# Features — laravel

Evidence date: 2026-10-10.

Source: `git@bitbucket.org:overdrive/laravel.git`, `master` at `10c0b9fa` (2023-08-15, "Restore prod .env").

No earlier Silicon Ark features file exists. "Current" means present and routed or scheduled at that revision. Commented routes are listed under removed-from-routing. Nothing in git is newer than 2023-08-15.

## Current features

### F-01 — HelloChoice / Freshtrade market shell

| | |
|---|---|
| Status | Current |
| Behaviour | Production name Freshtrade, site name HelloChoice, URL `https://market.hellochoice.co.za`. Signed-in users land on the dashboard |
| Provenance | Implemented |
| Evidence | Production `.env` keys `APP_NAME`, `APP_URL`; `config/application.php` `site_name`; `routes/web.php` `GET /` |

### F-02 — Registration, activation, and password reset

| | |
|---|---|
| Status | Current |
| Behaviour | Buyer, seller, and both registration. Token activation. User-info steps. Laravel `Auth::routes()` plus explicit forgot-password screens for the site and for admin |
| Provenance | Implemented |
| Evidence | `routes/web.php` register and activate routes; `app/Http/Controllers/Auth/` |

### F-03 — Role-based web session

| | |
|---|---|
| Status | Current |
| Behaviour | Roles admin, seller, buyer, guest_user, both. Middleware `user`, `admin`, and Spatie `role` |
| Provenance | Implemented |
| Evidence | `config/application.php` role keys; `app/Http/Kernel.php`; `AuthUserAccess`; `AuthAdminAccess` |

### F-04 — Marketplace browse

| | |
|---|---|
| Status | Current |
| Behaviour | Lot list, live lots, bin lots, packaging, products, preferences, wishlist, branded sellers, lot description |
| Provenance | Implemented |
| Evidence | `MarketPlaceController` routes inside the `user` group; views under `resources/views/marketplace` |

### F-05 — Auction bidding and proxy bids

| | |
|---|---|
| Status | Current |
| Behaviour | Bid now, proxy bid, cancel proxy bid, live bidding. Minute jobs `ProxyBid:proxy_bid` and `PriorProxyBid:prior_proxy_bid` when `APP_ENV` is not `dev` |
| Provenance | Implemented |
| Evidence | Buyer route group; `app/Console/Commands/ProxyBid.php`; `PriorProxyBid.php`; `app/Console/Kernel.php` |

### F-06 — Bin cart and bin offers

| | |
|---|---|
| Status | Current |
| Behaviour | Cart add, remove, save, thank-you page. Offer create, accept, decline, delete on web and API. Cart quantity cleanup every minute |
| Provenance | Implemented |
| Evidence | `LotBidController` bin routes; `Api\BinLotOfferController`; `BinQuantityRemove` |

### F-07 — Seller lot publishing

| | |
|---|---|
| Status | Current |
| Behaviour | Bulk bid lots, bin lots, agent loads, POA lots, calculator, templates, relist, images and note documents |
| Provenance | Implemented |
| Evidence | `role:seller\|both` group; `BulkLotController`, `BinBulkLotController`, `AgentLoadController`, `PoaLotController`, `CalculatorWidgetController` |

### F-08 — Special offers, donations, and relief dashboard

| | |
|---|---|
| Status | Current |
| Behaviour | Create and manage special/donation lots. Buyers reserve, accept, or reject on `/relief_dashboard`. Admin has a relief dashboard too |
| Provenance | Implemented |
| Evidence | `SpecialLotController`; `DashboardController@releifDashboard`; `relief_partner_type` |

### F-09 — Orders, tenders, and buyer requests

| | |
|---|---|
| Status | Current for list, view, approve/reject, and messages. Create routes for several of these are commented out |
| Behaviour | `/order`, `/tender`, `/request` inside `user` |
| Provenance | Implemented for the uncommented routes |
| Evidence | `routes/web.php` around the order, tender, and request blocks |

### F-10 — Profiles, documents, trade alerts, bulletin preferences

| | |
|---|---|
| Status | Current |
| Behaviour | Personal and company profile, logos, certificates, my products, trade alerts, listing templates, daily bulletin flags, close account |
| Provenance | Implemented |
| Evidence | `UserController`, `SettingController`, matching API methods |

