# Features — members.mypass.zone

Evidence date: 2026-10-09. Source: `master` at `7268c97` (2022-06-24, "Initial commit").

Status words: **Current** means the code path is present on `master`. **Dormant** means the repository has not changed since that single commit; whether any host still serves it is Unknown. **Unused** means the file exists and no routed controller in this repository uses it as a feature. **Documented only** means the text states the rule and the code does not enforce it.

There is no commit history of features being added or removed. "Recently changed" cannot be established inside this repository. The comparison with `supplier.sarugby.online` (Silicon Ark, revision `6f0e6c2`) is a cross-repository observation, not a git diff of this repo.

## Current (implemented, dormant repository)

| ID | Feature | Where | Notes |
|---|---|---|---|
| F-001 | Login, logout | `LoginController`, `login/index.phtml` | Email and MD5 password against `CompaniesLogin`. An existing identity is sent to `/`. |
| F-002 | Login override | `LoginController::indexAction` | A hardcoded password loads the stored hash for the typed email. Value omitted. |
| F-003 | Forgot and reset password | `login/forgot`, `login/reset` | Reset link uses the current host. New password is MD5-stored and emailed in clear text. |
| F-004 | Company registration | `RegisterController`, `register/index.phtml` | Rejects a duplicate registration number, ID number, or email. Creates member, company (`Active` = 1), and a `Company_Events` row for event 44. |
| F-005 | Email confirmation | `RegisterController::validateemailAction` | Link host in the email is `supplier.sarugby.online`. Sets `AllowLogin` and `Email_Confirmed`. |
| F-006 | Dashboard | `IndexController::indexAction`, `index/index.phtml` | Staff count, permit count, event count, permits grouped by load type. Buttons: Request Permit, Add Staff. |
| F-007 | Request a permit | `PermitsController::createAction`, `addpermitAction`, `permits/create.phtml` | Inserts status 2 and emails the applicant. Subject "BIL 2021 Notification". |
| F-008 | Permit profile and edit | `profileAction`, `savepermitAction`, `permits/profile.phtml` | Company-scoped read. Edit does not change status. |
| F-009 | Duplicate a permit | `duplicatepermitAction` | New status-2 row. Read is not filtered by company. |
| F-010 | Cancel a permit | `cancelAction` | Sets status 5 and a cancel message. No email, despite the comment. |
| F-011 | Status badges | `index/index.phtml` | Pending (<4), Approved (4), Cancelled (5), Declined (6), Checked-In (7), Delayed (8), Checked-Out (9). |
| F-012 | FAQ | `questionsAction`, `Questions()` | Static SA Rugby / HSBC Sevens copy. |
| F-013 | Company profile | `CompanyController::profileAction` | Updates `Companies_Profile`. Lists B-BBEE levels, company types, countries. |
| F-014 | Company logo | `CompanyController::uploadAction`, `LoginController::companypicAction` | JPEG under `public/archives/companies/{CID}_image.jpg`. `companypic` does not require a session. |
| F-015 | Remote company image upload | `LoginController::uploadremotecompanyAction` | Writes an image for a posted company id. No session check. |
| F-016 | Staff list, add, edit, photo | `UsersController` | Roles listed in the controller. Photo under `public/archives/accreditation/{MID}_image.jpg`. |
| F-017 | Authenticated chrome | `application/layouts/default.phtml` | Title "SA Rugby - Load-in and Load-out". Links: Dashboard, Company, Staff, FAQ, My profile, Company Profile, Logout. |
| F-018 | Event selector | Layout `<select>`, `IndexController::updatesessionAction`, script in `index/index.phtml` | Options 61, 62, 66. Login still forces 61. The script is only on the dashboard view. |
| F-019 | Permit PDF | `IndexController::getpermitpdfAction` | Fetches HTML from footprintapp.net and streams Dompdf output. |
| F-020 | HTTPS redirect | `modules/default/controllers/Bootstrap.php` | Redirects when `SERVER_PORT` is not 443. |
| F-021 | CodeDeploy | `appspec.yml`, `scripts/`, `bitbucket-pipelines.yml`, `codedeploy_deploy.py` | Pipelines on `qa` and `prod` only. Destination path is `supplier.sarugby.online`. |
| F-022 | Error page | `ErrorController` | 404, not authorised, and generic application error. |
| F-023 | Office 365 mail | `sendMail` in Login, Register, Index, Permits | Replaces the commented `mail.sarugby.co.za` transport. |

