# Features — ipw-php

Evidence date: 2026-10-11. Source: `main` at `054883d9`.

Status values: **Current** (present in the CI4 application), **Documented** (described in repo docs; confirm before treating as a separate feature), **Planned** (described as future and not found in the code searched), **Legacy description** (describes `livesite/` or starter text, not the current route map), **Removed or disabled in source**.

## Current features

### Public site

| Feature | Where | Status |
|---|---|---|
| Home, guidelines, manuals, literature, forms, courses, links, contacts, cellars, about, climate change, sustainability, GHG protocol, IP codings | `Pages`, `Content`, `PublicRoutes.php` | Current |
| Legacy `*.php` URL notice | `LegacyRedirect` | Current |
| Language switch (English / Afrikaans strings) | `Language`, `language_helper.php` | Current |
| No search-engine indexing header | `NoSearchEngineIndex` | Current |
| Maintenance mode | `MaintenanceMode`, `MaintenanceService` | Current |

### Access

| Feature | Where | Status |
|---|---|---|
| Login, registration, forgot and reset password | `Welcome` | Current |
| Two-factor prompt | Routes commented in `Routes.php` | Removed or disabled in source |
| Session login filter | `Authentication` | Current |
| Menu authorisation | `Authorization` | Current |
| Route policy (fine-grained action/object) | `RoutePolicy`, `RoutePolicyGrants.php` | Current |
| Hide selected staff pages | `HiddenStaffPages` | Current |
| No-cache on responses | `NoCacheHeaders` | Current |
| Coarse roles seed (Developer, Administrator, BWI Member, Member, Public User, Auditor, Lead Auditor) | `Database/Seeds/UserRole.php` | Current |
| Fine roles used by grants: System Developer, IPW Administrator, IPW Data Capturer, IPW Auditor, IPW Lead Auditor | `RoutePolicyGrants.php` | Current |
| Member roles documented: Edit Evaluation Forms, View Evaluation Forms, Member Administrator, View Status Only | `knowledgeBase/RBAC_Implementation.md` | Documented |
| Active member group API | `Api\User` | Current |
| Live admin sessions | `AdminSessions` | Current |
| Login history | `LoginHistory` | Current |
| RBAC policy audit command | `spark` command `RbacPolicyAudit` | Current |

### People and groups

| Feature | Where | Status |
|---|---|---|
| IPW users and members lists, create, update, suspend, delete | `Users`, `SystemUsers` | Current |
| Pending registration accept / decline | `Users::acceptPendingMember`, `declinePendingMember` | Current |
| User groups, SAWIS description lookup, apply to group, assign member | `Users` | Current |
| Group history and manual history item | `Users::groupHistory` | Current |
| Active SAWIS number, add and delete number | `Users` | Current |
| Group merge preview and execute | `GroupEntityMergeService`, `Users::previewGroupMerge` | Current |
| SAWIS number transfer and rollback | `SawisNumberTransferService` | Current |
| Suspend a group | `Users::setGroupSuspendStatus` | Current |
| Sync one group’s SAWIS data from BIS | `Users::syncGroupSawisData`, `SawisFarmSyncService` | Current |
| CLI farm sync | `SyncSawisFarms` | Current |

### Evaluations and scoring

| Feature | Where | Status |
|---|---|---|
| Evaluation form templates (items, parts, appendices) | `EvaluationForms`, `EvaluationFormTemplate` | Current |
| Member submissions list, detail, print | `MemberEvaluations` | Current |
| Application types: Self-assessment (0), IPW Audit (1), SEV Audit (2) | `getApplicationTypeText` | Current |
| Legacy vs modern score sets, disable-option bit masks | `ScoringRules` | Current |
| Cellar types A–E and greyed questions | `CellarTypes` | Current |
| Spray programme and control products | `SprayProgrammeScores`, `ControlProduct` | Current |
| Optional farm Table B unlocking the higher total only when points are positive | `SubmissionScoreRollup`, README | Current |
| Lead Auditor incomplete IPW audit submit | `user_authorization_helper.php` | Current |
| Lead Auditor appendix parent override | `AppendixParentOverrideService` | Current |
| Bulk score check, including search for one submission | Comment in `MemberEvaluations` around the removed per-row button; `BulkScoreCheckService` | Current. The per-row recalculate button was removed; the endpoint remains |
| Score backfill commands that write a revert snapshot and do not change status | `BackfillSubmissionScoreRollup`, `BackfillTableBRollup`, `BackfillPassCompliance` | Current |
| Form name display “FARM / CELLAR” without rewriting stored `form_desc` | README, `eval_form_helper.php` | Current |
| Appendix 2B dual tables from 2027 (bait vs miticides), column `appendix_section` | Migration `2026-07-22-073200_AddAppendixSectionToGroupEvalFormAppendix.php`, `scope/Task_Appendix_2B_Dual_Tables_2027.md` | Current schema. Whether the 2027 UI is already switched on for every form year is Unknown |