### F-11 — Reports

| | |
|---|---|
| Status | Current |
| Behaviour | Seller: listing summary, bidding, seller transactions, bin sales. Buyer: purchase summary, buyer transactions, distribution. Agent-load report is on `role:seller\|buyer\|both` |
| Provenance | Implemented |
| Evidence | `ReportController` routes |

### F-12 — Transport directory

| | |
|---|---|
| Status | Current |
| Behaviour | Web grid for seller, buyer, or both. API `transportation_directory` and `transport_list`. Admin maintains transporters, routes, truck sizes, and loading points |
| Provenance | Implemented |
| Evidence | `TransportController`; `Api\TransportationDirectoryController`; admin `TransporterController`, `TruckSizeController`, `LoadingPointController`. Migrations dated 2022-06-23 |

### F-13 — Admin console

| | |
|---|---|
| Status | Current |
| Behaviour | Login at `/admin/login`. Catalogue (product through bidding schedule), users, lots of each type, orders, notifications, settings, user stats, marketplace setup, platform templates |
| Provenance | Implemented |
| Evidence | Admin route group from `routes/web.php` line 630; `app/Http/Controllers/Admin/` (48 controllers) |

### F-14 — Mobile API

| | |
|---|---|
| Status | Current |
| Behaviour | Prefix `/api`. Public login, register, master data, forgot password. JWT group for trading and profile. Throttle 1000 requests per minute |
| Provenance | Implemented |
| Evidence | `routes/api.php`; `app/Providers/RouteServiceProvider.php`; `config/auth.php` guard `api` driver `jwt` |

### F-15 — Push notifications

| | |
|---|---|
| Status | Current |
| Behaviour | Device token save, unread counts, notification list, FCM test endpoint, custom notification endpoint. `sendNotification:send_notification` every minute. Categories: Message, Update, Both, Urgent. Types: normal and trade alert |
| Provenance | Implemented |
| Evidence | `Api\NotificationController`; `app/Console/Commands/sendNotification.php`; `config/fcm.php` |

`POST /api/send_custom_notification` and `GET /api/send_test_notification/{id}` are outside the JWT group.

### F-16 — Firebase live state

| | |
|---|---|
| Status | Current |
| Behaviour | Four events update Firebase paths for lots, bids, bin quantities, and special-donation status |
| Provenance | Implemented |
| Evidence | `app/Providers/EventServiceProvider.php`; `app/Events/`; `app/Listeners/`; `resources/views/firebase_connection.blade.php`, `firebase_lot_bid.blade.php` |

`GET testing` (inside the file, not commented) loads lot id 1 and fires `LotUpdateFirebase`. It has no auth middleware.

### F-17 — Scheduled maintenance and public trigger URLs

| | |
|---|---|
| Status | Current when `APP_ENV` is not `dev` |
| Behaviour | See the schedule table in `technical-documentation.md`. Matching `Route::any` URLs call `Artisan::call` with no auth middleware |
| Provenance | Implemented |
| Evidence | `app/Console/Kernel.php`; `routes/web.php` lines 39–115 |

### F-18 — PDFs and legal files

| | |
|---|---|
| Status | Current |
| Behaviour | TCPDF bulletin (`UserController@dailBulletingPdf`, `SendDailyBulletinMail`, `SpecialLotController`). Inline PDFs for six legal filenames under `uploads/pdf/` |
| Provenance | Implemented |
| Evidence | `app/Library/tcpdf`; `config/application.php` `pdf_files` |

### F-19 — WordPress lot feed

| | |
|---|---|
| Status | Current as an unauthenticated route |
| Behaviour | `GET /get_all_market_lots` |
| Provenance | Implemented. The comment is the only statement that a WordPress site calls it |
| Evidence | `routes/web.php`; `MarketPlaceCommonController@getAllMarketLots` |

### F-20 — Excel / customer CSV settings

| | |
|---|---|
| Status | Current as configuration and the `maatwebsite/excel` dependency |
| Behaviour | Customer CSV tax, discount, store, and product-code prefixes `BID-`, `BIN-`, `RELIEF-` are in `config/application.php`. `config/excel.php` exists |
| Provenance | Implemented configuration. The export screens were not each opened in this pass |
| Evidence | `composer.json`; `config/application.php` `customer_csv_*`; `config/excel.php` |

