# Features — findndrive_webportal

Evidence date: 2026-10-15. Source: `git@bitbucket.org:overdrive/findndrive_webportal.git`, `master` at `54b9de7` (2023-10-12).

Status words below mean what the tree shows, not a release board. No feature flags were found.

## Current (present on master)

### Staff shell

| Feature | Status | Where |
|---|---|---|
| Login and logout | Current | `Welcome::index`, `Welcome::logout`, `app/Views/common/login.php` |
| Public registration into role 1 | Current | `Welcome::registration` |
| Forbidden page | Current | `Welcome::forbiddenPage` |
| Session gate | Current | `app/Filters/Authentication.php` |
| Menu grant gate | Current | `app/Filters/Authorization.php` |
| Sidebar from granted categories | Current | `menu_helper.php`, `layouts/sidebar.php` |
| User list, create, update, delete | Current | `Users` |
| Role create, update, delete | Current | `Users::createRole` and neighbours |
| Menu, category, and submenu permission toggles | Current | `Users::changeMenuPermission` and neighbours |
| User profile update, including address and phone columns | Current | `Users::updateUserProfile`, migration `UsersExtraField` |
| Dashboard counts and 7-day charts | Current | `Home`, `app/Views/common/home.php` |

### Vehicle catalogue

| Feature | Status | Where |
|---|---|---|
| Car list JSON | Current | `Car::carList`, `app/Views/car/list.php` |
| Car detail form and tier images | Current | `Car::form`, `Car::updatecarimage`, `Car::updatecarDetails` |
| Spreadsheet import from row 5 into car and cost categories A, B, C | Current | `Car::importSm` |
| Distinct car types for the simulator | Current | `CarModel::getCarRange` |
| Models filtered by a comma-separated type list | Current | `CarModel::getCarModel`, `getCarRecomendedModel` |
| Maintenance row (category A) and services row (category B) | Current | `CarModel::getCarMaintenance`, `getCarServices` |
| Seeded type names Sedan, SUV, Hatchback, Coupe | Current | `app/Database/Seeds/CarType.php` |

### Simulator API

| Feature | Status | Where |
|---|---|---|
| REST resource `carapi` | Current | `Routes.php` `$routes->resource('carapi')` |
| Step methods from login probe through apply, congratulations, and fix-my-credit | Current | `CarApi` |
| Session insert with geo fields | Current | `AppSessionModel::newSession` |
| Session update by `session` string | Current | `updateAppSessionSpesific` |
| List all sessions with no token | Current | `CarApi::index` |
| JWT on `show` and `create` only | Current | `CarApi::show`, `create` |
| JWT check bypassed on steps | Current | `$is_jwt_valid = true` in each step |

### Organisation API

| Feature | Status | Where |
|---|---|---|
| Login by name + api_key, JWT response | Current | `Organisations::login` |
| List, show, create, update, delete behind JWT | Current | `Organisations` |
| Seed organisation `silicon overdrive` | Current | `app/Database/Seeds/Organisations.php` |

### Files and media

| Feature | Status | Where |
|---|---|---|
| Uploaded-file list and upload | Current | `UploadedFile` |
| Media list, upload, deactivate | Current | `MediaFile` |

### Also in the tree

These run as code. Their place in Find And Drive is not documented.

| Feature | Status | Where |
|---|---|---|
| ChatGPT page and `chatGPT/sent` | Current | `ChatGPT`, `chatgpt_helper.php` |
| Master file list, taste-note and history generation | Current | `MasterFile` |
| Overland import and ModelliQ import | Current | `MasterFile::importOverland`, `importModelliQ`. Route `importmodelliq` is explicit |
| Site health list | Current | `SiteHealth` |
| Side-file test projects and test log | Current | `Test`, `TestLog` |
| Menu management and CRUD generator | Current | `Developers\MenuManagement`, `Developers\CRUDGenerator` |
| Database admin and Adminer views | Current | `DbAdmin`, `app/Views/projects/adminer.php` |
| CORS allow-all | Current | `app/Filters/Cors.php` |
| CodeDeploy on `master`, then SonarQube | Current | `bitbucket-pipelines.yml` |

## Completed, as far as git shows

The vehicle session columns and cost tables were added across migrations from 2023-06-18 through 2023-08-08. The last commit on `master` (2023-10-12, "database settings") left `Database.php` credentials blank and commented out the Secrets Manager lookup. That is the latest change visible on this branch.

Earlier commit subjects were not available. The clone used for this reading was shallow.

## Planned

`README.md` lists a Jira URL (`SI` board) and a Confluence space `AO`, and an empty heading "CRUD automation scrips". Those pages were not read. No in-repo backlog, TODO issue list, or unfinished feature branch was found.

Planned work outside this tree: **Unknown / Requires Confirmation**.

## In development

No branch other than `master` was present on the remote HEAD that was cloned. In-development work: **Unknown**.

## Recently changed

| Change | Evidence | Notes |
|---|---|---|
| Database credentials removed from `Config\Database` | Commit `54b9de7` "database settings" | Username, password, and database name are empty strings. `getSecret(...)` calls are comments |
| Sample `env` still names database `adminoverdrive` | `env` | Development sample, not the PHP config class |

## Deprecated or unused in the running paths

| Item | Evidence | Reading |
|---|---|---|
| `sendMail` calls in `Home`, `MasterFile`, `SiteHealth` | Commented out | Not part of the request path |
| `salesforceConnect()` and `smsMessage()` at those same sites | Commented out | Helpers still exist and still contain credentials |
| JWT check on simulator steps | Commented out and replaced with `true` | The check function remains in `JwtLibrary` |
| CSRF and honeypot | Commented out in `Filters.php` | Not applied |
| `AppSessionModel::updateAppSession` field list | Present | Steps call `updateAppSessionSpesific` instead, which writes the posted array as-is |
| `CarApi::update_values` body that would read salary and expenses | Commented out | Method updates with the array it was given, after first replacing `$data` with the existing row |
| mPDF | `composer.json` only | No `app/` reference |
| `orhanerday/open-ai` | `composer.json` | ChatGPT helper uses cURL |
| Cron tables | Migrations only | No command or controller reads them |
| `Routes_old.php`, `Filters_old.php`, `Kint_old.php` | Present beside the live config | Not loaded by the framework bootstrap that loads `Routes.php` and `Filters.php` |
| Users seeder call | Commented in `scripts/start_server` | Migrate still runs on ApplicationStart |

## Removed

No removal of a product feature was visible from the single commit that was cloned. **Unknown** before 2023-10-12.