### Compliance, certificates, probation, documents

| Feature | Where | Status |
|---|---|---|
| SAWIS compliance list and year badges (`swsa_outcome = 1` is Yes) | `Compliance`, `SawisComplianceStatusResolver`, README | Current |
| Audit list with filtered CSV and Excel | `Audit`, README | Current |
| `group_audit` records; types 60 and 61 excluded from farm assessment audits | `GroupAuditModel` | Current |
| Certificate list, farm/cellar name column, mPDF download | `Certificates`, README | Current |
| Probation list (current, history, all), limited staff edit, daily `probation:process` | `Probation`, `ProbationLifecycle` | Current in code. Scheduler on production is Unknown |
| Document categories, upload, UUID download, inline PDF | `DocumentManagement`, `Admin\DocumentManagement` | Current |
| Laboratory analysis results | `LabAnalysis` | Current |
| SO2 reports | `So2Reports`, `So2Access` | Current |
| Reports dashboard | `Reports`, `Admin\ReportsController`, `knowledgeBase/IPW_REPORTS_DASHBOARD_README.md` | Current |

### Operations and developer tools

| Feature | Where | Status |
|---|---|---|
| System settings, cron records, public holidays, email logs | `SystemSettings` | Current |
| Email send helper and email templates | `mail_helper.php`, `Email`, `EmailTemplateModel` | Current |
| Email open pixel | `EmailPixelTracking` | Current |
| Cron HTTP entry | `CronJobs` | Current |
| Site health and server monitoring pages | `SiteHealth`, `ServerMonitoring` | Current |
| Request timing logs | `RequestTiming` | Current |
| CRUD generator, DB table viewer, menu management | `Controllers/Developers/` | Current. These are staff/developer tools. Whether they are reachable in production is Unknown |
| ChatGPT page calling OpenAI completions | `ChatGPT`, `chatgpt_helper.php` | Current code path. Not confirmed as a member-facing IPW feature |
| PHPUnit suite `Scoring` plus SonarQube on `main` and pull requests | `bitbucket-pipelines.yml`, `phpunit.xml.dist` | Current |
| Migration sync and one-class migrate commands | `SyncMigrations`, `RunMigration`, `MIGRATION_DEPLOYMENT_GUIDE.md` | Current |
| Playwright / browser notes | `BROWSER_TEST_RESULTS.md`, `FRONTEND_TESTING_PLAN.md`, `tests/e2e-nav-audit` | Documented test material. Not re-run for this knowledge update |

## Recently changed (inspected history only)

The clone used for this review contains 80 commits, from 2026-08-27 through 2026-09-28. Older history was not loaded.

