# Project plan — myPass-App

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/mypass-app.git`.

Inspected revision: `master` at `d8d04bf` (2022-06-22, "Merged in qrcode_scanner (pull request #2)"). That commit is `origin/HEAD`.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**MyPASS** is a mobile web app, installable as a standalone PWA, for an accredited person. After sign-in the person sees their events, health results, vaccination certificate, a pass card with a QR code, and their profile. They can complete a Covid-19 symptom check and upload a health certificate.

Provenance: **Implemented** (`index.html`, `_manifest.json`, `scripts/core.js`, `scripts/core2.js`). There is no README and no product brief in the repository. The side menu footer reads "Copyright Magus.Events".

The same tree still contains an accreditation registration form (`registration_form.html`) aimed at one hardcoded event id `304`. The shell menu does not link to that form. A later, separate repository `mypass-registration` continued the public registration form after a split on 2022-02-11. See "Related Silicon Ark projects" below. This plan does not treat that other repository as part of myPass-App.

## What this repository is

A static front end. `index.html` is the PWA start URL. Content screens are HTML fragments fetched into `#page-content`. Behaviour lives in `scripts/core.js` and `scripts/core2.js`. Styling is a vendored Enabled / Bootstrap mobile theme (`styles/bootstrap.css`, `styles/style.css`) plus Font Awesome and the Inter font from Google.

There is no application server and no database in this tree. Account, event, health, and pass data are loaded from `https://footprintapp.net/api/mypass/`. `php/contact.php` is theme boilerplate that posts mail to `mail@domain.com`. Nothing in `index.html` calls it.

Deployment, for pushes to `master`, `qa`, or `prod`, is Bitbucket Pipelines: upload the clone directory to an S3 bucket, then invalidate a CloudFront distribution. Bucket names, regions, distribution ids, and the public hostname are pipeline variables, not files in the repo. Provenance: **Implemented** as pipeline steps (`bitbucket-pipelines.yml`). The live URL is **Unknown / Requires Confirmation**.

Commit `d76cabf` (2022-02-11, "Branch Split , Master is production") is the only in-repo statement that `master` is the production line.

## History

Ten commits, 2022-02-11 to 2022-06-22. Authors: Jaco Brits, Joshua Gatley-Dewing (`joshgatdew`).

| Commit | Date | What changed |
|---|---|---|
| `bcdebb5` | 2022-02-11 | Initial commit |
| `d76cabf` | 2022-02-11 | "Branch Split , Master is production" |
| `ed29c6e` | 2022-06-08 | Favicon |
| `82a7de9`, `22a5aed` | 2022-06-18 | Symptom step 1 reload and number fixes; input trimming. Merged as pull request #1 (`752418b`) |
| `70ab3fd`, `2b8c510` | 2022-06-21 | QR scanner on health certificates; one add button for health certificates and symptom check; stop the scanner when the page changes. Merged as pull request #2 (`d8d04bf`) |

No commits on `master` after 2022-06-22.

## Branches that are not `master`

These remote branches exist and are not the inspected revision. Their commit subjects are evidence of later work. Whether any of that work shipped, and whether it should still be treated as planned, is **Unknown / Requires Confirmation**.

| Branch | Tip | Date | Subject |
|---|---|---|---|
| `multi-event` | `c63910b` | 2022-08-29 | Multi event registration |
| `qa` | `70cdb3e` | 2022-08-16 | Add tos api call, remove feeds from home_screen |
| `login-ui-1` | `cfd26db` | 2022-08-03 | Recommit Push |
| `joshChanges` | `6b33041` | 2022-07-26 | change logging to debug mode |
| `encryption` | `1fc083c` | 2022-07-22 | md5 hashing on password |
| `style_fetcher` | `36bea5a` | 2022-07-08 | Merged qa into style_fetcher |
| `unify_cards` | `2164f45` | 2022-06-29 | initial unify cards code |
| `qrcode_scanner` | `d1db140` | 2022-06-21 | Merged master into qrcode_scanner (the merge into master is `d8d04bf`) |
| `input_trimming` | `22a5aed` | 2022-06-18 | Add another trim (merged to master as pull request #1) |

`bitbucket-pipelines.yml` also defines a `prod` branch deploy. That branch is not on the remote that was cloned.

