# Project plan — eitaws (eIT)

Evidence date: 2026-10-15.

Source repository: `git@bitbucket.org:overdrive/eitaws.git`.

The tree that was read is the default branch `master` at `9dc596e` (2020-07-02, "API URL", Kagiso Malepe). Other remote branches exist. Their files were not inspected. This plan describes what that tree contains. It does not decide what the product should become.

## Product

**eIT** is Silicon Overdrive's internal operations system for client support work. Staff sign in, record billable work against clients, keep a to-do list, track machines and licences, and run a month-end invoice export toward QuickBooks.

The login page title is "eIT". The only README line is "31 Mar 2020 - Current working version on AWS". Provenance: **Documented** (`README.md`, `index.php` title).

The product is a staff tool. There is no customer portal in the login flow that was read. One public path is the HR feedback form linked from the login page, which the page says is anonymous.

## Branch reality

| Branch | Tip | Date | Author | Subject | Files read |
|---|---|---|---|---|---|
| `master` (`origin/HEAD`) | `9dc596e` | 2020-07-02 | Kagiso Malepe | API URL | Yes. This is the documented tree |
| `development` | `b65353c` | 2022-08-16 | Uriel Balela | sanitise special character function fix | No |
| `php8.2_upgrade` | `17740b0` | 2024-03-08 | Joshua G-D | Merged in php8.2_upgrade_josh (pull request #24) | No |
| `php8.2_upgrade---Wessels` | `a02bca9` | 2024-01-17 | Wessels | Merge of `php8.2_upgrade` | No |
| `php8.2_upgrade_josh` | `00fb327` | 2026-03-06 | Joshua G-D | Add trimming | No |

`master` has not moved since 2 July 2020. The newest tip found on any remote branch is `php8.2_upgrade_josh` on 6 March 2026. The branch names say a PHP 8.2 upgrade was started. What that upgrade contains, and whether it is deployed, is **Unknown / Requires Confirmation**.

The Bitbucket pipeline file on `master` deploys the `development` branch by FTP. `development` is not `master`. Which branch, if any, is the system staff use is **Unknown / Requires Confirmation**.

## Scope of this repository

In scope for the `master` tree that was read:

- Staff login and a single-page shell (`sheet.php`) that switches modules.
- Billing, to-do, stock, machine tracking, MLPA (asset and licence register), insurance, clients, reports, system settings, HR, and internal change requests.
- Month-end invoice build that calls `https://qb.overdrive.co.za/auth/` with `app=eit`.
- A QuickBooks Web Connector (SOAP) tree under `quickbooks_webservices/`.
- PDF and spreadsheet libraries bundled in the tree.
- A file-permission scanner, `fim_2.0` (`NemoFIM`).

Out of scope of the running PHP application, as far as the includes show, but still committed:

- Microsoft Access files (`accounts.mdb`, `adsl.mdb`, `billing_lamp.mdb`, `Database.mdb`, `db1.mdb`, `linked.mdb`, `stock.mdb`, and backups).
- IDE project files, `get-pip.py`, dated PHP copies (`*_20191210`, `*_old`, `includes_new`, `sheet_new.php`).
- Generated or stored document folders `billingdocuments/` and `backupscanfiles/`. Those folders were not opened. They may hold client documents.

The QuickBooks Online auth service at `qb.overdrive.co.za` is not in this repository.

## Architecture

```text
Browser
  index.php          login (username, password, external PIN)
  sheet.php          shell after login
       includes/menu.php
       entities/<module>/_controller.php
       includes/*.php           legacy screens (stock, HR, settings, reports)
  MySQL via includes/db_connect.php   (gitignored; not in the tree)
  https://qb.overdrive.co.za/auth/    month-end invoice handoff (app=eit)
  quickbooks_webservices/qbwc*.php    QuickBooks Web Connector SOAP
  mail()                              to-do notification
```

Provenance: **Implemented** on `master`.

`sheet.php` is both the new entity router and a large legacy `if/elseif` dispatcher. If a request names an entity folder and is not one of the old menu buttons `btnShow`, `btnShowStock`, `btnSystem`, or `btnHR`, the shell includes `entities/<folder>/_controller.php`. Those four buttons, and many older actions, stay in the `else` branch of `sheet.php`.

Dated copies (`mlpa_20191210`, `tracking_new`, `includes_new`, `sheet_new.php`) sit beside the live names. `sheet.php` includes `includes/`, not `includes_new`. Treat the undated `entities/<name>/` folders as the live modules unless a later branch says otherwise.

