# Project plan — indawo_84

Evidence date: 2026-10-12.

Source repository: `git@bitbucket.org:overdrive/indawo_84.git`.

This plan describes what that repository contains. It does not decide what the product should become.

The scan-host path named on the onboarding issue (`~/projects/sonar_scan/repos/indawo_84`) was not on this machine. The tree below was read from a clone of `main`. The issue recorded `223198b` (2026-09-21, "authorised by column added to suggestions"). That commit is an ancestor of current `main`. Current `main` is `6ce3e8d` (2026-10-12 15:04:43 +0200, Ettiene, "days differences added").

`git ls-remote --heads` on 2026-10-12 returned four heads and no tags:

| Ref | SHA |
|---|---|
| `refs/heads/main` | `6ce3e8d2dd948acea4952ff4e87f817db8587725` |
| `refs/heads/development` | `7700b5673d02ffe30901950a4e2436b37d54dafe` |
| `refs/heads/staging` | `8b0d4b4ea6fd8b5a2ca8675c1022cc269e889def` |
| `refs/heads/feature/odbc-connections-dashboard` | `3cbf504cd1e2ea20cad8a57b8cc69373df7df557` |

`origin/HEAD` is `main`. This onboarding read `main` only. How `development`, `staging`, and `feature/odbc-connections-dashboard` differ from `main` is **Unknown / Requires Confirmation**.

There is no prior Silicon Ark set for `indawo_84`.

## Product

The Git remote and the onboarding issue name the repository `indawo_84`. The application calls itself **Indawo Online**.

| Identity | Where | Provenance |
|---|---|---|
| Repository `indawo_84` | Git remote | **Implemented** |
| Composer package `russel-sauer/indawo`, description "PHP Indawo Project" | `composer.json` | **Implemented** |
| Product name "Indawo Online" | `login.php` (TOTP issuer and login log label), `README.md` title `indawo_online` | **Implemented** and **Documented** |
| Live app path `/var/www/html/indawo_online/` and MySQL database `indawo_online` | `docs/INDAWO-Online-Technical-Documentation.md` (2026-05-26) | **Documented**. The path is also the non-local return of `getFilesystemBase()` in `project.functions.inc.php` (`/var/www/html/indawo_filesystem/`) |
| Public host `online.indawo.biz` | `system.php` switch, including a rewrite from `vm-indawo-lamp-prod.southafricanorth.cloudapp.azure.com` | **Implemented** |
| Local folder example `http://localhost/indawo_84/ODBC_connections.php` | `README-odbc-dashboard.txt` | **Documented** |

Indawo Online is an internal PHP web application for construction-company operations: clients and contacts, jobs and enquiries (Foreman), purchase orders and authorisation, invoices, pre-start agreements, budget adjustments, job suggestions, assets, cash-flow and management dashboards, and users. MySQL holds the online copy. Microsoft SQL Server on `CPTSQL02` is the Foreman / back-office system of record, reached over ODBC. Provenance: **Documented** in `docs/INDAWO-Online-Technical-Documentation.md` and **Implemented** in the page and cron files named in `features.md`.

The May 2026 technical document says there is no realtime sync queue. Current `main` implements `sysSyncQueue`, morning catch-up, and an evening retry. That disagreement is recorded under Current status. The May document remains useful for the nightly SQL-to-MySQL chain. It is not the source of truth for realtime sync.

## Branch reality (recent `main`)

History below is the last 80 commits fetched from `main` (`git fetch --deepen=80`). Authors on that window are Ettiene (`ettiene@overdrive.co.za`) and Jacques Groenewald. Older history was not fetched.

Work since the issue's recorded commit `223198b` (2026-09-21):

| Commit | Date | Subject |
|---|---|---|
| `6ce3e8d` | 2026-10-12 | days differences added |
| `4099f45` | 2026-10-12 | Updated columns left for impact and fixed colours |
| `41f6b52` | 2026-10-07 | fixing Cash flow sp dashboard report to use same as week ending overhead rule/calculation |
| `a16c9c5` | 2026-10-01 | included impact |
| `7342054` | 2026-10-01 | undo authorisation impact |
| `9d28fe3` | 2026-09-30 | authorisation impact added |
| `cc78bb4` | 2026-09-30 | quote Luvthis job numbers in cron 3 percent insert |

`223198b` itself adds an "Approved / Declined By" column on the job suggestion list and stores `refApprovedByUserID` on accept and decline.

