# Features — footprint-app-api

Evidence date: 2026-10-14.

Source: `git@bitbucket.org:overdrive/footprint-app-api.git`, `master` at `fb96734` (2020-06-25).

"Current" means declared in `serverless.yml` or executed by a handler that file points at. A `.js` file that is not a function there is listed under not deployed. There is no issue tracker or roadmap in the repository, so nothing is marked planned unless a comment describes behaviour the code does not perform.

## Current features

### F-01 — AWS IAM on the HTTP API

Every event in `serverless.yml` sets `authorizer: aws_iam` and `cors: true`. Gateway 4XX and 5XX responses add `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` (`resources/api-gateway-errors.yml`).

Status: **current** (template). Confidence: high.

### F-02 — Create a note in DynamoDB

`POST /footprint` → `create.main`. Stores `content` and `attachment` with `userId` = Cognito identity id and `noteId` = time-based UUID. Table name `footprint-log`. Callback response, not the shared wrapper. Does not write the audit log.

Origin: starter files in `c0c86b4`. The path `/footprint` is the current template. Status: **current**. Confidence: high.

### F-03 — Get a note in DynamoDB

`GET /footprint/{id}` → `get.main`. Key is Cognito identity id plus path `id`. Missing item throws `Item not found.`

Status: **current**. Confidence: high. Whether this path captures literal GETs such as `/footprint/users` is **Unknown / Requires Confirmation**.

### F-04 — Search members

`POST /footprint/members` → `getfilteredusers.main`. Body fields `search`, `group`, `union`, `role`. Returns a short member row with role, gender, age, ethnicity, and organisation. Unfiltered calls are limited to 1000 rows. Filtered calls have no limit.

Mock: `mocks/getfilteredusers.json`. Status: **current**. Confidence: high.

### F-05 — Member profile by id

`GET /footprint/user/{id}` → `getuser.main`. Joined profile: personal, identity, passport, sport, address, next of kin, Facebook/Twitter/Instagram, extra member info, media URLs, medical aid, disability flags, age, ethnicity, organisation, status.

Profile image URLs point at bucket `footprint-reboot-qa-zaf`. S3 `getObject` is commented out. The secondary-position join's `ON` clause uses `pripos.PositionID` for the secondary id.

Mock: `mocks/getuser.json` (path `id` only). Status: **current**. Confidence: high.

### F-06 — Member by Cognito uuid

`GET /footprint/useruuid/{id}` → `getuseruuid.main`. Short profile plus `Status`, `GroupID`, and `CognitoUuid`.

Mock: `mocks/getuseruuid.json`. Status: **current**. Added in `173eddf` / surrounding 2020-06-09 commits. Confidence: high.

### F-07 — Member by email

`GET /footprint/email/{id}` → `getbyemail.main`. `SELECT *` where column `email` equals the path id.

Mock: `mocks/getbyemail.json`. Status: **current**. Confidence: high.

### F-08 — List members

`GET /footprint/users` → `getallusers.main`. `SELECT * FROM tbl_member LIMIT 0,100`. No audit log.

`mocks/listAll.json` is not named for this function. It supplies a path `id` and a Cognito identity. No handler is named `listAll`. Status: **current** for the route. Confidence: high.

### F-09 — Update general details

`POST /footprint/updateusergeneral` → `updateusergeneral.main`. Preferred name, full name, surname, title, nationality, birth country and city, ethnicity, gender, disability, additional needs, height, weight, sport safety number.

Wired in `8c9d5d6` (2020-06-19). Status: **current**. Confidence: high.

### F-10 — Update identity details

`POST /footprint/updateuseridentity` → `updateuseridentity.main`. Identity card, dates of birth and death, passport, residency status.

Status: **current**. Confidence: high.

### F-11 — Update other details

`POST /footprint/updateuserother` → `updateuserother.main`. Schools, tertiary institution, club, national player number, relationship, sports code, primary and secondary playing position.

Added to the template in `8555fa8` (2020-06-19). Status: **current**. Confidence: high.

### F-12 — Update address

`POST /footprint/updateuseraddress` → `updateuseraddress.main`. Country, address, suburb, city, province, postal code, mobile.

The SQL string has a comma immediately before `WHERE`. Status: **current** in the template, and the statement as written is not valid SQL. Confidence: high.

