# Project plan — farmtrade (FarmTrade / AgMarket)

Evidence date: 2026-10-15.

Source repository: `git@bitbucket.org:overdrive/farmtrade.git`.

The scan-host path `~/projects/sonar_scan/repos/farmtrade` was not on this machine. The tree was read from git. Secret values in `config.local.php` and in the mailer are not reproduced.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The repository is a **CS-Cart Multi-Vendor** store. `config.php` sets:

| Constant | Value |
|---|---|
| `PRODUCT_NAME` | Multi-Vendor |
| `PRODUCT_VERSION` | 4.11.4.SP3 |
| `PRODUCT_EDITION` | MULTIVENDOR |

`copyright.txt` is the Multi-Vendor licence agreement with the CS-Cart copyright owners. There is no product requirements document in the source repository.

Two customer-facing names appear in later commits:

| Name | Where it is written |
|---|---|
| FarmTrade | Repository name. CodeDeploy destination `/var/www/html/farmtrade.co.za/`. Database name `farmtrade` on `master`. Host `qa.farmtrade.co.za` on `master`. File `FarmTrade-Privacy-Policy-4-08-2020.pdf` on the product line. |
| AgMarket | `prod` host `agmarket.co.za`. `qa` host `qa.agmarket.co.za`. Database name `db_agmarket` on `prod` and `qa`. Shipping constant `STOREFRONT = 'AgMarket'`. Mail strings `noreply@agmarket.co.za` and `AgMarket`. Vendor terms link `https://www.agmarket.co.za/...`. Session key `$_SESSION['agmarket']`. |

Provenance: **Implemented** strings. No document in the repository says which name customers should see, or whether FarmTrade and AgMarket are one store, a rename, or two storefronts.

**Unknown / Requires Confirmation:** the live brand, the live hostname, and whether `farmtrade.co.za` still serves this application.

Reading "farm" and "ag" as an agricultural marketplace is **Inferred** from the names only.

## Branch reality

`origin/HEAD` is `master`. `master` is not an ancestor of `prod`. They share `5a0e9596` (2020-06-23, "codedeploy"). `prod` is an ancestor of `qa`. There are no git tags.

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default) | `f4f46ea9` | 2020-07-03 | Early CodeDeploy snapshot. Host `qa.farmtrade.co.za`, database `farmtrade`, admin entry `admin.php`. Last commit message: "changed service to httpd". |
| `prod` | `429b1564` | 2020-09-15 | Product line. Host `agmarket.co.za`, database `db_agmarket`, admin entry `fa-admin.php`. Custom shipping, PayFast, vendor registration, product import, storefront edits. |
| `qa` | `a755fe81` | 2020-09-16 | `prod` plus the `tokenMan` merge. Host `qa.agmarket.co.za`. Latest commit in the repository. |
| `tokenMan` | `5e805c26` | 2020-09-16 | Parcel Perfect token cleanup. Merged into `qa` by `a755fe81`. |
| `ShipmentAddressing` | `7db6d3b6` | 2020-09-11 | Address lookup work. Merged toward `qa` in earlier pull requests. |
| `parcelperfect-auth` | `592ebbe6` | 2020-09-01 | Parcel Perfect authorisation. |
| `dns-change` | `aea43334` | 2020-09-02 | DNS change toward `qa.agmarket.co.za`. |

History on `master` after the split is five commits: config, Apache owner/group, and renaming the service to `httpd`. The custom product behaviour described in the other Silicon Ark documents is on `prod` and `qa`, not on `master`.

**Unknown / Requires Confirmation:** which branch is deployed. The Bitbucket pipeline files deploy the `prod` branch, and on `qa` also the `qa` branch. They do not deploy `master`.

## Objectives (inferred from the implementation, not from a written plan)

- Run a CS-Cart Multi-Vendor marketplace on Apache `httpd`, deployed by AWS CodeDeploy.
- Let vendors sell and customers buy through the stock Multi-Vendor storefront, admin, and vendor panel.
- Quote and collect shipments through Parcel Perfect, and store the quote against the order.
- Take card payments through PayFast.
- Import products (and, for an administrator, categories) through a custom API entity.
- Collect extra vendor registration fields with a third-party add-on.
- Send mail through Amazon SES in `eu-west-1` with fixed AgMarket from-strings.
- Hide the newsletter block and the call-request block, and show Mastercard and Visa icons.

