# Project plan — nataliehirschman

Evidence date: 2026-10-09.

Source repository: `git@bitbucket.org:overdrive/nataliehirschman.git`.

Inspected revision: `f9248b83` (2025-10-03, "bitbucket-pipelines.yml edited online with Bitbucket") on `master`. `origin/HEAD` is `master`. No other branches exist on the remote.

This plan describes what the repository contains. It does not decide what the product should become.

There is no prior Silicon Ark directory for this project, and the source repository has no product PRD. The admin README is the CodeIgniter starter readme ("Admin Overdrive Starter"), not a plan for the artist site.

## Product

**Natalie Hirschman Fine Art** is a public artist website. Visitors read a biography and CV, browse works, contact the artist, and join an email list. Staff manage page content and artwork through an admin application at `admin.nataliehirschman.com`.

Provenance: **Documented** in public page titles and the header "natalie hirschman Fine Art" (`index.html`). The admin brand string in the sidebar is "Nathalie Hirschman" (`app/Views/layouts/sidebar.php`). The spelling difference is implemented, not explained.

The public site is a Fine Art Studio Online (FASO) HTML export that Overdrive later wired to its own admin. FASO markers remain in the markup (`faso-*` classes, `styles/master/faso.css`, comments such as `start_con_processed`, image names `33778_*`, FASO admin id `33778`, and links to `fineartstudioonline.com`). Provenance: **Implemented**.

## Branch reality

One line of history. First commit `94bc1ad4` (2022-12-13, Jaco Brits, "Initial commit"). Tip `f9248b83` (2025-10-03, Wessels de Wet).

| Period | What changed |
|---|---|
| 2022-12-13 to 2023-02 | Initial site and admin, FTP pipeline, vendor and AWS SDK copies, database and upload work |
| 2023-02 to 2023-07 | Public pages, reCAPTCHA, image ordering, zoom and carousel, CV page, Matomo already present on the public HTML |
| 2023-11-01 | `robots.txt` added (Rachel Mogano) |
| 2024-11-01 | `robots.txt` removed (Uriel Balela) |
| 2025-10-01 to 2025-10-03 | Deploy pipeline rewritten (CI4 rsync, then git-ftp), then the pipeline block commented out |

No open feature branch is in the repository. Work since May 2023 is deploy tooling and the robots file, not new public features.

## Objectives (inferred from the site, not from a written plan)

No project plan exists in the repository. The following are **Inferred** from the public pages and the admin:

- Publish Natalie Hirschman's biography, CV, and portfolio.
- Let a visitor enquire about the artist and subscribe to an email list, with reCAPTCHA on those two forms.
- Let a signed-in admin edit the text and images that the public About, CV, and Works pages load from the admin API.
- Keep a static FASO snapshot of individual artwork and enquire pages in the same repository.

## Scope

### In scope of the repository

- Static public HTML, CSS, JS, and image assets at the repository root (`index.html`, `about.html`, `cv.html`, `contact.html`, `works.html`, `galleries.html`, `email-newsletter.html`, `newsletter-archive.html`, `assets/`, `styles/`).
- Root PHP form handlers `contact.php` and `newsletter.php`.
- Per-artwork static pages under `inquire/`, `works/`, `workszoom/`, and `workszoom-all/`.
- CodeIgniter 4 admin in `admin.nataliehirschman.com/` (content, contacts, newsletter, users, menus).
- A vendored admin HTML theme under `admin/` (Star Admin-style pages, plus `admin/js/ajaxcalls.js`, which the public pages actually call).
- Bitbucket pipeline history, `sonar-project.properties`, `.git-ftp-ignore`, `.rsync-exclude`.

### Out of scope / not in this repository

- The MySQL server. The admin points at a host; the database is not in git. Schema for `pages`, `images`, `contacts`, and `newsletter` is not in the migrations.
- The Matomo server `analytics.medmin.co.za`.
- FASO's own hosted service (`nataliehirschman.fineartstudioonline.com`, `data.fineartstudioonline.com`). Several static pages still post to it.
- Google reCAPTCHA as a service. The site only calls the siteverify endpoint.
- Mail delivery beyond the SMTP settings in the admin. The contact controller's call to send mail is commented out.
- A written content model for which page names and categories must exist in the database. Those rows are data, not code.

## System architecture

Two applications share one git repository and, from the pipeline history, one FTP document root.

```text
Visitor browser
  -> static HTML on nataliehirschman.com
       -> admin/js/ajaxcalls.js
            GET https://admin.nataliehirschman.com/api/{about|cv|works|contact}
       -> contact.php / newsletter.php
            reCAPTCHA siteverify
            POST https://admin.nataliehirschman.com/public/{contact|newsletter}

Staff browser
  -> CodeIgniter 4 at admin.nataliehirschman.com
       session login, menu-based authorisation
       MySQL (sql11.cpt4.host-h.net / natalgyyqk_db1)
       image files under the admin public/assets/uploads path
```

The public Works, About, and CV pages do not render their main text or portfolio from the HTML file. They call the admin API and write into DOM nodes (`article_body`, `#images`, artwork viewer). The surrounding chrome (nav, footer, FASO widgets) is still static HTML.

