# Business rules — media.accreditations.sarugby.online

Evidence date: 2026-10-09. Source: `master` at `773e00f`.

Rules below are what the code enforces. They are not a signed business policy. Each rule is **Inferred** from implementation unless the entry says **Documented** (copy in a view or email). Where the collection desk and the imported supplier code disagree, both are recorded.

No business-rules document exists in the source repository.

## Access

**BR-001 — Shared PIN opens one event.** **Inferred.** A single shared secret in `LoginController::indexAction` is the only check on the login form. Success stores event id `63` and no user id. Failure does not start a session event.

**BR-002 — Dashboard requires that event session.** **Inferred.** `IndexController` and `PermitsController` redirect to `/login/` when `EVENT.EID` is missing. They do not check a user role.

**BR-003 — Company profile and staff require a company login identity.** **Inferred.** `CompanyController` and `UsersController` redirect to `/login/` unless `Zend_Auth` has an identity. The PIN form never creates that identity, so those rules are not exercised by the collection login.

**BR-004 — Logout ends the desk session.** **Inferred.** `logoutAction` destroys the whole session, including `EVENT`.

**BR-005 — Session cookie lifetime is 10 days.** **Inferred** from `resources.session.cookie_lifetime = 864000` in `application.ini`. Whether the server session store matches that lifetime is **Unknown / Requires Confirmation**.

## Collection

**BR-006 — The list is the session event only.** **Inferred.** `getApplications` filters `Accreditation_Collections.AC` to the session event id. The UI cannot switch event. The header text "HSBC Cape Town Sevens - Media" is **Documented** in `default.phtml` and is not loaded from the event row.

**BR-007 — People are grouped by company id.** **Inferred.** Rows sharing `ID` become one company. The company label is `organisation`. The person count is the number of rows in the group. The collected count is how many of those rows have `ServiceStatus` `8` when the page is loaded.

**BR-008 — Only status 7 can be collected from the screen.** **Inferred** from `getapplicants.phtml`. Status `7` is labelled "Ready To Collect". Status `8` is labelled "Collected". Every other value is labelled "Pending" and has no Collect button.

**BR-009 — Collect writes status 8 and a timestamp.** **Inferred.** `collectAction` sets `Status` from the request (the button sends `8`), `LastUpdate`, and `Collected` to the current time, on `Accreditation_Applicants_Services` matched by `AASID`. It does not check the previous status or the event id. The server will accept another status if a client posts one.

**BR-010 — Collect is immediate.** **Documented** by the button label "Collect" and the absence of a confirm step. The unused modal on the home page talks about cancelling a permit, not about collection.

**BR-011 — Search matches name, reference, organisation, ID number, role, or barcode.** **Inferred** from the WHERE clause in `getApplications`. An empty search returns every row for the event.

## Status codes seen in this repository

| Code | Where it is written or shown | Label in this app |
|---|---|---|
| Service status `7` | Shown on the collection list. Not written here | Ready To Collect |
| Service status `8` | Written by Collect | Collected |
| Permit `Status` `2` | `PermitsController` add and duplicate, if those actions ran | Not labelled on the collection screen |
| Permit `Status` `5` | `PermitsController::cancelAction`, if that action ran | Not labelled on the collection screen |
| `CompanyEvents.Status` `2` | `RegisterController` when a company is created, against event `44` | Not labelled |

**Unknown / Requires Confirmation:** the official status catalogue, and which application sets service status `7`.

## Registration and supplier rules (imported code)

These are **Inferred** from controllers that the collection PIN does not fully enable. Do not treat them as rules of the media desk until a person confirms they still apply on this host.

**BR-012 — A new company is unique by registration number.** `RegisterController` looks up the registration number before insert.

**BR-013 — A new member is unique by ID number and email.** Same action.

**BR-014 — The first user of a new company is Administrator.** Role string `Administrator` is set in code, not chosen on the form.

**BR-015 — Country SOUTH AFRICA uses ID type 1. Any other country uses ID type 2.** Exact string match on `Country`.

**BR-016 — New companies are attached to event 44 with status 2.** This is not event `63`. **Requires Confirmation.**

**BR-017 — Member passwords are stored as md5.** Reset and staff create do this. The reset email contains the new password in clear text. **Documented** in the email body built in `LoginController::resetAction`.

**BR-018 — Allowing login generates a password only when login was previously off.** `UsersController::profileAction` generates a password when `AllowLogin` is posted and the stored value is `0`.

**BR-019 — Staff types.** **Documented** as the view list: Administrator, Director, Management, Operations, Driver, Technician, General Staff.

**BR-020 — Delivery permits versus work permits.** **Documented** in the FAQ: a delivery permit is for deliveries only, not longer than 2 hours, and is limited in access areas. A work permit is for contracted work and requires a health and safety file. This FAQ is supplier copy, not media-accreditation copy.

**BR-021 — A new permit would be status 2 for the session event.** **Inferred** from `addpermitAction` and `duplicatepermitAction`. Those actions also require a company identity the PIN does not set, so the rule does not run on the desk path.

**BR-022 — Cancelling a permit would set status 5.** **Inferred** from `cancelAction`. Same identity gap.

## Mail

**BR-023 — Accreditation mail is sent as accreditation@sarugby.co.za.** **Documented** in `setFrom` and in email HTML. SMTP host is `mail.sarugby.co.za`. Enquiries in the templates use the same address. Registration contact centre number in the permit email footer is `+27219287000`.

**BR-024 — Password-reset mail tells the recipient to contact SA Rugby if they did not request the reset.** **Documented** in `forgotAction` body. Sign-off is "SA Rugby Event Administration".

## Conflicts to confirm

1. Collection event id is `63`. Company registration writes event `44`.
2. Login page title says load-in and load-out. The working screen is media accreditation collection. The FAQ is about supplier vehicle permits.
3. The PIN is not a company login, but several controllers still require a company login.
4. `application.ini` turns display errors off. `public/index.php` and controllers turn them on.