No roadmap, milestone list, or issue tracker is stored in the repository.

## Scope

### In scope of `qa` at `a755fe81`

1. CS-Cart Multi-Vendor 4.11.4.SP3 tree: storefront (`index.php`), admin (`admin.php` and `fa-admin.php`), vendor panel (`vendor.php`), REST entry (`api.php`).
2. Stock add-ons shipped under `app/addons/` (listed in the technical document). Activation of each add-on is database state and was not readable from git.
3. Custom add-on `sil_parcel_perfect` (Silicon Overdrive), shipping service `Tygh\Shippings\Services\Parcelperfect`, and `Tygh\ParcelPerfectAuth`.
4. Checkout address lookup at `addressing.php` and `js/addons/sil_parcel_perfect/parcel_perfect_address.js`.
5. PayFast processor `app/payments/payfast.php` and `sql/payfast_mysql_install.sql`.
6. Webkul add-on `wk_vendor_custom_registration` version 2.0.
7. Custom add-on `product_import` and API entity `ImportProducts`.
8. Storefront and mail edits named in the features document.
9. CodeDeploy packaging and Bitbucket Pipelines for `prod` and `qa`.
10. `FarmTrade-Privacy-Policy-4-08-2020.pdf` at the repository root.

### In scope of `master` at `f4f46ea9` only

The stock Multi-Vendor tree plus CodeDeploy files, `config.local.php` pointed at `qa.farmtrade.co.za`, and `install.html`. The custom items in the `qa` list above are absent.

### Out of scope of this repository

- The MySQL data: products, vendors, orders, which add-ons are active, and which order-status letter `A` is labelled with.
- The AWS CodeDeploy application, deployment groups, S3 bucket, and pipeline variable values. The scripts read those from the environment.
- A mobile app. The stock `mobile_app` add-on is in the tree. No separate app repository is referenced.
- Any storefront copy, category tree, or price list. Those live in the database and in `var/`, much of which is runtime data.

## System architecture

```text
Browser
  ├─ index.php          customer storefront (AREA C)
  ├─ fa-admin.php       admin entry named in prod/qa config (AREA A)
  ├─ admin.php          original admin entry; still in the tree
  ├─ vendor.php         vendor panel
  ├─ api.php            CS-Cart REST API
  └─ addressing.php     GET town lookup for checkout autocomplete

CS-Cart Multi-Vendor 4.11.4.SP3
  ├─ app/addons/        stock add-ons + sil_parcel_perfect, product_import, wk_vendor_custom_registration
  ├─ app/payments/payfast.php
  ├─ app/Tygh/ParcelPerfectAuth.php
  └─ app/Tygh/Shippings/Services/Parcelperfect.php

MySQL (mysqli, table prefix cscart_)
  sessions and locks in the database; file cache

External
  ├─ Parcel Perfect HTTP API (URL from add-on settings)
  ├─ PayFast (www.payfast.co.za or sandbox.payfast.co.za)
  ├─ Amazon SES SMTP in eu-west-1 (hardcoded in the mail transport on prod/qa)
  └─ AWS CodeDeploy + S3, from Bitbucket Pipelines
```

`config.local.php` sets `cdn_backend` to `cloudfront`. No distribution id or domain is set in the lines read. Whether CloudFront is actually in front of the site is **Unknown / Requires Confirmation**.

## Milestones visible in git

| When | What landed | Line |
|---|---|---|
| 2020-06-19 | "Init CS-Cart" | common history |
| 2020-06-23 | CodeDeploy scripts and pipeline | common history |
| 2020-07-03 | `master` tip: httpd service name, Apache owner, host `qa.farmtrade.co.za` | `master` only, after the split |
| 2020-07-09 to 2020-07-14 | PayFast, Webkul vendor registration, payment icons, newsletter and call-request markup commented out | `prod` / `qa` |
| 2020-07-15 to 2020-07-23 | Mail from-strings, admin entry `fa-admin.php`, install directory removed from the product line | `prod` / `qa` |
| 2020-08-03 to 2020-08-13 | Product import API, disable-products path, privacy-policy PDF, PayFast status `P` on complete | `prod` / `qa` |
| 2020-09-01 to 2020-09-02 | Parcel Perfect auth; hosts move between `qa.farmtrade.co.za` and `qa.agmarket.co.za` | `dns-change`, then product line |
| 2020-09-08 to 2020-09-16 | AgMarket domain and mail strings, address autocomplete, quotes, `quoteToCollection`, token storage | `prod` and `qa` |

There is no commit after 2020-09-16.

