# Project plan — members.mypass.zone

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/members.mypass.zone.git`.

Inspected revision: `master` at `7268c97` (2022-06-24 07:32:54 +0200, message "Initial commit"). That commit is `origin/HEAD`. It is the only commit on `master`. There are no other branches on the remote that this clone fetched.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The running application is **SA Rugby — Load-in and Load-out**, a supplier portal. A company registers, confirms an email address, signs in, and requests vehicle permits (load-in and load-out) for an event. Signed-in users see a dashboard, a company profile, staff, and an FAQ.

The authenticated layout title is "SA Rugby - Load-in and Load-out". Mail is signed "SA Rugby Event Administration". The live From address is `accreditations@sarugbyevents.co.za` with subject "BIL 2021 Notification". Older From addresses on `sarugby.co.za` are left in comments.

Provenance: **Implemented** (`application/layouts/default.phtml`, `RegisterController`, `LoginController`, `PermitsController`).

The repository name is `members.mypass.zone`. The product copy, the registration link host, and the CodeDeploy destination are `supplier.sarugby.online`. No screen in this tree is titled MyPass, and no controller implements a member-card or membership product under that name. Whether this tree was ever served on the hostname `members.mypass.zone` is **Unknown / Requires Confirmation**.

Silicon Ark already documents two relatives:

- `supplier.sarugby.online/` — the same supplier portal at `6f0e6c2` (2021-04-29). This repository is a later single-commit snapshot of that product, with the differences listed below.
- `track.mypass.zone/` — an operations dashboard on a different host. It is not this application.

## What changed relative to the 2021 supplier tree

These differences are visible in this repository. They are **Implemented** here. They are not a claim that the 2021 tree was edited in place; this git history is one commit.

| Topic | This repository (`7268c97`, 2022-06-24) |
|---|---|
| History | One commit, message "Initial commit". No author trail inside the repo. |
| Database host | `localhost`. Database name remains `teamwizz_SARU`. |
| Outbound mail | `smtp.office365.com`, port 587, TLS. From `accreditations@sarugbyevents.co.za`, display name "Accreditation - BIL 2021", subject "BIL 2021 Notification". The older `mail.sarugby.co.za` block is commented out. |
| Event picker | The authenticated layout shows a live `<select>`: HSBC Cape Town Sevens (61), Kyalami 9 Hour (62), The Sun Met 2020 (66). The same control on the dashboard body is commented out. |
| Login event | A successful login still writes session `EVENT.EID` = 61. |
| Registration event | A new company is still linked to event id 44. |
| Deploy path | CodeDeploy still copies the tree to `/mnt/data/www/html/sarugby.online/supplier.sarugby.online/`. |

## History

| Commit | Date | Message |
|---|---|---|
| `7268c97` | 2022-06-24 | Initial commit |

No later commits exist on `master`. Pipelines are defined for branches `qa` and `prod`. Those branches are not present on the remote this clone fetched. Whether they ever existed for this repository is **Unknown / Requires Confirmation**.

## Objectives (inferred; no written plan is in the repository)

No README, project plan, or requirements document is in the repository. The following are **Inferred** from screens, emails, and the FAQ:

- Let a supplier company register and keep a company profile, including B-BBEE level and company type.
- Let that company keep a staff list and request a vehicle permit for each day a vehicle enters the venue.
- Show the company its own permits and their status.
- Tell suppliers the venue rules (health and safety file, printed permit, identification) even where this application does not enforce them.
- Deploy the PHP tree with AWS CodeDeploy from Bitbucket Pipelines.

## Scope that is in this repository

- Public registration of a company and its first user, with email confirmation.
- Email and password login, logout, forgot-password, and reset. Passwords are stored as MD5.
- Dashboard of the signed-in company's permits for the session event.
- Create, edit, duplicate, and cancel a permit. FAQ page.
- Company profile and company logo upload.
- Staff list, add, and profile, including a photo upload.
- An event `<select>` in the authenticated header for ids 61, 62, and 66.
- PDF stream of a permit by fetching HTML from footprintapp.net and rendering it with Dompdf.
- Deploy description for AWS CodeDeploy via Bitbucket Pipelines on branches `qa` and `prod`.
- A Plesk "domain default" page at the repository root (`index.html`), plus Plesk script test pages under `test/`.
- A Limitless admin-theme dump under `default/`, `default.zip`, and `public/html/`.