`admin/` is not the live admin. It is a front-end theme dump. The live admin code is `admin.nataliehirschman.com/`. The public site loads JavaScript from `admin/js/ajaxcalls.js` by a relative path, so that file is part of the public site even though it sits in the theme folder.

## Major components

| Component | Path | Role |
|---|---|---|
| Public shell | Root `*.html`, `assets/`, `styles/` | Navigation, layout, Matomo, some leftover FASO forms |
| Public API client | `admin/js/ajaxcalls.js` | Loads About, CV, Works, and a single work from the admin |
| Contact and newsletter handlers | `contact.php`, `newsletter.php` | reCAPTCHA, then POST into the admin |
| Admin application | `admin.nataliehirschman.com/` | CodeIgniter 4.6.3, PHP `^8.0` |
| Admin theme (unused as the app) | `admin/` | HTML dashboard template and the ajax script above |
| FASO snapshot | `inquire/`, `works/`, `workszoom/`, `workszoom-all/`, `home/g21s/` | Static artwork, enquire, and viewer files |
| Deploy config | `bitbucket-pipelines.yml`, `.git-ftp-ignore`, `.rsync-exclude` | FTP / rsync history; pipeline currently commented out |

## Milestones visible in git

These are commit clusters, not an approved plan.

1. **2022-12-13** — Initial commit of the public site and admin.
2. **2023-01 to 2023-02** — Web admin, image upload, API routes, pipeline and vendor deploy, database settings.
3. **2023-02 to 2023-05** — Contact page, reCAPTCHA, ordering, CV, zoom, carousel, mobile layout.
4. **2023-06 to 2023-07** — Lightbox carousel and desktop pan/zoom fixes. Last product-facing commits.
5. **2023-11 / 2024-11** — `robots.txt` added, then removed.
6. **2025-10-01 to 2025-10-03** — Pipeline moved to rsync, then back to git-ftp, then the `pipelines:` block was commented out. No application code changed in that burst.

## Known dependencies

- PHP `^8.0` and CodeIgniter 4 (`codeigniter4/framework` locked at `v4.6.3`).
- MySQL via MySQLi. Live connection values are in `app/Config/Database.php`. A separate development block is in the committed `env` file (database name `nataliehirscham`, user `root`, empty password).
- Composer packages also required, with **no call site under `app/`**: `aws/aws-sdk-php`, `mpdf/mpdf`, `phpoffice/phpspreadsheet`. Provenance: **Implemented** as dependencies only.
- jQuery, Bootstrap, Slick, Hammer, Font Awesome, and Google fonts on the public site. Admin UI uses the starter's Bootstrap/feather layout.
- Google reCAPTCHA v3 (site key is in the public HTML; the secret is hardcoded in the two root PHP files and is omitted here).
- Matomo at `analytics.medmin.co.za`, site id `3`, cookie domain `*.nataliehirschman.com`.
- SMTP `smtp.googlemail.com:587`, from `nataliehirschmanweb@gmail.com`. The password is in `app/Config/Email.php` and is omitted here.
- Bitbucket repository variables referenced by older pipeline revisions: `FTP_USERNAME`, `FTP_PASSWORD`, `FTP_HOST`, and (in the commented Sonar step) `SONAR_HOST_URL`, `SONAR_TOKEN`.

## Current project status

**Implemented and present on `master`.** The public shell, the admin, and the API client are in the tree at `f9248b83`.

**Deploy automation is off.** On 2025-10-03 the entire `pipelines:` block in `bitbucket-pipelines.yml` was commented out. The last active mechanism, on 2025-10-02, was `git ftp push` to `ftp://$FTP_HOST/public_html`, ignoring `admin.nataliehirschman.com/vendor/` via `.git-ftp-ignore`. A same-week rsync deploy (with `--delete`) was replaced by that git-ftp version. Whether production is still that FTP host, and whether anyone deploys by hand, is **Unknown / Requires Confirmation**.

**SonarQube** is configured only as a project key in `sonar-project.properties` (`overdrive_nataliehirschman_AYZhdsHLtKPJNQrmj1Pe`). The scan step in the pipeline is commented. `sonarqube_scan.bat` was listed at task-creation time and is **not** in `master` at `f9248b83`.

**Not a maintained product plan.** There is no roadmap, issue list, or README beyond the admin starter text.

## Implementation plan

There is no forward plan in the repository. Nothing in git after July 2023 describes unfinished product work. Disabled nav items (Galleries, Landscape, Still life) and unused composer packages are present, but no comment marks them as scheduled work. Treat them as **Unknown / Requires Confirmation**, not as a backlog.

## Human review

- Confirm the live public URL and the live admin URL still match `nataliehirschman.com` and `admin.nataliehirschman.com`.
- Confirm whether the commented pipeline means deploys stopped, or deploys moved outside this file.
- Confirm that committed database, SMTP, reCAPTCHA, and encryption values are still in use and should be rotated. Values are intentionally not copied into this plan.
- Confirm whether public self-registration (role "Developer") is still acceptable. See business rules.