# Project plan — footprint-app-api

Evidence date: 2026-10-14.

Source repository: `git@bitbucket.org:overdrive/footprint-app-api.git`.

Inspected revision: `master` at `fb96734` (2020-06-25, Jaco Brits, "Update the active member"). That commit is `origin/HEAD`. `git branch -a` listed only `master` and `origin/master`. `git rev-list --count master` is 22. `git tag -l` printed nothing.

The scan-host path `~/projects/sonar_scan/repos/footprint-app-api` was not on this machine. The tree below was read from a clone of that git revision. No database password is stored in git. Mock files contain identity identifiers; those values are omitted here.

This plan describes what the repository contains. It does not decide what the product should become.

No `silicon_ark/footprint-app-api/` directory existed before these files. `README.md` in the source is a short deploy note titled "Evolv Foorprint Reboot API" (spelled that way). `package.json` still describes "A Node.js starter for the Serverless Framework" and its `repository.url` still points at `https://github.com/AnomalyInnovations/serverless-nodejs-starter.git`. `LICENSE` is the MIT licence, copyright 2017 Anomaly Innovations.

Silicon Ark already has other Footprint-named directories (`FootprintApp.net`, `FootPrintLive`, `footprint-lambda`, `footprintapp-Not-Used`, `Footprint-Not-Used`, `tournaments.footprintapp.net`, `matchcentre.footprintapp.net`). `unity-lambda-api` documentation records the same S3 bucket string `footprint-reboot-qa-zaf` inside an unwired example file. This repository does not name those directories. Whether they are one product is **Unknown / Requires Confirmation**.

## Product

**Documented** in `README.md` as "Evolv Foorprint Reboot API". The Serverless service name in `serverless.yml` is `footprint-reboot-api`. The npm package name is `footprintApp-api`, version `1.1.0`.

**Inferred** from the routes and SQL: an AWS HTTP API that reads and updates member rows, member lookup lists, and permission rows in MySQL, and that also keeps the Serverless starter's DynamoDB note create/get on the same table name used for an audit log.

**Implemented.** Twenty-six HTTP functions are declared in `serverless.yml`. Four JavaScript files exist and are not functions in that file (`handler.js`, `getgroups.js`, `savepermissions.js`, and `grouptomembercustom.js`, the last of which is present only as a commented block).

There is no product brief, owner statement, or audience statement beyond the README title and the deploy commands.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `fb96734` | 2020-06-25 | Only branch. 22 commits from 2020-03-26 to 2020-06-25 |

Nothing in git is dated after 2020-06-25. Whether the API is still deployed is **Unknown / Requires Confirmation**.

| Commit | Date | Author | Subject |
|---|---|---|---|
| `c0c86b4` | 2020-03-26 | Jaco Brits | First commit |
| `4a95693` | 2020-06-05 | Jaco Brits | Update to curret footprint API |
| `cdf2e00` | 2020-06-09 | JacquesOverdrive | Update getUser mysql Query |
| `0807ffc` | 2020-06-09 | JacquesOverdrive | Update getUser mysql Query |
| `371c1ff` | 2020-06-09 | JacquesOverdrive | Update getUser mysql Query |
| `908945e` | 2020-06-09 | JacquesOverdrive | Update getUser mysql Query |
| `3b6007d` | 2020-06-09 | JacquesOverdrive | Update getUser mysql Query |
| `2f5600d` | 2020-06-09 | Jaco Brits | Update code |
| `cb2a355` | 2020-06-09 | Jaco Brits | Merge branch `master` |
| `173eddf` | 2020-06-09 | Jaco Brits | Added CognitoUuid |
| `a0da02b` | 2020-06-09 | Jaco Brits | New Api Update Cognito Uuid |
| `1707a63` | 2020-06-10 | JacquesOverdrive | Update getUser mysql Query |
| `a926ae3` | 2020-06-10 | Jaco Brits | Update get security module settings |
| `8e456a3` | 2020-06-12 | Jaco Brits | alot of new apis |
| `a72140d` | 2020-06-18 | Jaco Brits | new permissions API |
| `000fa06` | 2020-06-18 | Jaco Brits | Update and insert on custom member rules |
| `b46ed0c` | 2020-06-18 | JacquesOverdrive | create api files for personal and contact info |
| `8555fa8` | 2020-06-19 | JacquesOverdrive | added updateuserother to the yml file |
| `8c9d5d6` | 2020-06-19 | JacquesOverdrive | update yml file with new update calls for user details |
| `a20daf6` | 2020-06-19 | Jaco Brits | New all tables |
| `f52a45a` | 2020-06-19 | Jaco Brits | Merge branch `master` |
| `fb96734` | 2020-06-25 | Jaco Brits | Update the active member |

