# Project plan — crimemapping_website

Evidence date: 2026-10-18.

Source repository: `git@bitbucket.org:overdrive/crimemapping_website.git`.

Inspected revision: `master` at `8c3c372f82a07c3b808cf75a64d2e2f49eca502a` (`8c3c372`, 2025-11-14 09:07:20 +0200, Jacques Groenewald, "debug"). `origin/HEAD` is `master`. No other remote branches and no tags were present. 92 commits. 5,185 tracked files.

The scan-host path `~/projects/sonar_scan/repos/crimemapping_website` was not on this machine. The tree below was read from that git revision. OVER-78's recorded tip matches this commit. `sonarqube_scan.bat` was listed in the issue's scan inventory and is not in `git ls-files` at `8c3c372`.

This plan describes what the repository contains. It does not decide what the product should become.

There was no `silicon_ark/crimemapping_website/` directory before this document set. The admin README is the CodeIgniter starter text plus a WAMP vhost named `crimeMappingWebportal.local`. It does not state a customer problem. The public `index.html` does.

## Product

The public page titles itself **Crimemapping** and describes crime mapping as digitising, mapping, and analysing crime incidents. The admin sidebar brand is **Crime Mapping**. The mobile build's manifest name is **Crime Mapping Mobile Application**; its HTML title is **Crime Mapping Org**.

Provenance of the names: **Implemented** (`index.html`, `app/Views/layouts/sidebar.php`, `app.crimemapping.co.za/manifest.json`, `app.crimemapping.co.za/index.html`).

The repository holds four surfaces in one tree:

1. A static marketing site at the repo root (`index.html`, `assets/`).
2. A CodeIgniter 4 admin and JSON API under `admin.crimemapping.co.za/`.
3. A production Create React App build under `app.crimemapping.co.za/` (no React source).
4. A saved WordPress "Coming soon" page under `org/` (not an application).

Provenance: **Implemented** (directory layout). A signed product statement beyond the marketing copy is **Unknown / Requires Confirmation**.

## Objectives

No project-plan file in the repository states objectives. The following are taken from marketing copy or from what the code does:

1. Present CrimeMapping as a tool for spatial crime data, hotspots, and resource decisions. **Documented** in `index.html`.
2. Let an organisation capture crime incidents with coordinates, incident types, notes, and photos. **Implemented** in the admin crime log and `Apicrimes::create`.
3. Show those incidents on a Google Map, filterable by date, incident type, and an "attempted" flag. **Implemented** in `CrimeMap`.
4. Let a signed-in mobile user report a crime against the admin API. **Implemented** in the built app's routes and hardcoded API URLs.
5. Expose a town-level crime feed as GeoJSON-like features for an external GIS caller. **Implemented** in `Apigis`.
6. Deploy `master` to FTP with `git-ftp`. **Implemented** in the root `bitbucket-pipelines.yml`.

Whether items 2–5 are the approved product goals is **Unknown / Requires Confirmation**.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `8c3c372` | 2025-11-14 | Current tree. 92 commits |

| Commit | Date | Subject | Author |
|---|---|---|---|
| `eb49f2d` | 2023-03-01 | Initial commit | Jaco Brits |
| `8c3c372` | 2025-11-14 | debug | Jacques Groenewald |

Author counts on `master`: JacquesOverdrive 70, Jaco Brits 17, Uriel Balela 4, Jacques Groenewald 1.

Recent subjects that name product behaviour (newest first): notes on crime-log export; incident ordering; attempted incidents on the crime log; suburbs on the organisation location list; remove address lookup from crime-map drag; user-location API; website link to the app; hidden email on the GIS page; Google API key updates; remove "notify me"; GIS page and linked crimes; crime export page; organisation admin group.

Provenance: **Implemented** (git history). Intermediate diffs were not reviewed commit by commit.

## Scope in the repository

In scope of what is on `master`:

- Marketing HTML, CSS, and images at the repo root, with a Matomo tracker and links to the app and the admin login.
- CodeIgniter 4 admin (`composer.json` name `codeigniter4/adminstarter`, description "Admin Overdrive", PHP `^8.0`).
- Session login, menu-based access, users, roles, organisations, locations, incident types, crime log, crime map, GIS map page, crime-log export view, activity log, menu management, CRUD generator.
- JSON resources `apiorganisations`, `apiusers`, `apicrimes`, `apiincidents`, `apigis`.
- A built React app that logs in and reports crimes against `https://admin.crimemapping.co.za/public`.
- Bitbucket Pipelines: `git-ftp` push of `master`. SonarQube is active in the admin subdirectory pipeline and commented out in the root pipeline.
- MySQL schema migrations dated 2022-11-20 and 2022-11-25, plus seeders.

Out of scope of the code that was found, or not present as a committed application:

- React source, `package.json`, or a mobile store project inside this repository. Only the production `build` output is committed. The React source is `overdrive/crimemapping` (`silicon_ark/crimemapping/`).
- A WordPress installation. `org/index.html` is a saved page from `https://crimemapping.co.za/coming-soon/`.
- Migrations for tables and columns the current PHP reads (`locations`, `org_location_map`, `users.token`, `crime_log.coordinates_address`, `incident_type.attempted`, `incident_type.name_group`, `incident_type.color`).
- Call sites for `aws/aws-sdk-php`, `mpdf/mpdf`, or `phpoffice/phpspreadsheet` under `app/`. Those packages are in `composer.json` and `vendor/`.
- Product tests. `tests/` is the CodeIgniter example suite. `HealthTest` asserts `APPPATH` and that a base URL exists.
- The scan-host file `sonarqube_scan.bat`.

