13` | File remains. `index.js` imports it and never renders it |

The removing commit for the JWT files is `afd65d0`, because `e424b25` touches only `README.md`.

## Deprecated

Nothing is marked deprecated in comments or docs. The web auth controllers and the Fuse JWT service are unused scaffolds, not labelled deprecated.

## Not features of this product

- Smart Admin files under `public/src/components/assets/` (Jarvis widgets, chat UI, demo PHP). `public/src/index.js` does not import them. AppleDouble `._` copies are committed beside many of those files.
- Fuse documentation pages and role-example pages. They are theme content mounted by the router.
- `artisan inspire` in `api/routes/console.php`. The schedule in `api/app/Console/Kernel.php` is empty. There is no `app/Console/Commands` class.