## Scope that is not established

- Whether anything is still deployed, and on which hostname (`members.mypass.zone`, `supplier.sarugby.online`, or another).
- Which event a supplier should work against. Login writes 61, registration writes 44, and the header offers 61, 62, and 66.
- Where permits are approved, declined, checked in, delayed, or checked out. This repository displays those statuses and does not set them. New requests are inserted with status `2`. Cancel sets status `5`.
- The SQL behind `CompaniesLogin` and the other queried names (`Permits_view` is used by permit reads). Definitions are not in this repository.
- SonarQube. The onboarding brief listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master` at `7268c97`. Provenance: **Unknown** — they may have been untracked on the scan host.
- `public/wp-content` and `public/wp-includes` are present. No WordPress bootstrap (`wp-config.php`, root `wp-load.php`) was found as the application entry. Whether those directories are a partial WordPress tree or leftover files is **Unknown / Requires Confirmation**.

## Architecture (as implemented)

```text
Browser
  -> root .htaccess (rewrite into public/ unless the URI already starts with /public/)
  -> Apache (public/.htaccess rewrites missing files to public/index.php)
  -> Zend_Application 1.11.10 (APPLICATION_ENV, default production)
  -> default module controllers
  -> Zend_Db (pdo_mysql, host localhost, database teamwizz_SARU)
  -> views (Limitless / Bootstrap under public/assets and public/global_assets)
```

`Default_Bootstrap::_initForceSSL` redirects any request whose port is not 443 to `https://` on the same host. The root `.htaccess` HTTPS and www rules are commented out.

CodeDeploy (`appspec.yml`) copies `/` to `/mnt/data/www/html/sarugby.online/supplier.sarugby.online/` and sets owner and group `apache`. Hooks install `httpd`, stop it, delete old CodeDeploy archives, and start `httpd`.

External calls the code makes or prepares:

| System | Direction | Where |
|---|---|---|
| MySQL `teamwizz_SARU` on `localhost` | Read and write | `application/configs/application.ini` |
| SMTP `smtp.office365.com:587` as `accreditations@sarugbyevents.co.za` | Outbound mail | Login, Register, Index, Permits controllers |
| `https://www.footprintapp.net/pdf/getpermit/id/{id}` | Server fetches HTML; Dompdf renders landscape A4 | `IndexController::getpermitpdfAction` |
| `https://footprintapp.net/email/send` | Prepared POST of email fields. The permit-create path calls `sendMail` and leaves `postEmailToFp` commented at the call site | `PermitsController::postEmailToFp` |

Credentials for the database and the mailbox are stored in the repository. The values are not repeated in Silicon Ark. Human review should treat them as exposed.

## Current status

The repository is dormant. The only commit is 2022-06-24. Pipelines do not run on `master`. The deploy path still names `supplier.sarugby.online`, while the git repository is named `members.mypass.zone`.

## Milestones

No milestone plan is in the repository. The only observable milestone is the single commit that imported this tree.

## Human confirmation

1. Was `members.mypass.zone` a live hostname for this tree, or is the repository a renamed copy of the supplier portal?
2. Is the site still deployed, and does CodeDeploy still target `/mnt/data/www/html/sarugby.online/supplier.sarugby.online/`?
3. Which event id is correct: 61 (login and "HSBC Cape Town Sevens"), 44 (registration), 62 (Kyalami 9 Hour), or 66 (The Sun Met 2020)?
4. Should the Office 365 mailbox and the localhost database host replace the 2021 supplier configuration, or is this snapshot a local or staging copy?
5. Confirm that the committed database password, mailbox password, and login override should be rotated. The values are not copied into this document.