# Project plan — magus-core

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/magus-core.git`.

Inspected revision: `master` at `f806a7e` (2019-08-19, "update .htaccess"). Only branch: `master`. `origin/HEAD` points at `master`.

This plan describes what the repository contains. It does not decide what the product should become.

There is no prior Silicon Ark directory for this project. The only product statement in the repository is the README: "The core source code for the Magus PHP Application". The browser title in the active layout is "Magus Events - Accreditation Portal". User-facing email and page footers name SA Rugby. Provenance: **Documented** (README, `application/layouts/default.phtml`, registration and login views).

The local scan path named when this task was created (`~/projects/sonar_scan/repos/magus-core`) was not present on this machine. Evidence below is from a read-only clone of `origin/master`.

## Product

Magus is an internal web application for event accreditation. A signed-in user manages companies, people, venues, accreditation events, and vehicle load permits (work permits and delivery permits). Public registration creates a company and a user, then asks the person to confirm an email address.

The product copy identifies the operator as SA Rugby Event Administration (`accreditation@sarugby.co.za`, contact centre `+27219287000`, terms link `http://www.sarugby.co.za/`). Email validation links are built for `http://supplier.sarugby.online/`. Provenance: **Implemented** in `RegisterController`, `CompaniesController`, `LoginController`, and `PermitsController`.

Whether `supplier.sarugby.online` is still the live host is **Unknown / Requires Confirmation**. The last commit is 2019-08-19.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `f806a7e` | 2019-08-19 | Zend Framework 1 application plus a phpMyAdmin dump |

History is five commits, all on `master`:

| Commit | Date | Author | Subject |
|---|---|---|---|
| `ac7f1b8` | 2019-03-14 | Mandus Momberg | Initial commit |
| `08532b1` | 2019-03-15 | Andre Ferraz | Magus File (application, layouts, controllers, vendored Zend and Limitless) |
| `d5d0227` | 2019-03-15 | Andre Ferraz | magus DB (`admin_magus.sql`) |
| `9b5b3e2` | 2019-03-15 | Mandus Momberg | Updating Database Connection Details |
| `f806a7e` | 2019-08-19 | siliconoverdrive | update .htaccess (also edits `application.ini`) |

No other branches, tags, or pull-request history were present on the remote that was cloned.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives

No project plan, roadmap, or requirements document exists beyond the one-line README. The following objectives are **Inferred** from the layout title, navigation, controllers, and email copy:

- Let suppliers register a company and a user for SA Rugby event accreditation.
- Let staff list and edit companies, users, venues, company types, and user roles.
- Let staff open accreditation events and manage load-in / load-out permits for vehicles and occupants.
- Email applicants when they register, reset a password, or submit a permit.

## Scope

### In scope of this repository

- One Zend Framework 1 module (`application/modules/default`).
- Authenticated screens for companies, users, venues, events, accreditation list, company types, and user roles.
- Public screens for login, password reset, and company registration.
- Permit create/edit flows and a FAQ page of hardcoded questions.
- A phpMyAdmin dump of database `admin_magus` (generated 2019-03-15).
- Vendored Zend Framework 1.11.10 under `library/Zend`.
- Vendored Limitless admin theme under `public/limitless`, plus `public/assets`, `public/dist`, and `public/html`.

### Out of scope / not in this repository

- The mail server `mail.sarugby.co.za`. The application only contains an SMTP client.
- The site `supplier.sarugby.online` and `www.sarugby.co.za`. They appear as links, not as this codebase.
- Google Geocoding. `GeoController` calls the HTTP API. The Google account is not in this repo.
- Footprint (`https://footprintapp.net/email/send`). A method exists; the call from permit creation is commented out.
- "FS Stadium Management", named only as a comment on `Accreditation_List.PostExternal`.
- Automated tests, CI, Docker, Composer application dependencies, and a deployment pipeline. None are in the repository.
- Classes the controllers instantiate that were never committed. See technical documentation. Registration and several permit screens cannot run from this tree alone.

## System architecture

One PHP application. Apache rewrites requests that are not already under `/public/` into `public/`, and `public/.htaccess` sends non-file requests to `public/index.php`. That front controller boots Zend_Application with `application/configs/application.ini`.

```text
Browser
  -> Apache (.htaccess -> public/.htaccess -> public/index.php)
  -> Zend_Controller (module: default)
  -> Controller action
  -> Zend_Db_Table model
  -> MySQL (configured name: magus; dump name: admin_magus)
  -> default.phtml layout (Limitless theme) or no layout (login, register)
```

`PG_Controller_Plugin_LayoutPicker` sets the layout name to the current module name. The only module is `default`, and `application.ini` also sets `resources.layout.layout = default`, so the rendered shell is `application/layouts/default.phtml`.

