# Features — orginal_code

Evidence date: 2026-10-08.

Source: `main` at `18caf8e` (2024-11-12). Git history has two commits and no feature-by-feature trail. "Current" means the code is on that revision and is wired from `app.js`, `grinder.js`, or `schedule.js`. "Completed" is not a separate state: nothing is marked released. Planned items are only those the code itself marks as unfinished.

Mount paths are relative to the Express app. Auth is the middleware on the mount unless a row says otherwise.

## Current

### API shell

| Feature | Evidence | Notes |
|---|---|---|
| Express JSON API | `app.js` | `body-parser` JSON. Listen on `PORT` |
| CORS allow-list | `app.js` | `ALLOWED_ORIGINS` comma-separated |
| Socket.IO server | `app.js`, `handlers/teetimes.js` | Two events, empty broadcast payload |
| Health of config field rename | `app.js` | Copies `northEastLatitute` to `northEastLatitude` once |

### Course and map

| Feature | Evidence | Auth |
|---|---|---|
| Import course from `{course}.tagmarshal.com` | `GET /course/change/:course/:importAll?` | None |
| Course setup read and update | `GET` and `PATCH /course/setup` | None |
| Map and flags update | `PATCH /course/updateMapAndFlags` | None |
| Section update | `POST /course/setup/sections` | None |
| Layout | `GET /course/layout` | None |
| Support ticket stored locally | `POST /course/createSupportTicket` | None |
| Dashboard map bounds | `GET /dashboard/getBoundsMapAndFlags` | JWT |

### Devices and fixes

| Feature | Evidence | Auth |
|---|---|---|
| Insert one fix by JSON or by URI | `POST /device/fix/:imei`, `GET /device/fix/:imei/...` | None |
| Insert a batch or cached batch | `POST /device/fixes/:imei`, `POST /device/fixes/cached/:imei` | None |
| Device list, assignment, buzzer, actions | `/device/getAllDevices`, `postAssignment`, `postBuzzerToggle`, `sendAction`, `management` | None on these routes |
| Fix history for a date range | `POST /device/tracker/:from/:to` | JWT |
| Delete devices | `DELETE /device/devices` | Server IP or `ENV=local` |
| Two-way fix post | `POST /two-ways/fixes/:cached?` | `DeviceIMEI` |
| Round builder | `grinder.js` | Process, not HTTP |

### Rounds, pace, goals

| Feature | Evidence | Auth |
|---|---|---|
| Active rounds, round info, manual start, end round | `/dashboard/getActiveRounds`, `roundInfoByRoundId`, `manuallyStartingRound`, `endAndRemoveRound` | JWT |
| Mark incomplete, share round | `/trackmap/postMarkRoundIncomplete`, `postShareRoundInfo` | JWT |
| Round replay and rerun | `POST /rounds`, `POST /rerun` | JWT |
| Goal times (VGT) | `/goaltime` | JWT |
| Daily and weekly goal settings | `/goalsetting` | JWT |
| Timing schedule by round, hole, or date | `/timingschedule` | JWT |
| Pace text and colour | `modules/pace.js` | Used by round building |
| Gap time | `modules/gaptime.js` | Used by the grinder |

### Tee times and shotgun

| Feature | Evidence | Auth |
|---|---|---|
| Tee sheet CRUD, tagging, CSV, provider switch | `/teetime` | JWT |
| Provider poll | `schedule.js` and `teetimes/providers/*` | Cron |
| Default tee times at 00:10 | `schedule.js`, `controllers/modules/teetime.js` `loadDefaultTeetimes` | Cron |
| Shotgun create, retroactive, group B, delete | `/shotgun` | JWT |
| Device tee-time assign | `PATCH /two-ways/teetimes/:id/:action` | `DeviceIMEI` |