## System architecture

```text
Browser
  → crimemapping.co.za static index.html
       → https://app.crimemapping.co.za/          (React build)
       → https://admin.crimemapping.co.za/public/ (CI4 login)

React build (app.crimemapping.co.za)
  → Google Maps JavaScript API
  → CI4 JSON API under /public
       apiusers/login, apiusers/logout, apiusers/
       apicrimes/create
       apiincidents
       apiorganisations

CI4 admin (admin.crimemapping.co.za, document root public/)
  → session (database handler, table sessions)
  → MySQL database name adminoverdrive (env sample)
  → Google Maps JavaScript API (crime log, crime map)
  → files under assets/img/crime_images/{organisation_id}/{crime_id}/

External GIS caller
  → apigis/authenticate, getActiveTowns, getUserLocation, getTownCrimeLog

master push
  → Bitbucket Pipelines (python:3.5.7)
  → git-ftp to $FTP_HOST
```

Hosting product, server OS, and whether FTP is the live site were not in the repository. **Unknown / Requires Confirmation.**

## Major components

| Component | Path | Role |
|---|---|---|
| Marketing site | `index.html`, `assets/`, `email.php`, `.htaccess` | Public explanation and contact address |
| Previous marketing page | `index.old.html` | Older HTML kept in the tree |
| Saved coming-soon page | `org/` | Static copy of a WordPress page |
| Admin application | `admin.crimemapping.co.za/app` | Controllers, models, views, filters |
| Admin public web root | `admin.crimemapping.co.za/public` | CI4 front controller |
| Mobile client build | `app.crimemapping.co.za/` | CRA `build` output and PWA manifest |
| Schema | `app/Database/Migrations`, `app/Database/Seeds` | Partial MySQL schema and starter rows |

## Milestones visible in git

No milestone document exists. The history supports this sequence. Provenance: **Inferred** from commit subjects and dates.

1. 2023-03-01 — repository and pipeline created.
2. 2023-03-02 — website and AWS vendor files updated. A commit says "Remove AWS from vender deploy".
3. Later commits (subjects only) add the crime log, export, linked crimes, GIS page, organisation locations/suburbs, attempted incidents, and a user-location API.
4. 2025-11-14 — tip commit "debug". What that commit changed was not diffed line by line.

## Implementation plan

There is no forward plan in the repository. The admin README lists setup steps (copy `env` to `.env`, `spark db:create`, `spark migrate`, `spark db:seed users`, `spark key:generate`, `spark serve`) and a WAMP vhost. It also points at a Jira board `SI` and a wiki space `AO` on `siliconsoftware.atlassian.net`. Those sites were not opened. Whether they are still the working backlog is **Unknown / Requires Confirmation**.

The README "Development TODOS" section is only that Jira URL. The "CRUD automation scrips" section is empty.

## Known dependencies

- PHP `^8.0`, CodeIgniter 4, MySQLi.
- Google Maps JavaScript API. The key is read from `GOOGLE_MAP_API_KEY` in the admin and from `REACT_APP_GOOGLE_API_KEY` baked into the app build. The key values are not repeated here.
- Matomo at `//analytics.medmin.co.za/` site id `4` on the marketing page.
- DataTables buttons (copy, csv, excel, pdf, print) on the crime-log export view. The buttons are client-side. PhpSpreadsheet is not called from `app/`.
- `git-ftp` and Bitbucket repository variables `FTP_USERNAME`, `FTP_PASSWORD`, `FTP_HOST`.
- SonarQube variables `SONAR_HOST_URL` and `SONAR_TOKEN` in the admin pipeline.
- Marker clusterer script from `cdn.rawgit.com` on the crime map view.

## Current project status

**Implemented** and deployed by pipeline configuration: marketing page, admin, API, and a built mobile client, with `master` as the only branch.

**React source:** the client that produced this kind of build is `git@bitbucket.org:overdrive/crimemapping.git`, `master` at `5927ab4` (2023-12-06), documented in `silicon_ark/crimemapping/`. This website repository still contains only the production build, not that source. Whether `app.crimemapping.co.za/` was built from `5927ab4` is **Unknown / Requires Confirmation**.

**Stale relative to the code:** the 2022 migrations. The PHP written after that date reads columns and tables those migrations do not create.

**Empty or stubbed:** admin home content (`app/Views/common/home.php` has no body), `Apiusers::ForgotPassword`, `Apiusers::ChangePassword`, `ApiIncidents::ForgotPassword`, `ApiIncidents::ChangePassword`.

## Human confirmation

- What role id `4` is called, and whether it is the only organisation-scoped role.
- Whether public self-registration (`Welcome::registration`, which stores role id `1`) is still offered.
- Whether the live database was altered outside the committed migrations.
- Whether `org/` is still published, and at which URL.
- Whether the build under `app.crimemapping.co.za/` was produced from `overdrive/crimemapping` at `5927ab4`. The source repository is no longer unknown. See `silicon_ark/crimemapping/`.
- Whether FTP from this pipeline is the production host for `crimemapping.co.za`, `admin.crimemapping.co.za`, and `app.crimemapping.co.za`.
- Whether the hardcoded JWT HMAC secret and the committed `env` encryption key are what production uses.