## Major components

| Component | Role on `master` | Evidence |
|---|---|---|
| Login | Username, password, shared external PIN | `index.php` |
| Shell and menu | Year/month context, module buttons, logout | `sheet.php`, `includes/menu.php` |
| Billing | Support billing lines, month-end invoice | `entities/billing/` |
| To-do | Tasks, optional email | `entities/todo/`, `sendTodoEmail()` |
| Clients | Client record, contacts, flags, lock | `entities/client/` |
| Tracking | Machine inventory (OS, disk, memory, antivirus, supplier) | `entities/tracking/` |
| MLPA | Asset and licence register (`tblMLPA`) | `entities/mlpa/` |
| Insurance | Insurance records and PDF export | `entities/insurance/` |
| SLA | Client SLA records | `entities/sla/` |
| Stock | Stock list, gated by a user flag | `includes/stock_*.php` |
| Reports | Billing, mileage, SLA, software expiry, tools | `includes/report_console.php` |
| System | Codes, users, tracking lookups, support lists | `includes/settings_entry.php` |
| HR | Leave, responsibilities, public holidays, feedback, staff cost | `includes/settings_entry_hr.php` |
| Requests | Internal change requests (`tblX`) | `entities/requests/`, `change_requests.php` |
| QuickBooks | Online invoice handoff and Web Connector | `entities/billing/action_iif_export.php`, `quickbooks_webservices/` |
| FIM | Directory permission scan | `fim_2.0/` |

## Milestones visible in the tree

These are commit and comment dates, not an approved roadmap.

| When | What the tree shows |
|---|---|
| 2005-01-21 | `todo.txt` is a sample support job note, not a product backlog |
| 2005-04-18 | `Support Agreement 7.1 18 April 2005.doc` is committed. The document body was not extracted |
| 2012-12-07 | `doc new iif export pseudocode 20121207` describes SLA, fixed SLA, and ad hoc IIF export |
| 2013-02-07 | `DB changes.txt` adds `tblClient.blnLocked` |
| 2015-05-05 | Comment in `sheet.php`: MLPA menu (Jacques) |
| 2015-12-17 | Month-end invoice button (Christiaan), later pointed at QuickBooks Online |
| 2018-10-18 | `header.php` adds `noindex,nofollow` (Rachel) |
| 2019-09 to 2019-12 | MLPA PDF, insurance menu, dated copies of MLPA, tracking, to-do, and user modules |
| 2020-03-31 | README: "Current working version on AWS" |
| 2020-03/04 | Comment in the billing controller: QuickBooks Online invoice API (Kagiso) |
| 2020-06-07 | Device type events; System menu gains Device Types, Design, and Other (Maanie) |
| 2020-07-02 | `master` tip: "API URL". Defines `QB_API_AUTH_URL` as `https://qb.overdrive.co.za/auth/` |
| 2022-08-16 | `development` tip. Files not read |
| 2024-03-08 | `php8.2_upgrade` merges `php8.2_upgrade_josh` pull request #24. Files not read |
| 2026-03-06 | `php8.2_upgrade_josh` tip "Add trimming". Files not read |

## Implementation plan

There is no project plan inside the repository. `todo.txt` is a 2005 support-call example. The pipeline deploys `development` by FTP and does not run tests.

Work that the branch list shows as later than `master`:

- Continued commits on `development` through August 2022.
- PHP 8.2 upgrade branches through March 2026.

Whether that work should replace this document's `master` baseline is **Unknown / Requires Confirmation**.

## Dependencies known from the tree

- PHP with `mysqli`. No `composer.json` PHP version constraint. `phpinfo.php` and `info.php` call `phpinfo()`.
- MySQL (or MariaDB) database. The connection file is gitignored.
- Composer package `wayne-oliver/otp` `^0.0.1`, with `christian-riesen/base32`. No application PHP outside `vendor/` references `OTP` or `TOTP`.
- Bundled libraries: PHPExcel, PHPMailer, FPDF, mPDF, html2pdf, htmltopdf, jQuery 1.8.6 and a page-level jQuery 3.3.1 on the invoice export, Consolibyte QuickBooks PHP framework.
- External HTTP service `https://qb.overdrive.co.za/auth/`.
- Bitbucket Pipelines image `python:3.5.7`, used only to install `zip`, `git`, and `git-ftp`.

## Current status

| Question | Answer from evidence |
|---|---|
| What was read | `master` at `9dc596e` (2020-07-02) |
| What the README calls current | "Current working version on AWS" dated 31 Mar 2020 |
| What the pipeline deploys | Branch `development`, by FTP |
| Newest remote tip | `php8.2_upgrade_josh` at `00fb327` (2026-03-06), files not read |
| Tests | No project test suite found. `vendor/christian-riesen/base32/tests/` is the library's own tests |
| Silicon Ark before this change | No `eitaws/` directory |

## Human confirmation

1. Which branch is deployed, and is that host AWS, FTP, or both?
2. Should Silicon Ark follow `master`, `development`, or `php8.2_upgrade_josh`?
3. Is the QuickBooks Online month-end path the live invoicing path, or is the Web Connector still used?
4. What does MLPA stand for? The PDF heading calls the export an "IT Asset & License Register". The acronym is not expanded in the code that was read.
5. Are the committed Access databases still loaded, or are they archives?
6. Should the hardcoded QuickBooks Web Connector database DSN in `quickbooks_webservices/config.php` be rotated? The value is not copied into this documentation.
7. Are `phpinfo.php` and `info.php` reachable on the deployed host?