## Implementation plan

No forward plan is written in the repository.

**Unknown / Requires Confirmation** whether further work is expected. The default branch does not contain the product customisations, so a deploy of `master` would not ship Parcel Perfect, PayFast, or the AgMarket host settings.

## Known dependencies

- PHP. Entry scripts refuse versions below 5.6.0. The Webkul add-on header says PHP 7.1. The PHP version actually installed on the CodeDeploy host is **Unknown / Requires Confirmation**.
- MySQL, accessed with `mysqli`. Database names differ by branch (`farmtrade` on `master`, `db_agmarket` on `prod` and `qa`).
- CS-Cart Multi-Vendor 4.11.4.SP3. `changelog.txt` in the tree stops at 4.5.2.SP2 and points later history at `http://docs.cs-cart.com/latest/history/index.html`. The version constant and the changelog file disagree. The constant is what `config.php` executes.
- Apache `httpd`, installed with `yum` by `scripts/install_dependencies`.
- AWS CodeDeploy, S3, and Bitbucket Pipelines (Python 3.5.1 image, `boto3==1.3.0`).
- Parcel Perfect / EPX (`https://epx.pperfect.com/` is the tracking URL returned by the shipping service).
- PayFast.
- Amazon SES SMTP endpoint `email-smtp.eu-west-1.amazonaws.com`, port 587, TLS. Credentials are hardcoded on `prod`/`qa` and are omitted here.
- Webkul Vendor Custom Registration 2.0 (`https://store.webkul.com/CS-Cart.html`).

## Current project status

Last commit: 2020-09-16 on `qa`. The repository has been idle since then, as far as this git history shows.

`master` is an early deploy snapshot of stock Multi-Vendor. The behaviour that makes this repository FarmTrade / AgMarket rather than an unmodified CS-Cart install is on `prod` and `qa`.

## Discrepancies

1. **Default branch versus product line.** `master` at `f4f46ea9` does not contain the custom add-ons. `qa` at `a755fe81` does. Task metadata recorded `master` as the current branch, which matches `origin/HEAD`, and does not match the branch that holds the product work.
2. **Deploy path versus configured host.** `appspec.yml` on `master` and on `qa` still copies the tree to `/var/www/html/farmtrade.co.za/`. `prod` config host is `agmarket.co.za`. `qa` config host is `qa.agmarket.co.za`. `master` config host is `qa.farmtrade.co.za`.
3. **Task-creation file list versus git.** The scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is tracked on `master` or on `qa`. `upgrades/source_restore.php` is tracked. `install.html` is on `master` and deleted on the product line.
4. **`changelog.txt` versus `PRODUCT_VERSION`.** The changelog file's newest section is 4.5.2.SP2. `config.php` reports 4.11.4.SP3.
5. **`.gitignore` versus tracked config.** On `qa`, `.gitignore` lists `config.local.php`. The file is still tracked and still contains `db_password` and `crypt_key`. A Vim swap file `.config.local.php.swp` is also committed on the product line.
6. **Mail from-arguments.** `AMessageBuilder` and `PhpMailerTransport` call `setFrom` with `'AgMarket'` first and `'noreply@agmarket.co.za'` second. PHPMailer's `setFrom` takes the address first and the display name second. The call order is **Implemented**. That the two values are swapped relative to that parameter order is **Inferred**.

## Human confirmation

- Which branch and which hostname are live.
- Whether FarmTrade and AgMarket are a rename of one marketplace.
- Whether order status `A` is configured as "Ready for Collection".
- Which stock add-ons are enabled in the database.
- Whether the committed SES and database credentials are still valid, and whether they should be rotated. Values are not copied into this document.
- The PHP version on the CodeDeploy host.
- Whether any work is still planned. Nothing in git says so.