### People

| Feature | Evidence | Auth |
|---|---|---|
| Users, roles, permissions, report settings | `/user` | JWT. Writes also call `LOCALHOST` |
| Associate a user from the central server | `POST /user-server/postUserToAssociates` | Server gate |
| Caddies, invites, device token, loops | `/caddietag` | JWT, except `DELETE /caddietag/delete/:email` (server gate) |
| Players, CSV upload, experience tracker | `/players` | JWT |
| Data-directory templates | `/datadirectory` | JWT |

### On-course operations

| Feature | Evidence | Auth |
|---|---|---|
| Geofence groups, fences, presets, breaches | `/geofence` | JWT |
| Marshal notes and templates | `/interaction` | JWT. Several deletes are `GET` |
| Staff-to-device messages | `/messaging` | JWT |
| In-app notifications | `/usernotification` | JWT |
| Push to caddie app and to course devices | `modules/notifications.js` | Firebase |
| Food and beverage catalogue and orders | `/foodandbev` | JWT |
| Device menu, orders, scores, rating, disclaimer | `/two-ways` | `DeviceIMEI` |
| Advertisements | `/advertisements` and `GET /two-ways/advertisements` | JWT on the staff mount |
| Pin templates, schedules, nightly apply | `/pinlocations`, `schedule.js` | JWT / cron |
| Hole-time tournaments | `/holetimes` | JWT |
| Golf Genius events, sync, leaderboards | `/golfgenius` | JWT |

### Reporting

| Feature | Evidence | Auth |
|---|---|---|
| Round report and CSV | `/roundreport` | JWT |
| Player profile and CSV | `/playerreport` | JWT |
| Caddie profile and CSV | `/caddie` (same report controller) | JWT |
| Analytics hub | `/analyticshub` | JWT |
| Dashboard widgets | `/dashboard/widget*` | JWT |

### Tokens

| Feature | Evidence | Auth |
|---|---|---|
| Issue JWT | `POST /token` | Server gate |
| Verify | `GET /token` | Server gate, then JWT |
| Refresh | `GET /token/refresh` | Server gate. Verifies the JWT inside the controller |

## Stub or unfinished in code

| Item | Evidence | Status |
|---|---|---|
| Socket.IO assign player / assign tag | `handlers/teetimes.js` emits `{}` | **Implemented** stub. Comment says it alerts clients. Payload is empty |
| Jest test | `tests/app.test.js` `// TODO: write test` | Placeholder |
| `pageAccess` | `models/config.js` `// TODO: fix this` | Field exists, shape undocumented |
| Latitude typo copy | `app.js` `// TODO:: remove at later stage` | Still runs |
| Skip marshal, super, drinks in the grinder | `grinder.js` `// TODO:: Remove special devices` | Still skipped |
| `bcrypt` dependency | `package.json` only | Not referenced |
| Monday.com ticket | `controllers/course.js` after `return` | Dead code |
| `LARAVEL_AUTH_SERVER`, `FIX_LIMIT` | `.env.example` only | Not read by the JavaScript searched |

## Changed in git

| Commit | Date | What landed |
|---|---|---|
| `c7d2d20` | 2024-11-06 | Initial commit |
| `18caf8e` | 2024-11-12 | The tree described above ("orginal commit") |

No later commit changes a feature.

## Not in this repository

- The staff web client (CORS expects port 3000).
- The user/role service behind `LOCALHOST`.
- The legacy PHP (or other) app at `*.tagmarshal.com`, except the import client.
- Firebase service-account JSON (paths come from the environment).
- CI, Docker, SonarQube config, and the scan-host files `sonar-project.properties`, `sonarqube_scan.bat`, and `controllers/ngrinder.js`.

## Deprecated or removed

Nothing was removed in git. Schema comments mark fields as successors of older names (`current` to `currentSection`, `is_9_hole` to `isNineHole`, `battery_perc` to `batteryPercentage`). Both the comment and the new field are on `18caf8e`. The old names are not a second API.

`northEastLatitute` remains on `Config` next to `northEastLatitude`.

`POST /two-ways/fnb/legacy` is a second order path beside `POST /two-ways/fnb/createOrder`. Both are mounted.