# Project plan — myPass

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/mypass.git`.

Inspected revision: `master` at `803166e` (2022-01-27, "Domains update , number validation"). That commit is `origin/HEAD`. The remote has no other branches.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**MyPass** here is a public, mobile-oriented web form. A visitor on an event subdomain fills in personal details, identity and organisation, optionally linked events, accepts two declarations, and submits an accreditation application. The page title is "MyPass".

Provenance: **Implemented** (`index.html`, `scripts/core.js`, `domains.js`). There is no README and no product brief in the repository.

The event is chosen from the first label of the hostname. `domains.js` maps that label to a numeric event id. An unknown label replaces the page body with "Please check subdomain". Provenance: **Implemented** (`scripts/core.js` lines that read `location.hostname`).

A confirmation panel then shows a reference number returned by `POST https://footprintapp.net/api/mypass/postaccreditation` and tells the visitor a confirmation email was sent. This repository does not send that email. Provenance: **Documented** in the success copy in `index.html`; email dispatch is **Unknown** and lives outside this repository.

## What this repository is

A static front end. `index.html` is the only page the live script treats as the product (`page = "registration"` in a script block at the bottom of `index.html`). Styling is a vendored Enabled / AppKit mobile theme (`scripts/custom.js` names the PWA "MyPass"; `menu-main.html` still says "AppKit") plus Cropme for the photo (`plugins/cropme/`).

There is no application server, database, login, or test suite in this tree. `php/contact.php` is theme boilerplate that posts mail to `mail@domain.com`. Nothing in `index.html` calls it.

Deployment, for pushes to `master` or `qa`, is Bitbucket Pipelines: upload the clone directory to an S3 bucket, then invalidate a CloudFront distribution. Bucket, region, distribution id, and the public hostname are pipeline variables, not files in the repo. Provenance: **Implemented** as pipeline steps (`bitbucket-pipelines.yml`). The live URL pattern is **Inferred** as `{subdomain}.mypass.zone` from commit subjects (`a6f32f3` "include bil2021.mypass.zone", `633d3d2` "Added rc.mypass.zone"). Whether those hosts are still deployed is **Unknown / Requires Confirmation**.

## History

128 commits, 2021-04-18 to 2022-01-27. Authors on the log: Jaco Brits, `heinrichoverdrive`, Joshua Gatley-Dewing.

| Period | What changed |
|---|---|
| 2021-04-18 to 2021-04-30 | `354e289` initial commit. Styling against XD exports. `8e4eef7` adds `bitbucket-pipelines.yml`. |
| 2021-05-05 to 2021-05-19 | `179c371` adds `scripts/core.js`. Organisation search, production API host, photo upload, tab flow, CORS on `fetch`. |
| 2021-05-28 | Subdomain selects the event (`e59cc74`, `615e895`). CloudFront invalidation added to the pipeline (`6122675`). Gender options updated (`7a305d2`). |
| 2021-05-31 | `905e7f8` "All roles removed", after `21b0a6a` "update changes to roles". Categories and roles later come back from the event API (`roleSelect` in the current `scripts/core.js`). |
| 2021-06-01 | Pull request #2 merges `center_site` (`b663588`, Joshua Gatley-Dewing). Pull request #1 was `6121063` on 2021-05-19. |
| 2021-06-03 to 2021-06-09 | Domain map, `MediaEvent` hiding the events step, postal code made free text (`89d3668`), UK and USA dial codes (`65f74d7`, `9c25c70`). |
| 2021-06-15 | `11e1d9f` shows "Registration for this event is now closed." when the event end date is today or earlier. |
| 2021-07-07 to 2021-07-10 | `633d3d2` maps `rc` to event `341`. `da1b9b8` "Sonar-Scan done". |
| 2021-11-19 to 2021-12-15 | Birth-year list extended (`5ce83bc`). Rugby and SuperSport domain entries (`e35833e`, `7019a47`). API field handling (`1dafe8c`, `a78d174`). |
| 2022-01-04 to 2022-01-27 | Domain list and mobile-number check icon (`803166e`). Success contact address set to `info@mypass.zone` (`097486a` "Updated email adress"). |

No commits after 2022-01-27 were on `master` at inspection time. Current status: **dormant front end**. Whether it is still deployed is **Unknown / Requires Confirmation**.

## Related Silicon Ark projects

These are separate repositories. They are not part of this tree.

| Silicon Ark directory | Repository | Relationship |
|---|---|---|
| `myPass-registration` | `git@bitbucket.org:overdrive/mypass-registration.git` | Later public registration form. Its project plan records an initial commit on 2022-02-11 described as a split from a larger tree (`85fcc31` "Slitout repos"). It calls `getstyling` to resolve the event, then the same `getevent`, `getorganisation`, and `postaccreditation` paths. This repository does not contain that split commit. That this repo is the parent is **Inferred** from the dates, the shared form, and the Sonar project key `MyPassRegistration` left in `.scannerwork/report-task.txt`. |
| `myPass-App` | `git@bitbucket.org:overdrive/mypass-app.git` | Accredited-person PWA (sign-in, health, pass QR). Its plan says a later registration repository continued the public form after 2022-02-11. This repo does not load that PWA. |
| `track.mypass.zone` | `git@bitbucket.org:overdrive/track.mypass.zone.git` | Vehicle load-in / load-out permits for one SA Rugby event. Different stack (Zend Framework 1). A shared Footprint data store is **Unknown / Requires Confirmation**. |