### F-13 — Update next of kin

`POST /footprint/updateusernextofkin` → `updateusernextofkin.main`. Initials, first name, last name, email, mobile, relationship id.

Status: **current**. Confidence: high.

### F-14 — Update email

`POST /footprint/updateemail` → `updateemail.main`. Sets `Email` for `MemberID`.

README local-invoke example names this function and `mocks/updateemail.json`. That mock is not in the repository. Status: **current**. Confidence: high.

### F-15 — Set Cognito uuid

`POST /footprint/updateuuid` → `updateuuid.main`. Sets `CognitoUuid` for `MemberID`.

Commit `a0da02b` (2020-06-09, "New Api Update Cognito Uuid"). Mock: `mocks/updateuuid.json`. Status: **current**. Confidence: high.

### F-16 — Set member status

`POST /footprint/updatememberactive` → `updatememberactive.main`. Sets `StatusID` from `data.status` for `data.memberId`.

Commit `fb96734` (2020-06-25, "Update the active member"). The code does not map a status name. Status: **current**. Confidence: high.

### F-17 — List permission modules for a group

`GET /footprint/getpermissionmodules/{id}` → `getpermissionmodules.main`. Distinct `ModulePermission` for `GroupID`.

Mock: `mocks/getpermissionmodules.json` (identity and path shape; no body). Status: **current**. Confidence: high.

### F-18 — Group permission rows

`POST /footprint/permissions` → `getpermissions.main`. All columns for `GroupID` and `ModulePermission`.

`POST /footprint/getmoduledetails` → `getmoduledetails.main`. Same table, body fields `group` and `module`.

Mocks: `getpermissions.json`, `getmoduledetails.json`. Status: **current**. Confidence: high.

### F-19 — Update group permission flags

`POST /footprint/updatepermissions` → `updatepermissions.main`. Sets `PRIVATE`, `VIEW`, `EDIT`, `CREATE`, `DELETE` on `tbl_permissions_group` by `PermissionGroupID`, and stamps `ModifiedUserID` from `personId` (a Cognito uuid).

Commit `a72140d` (2020-06-18, "new permissions API"). Mock: `updatepermissions.json`. Status: **current**. Confidence: high.

### F-20 — Member permission override

`POST /footprint/updatecustompermissions` → `updatecustompermissions.main`. Updates `tbl_permissions_member` when a row exists for `PermissionGroupID` and `MemberID`. Otherwise builds an insert that is not valid SQL.

`POST /footprint/userpermissions` → `getuserpermissions.main`. Reads `tbl_permissions_member` by `GroupID`, `ModulePermission`, and `MemberID`.

Commit `000fa06` (2020-06-18, "Update and insert on custom member rules"). Mocks: `updatecustompermissions.json`, `getuserpermissions.json`. Status: **current**. The insert branch does not match the read's columns. Confidence: high.

### F-21 — Card permission list

`GET /footprint/getallcardpermissions` → `getallcardpermissions.main`. `PermissionGroupID` and `CardPermission`, grouped only by `CardPermission`.

Mock: `getallcardpermissions.json`. Status: **current**. Confidence: high.

### F-22 — Delete a group permission row

`GET /footprint/deletepermission/{id}` → `deletepermission.main`. Deletes `tbl_permissions_group` by `PermissionGroupID`. Method is GET.

Mock: `deletepermission.json`. Status: **current**. Confidence: high.

### F-23 — Organisation groups by country

`GET /footprint/types/{id}` → `getalltypes.main`. `GroupID` and `Description` from `tbl_organisation_group` where `CountryID` is the path id.

The route name says types. The table is organisation groups. Mock: `getalltypes.json`. Status: **current**. Confidence: high.

### F-24 — Member groups

`GET /footprint/groups` → `getallgroups.main`. `MemberGroupID` and `Description` from `tbl_member_group`. Comment in `serverless.yml` says "created : jaco brits".

Status: **current**. Confidence: high.

### F-25 — Roles for a member group

`GET /footprint/roles/{id}` → `getrole.main`. `MemberRoleID` and `Description` from `tbl_member_role` where `MemberGroupID` is the path id.

Status: **current**. Confidence: high.

