# Project plan — logintuto

Evidence date: 2026-10-10.

Source repository: `git@bitbucket.org:overdrive/logintuto.git`.

Inspected revision: `master` at `f679256` (2020-04-02, Uriel Balela, "all forms and dashboard"). `origin/HEAD` points at `master`. The scan-host path `~/projects/sonar_scan/repos/logintuto` was not on this machine. The tree below was read from that git revision.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

There is no README, ticket export, or prior Silicon Ark set. The only product description is the code itself.

**Inferred.** The repository is a PHP and MySQL login exercise: a person can sign up, log in, open a dashboard, change a username, email, and password, recover a password by email, and maintain a list of user-group names. The repository name `logintuto` and the hard-coded reset link under `/logintuto/` support that reading. Nothing in git states a product name, a customer, or a release.

Whether anyone still runs this application is **Unknown / Requires Confirmation**. The last commit is 2020-04-02.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `f679256` | 2020-04-02 | Only branch. 16 commits from 2020-02-25 to 2020-04-02 |

No other local or remote branches were present at inspection.

Authors on the commits:

- Uriel Balela (`uriel@overdrive.co.za`) — 15 commits, including the first commit (2020-02-25, "first commit") and the tip. One of those commits records the author name as `Uriel_Balela` with the same email (2020-03-23).
- Kagiso Malepe (`kagiso@overdrive.co.za`) — one commit, 2020-02-27, subject "session comment".

Commit subjects do not cite a tracker number.

## Objectives visible from the commit history

The subjects, in order, describe the work that landed. They are **Documented** only as commit messages, not as an approved plan:

1. 2020-02-25 — first commit.
2. 2020-02-27 — CSS and cleanup, a "reset repo" commit, then a session comment.
3. 2020-03-02 to 2020-03-03 — dashboard, CSS, a date function.
4. 2020-03-10 — user profile, new password, email, and username.
5. 2020-03-12 to 2020-03-13 — a user log table, in two commits.
6. 2020-03-17 to 2020-03-18 — insert, update, and select helpers, and `tblusergroup`.
7. 2020-03-23 — functions and a test commit.
8. 2020-03-25 — usage log.
9. 2020-03-27 — login usage and user-group display.
10. 2020-04-02 — "all forms and dashboard".

`php/functions.php` still contains the comments "email function still need to be added", "this must be changed !!!", "not implemented yet" (`UpdateTable`), and "works but not implement yet" (`SelectData`). `php/test.php` says it is "just for testing my functions before implementing them". Those comments are **Documented** inside the source. The mail path itself lives in `php/email.php`, which is called by `recover.php`.

## Scope that is in the tree

**Implemented** pages and endpoints:

- Login (`index.php`, `php/login.php`) and logout (`php/logout.php`).
- Sign-up (`signUpForm.php`, `php/signUp.php`).
- Password recovery email (`recover.php`, `php/email.php`) and the reset form (`newPassword.php`, `php/reset_pass.php`).
- A sidebar dashboard (`dashboard.php`) and a profile form that updates username, email, and password (`profileform.php`, `php/profile.php`).
- A user-group name list (`usergroup.php`, `php/usergroups.php`).
- A change log insert into `loguser` from the profile update (`SaveLog` in `php/functions.php`).
- A login-attempt insert into `tblloginuser` from `php/login.php`.

**Present in the tree, not linked from the login or dashboard navigation:**

- `welcome.php` — prints the session username and a logout link.
- `dashboard2.php` — a second sidebar. Its stylesheet link is `css/dashbaord.css`, which is not a file in the repository. Logout on that page is not an anchor to `php/logout.php`.
- `php/resetPassword.php` — an earlier recover form whose Ajax URL is `email.php` in the same directory.
- `php/test.php` and `php/updateuser.php` — a function probe and a `var_dump` of `$_POST['checkRead']`.

**Commented and not running:** hiding a dashboard item when `userGroup` is 1 (`dashboard.php`), and updating `blnRead`, `blnWrite`, and `blnNoAccess` on `tblusergroup` (`php/usergroups.php`, `usergroup.php`).