## Present in the tree, not a routed product feature

| ID | Item | Where | Notes |
|---|---|---|---|
| F-024 | Plesk default page | Root `index.html`, `css/`, `img/`, `test/` | "Domain Default page". Root `.htaccess` rewrites into `public/` before this file is the site. |
| F-025 | Limitless theme dump | `default/`, `default.zip` (about 27 MB), `public/html/` | Demo HTML, not the supplier views. `default/` also contains names that look like extracted browser-cache files. |
| F-026 | Second layout | `application/layouts/layout.phtml` | Limitless demo markup (invoices, campaigns). `application.ini` selects layout `default`. |
| F-027 | SARU / Teamwizz models with no controller | `application/models/` Fixture, Squad, Tournament, MatchReport, food, news, unions, GIR, and others | Tables are declared. No controller in `application/modules` constructs them. |
| F-028 | Duplicate source files | `PermitsController - Copy.php`, `Copy of Fixture.php`, `index/Copy of index.phtml` | Not the routed names. |
| F-029 | Mismatched controller classes | `EventsController.php` declares `Companies_EventsController`. `OrgController.php` declares `Company_OrgController`. | The router will not load those class names from those file names. |
| F-030 | Empty actions | `AuthonController`, `OrganisationController`, `CompanyController::getmembersAction`, `IndexController::validateemailAction` | No behaviour. |
| F-031 | Older registration on Index | `IndexController::newcompanyAction` | Requires a session because of `init`. Confirmation URL points at `www.sarugby.online`. |
| F-032 | Footprint email POST | `PermitsController::postEmailToFp` | Implemented method. The permit-create call site uses `sendMail` instead. |
| F-033 | Mail test action | `PermitsController::emailtestAction` | Sends a fixed test body to a hardcoded personal address. Address omitted. |
| F-034 | WordPress directories | `public/wp-content`, `public/wp-includes` | Present. Not the application entry point. |

## Documented only (stated to the user, not enforced here)

| ID | Statement | Where it is written | What the code does |
|---|---|---|---|
| F-035 | Activation can take up to 48 hours and an administrator reviews the company first | Registration email | `Companies_Profile.Active` is set to 1 on insert. Email confirmation sets `AllowLogin` immediately. |
| F-036 | A delivery permit cannot exceed 2 hours | FAQ | Time in and time out are posted fields. No duration check in `addpermitAction`. |
| F-037 | A work permit requires a health and safety file on site | FAQ | No file upload or approval flag in this repository. |
| F-038 | Only one company administrator | FAQ | Staff add allows role Administrator with no count check. |
| F-039 | One permit per day per vehicle | FAQ | No uniqueness check on vehicle and date. |
| F-040 | Cancellations and changes close at 1pm for the next day | Permit email | Profile lock uses 13:00 the day before `RequestDate`. Create-screen dates use 12:00 the day before. The two cutoffs differ. |
| F-041 | Download the permit only after approval | FAQ | `getpermitpdfAction` does not read status. |
| F-042 | Event-day accreditation is a separate portal | FAQ, placeholder `[www]` | No accreditation application flow in this repository. |
| F-043 | Additional documents are required before the company can connect to an event | Registration email | No document checklist is enforced. |

## Not in this repository

| ID | Item | Note |
|---|---|---|
| F-044 | Permit approval, decline, check-in, delay, check-out | Labels exist. This code does not set statuses 4, 6, 7, 8, or 9. |
| F-045 | SonarQube project files | Named in the onboarding brief. Absent from `7268c97`. |
| F-046 | Automated tests of the application | `test/` is the Plesk FastCGI, PHP, and SSI sample pages. |
| F-047 | A MyPass member product | The repository name is the only occurrence of that identity found as a product name. |

## Cross-repository note

Relative to the Silicon Ark record of `supplier.sarugby.online` at `6f0e6c2`:

- **Changed in this tree:** database host is `localhost`; mail transport is Office 365 with a BIL 2021 subject; the header event selector is present and lists three named events.
- **Unchanged in substance:** registration, MD5 login, permit status 2 / 5, FAQ, CodeDeploy destination path `supplier.sarugby.online`, login event 61, registration event 44.

That comparison is **Inferred** from the two Silicon Ark evidence sets. It is not a line-by-line diff against the other git repository performed in this onboarding.