### F-21 — Online presence

| | |
|---|---|
| Status | Current |
| Behaviour | `UpdateOfflineUser` every minute. `OnlineUser` and `UserHistory` use connection `mysql2`. Admin user stats show login history and online ids. Ajax interval `user_online_offline_ajax_second` = 3000 |
| Provenance | Implemented |
| Evidence | `app/Models/OnlineUser.php`; `app/Models/UserHistory.php`; `UpdateOfflineUser.php` |

## Present in the tree, not a product feature

### F-22 — Laravel Mix / Vue example

`webpack.mix.js` compiles `resources/assets/js/app.js` and `app.scss`. `app.js` registers only `example-component` and mounts Vue on `#app`. Trading screens are Blade views. Provenance: **Implemented** scaffold. Whether any Blade layout still has `#app` was not confirmed.

### F-23 — Example tests

`tests/Feature/ExampleTest.php` expects `GET /` to return 200. `tests/Unit/ExampleTest.php` is the framework example. No project `phpunit.xml`. Provenance: **Implemented** files that do not describe the market.

### F-24 — `check.php`

The file body is `phpinfo()`. Provenance: **Implemented**. It is reachable if the web root serves the repository root.

### F-25 — Second Composer manifest

`bcomposer.json`, `bcomposer.lock`, `BAK_composer.lock`, and `bvendor/` sit beside `composer.json` and `vendor/`. The backup manifest does not require JWT Auth or FCM. Provenance: **Implemented** files. Which tree production autoloads is **Unknown**. CodeDeploy copies source `/`, so both trees would be deployed.

## Commented out or not scheduled

These are in the source and are not active routes or are not on the schedule.

| Item | Evidence | Status |
|---|---|---|
| FCM `/testing` closure | `routes/web.php` block comment above the live routes | Not registered |
| `send_mail` closure | Commented `Route::any('send_mail'...)` | Not registered. The command is still scheduled |
| Company-code maintenance URLs | Commented routes on `LoginController` | Not registered |
| Old `/lot/add`, `/lot/edit`, `/lot/grid`, `/lot/approve` | Commented inside the seller group | Not registered. Newer `/bulk_lot/add_new` is registered |
| Tender and order create/withdraw routes | Commented in buyer and seller groups | Not registered |
| Feedback page | `//Route::get('/feedback'...)` | Not registered. `FeedbackController.php` still exists |
| Seller location screens | Commented in the buyer group | Not registered. Admin `SellerLocationController` is registered |
| `SoftClose:soft_close` | Commented in `Kernel::schedule` and in `$commands`. Class file remains. Public URL `extend_soft_close` still calls it | Not scheduled. Still reachable by HTTP |
| `CreateMarketplaceFilterPdf` schedule | Commented. Comment says Monday and Wednesday. The commented code uses `days([1,4])` at `07:00`, which is Monday and Thursday | Not scheduled. Public URL still calls it |
| `UpdateBinLotStatus` | Command file and public URL. Not referenced in `Kernel::schedule` | HTTP only |
| `DeleteLotBinCart` | Command file and public URL. Not on the schedule | HTTP only |

`RemoveTempMyProducts` is scheduled daily and is not given a public URL. `routes/web.php` has `remove_temp_images` but not a my-products URL.

## Planned

No roadmap, TODO issue list, or "planned" document is in the repository. Commented routes are not treated as an approved backlog.

## Recently changed

The only change on `master` after the `local-dev` merge is `10c0b9fa` ("Restore prod .env") plus the merge commit's `.env`, `DEV.env`, removal of `BAK.env`, and committed bootstrap cache. Application PHP is the same as `local-dev` at `95f5a2e4` for the paths compared in `project-plan.md`.

`ad78d7a6` is labelled "NOT PROD READY". The following day's commit restores a production `.env` (`APP_ENV=production`, `APP_DEBUG=false`).

## Deprecated or removed

Nothing in git history shows a removed product area, because history is six commits and the application code does not change between `local-dev` and `master`. Soft-deleted Eloquent models (`Lot`, `BulkLot`) are a data feature, not a removed feature.

`Api\AuthControllerOld.php` is an extra controller. No route in `routes/api.php` points at it. Provenance: **Implemented** file, unused by the route file that was read.