## System shape

One PHP application. Pages in the repository root render HTML and call scripts under `php/` with jQuery Ajax. Those scripts use `mysqli` against a database named `login` on `localhost`. Password recovery sends mail through PHPMailer over Gmail SMTP. There is no framework, no router, no API versioning, and no schema file.

```text
Browser
  index.php / signUpForm.php / recover.php / newPassword.php
  dashboard.php / profileform.php / usergroup.php
        |  jQuery $.ajax
        v
  php/login.php  php/signUp.php  php/email.php  php/reset_pass.php
  php/profile.php  php/usergroups.php  php/logout.php
        |  mysqli (plaintext SQL)
        v
  MySQL database "login"
        tables referenced: user, tblusergroup, tblloginuser, loguser

  php/email.php --SMTP--> smtp.gmail.com:587
```

`profileform.php` and `usergroup.php` `include` `dashboard.php`, so those responses start with the dashboard document and then a second HTML document.

## Major components

| Component | Where | Role |
|---|---|---|
| Login screen | `index.php` | Posts username and password to `php/login.php`. Redirects to `dashboard.php` when `$_SESSION['username']` is already set |
| Sign-up screen | `signUpForm.php` | Client checks, then posts to `php/signUp.php` |
| Recover screen | `recover.php` | Posts an email to `php/email.php` |
| Reset screen | `newPassword.php` | Reads `email` and `token` from the query string and posts them with a new password to `php/reset_pass.php` |
| Dashboard | `dashboard.php` | Sidebar. Only Profile and Logout have real targets |
| Profile | `profileform.php`, `php/profile.php` | Updates `user` and calls `SaveLog` |
| User groups | `usergroup.php`, `php/usergroups.php` | Lists, inserts, and renames `tblusergroup` |
| Shared SQL helpers | `php/functions.php`, `php/db.php` | Connection and insert/update/select/log helpers |
| Mail | `php/email.php`, `php/vendor/phpmailer` | Token mail |
| Static UI | `css/`, `js/`, `images/` | Bootstrap 4.4.1, Font Awesome 5.13.0, jQuery 3.4.1, two unused images |

## Milestones

No milestone document exists. The commit dates above are the only timeline. Status at `f679256`: the forms and the dashboard sidebar are in the tree; several helpers and the permission checkboxes are unfinished or commented out; there is no deployment definition in git.

## Known dependencies

- PHP with `mysqli`, `session`, and `random_bytes` (the token uses `random_bytes`, which requires PHP 7 or later). The exact PHP version is **Unknown / Requires Confirmation**.
- MySQL or MariaDB reachable as `localhost`, database `login`, user `root`, empty password (`php/db.php`).
- PHPMailer 6.1.4 (`php/vendor/phpmailer/phpmailer/VERSION`), required as `phpmailer/phpmailer` `^6.1` in `php/composer.json`. The `vendor` tree is committed.
- Browser libraries shipped in the repo: Bootstrap v4.4.1, Font Awesome Free 5.13.0, jQuery v3.4.1 (two files; see technical documentation), Popper.
- Google Fonts stylesheets (Open Sans on the dashboard and profile; Vidaloka and Viga only inside CSS files that no page links).
- Gmail SMTP (`smtp.gmail.com`, port 587, TLS). The username, From address, and password are literals in `php/email.php`. The password is omitted here.

## Current project status

**Implemented** as a single `master` snapshot from April 2020. No open branches, no README, no tests, no migration, no Docker file, no `bitbucket-pipelines.yml`.

`sonar-project.properties` and `sonarqube_scan.bat` were listed in the OVER-188 discovery snapshot of the scan-host working tree. They are not tracked at `f679256`. **Unknown / Requires Confirmation** whether they were uncommitted local files.

## Items that need a human

- Is logintuto a finished tutorial, an abandoned prototype, or something still deployed?
- What is the real MySQL schema (types, keys, nullability)? No `CREATE TABLE` is in git.
- Which PHP version was this written for? Several scripts compare a `mysqli_fetch_array` result to `0`.
- Should the Gmail credentials committed in `php/email.php` be rotated? The password is in git history.
- Were user-group flags (`blnRead`, `blnWrite`, `blnNoAccess`) an intended permission model?
- Are `dashboard2.php`, `welcome.php`, and `php/resetPassword.php` obsolete?