## Scope

### In this repository

- One registration page with four steps: Personal, Identity, Events, Submit.
- Hostname-label to event-id map in `domains.js`.
- Organisation lookup by reference number.
- Event close-date stop.
- Terms text and a second declaration loaded from the event payload.
- Photo select and crop, posted with the application.
- Banner and titles from the event payload.
- A service worker that cache-first serves `index.html`.
- Production and QA deploy pipelines to S3 and CloudFront.

### Present but not on the live page

- `exports/`: static design HTML (sign-in, sign-up, onboarding, health pass, menus, an accreditation mock). Not linked from `index.html`.
- `template/`: the Enabled / AppKit theme catalogue. Not the registration flow.
- `menu-main.html`, `menu-colors.html`, `menu-footer.html`, `menu-share.html`: theme menus. The registration page's own menus are the terms modal `#menu-call` and the warning sheet `#menu-warning`, both inline in `index.html`.
- `php/contact.php`: unused theme mailer.
- `country.json`: country metadata (names, dialling codes, flags). `index.html` hardcodes its own nationality, country, and dial-code lists and does not load this file.
- `.scannerwork/`: committed SonarQube scanner output, including `report-task.txt`.
- `sonar-scanner.bat`: stock Windows launcher pointing at `C:\sonar-scanner`.

### Not in this repository

- The Footprint API implementation (`getevent`, `getorganisation`, `postaccreditation`).
- Storage of applications, organisation records, close dates, terms text, and confirmation email.
- Review, approval, or badge printing after submit.
- Accounts, passwords, health passes, or QR passes. Those screens exist only as static files under `exports/`.

### Listed at onboarding and absent from `master`

The onboarding brief listed `plugins/nscripts`, `sonar-project.properties`, and `sonarqube_scan.bat` at the repository root. None of those paths are in `master` at `803166e`. They may have been untracked on the scan host. Provenance: **Unknown**.

## System shape

```text
Browser  index.html + scripts/core.js + scripts/custom.js + domains.js
   |  first hostname label → domains[label] → event id
   |  GET  /api/mypass/getevent/EventID/{id}
   |  GET  /api/mypass/getorganisation/ORefNumber/{ref}
   |  POST /api/mypass/postaccreditation   (application JSON, photo as data URL)
   v
https://footprintapp.net
```

`scripts/core.js` sets `qa` to `""`, so the host is `https://footprintapp.net` with nothing in front of `footprintapp.net`. Commit messages from May 2021 ("Testing cors endpoints", "new production key", "Update end points") show the host was being pointed at production. No API key or `Authorization` header is sent by the current script.

## Milestones (as the history shows them)

There is no written milestone plan. The commit sequence is the only plan on record:

1. Theme and XD exports landed (April 2021).
2. The registration script and Footprint calls landed (May 2021).
3. One subdomain per event, CloudFront, and the events step landed (late May to June 2021).
4. Close date, rugby domains, and the last domain/validation edits landed (June 2021 to January 2022).
5. Work on this repository stopped. The registration form continued in `mypass-registration` (see related projects). That continuation is not a milestone written in this repository.

## Known dependencies

- Footprint MyPass HTTP API on `footprintapp.net`. Contract details that this client reads are in `technical-documentation.md`.
- Amazon S3 and CloudFront, via Bitbucket Pipelines. Account and bucket names are not in the repo.
- Google Fonts (Inter) from `fonts.googleapis.com`, loaded by `index.html`.
- Cropme, vendored under `plugins/cropme/`.
- Enabled / AppKit theme assets under `styles/`, `scripts/bootstrap.min.js`, `scripts/custom.js`, `fonts/`, `scss/`, and `template/`.

## Current project status

Dormant. Last change 2022-01-27. One branch (`master`). No tests. No README. The page still contains the Covid-worded second declaration as the HTML default; the event API replaces that label at runtime.

## Human confirmation

1. Whether `mypass` at `803166e` is still deployed, and which `{label}.mypass.zone` hosts still resolve.
2. Whether `mypass-registration` was forked from this repository on 2022-02-11.
3. Whether the Footprint API still accepts `postaccreditation` from this older client (this client does not call `getstyling`).
4. Whether the API sends the confirmation email the success panel promises, and whether `info@mypass.zone` is still the contact address.
5. Whether event ids in `domains.js` are still live events.
6. What the `qa` pipeline branch was for. It is not on the remote. Both pipeline steps are named deployment environment `production` while the `qa` branch uses `QA_*` variables.
7. Whether the SonarQube server recorded in `.scannerwork/report-task.txt` (`MyPassRegistration`, SonarQube 8.9.1) is still in use. `sonar-project.properties` is not in the tree.