| Date | Commit | Subject | Feature effect |
|---|---|---|---|
| 2026-09-28 | `054883d` | auditor score alignment | Scoring. Latest `main` |
| 2026-09-23 | `eda1a74` | pipeline fix | CI. This was the onboarding snapshot |
| 2026-09-22 | `8e26917` | usermanagement updates | Users |
| 2026-09-15 | `1d6eba9` | loosen probation rules | Probation |
| 2026-09-15 | `847bbec` | sawis sync update | SAWIS sync |
| 2026-09-14 | `071ad4c` | Align Scoring PHPUnit with compact 199/285 (70%) display | Scoring display vs stored pass mark. See PRD FR-004 |
| 2026-09-09 | `e876aec` | score & filter fixes | Scoring |
| 2026-09-08 | `6819dcf` | sawis activation / note save | SAWIS and notes |
| 2026-09-07 | `6c0e488` | performance and probation changes, permission enhancement | Probation and RBAC |
| 2026-09-03 | `db3330f` | large document set handling | Documents |
| 2026-09-02 | `56f5963` | mobile & privacy fixes | Layout and access |
| 2026-09-01 | `9ca7620` | match IPW certificate PDFs to the legacy layout and farm names | Certificates |
| 2026-09-01 | `a5823ee` | ownership transfer fix | SAWIS number transfer |
| 2026-08-31 | `1dc0392` | show FARM/CELLAR without rewriting form_desc | Evaluation display |
| 2026-08-28 | `2a6dfb6` | Member Rbac | Member permissions |
| 2026-08-28 | `fc6b8f6` | Farm / Cellar Name column on certificates | Certificates |
| 2026-08-28 | `f1d74f5` | data leak fix | Object-level access |

Commit subjects are evidence of intent at the time of the commit. The files cited in the current-feature tables are the evidence of what the tree contains now.

## Planned, from repository documents, not confirmed as done

From `scope/IPW_Audit_Platform_Scope.md` (January 2025, status “Ready for Client Review”):

| Item | What the scope asked for | What the 2026 tree shows |
|---|---|---|
| Three audit types | Self-evaluation, scored IPW audit, non-scored SEV/SAV | Application types 0, 1, and 2 exist. Status 40 is still labelled SEV as well |
| Automatic auditor copy on producer submit | Lock the producer form and copy it for the auditor | Not found in `MemberEvaluations`. Remains Planned |
| Consolidated history across years, documents, scores, and relationships | One history page | Group history exists (`users/editGroup/{id}/history`). Whether it meets the full scope list was not verified. Partial |
| Documents linked to audit type and year | Upload organisation | Storage is by calendar year and month under `public/assets/content/audit/`. A category mapping was added in August 2026 commits. Link to audit type is Unknown |
| Weekly automatic BIS sync | Explicitly out of that scope; manual sync continues | Manual group sync and `SyncSawisFarms` exist. A weekly scheduler was not found. Planned if someone still wants it |
| Mobile-specific redesign | Out of that scope | September 2026 commits mention mobile-friendly adjustments. A separate mobile product was not found |

`AGENT_PLAN.md` is a completed defect plan for SEV submit rollback, not an open feature.

## Legacy descriptions (do not treat as the live feature list)

| Document | Why it is legacy |
|---|---|
| `knowledgeBase/Overview.md` | Sitemap is `livesite/*.php` and `system/*.php` |
| `knowledgeBase/RolesAndInteractions.md` | Same legacy URLs, including `/login.php` and `/bwi/memberlist.php` |
| `knowledgeBase/Certification.md` | Describes `certificate`, `certificate_type`, and `certificate_history` tables and biodiversity certificates. The CI4 certificate flow found here generates PDFs from passed group evaluation forms (`Certificates`, mPDF), not from those three tables |
| `knowledgeBase/BusinessRules.md` | Generic rules (weights sum to 100%, virus scan, encryption at rest) that conflict with `ScoringRules` or were not found in code |
| `overview.md` | Generic Transactflow starter |
| `BIS_INTEGRATION_README.md` | Analyses `system/BIS.php` and `livesite/` queries. Still useful as a catalogue of BIS SQL the business needed. The CI4 client is `BisService` |

## Deprecated or removed in the current tree

| Item | Evidence |
|---|---|
| MFA / 2FA routes | Commented in `Routes.php` |
| Per-row score recalculation button on the submissions list | Comment in `MemberEvaluations` says Bulk Score Check replaced it. Endpoint kept |
| Salesforce connect | Function body commented out |
| Africa’s Talking SMS send | Function body commented out |
| Direct BIS ODBC as the default `BisService` path | `$this->useApi = true` is forced. The ODBC constructor arguments remain in the class |

`scope/FEATURE_VERIFICATION_SUMMARY.md` says the rewrite has feature parity with `ipw.co.za` and that missing functionality was implemented. That document is a point-in-time verification note. It was not re-executed for this Silicon Ark update. Parity with the live site is **Unknown / Requires Confirmation** as of 2026-10-11.