### F-26 — Request audit log

`logging.js` writes the API Gateway event, the SQL string, and the MySQL result to DynamoDB table `footprint-log`. Used by the MySQL handlers except `getallusers.js`. The put is not awaited and errors are not returned to the caller.

Status: **current**. Confidence: high.

### F-27 — Local invoke and offline tooling

`serverless-offline` and `serverless-dotenv-plugin` are plugins. README documents a global Serverless install, one local invoke, and `serverless deploy -v --aws-profile evolvqa`.

`mocks/` holds Lambda proxy events (string `body` and/or `pathParameters`, plus `requestContext.identity.cognitoIdentityId`) for a subset of functions. Identity values are not repeated here.

Status: **current** as tooling in the repo. Whether the team used it after 2020-06-25 is **Unknown**. Confidence: high for the files.

## Changed

Recovered from commit subjects. Diffs were not re-reviewed line by line beyond the tip.

| When | Commit | What the subject says |
|---|---|---|
| 2020-06-05 | `4a95693` | Update to current Footprint API (subject spells "curret") |
| 2020-06-09 | `cdf2e00` through `1707a63` | Repeated updates to the get-user MySQL query |
| 2020-06-09 | `173eddf`, `a0da02b` | Cognito uuid on the member read, then an update API |
| 2020-06-10 | `a926ae3` | Security module settings |
| 2020-06-12 | `8e456a3` | "alot of new apis" |
| 2020-06-18 | `a72140d`, `000fa06` | Permissions API, then member-rule update and insert |
| 2020-06-18 to 2020-06-19 | `b46ed0c`, `8555fa8`, `8c9d5d6` | Personal and contact update files, then YAML wiring including `updateuserother` |
| 2020-06-25 | `fb96734` | Active member status update |

## Not deployed

Present in git. Not a function in `serverless.yml`.

| Behaviour | File | What it does |
|---|---|---|
| Hello | `handler.js` | Starter message. The only unit test imports it |
| Organisation groups by type | `getgroups.js` | `GroupID`, `Description` from `tbl_organisation_group` where `type_id` is the path id |
| Insert group permission | `savepermissions.js` | Insert into `tbl_permissions_group`. The values string is not valid SQL |
| Copy group flags onto every member | `grouptomembercustom.js` | Selects all members and inserts `tbl_permissions_member` rows from their group's `tbl_permissions_group` rows. `CreatedUserID` is `0`. No duplicate check. The YAML function is commented out |

`libs/images-lib.js` is an empty file and is not imported.

`Member_Manage.txt` lists sixteen names (`Member_Manage`, `Member_Reports`, `Member_Pivot_Report`, `Member_Home_Details`, `Member_Performance_MatchStatistics`, career-history names, the five profile sections that match F-09 to F-13, organisation, contract, apparel). Nothing in the JavaScript reads the file.

`Untitled-2.txt` is two JSON product records (barcode, product code, description, price). Nothing in the JavaScript reads the file.

## Not implemented

No route does the following. This is an absence in the tree, not a request to build it.

- Create a member.
- Delete a member.
- Write social, additional-info, media, or medical-aid rows (they are only selected in `getuser.js`).
- Check `PRIVATE` / `VIEW` / `EDIT` / `CREATE` / `DELETE` before serving another route.
- Validate body fields, dates, or status ids.
- Return HTTP 404 for a missing member. An empty MySQL array is still the success payload, wrapped as HTTP 200.
- Bind SQL parameters.
- Create the DynamoDB table or the MySQL schema.
- Run a queue, schedule, or worker.
- CI on push.

## Removed

No commit subject says a feature was removed. The starter `hello` function is not in `serverless.yml`. The first commit's long README is not the current README. `grouptomembercustom` remains in git and is commented out of the template rather than deleted.

## Planned

None documented. The commented `grouptomembercustom` block is disabled configuration, not a written plan.

## Deprecated

Nothing is marked deprecated.

`nodejs12.x`, the starter `hello` path, and the unused product sample in `Untitled-2.txt` are leftovers. The template still deploys `nodejs12.x`. Whether AWS still runs that runtime is outside this repository.

## Recently changed

The newest commit on `master` is `fb96734` (2020-06-25), which is the member status update (F-16). No later commit is on `origin/master`.