`c0c86b4` added the Serverless Node.js Starter files only (`.gitignore`, `LICENSE`, a long `README.md`, `env.example`, `handler.js`, `package.json`, `package-lock.json`, a 32-line `serverless.yml`, `tests/handler.test.js`). The member and permission handlers arrived in the June 2020 commits. The current `README.md` is nine lines and is not that starter README.

## Objectives

No objectives document exists in the repository. What the code does, as of `fb96734`:

1. Expose IAM-authenticated HTTP routes under `/footprint` on API Gateway.
2. Read and update `tbl_member` and related lookup tables in MySQL.
3. Read and update group and member permission flag rows.
4. Write an audit item to DynamoDB for most MySQL handlers.
5. Keep the starter note create and note get against the configured DynamoDB table name.

Those are observations of the implementation, not a signed-off goal statement.

## Scope

### In scope of `master` at `fb96734`

- Serverless Framework service `footprint-reboot-api`.
- Twenty-six HTTP Lambda functions in `serverless.yml`.
- MySQL access through `serverless-mysql`.
- DynamoDB document client for notes (`create.js`, `get.js`) and for `logging.js`.
- Gateway 4XX and 5XX CORS responses in `resources/api-gateway-errors.yml`.
- Local invoke mocks under `mocks/`.
- One unit test, `tests/handler.test.js`, which targets `handler.hello`.

### Out of scope / not in this repository

- The caller application (web, mobile, or other). No frontend is in this tree.
- MySQL schema migrations, seed data, or a database project. Table and column names appear only inside SQL strings.
- Creation of the DynamoDB table. The template grants IAM and names `footprint-log`. It does not declare the table.
- A custom domain or a public base URL.
- CI. There is no Bitbucket Pipelines file.
- Member creation, member deletion, and the modules named in `Member_Manage.txt` that have no handler (reports, pivot, performance, career history, organisation, contract, apparel).

## System shape

```text
IAM caller
    │
    ▼
API Gateway  (stage prod, CORS on routes and on gateway errors)
    │
    ▼
Lambda nodejs12.x   (one function per file, packaged individually)
    │
    ├── MySQL   serverless-mysql
    │     host, user, password, database from deploy env
    │     VPC security group + two subnets from deploy env
    │
    └── DynamoDB eu-west-1
          table name footprint-log
          notes: create.js, get.js
          audit: logging.js
```

Profile image fields in `getuser.js` are URL strings for bucket `footprint-reboot-qa-zaf`. The S3 client in that file is commented out. This template does not upload or fetch objects.