September 2026 commits also cover PHP 8.4 fixes, order save and authorise, invoice PDF totals, SharePoint document links, ODBC connection guards, cron HTTP gating, and `.env` for the live site (`075f81e`).

`CHANGELOG.md` and `README.md` stop at 2026-02-11 (PHP 8.4 null and quoting fixes). They do not record September–October 2026 behaviour. Provenance: **Documented** lag.

## Scope on `main`

In the committed application (libraries under `mpdf/`, `PHPExcel/`, `html2pdf/`, and `plugins/` excluded from this list):

- Page scripts for login, home, clients, contacts, contact log, jobs, enquiries, orders, order authorisation, invoices, pre-start agreements, budget adjustments, job suggestions, job types, assets, companies, sales people, users, security groups, settings, email, messages, my tasks, KPI, dashboards, and reports.
- A Nemo page framework (`_nemo*.cls.php`) for lists, details, menus, email, reports, and MySQL.
- ODBC access to SQL Server (`_nemo.database.SQL_SERVER.cls.php`, `_sync.cls.php`).
- Nightly and manual batch sync crons, cash-flow PDF generation, order-authorisation email, and monthly order cancellation.
- Realtime MySQL-to-SQL queue, morning re-apply, and evening retry (`includes/syssyncqueue_schema.inc.php`, `includes/realtime_retry.inc.php`, `includes/realtime_morning_catchup.inc.php`, `cron.evening.realtime-retry.php`, `cron.morning.realtime-catchup.php`).
- An ODBC diagnostic dashboard (`ODBC_connections.php`, `README-odbc-dashboard.txt`).
- Composer dependencies for PHP 8.4, dotenv, TOTP, QR codes, and PDF (`composer.json`).
- Two-factor authentication pages and `MFATables.sql`.
- In-repo technical notes under `docs/`, including a May 2026 architecture document and a June 2026 realtime-queue plan.
- A Bitbucket Pipelines file that runs SonarQube on a branch pattern `{master}`.
- A CLI regression script `tests/ett_odbc_regressions.php`.

Out of the committed tree, though named by code or docs:

- `.env` (gitignored). The tracked template is the file named `env`.
- `vendor/` (`composer.json` says not to commit it).
- `SESSION/`, `orders/`, `RequestInvoice/`, `ProfitOverviewPDF/`, `JobReport/`, and logs (`.gitignore`).
- The live MySQL schema. `docs/schema/README.md` says no full dump is in the repository and that `export_schema.php` must be run against a live database. The generated JSON/CSV outputs were not in this checkout.
- Crontab on the live host. Schedules in the May technical document are **Documented**, not stored as a crontab file in git.
- `development`, `staging`, and `feature/odbc-connections-dashboard` trees.

`Cash Flow Report/` is listed in `.gitignore` and is also present in `main` (PDF files under company-named folders). Gitignore does not remove files that are already tracked. Provenance: **Implemented**.

## Architecture (summary)

```text
Browser
  -> Apache (.htaccess rewrites HTTP cron URLs through http_cron_gate.php)
  -> PHP 8.4 page (Nemo) + session ONLINE
  -> MySQL indawo_online
  -> ODBC -> SQL Server CPTSQL02 (CLIENTS and per-company Foreman databases)

Crons (CLI, or HTTP only after login and menu view rights)
  -> same PHP sync classes
  -> staging tables stg* then tbl*
  -> PDFs / Excel under the filesystem base
```

Host selection is a `switch` on `$_SERVER["SERVER_NAME"]` in `system.php`. Named cases: `10.50.1.4`, `online.indawo.biz`, `localhost:8888`, `localhost`, `127.0.0.1`, plus a default that falls back to the localhost settings. Production-named cases read database credentials from `.env`. Local cases contain fallback credentials in source. Those values are not copied into Silicon Ark.

Detail is in `technical-documentation.md`.

## Milestones visible in the repository

These are observed deliveries, not a forward roadmap.

| When | What landed | Evidence |
|---|---|---|
| Through 2016 (comments) | Password policy, order and job workflows, company scoping | Comments in `login.php`, `project.functions.inc.php`, order and dashboard classes |
| 2026-02-03 to 2026-02-11 | PHP 8.4 quoting, null guards, `system.php` switch | `CHANGELOG.md`, `NewKnowledgeBase.md`, `README.md` |
| 2026-05-26 | Architecture write-up of nightly sync, crons, and entity relationships | `docs/INDAWO-Online-Technical-Documentation.md` |
| 2026-06-09 | Plan and section-1 log for `sysSyncQueue` | `docs/INDAWO-Realtime-Sync-Queue-Retry-Implementation-Plan.md`, `docs/Section-1-Live-Changes-Log.md` |
| 2026-08 to 2026-09 | ODBC guards, SharePoint folder links, `.env` on the live host, cron HTTP lock, order and invoice PHP 8 fixes | `main` commits listed above |
| 2026-09-21 to 2026-10-12 | Suggestion approver column, authorisation money impact, cash under/over formula alignment, date-difference tables | `223198b` through `6ce3e8d` |

No issue tracker, milestone file, or dated roadmap beyond those documents was found. A forward plan is **Unknown / Requires Confirmation**.