## Scope that is in this repository

- PWA shell: home, health history, MyPASS card, profile view and edit, side menu, install prompt, service worker.
- Sign-in against the Footprint MyPASS API, plus a first-login / forgot-password screen that calls `getpwdreset` and `postpwd`.
- Home cards for events, upcoming test, vaccination certificate, and health results.
- Symptom check: identity, Covid-19 contact question, recent symptoms, declaration, submit.
- Health certificate list and upload (vaccine and test types), including a camera QR scan that does not yet call an API.
- Accreditation registration form for event id `304`, reachable by loading the `registration_form` page, not from the menu.
- Deploy description for S3 and CloudFront on `master`, `qa`, and `prod`.

## Scope that is not established

- The public hostname, and whether production still serves `master` or a later branch.
- Who operates the Footprint API, and which event ids `304`, `345`, and `346` still refer to.
- Whether sign-up, onboarding, the Events item, and the MyORGANISATION menu were ever finished. In this revision they are present and not wired through to a working API.
- Whether `docs/BIL_Tour-COVID-19_Protocol_Final.pdf` is the product's health protocol. The file is in the tree. Its text was not transcribed for this document.

## Architecture (as implemented)

```text
Browser (standalone PWA or tab)
  -> index.html
  -> service worker (_service-worker.js, cache Cache-v3.06)
  -> fetch of {page}.html into #page-content
  -> scripts/core.js + scripts/core2.js
  -> POST https://footprintapp.net/api/mypass/{action}
```

`debug` in `scripts/core.js` is `false`. When it is `true`, the host prefix becomes `qa.` (`https://qa.footprintapp.net/...`). That switch is not on for this revision.

External calls the running scripts actually make:

| System | Direction | Where |
|---|---|---|
| `https://footprintapp.net/api/mypass/` | Browser POST (and one path-style POST) | `requestAPI` in `scripts/core.js`; `registerSymptomUser` posts accreditation directly |
| Google Fonts (Inter) | Browser GET | `index.html` |
| AWS S3 + CloudFront | Deploy | `bitbucket-pipelines.yml` |
| Camera / QR (qr-scanner) | On-device | `doScanner` in `scripts/core2.js` |
| PDF.js | On-device preview of an uploaded certificate | `renderPDF` in `scripts/core2.js` |
| EasyQRCodeJS | On-device QR drawn from the pass payload | `generateQRCode` |

`https://api.qrserver.com` is referenced inside the theme file `scripts/custom.js`. The pass card uses EasyQRCodeJS, not that remote QR service.

## Related Silicon Ark projects

These are separate repositories. They are named here so they are not folded into this product by mistake.

| Directory | What the other document set says |
|---|---|
| `silicon_ark/myPass-registration/` | Public accreditation form split out on 2022-02-11 (`mypass-registration.git`). It kept evolving through 2023-01-18. It is not this app. |
| `silicon_ark/track.mypass.zone/` | Zend Framework permit dashboard. It calls `footprintapp.net` for terms and permit HTML. It is not this PWA. |

Shared API host `footprintapp.net/api/mypass/` is a fact of the client calls in this repository. Whether one backend serves all of those products is **Unknown / Requires Confirmation**.

## Current status

Last application commit on `master` is 2022-06-22. Later branches exist and were not merged. Whether the S3/CloudFront deploy is still running is **Unknown / Requires Confirmation**.

## Human confirmation

1. Is `master` at `d8d04bf` what production still serves, or did `qa` / `multi-event` replace it outside this remote?
2. What are the live hostnames for the `master`, `qa`, and `prod` pipeline targets?
3. Are event ids `304`, `345`, and `346` still the events this client should use?
4. Should the registration form inside this repo stay, or is `myPass-registration` the only registration product?
5. Is `docs/BIL_Tour-COVID-19_Protocol_Final.pdf` an approved protocol for this app?
6. Should password hashing on branch `encryption` (`1fc083c`) be treated as a required change that never landed on `master`?