# Project plan — dev.sabullion (SA Bullion WordPress)

Evidence date: 2026-10-17.

Source repository: `git@bitbucket.org:overdrive/dev.sabullion.git`.

Inspected revision: `master` at `c58febf` (2020-07-12 23:28:02 +0200, "Investment Calc adding index graph", author rachelmogano). That is `origin/HEAD`. The repository has one branch. History is 79 commits, from the initial commit on 2020-05-12 to `c58febf`.

The scan-host path named on the onboarding issue (`~/projects/sonar_scan/repos/dev.sabullion`) was not on the machine that wrote this document. The tree was read from a clone of `c58febf`.

Plaintext database passwords, an Office 365 mailbox password, and an authorization key are committed under `config/`, `dashboard/config/`, and `wp-content/themes/sabullion/config/`. Those values are omitted here.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The site name constant is `Sa Bullion` (`config/site.php` and `dashboard/config/site.php`). The README title is "SA Bullion" and the only product sentence in the README is "New SA Bullion WordPress website."

Public copy in `content/home-content.txt` says SA Bullion converts earnings and capital into newly minted Krugerrands and lets the client manage transactions online. Two facilities are named throughout the copy: **BullionGold** and **HasanaGold**. HasanaGold is described as a Halaal facility. Older filenames and variable prefixes still say Baraka (`content/baraka-*.txt`).

Provenance: **Documented** in `README.md` and `content/home-content.txt`.

The about story names founders Hilton Davies, Helen, Imran, and Clint, and says the firm was built with Rand Refinery and "the authorities" (`content/about-story.txt`). Provenance: **Documented**. The operating company's registered legal name is **Unknown / Requires Confirmation**. `content/client-mandate.txt` is a Harry's (HF Global) terms template, not an SA Bullion mandate.

## Related Silicon Ark directories

Two other directories already describe other remotes. This plan does not treat those commits as this repository.

| Silicon Ark directory | Remote | Tip used in that directory's docs |
|---|---|---|
| `sabullion/` | `git@bitbucket.org:overdrive/sabullion.git` | `a5cd347` (2024-03-12) |
| `sabullion_current_live/` | `git@bitbucket.org:overdrive/sabullion_current_live.git` | `6cbf6777` (2022-10-01) |

`sabullion/project-plan.md` says `origin/development` of that other remote is a WordPress site whose README is "New SA Bullion WordPress website." This repository's README uses that same sentence. The commits are not the same object. Whether one tree was copied from the other is **Unknown / Requires Confirmation**.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `c58febf` | 2020-07-12 | WordPress 5.1.5 at the repository root, Sage theme `sabullion`, custom plugin `sab-api`, plus the older custom PHP site and client dashboard still in the tree |

There is no `development` branch in this remote.

Recent history that still describes product work (all 2020):

- 2020-05-12 — initial website commit, gitignore, deploy pipeline.
- 2020-05-29 — "Custom SA Bullion Plugin: Calculators & Charts ADPI Handler", gold price chart, DB config combined with WordPress.
- 2020-06-01 — Krugerrand buy calculator, buy request form, delivery method.
- 2020-06 through 2020-07 — savings and investment calculators merged; Gravity Forms button changes; Krugerrand buy/sell styling; minted-bar calculator hardcoded to USD; index graph added on the investment calculator.

Authors visible on recent commits: rachelmogano, JacquesOverdrive.

## Scope in this commit

In scope of the tree:

- A WordPress front (`index.php` loads `wp-blog-header.php`). `.htaccess` is a standard WordPress rewrite to `/index.php`.
- Theme `wp-content/themes/sabullion` (header name "Rocket Theme", Sage 8, version 1.2).
- Plugin `wp-content/plugins/sab-api` ("SA Bullion Custom API Handler", Silicon Overdrive, version 1.0).
- Vendored WordPress plugins: WooCommerce, Gravity Forms, Elementor and Elementor Pro, ACF Pro, PayGate, and others listed in the technical document.
- A custom PHP client dashboard under `dashboard/`.
- Legacy public PHP entry points under `krugerrand/` and `scheduler/`, and content files under `content/`.
- A second copy of config, helpers, templates, and dashboard assets nested inside the theme. `sab-api` loads the theme copy via `get_template_directory()`.

Out of scope of git, and therefore unknown as product data:

- WordPress pages, posts, menus, Gravity Forms definitions, and WooCommerce products. They live in the database. `wp-config.php` is gitignored and is not in the commit.
- Which theme and which plugins are active.
- Whether `https://sabullion.co.za` or the QA host still serves this commit.

## System architecture

```text
Browser
  → Apache rewrite (.htaccess) to /index.php unless the path is a real file or directory
      → WordPress 5.1.5
          → theme sabullion (Sage 8 page templates)
          → plugin sab-api
              → WordPress REST /wp-json/api/v1/...
              → theme config + MySQL (gold_price, calculator tables, client tables)
              → PHPMailer / Office 365 SMTP (non-lamp hosts)
      → existing directories are served directly, including:
          dashboard/     client, IFA, house, and global-admin portal
          krugerrand/    buy and sell PHP pages
          scheduler/     drop-off page
```

Host selection in `config/site.php` and `dashboard/config/site.php`:

| `SERVER_NAME` | Site URL chosen | Protocol |
|---|---|---|
| `localhost` | `http://localhost/dev.sabullion` (dashboard: `http://localhost/sabullion/dashboard`) | http |
| `lamp` | `http://lamp/sabullion` | http |
| `dev.overdrive.co.za` | `http://dev.overdrive.co.za/sabullion` (dashboard path is rewritten to include `/sabullion`) | http |
| `sabullion.overdriveqa.co.za` | `https://sabullion.overdriveqa.co.za` | https |
| `sabullion.co.za` and any other name | `https://sabullion.co.za` | https |

The README also records a temp URL: `sabullion.co.za.www18.jnb2.host-h.net`. That host is not a `switch` case. Provenance: **Documented** in `README.md`. Whether it still resolves is **Unknown**.