## Dependencies

| Dependency | Role | Evidence |
|---|---|---|
| PHP `>=8.4`, `ext-gd` | Runtime | `composer.json` |
| `vlucas/phpdotenv` `^5.6` | `.env` | `composer.json`, `setup_composer.md` |
| `robthree/twofactorauth` `^3.0`, `endroid/qr-code` `^6.1` | TOTP and QR | `composer.json`, `login.php` |
| `mpdf/mpdf` `^8.2`, `spipu/html2pdf` `^5.3` | PDF via Composer | `composer.json` |
| Vendored `mpdf/` (v5-era) and `PHPExcel/` | Still included by `project.functions.inc.php` | **Implemented** |
| Vendored `html2pdf/` | Present in the tree | **Implemented**. Which PDF path each screen uses is not fully mapped |
| MySQL database `indawo_online` | Application database | Docs and local `system.php` default |
| SQL Server `CPTSQL02`, ODBC Driver 18 or FreeTDS | Foreman | `system.php` comments, `setup_composer.md`, May technical doc |
| SharePoint site default `https://indawocape.sharepoint.com/sites/OnlineProjects` | Job/enquiry file links | `Foreman::publicFileUrl()` |
| SonarQube pipe `sonarsource/sonarqube-scan:3.0.2` | Pipeline | `bitbucket-pipelines.yml` |
| Sibling repos `indawo_docker` and `indawo_online_docker` | **Unknown** whether they are the runtime for this app. They are separate Silicon Ark projects. This repository does not reference them |

`setup_composer.md` documents a production document root `/var/www/indawo` and an ODBC system DSN named `CPTSQL02` at `192.168.0.9,53950`. The May technical document documents `/var/www/html/indawo_online/` and live host `192.168.0.28`. Those paths disagree. **Requires Confirmation** which path is current production.

## Current project status

`main` is an active legacy PHP application under PHP 8.4 hardening and sync-robustness work. The newest commit on the evidence date changes job date-difference display.

Implemented and in use on `main` (code present, not observed running):

- Login with email, password, shared login PIN, optional TOTP, remembered device, lock, and password expiry.
- Security-group menu permissions (view, new, save, delete, special).
- Company context in the session (`getOWC()`).
- Foreman batch pull and a realtime push queue for Client, Contact, Foreman, and Foreman job start/end date history.
- Order authorisation (admin and production) and a monthly cancel cron aimed at company 1.
- Money-impact and date-difference tables on job suggestions / tasks.
- Cash under/over that applies a 1.3 factor to labour and material only, then adds subcontractor actuals. The same expression is in `cron.CashFlow.php` and `includes/dashboard.users.cls.php` as of `41f6b52`.

Still a placeholder:

- `cron.daily.repeater.update.php` prints a temporary-file message and, when `?odbc=1`, a diagnostic banner. It does not sync. The May document's warning still matches the file.

Stale relative to `main`:

- `docs/INDAWO-Online-Technical-Documentation.md` section 1 and section 5.4 say there is no `sysSyncQueue` and no retry. The code has both.
- `CHANGELOG.md` / `README.md` end at 2026-02-11.
- `bitbucket-pipelines.yml` targets branch pattern `{master}`. Remote heads on 2026-10-12 are `main`, `development`, `staging`, and one feature branch. No `master` head was returned.

## Human confirmation

1. Which host, filesystem path, and database name are production today (`online.indawo.biz`, `192.168.0.28`, `10.50.1.4`, `/var/www/html/indawo_online/`, `/var/www/indawo`)?
2. Is the May 2026 crontab still the live schedule, including the five-minute repeater and the Saturday chain?
3. Are `development` and `staging` deployment targets, or stale?
4. Should tracked files under `Cash Flow Report/` stay in Git?
5. Should the hardcoded local SQL credentials in `system.php` be removed from Git? Silicon Ark does not repeat them.
6. Is the Sonar pipeline expected to run on `main`?