## Major components

| Component | Where | Role |
|---|---|---|
| Route table | `serverless.yml` | Service, runtime, VPC, IAM, 26 functions |
| Member profile read | `getuser.js` | One member, many joins, image URL strings |
| Member search | `getfilteredusers.js` | Search plus group, organisation, and role filters |
| Member summary reads | `getuseruuid.js`, `getbyemail.js`, `getallusers.js` | By Cognito uuid, by email, or first 100 rows |
| Profile writes | `updateusergeneral.js`, `updateuseridentity.js`, `updateuserother.js`, `updateuseraddress.js`, `updateusernextofkin.js`, `updateemail.js`, `updateuuid.js`, `updatememberactive.js` | Section updates on `tbl_member` |
| Permissions | `getpermissionmodules.js`, `getpermissions.js`, `getmoduledetails.js`, `getuserpermissions.js`, `getallcardpermissions.js`, `updatepermissions.js`, `updatecustompermissions.js`, `deletepermission.js` | Group and member flag rows |
| Lookups | `getalltypes.js`, `getallgroups.js`, `getrole.js` | Organisation groups by country, member groups, roles |
| Notes | `create.js`, `get.js` | Starter DynamoDB note put and get |
| Audit | `logging.js` | DynamoDB put of event, query, and result |
| Wrapper | `libs/handler-lib.js`, `libs/response-lib.js` | Status and CORS. MySQL handlers use both |
| Unwired | `handler.js`, `getgroups.js`, `savepermissions.js`, `grouptomembercustom.js` | Present in git, not a live function in the template |
| Empty file | `libs/images-lib.js` | Zero bytes. Not imported |

## Milestones

The repository does not list future milestones. The commit subjects are the only timeline:

| When | What landed |
|---|---|
| 2020-03-26 | Serverless starter |
| 2020-06-05 | Described as the current Footprint API |
| 2020-06-09 to 2020-06-10 | `getuser` SQL expanded; Cognito uuid read and update |
| 2020-06-12 to 2020-06-18 | Further APIs and permission group/member writes |
| 2020-06-18 to 2020-06-19 | Personal, identity, other, address, and next-of-kin updates wired in the template |
| 2020-06-25 | Member status update (`updatememberactive`) |

No milestone after 2020-06-25 is written down.

## Dependencies known from the tree

Runtime and deploy, from `serverless.yml` and `package.json`:

- AWS API Gateway, Lambda, IAM, DynamoDB, and a VPC (security group and two subnet ids supplied at deploy time).
- Node.js 12 (`provider.runtime: nodejs12.x`).
- Serverless Framework. README says `npm i -g serverless` and `serverless deploy -v --aws-profile evolvqa`. The template also sets `profile: evolvqa`.
- Plugins: `serverless-bundle` ^1.2.5, `serverless-offline` ^5.3.3, `serverless-dotenv-plugin` ^2.1.1.
- Libraries: `serverless-mysql` ^1.5.4, `uuid` ^7.0.3, `aws-sdk` ^2.661.0 (devDependency).

Environment names the template interpolates: `SECURITYGROUPIDS`, `SUBNETIDS1`, `SUBNETIDS2`, `DBHOST`, `DBUSERNAME`, `DBPASSWORD`, `DBNAME`. `env.example` does not list those names. It contains one sample variable.

MySQL tables named in SQL strings: `tbl_member`, `tbl_member_role`, `tbl_member_group`, `tbl_gender`, `tbl_ethnicity`, `tbl_organisation`, `tbl_organisation_group`, `tbl_status`, `tbl_country`, `tbl_city`, `tbl_identitytype`, `tbl_relationship`, `tbl_sportscode`, `tbl_position`, `tbl_suburb`, `tbl_province`, `tbl_socialmedia`, `tbl_additional_member_info`, `tbl_media_hub`, `tbl_medical_aid`, `tbl_permissions_group`, `tbl_permissions_member`.

The database that owns those tables is whatever `DBNAME` is at deploy time. It is not in git.

## Current status

**Implemented** and last changed on 2020-06-25. Single branch `master`. No open work, issue tracker, or roadmap is in the repository.

**Unknown / Requires Confirmation:**

- Whether `evolvqa` / stage `prod` in `eu-west-1` is still the deployed API.
- The public URL, if any custom domain exists outside this template.
- Which application calls these routes.
- Whether `footprint-log` exists and what its key schema is. Note items and audit items use different attribute names.
- How this repository relates to the other Footprint directories in Silicon Ark.
- Whether the SQL defects called out in the PRD (address update comma, custom-permission insert text, secondary-position join) were ever corrected in the database client or left as they are in git.