**Discrepancy:** theme header and footer send "Open an Account" and "Sign In" to `https://sabullion.overdriveqa.co.za/dashboard/login.php`. `template-partnership.php` sends "Become a Partner" and "Register" to `https://sabullion.co.za/dashboard/...`. Commit `21de241` is "update open account and sign in url to point to current QA site". Which host is the intended public target of this commit is **Requires Confirmation**.

## Major components

| Component | Path | Role |
|---|---|---|
| WordPress core | `wp-admin/`, `wp-includes/`, root `wp-*.php` | CMS, users, REST, cron. Version `5.1.5` |
| Public theme | `wp-content/themes/sabullion/` | Page templates for story, gold price, buy, sell, SA and international gold, illustrations, partnership, contact, documents |
| Calculator and chart API | `wp-content/plugins/sab-api/` | REST routes, page scripts, PDF and email helpers |
| Legacy public PHP | `content/`, `templates/`, `helpers/`, `krugerrand/`, `scheduler/` | Older page router (`?pageReq=`) and standalone buy, sell, and scheduler pages |
| Client portal | `dashboard/` | Session portal for client, unapproved client, IFA, house, and global admin |
| Shared assets and downloads | `assets/`, `download_files/` | CSS, JS, brochures, reports, forms |
| Deploy | `bitbucket-pipelines.yml` | `git ftp push` on `master` |

## Milestones visible in git

There is no separate project plan in the source repository. The only milestone sequence is the commit log:

1. 2020-05-12 — repository created and the website tree committed, with an FTP deploy pipeline.
2. 2020-05-16 — README and root `.htaccess` path.
3. 2020-05-25 to 2020-05-29 — database config, dashboard template assets, `sab-api`, gold price chart.
4. 2020-06 — Krugerrand buy flow and delivery method.
5. 2020-06 to 2020-07-12 — savings calculator, investment calculator, minted-bar calculator (USD hardcoded), merged illustration, index graph. Work stops at `c58febf`.

No commit after 2020-07-12 is on this remote. Provenance: **Implemented** as git history. Whether later work continued in `sabullion.git` is a question for that other repository, not a fact about this one.

## Known dependencies

- PHP. Theme `composer.json` requires `php >= 5.4.0` and `phpmailer/phpmailer ^6.1`. Comments in config refer to a PHP 7 conversion (2018-11-30) and a PHP 7.2 QA host (2019-06-13). The PHP version that actually ran this commit is **Unknown**.
- MySQL, two logical databases per host: an access database and a web database (`config/dbconnect.php`). Table names used by code include `gold_price`, `sysVat`, `applogin`, `web_client_detail`, `web_client_registration`, `web_ifa_advisor`, `web_ifa_company_detail`, `web_global_admin_detail`, `sb_invst_minted_bar_calc`.
- WordPress 5.1.5 and the vendored plugins listed in the technical document.
- SMTP `smtp.office365.com` port 587 as `business@sabullion.co.za` when the host is not `lamp` (`dashboard/config/mailer.php`). `lamp` uses `isSendMail()`.
- Bitbucket Pipelines image `python:3.7.3`, packages `zip`, `git`, `git-ftp`. Secrets `FTP_USER`, `FTP_PWD`, `FTP_HOST` are pipeline variables, not in git.
- External parties named in copy, not as API clients in this tree: Rand Refinery, South African Reserve Bank, LBMA, Lloyd's of London, Nedbank, Deloitte, PwC. See business rules for the conflicting audit wording.

## Current project status

The git tip is a frozen development snapshot from July 2020. No open branch, no issue tracker, and no test suite are in the repository.

Deployment of this commit is **Unknown / Requires Confirmation**. The pipeline would FTP-push `master`. The FTP host is not in the file.

`sonar-project.properties` and `sonarqube_scan.bat` were listed in the onboarding issue's top-level scan. They are not files in `c58febf`.

## Documentation before this change

| Source | What it contained |
|---|---|
| Product documentation inside the source repo | `README.md` is three lines. Theme README material is the upstream Sage / Rocket Theme description. No project plan |
| Silicon Ark before this change | No `dev.sabullion/` directory. `sabullion/` and `sabullion_current_live/` document other remotes |

## Human confirmation

- Whether `https://sabullion.co.za` in 2026 serves this commit, a later `sabullion` commit, or `sabullion_current_live`.
- Whether `sabullion.overdriveqa.co.za` was the intended public target when commits stopped.
- Which of the two code trees (repository root versus the copy inside the theme) was the one operators edited.
- Whether WooCommerce checkout (PayGate, EFT) was enabled, and what was sold.
- The registered legal name, and replacement copy for the Harry's templates in `content/terms-of-use.txt`, `content/privacy-policy.txt`, `content/popi-notice.txt`, and `content/client-mandate.txt`.
- Whether the committed Office 365 and database passwords are still valid. They should be treated as exposed. This document does not repeat them.