Timezone is set in the front controller to `Africa/Johannesburg`. The INI locale is `af_ZA`. The layout language is `en` and the visible UI strings that were read are English.

## Major components

| Component | Path | Role |
|---|---|---|
| Front controller | `public/index.php` | Boot, timezone, photo path |
| Config | `application/configs/application.ini` | DB, session, layout, module directory |
| Layout | `application/layouts/default.phtml` | Shell titled "Magus Events - Accreditation Portal" |
| Navigation | `application/modules/default/views/scripts/menu/nevigation.phtml` | Sidebar actually included by the layout |
| Alternate menu | `.../menu/main_menu.phtml` | Not included by `default.phtml`. Links are mostly `#` |
| Models | `application/models/` | Zend_Db_Table gateways |
| Controllers | `application/modules/default/controllers/` | HTTP actions |
| PG plugins | `library/PG/` | Layout picker, uploaders, FPDF, leftover match-report code |
| Schema and data | `admin_magus.sql` | phpMyAdmin dump, 15 March 2019 |
| Theme | `public/limitless`, `public/assets` | Limitless admin UI (HTTrack comment dated 2018-02-02) |

## Milestones visible in git

There is no milestone plan. The repository arrived in one day of commits (14–15 March 2019) and received one configuration commit five months later (19 August 2019). Nothing in git describes a later phase.

## Known dependencies

- PHP with the `mcrypt` extension (`random_id` uses `mcrypt_create_iv`). The dump header records PHP 7.1.14 on the machine that exported the database. The application does not declare a PHP version.
- Apache with `mod_rewrite`.
- MySQL. Dump server version: 5.7.23 on Ubuntu 16.04. Configured adapter: `pdo_mysql`.
- Zend Framework 1.11.10, vendored.
- SMTP at `mail.sarugby.co.za` port 25.
- Google Maps Geocoding HTTP API, used by `GeoController` with a key committed in that file.
- Optional, and currently not called from the permit submit path: `https://footprintapp.net/email/send`.

## Current project status

**Frozen snapshot.** Last change 2019-08-19. No open branch, no tests, no pipeline.

The tree is not a complete runnable copy of the flows it starts:

- `RegisterController` constructs `Model_CompanyProfile`, `Model_AccreCompanyTypes`, and `Model_CompanyEvents`. None of those classes exist under `application/models/`.
- `PermitsController` also constructs `Model_CompanyEvents` and `Model_AccreditationList`. `Model_AccreditationPermits::getRef` does the same.
- `LoginController::forgotAction` constructs `Model_CompanyProfile` and does not use the variable. Password reset can still update `users` through `Model_UserProfile`.
- `UserProfile` queries tables and a view that are not in the dump: `CompaniesLogin`, `Jobtitles`, `Company_Events` (via `Model_Events`), and `AccriditationNewConfirmedApprovedStatus_view`.

`application.ini` at `f806a7e` points production and development at host `localhost`, database name `magus`, user `root`, empty password. The committed dump is database `admin_magus`. Those two names are not the same.

A maintenance banner in `public/index.php` is commented out, so the application boots instead of showing the outage page.

## Related Silicon Ark directories

`silicon_ark/magusEvents/` documents `git@bitbucket.org:overdrive/magusevents.git`, a WPF barcode scanner. That is a different repository and a different stack. This directory documents `magus-core` only. Shared words (accreditation, Footprint, SA Rugby) are not evidence that the two trees are one product.

`silicon_ark/evolve-infra/` documents `git@bitbucket.org:overdrive/evolve-infra.git`, a Docker Compose file for a local Magus stack. Its `magus-core` gitlink is pinned at `9b5b3e2`, not at this repository's tip `f806a7e`. The container files are not in this repository. The development database settings in `9b5b3e2` match that Compose file; the settings in `f806a7e` do not. See `evolve-infra/` for the container contract.

## Items that need human confirmation

- Whether this repository is the code that served `supplier.sarugby.online`, and whether that site is still in use.
- Which database name is authoritative: `magus` (INI) or `admin_magus` (dump).
- Whether the missing model classes lived in another repository or were never finished.
- Whether permit status numbers in `Permit_Status` or the different numbers in `EventsController` are the rule operators used. See business rules.
- The scan-host files `sonar-project.properties` and `sonarqube_scan.bat` are not in git.
- Committed secrets (SMTP password, Google API key, a login literal) and personal data inside `admin_magus.sql` need a security review. Values are not copied into this plan.