# Project plan — orginal_code

Evidence date: 2026-10-08.

Source repository: `git@bitbucket.org:overdrive/orginal_code.git` (also reachable as `https://bitbucket.org/overdrive/orginal_code.git`).

Inspected revision: `main` at `18caf8e` (2024-11-12, Jaco Brits, "orginal commit"). The scan-host path `~/projects/sonar_scan/repos/orginal_code` was not on this machine. The tree was read from that git revision.

There is no prior Silicon Ark directory for this project. The source README is an install and smoke-test note. This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Inferred.** A multi-process Node.js service for one golf course running on the Tagmarshal stack. GPS fixes from carts and tags are stored in MongoDB, turned into rounds, and shown to course staff. The same process also serves tee times, shotgun starts, pace and goal times, geofences, food and beverage orders, two-way device menus, caddie and player records, pin sheets, messaging, and analytics.

The repository name is `orginal_code`. Nothing in the tree titles the product that way. Hosts, mail, and the example database use the Tagmarshal name:

- `GET /course/change/:course` loads `https://{course}.tagmarshal.com` (`controllers/course.js`).
- The example `DATABASE_URL` is `mongodb://127.0.0.1:27017/tagmarshal` (`.env.example`).
- Caddie mail is sent as `Tagmarshal <MAILGUN_FROM_EMAIL>` (`modules/caddie.js`).
- Round-share mail is sent from `customerexperience@tagmarshal.com` (`controllers/modules/trackmap.js`). The password beside that address is omitted from this documentation.

**Unknown / Requires Confirmation:** whether this repository is the current production API, a course-specific snapshot, or a renamed copy. No product owner, environment, or deploy target is named beyond the code.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `main` (default; `origin/HEAD`) | `18caf8e` | 2024-11-12 | Only branch. Two commits. |

History:

| Commit | Date | Author | Subject |
|---|---|---|---|
| `c7d2d20` | 2024-11-06 | Jaco Brits | Initial commit |
| `18caf8e` | 2024-11-12 | Jaco Brits | orginal commit |

The product tree is the second commit. There is no earlier feature history inside git, no tags, and no `develop` branch.

The task that created this onboarding listed `controllers/ngrinder.js`, `sonar-project.properties`, and `sonarqube_scan.bat` at the scan-host root. Those paths are not in `18caf8e`. The round processor on this revision is `grinder.js` at the repository root.

## Scope that is in the tree

- HTTP API (`app.js`) on `process.env.PORT` (example `5000`), with CORS and Socket.IO.
- Background round builder (`grinder.js`), polling every 5 seconds.
- Cron process (`schedule.js`) for legacy fixes, tee-sheet sync, midnight close, default tee times, and pin sheets.
- MongoDB models for course config, devices, fixes, rounds, tee times, players, caddies, geofences, food and beverage, Golf Genius, and related records.
- Twenty-five tee-sheet provider modules under `teetimes/providers/`.
- A one-course import from a legacy Tagmarshal host (`modules/migration.js`).
- JWT issuance for a user, caddie, or player already stored locally, with user and role data also read from an HTTP API at `process.env.LOCALHOST`.

## Scope that is not in the tree

- No Docker, CI, infrastructure, or process manager.
- No SonarQube project file or scan script (see the scan-host discrepancy above).
- No frontend. The README assumes a caller on port 3000 via `ALLOWED_ORIGINS`.
- No `yarn.lock`. The README says `yarn`. The lockfile present is `package-lock.json`.
- `tests/app.test.js` is a Jest placeholder (`// TODO: write test`).
- `bcrypt` is listed in `package.json` and is not required by any JavaScript file.
- `LARAVEL_AUTH_SERVER` and `FIX_LIMIT` appear in `.env.example` and are not read by the JavaScript that was searched.

## Architecture (as implemented)

Three Node processes share one MongoDB database. They are started separately, as the README states:

```text
node grinder.js    # processes fixes into rounds
node app.js        # APIs
node schedule.js   # cronjobs
```

`app.js` mounts Express routers, opens Socket.IO, and listens on `PORT`. Authenticated dashboard routes sit behind `middleware/auth.js` (JWT). A few routes sit behind `middleware/server.js` (caller IP equals `SERVER_IP`, or `ENV` is `local`). The device two-way API sits behind `middleware/twoway.js` (header `DeviceIMEI` must match a device).

`grinder.js` reads new `Fix` documents, ignores devices flagged `marshal`, `super`, or `drinks`, matches the point to a course section polygon, and creates or extends a `Round`.

`schedule.js` reads `Config.timezone` once at startup and registers `node-cron` jobs in that zone.

## Major components

| Component | Path | Role |
|---|---|---|
| API process | `app.js` | HTTP and Socket.IO |
| Round grinder | `grinder.js` | Fix-to-round loop |
| Scheduler | `schedule.js` | Cron |
| Auth | `middleware/auth.js`, `controllers/token.js` | JWT verify and issue |
| Server gate | `middleware/server.js` | IP or local env |
| Device gate | `middleware/twoway.js` | IMEI header |
| Course import | `controllers/course.js`, `modules/migration.js` | Pull a legacy course |
| Tee sheets | `teetimes/providers/*.js`, `schedule.js` | External reservations |
| Pace | `modules/pace.js`, `modules/gaptime.js` | On-pace / slow / delayed labels |
| Push | `modules/notifications.js` | Firebase Cloud Messaging |
| Realtime | `handlers/teetimes.js` | Socket.IO listeners (stub) |

## Milestones visible in the code

Git does not record feature milestones. The only dates in history are the two commits above. Schema comments such as `was current` and `TODO:: remove` show fields carried over from an older shape. Those comments are **Implemented** notes, not a dated plan.

The README smoke test uses dates in May 2023 (`POST /device/fixes/:imei`). That is sample payload data, not a release date.

## Current status

**Implemented** as a single import on `main`, last changed 2024-11-12. No open work, version, or changelog is in the repository.

Runtime status of any deployed copy is **Unknown / Requires Confirmation**.

## Known dependencies

Runtime (README): Node `^v16.19.0`. `package.json` has no `engines` field. That version was not executed for this document.

Direct dependencies in `package.json`: `express` 4, `mongoose` 6, `socket.io` 4, `jsonwebtoken` 8, `node-cron` 3, `axios`, `soap`, `firebase-admin` 11, `mailgun-js`, `messagebird`, `nodemailer`, `moment` and `moment-timezone`, `validatorjs`, `formidable`, `csv-parser`, `json2csv`. Dev: `jest` 29, `supertest`.

External systems the code calls are listed in `technical-documentation.md`.

## Implementation notes that affect any future work

- `.env` is tracked. `.gitignore` does not exclude it. Values were not copied into Silicon Ark.
- `controllers/course.js` contains a Monday.com bearer token in a block that sits after `return` inside the support-ticket success path, so that request does not run. The token is omitted here.
- `controllers/modules/trackmap.js` contains a Gmail SMTP password next to `customerexperience@tagmarshal.com`. The password is omitted here.
- `Config.findOne()` is used as the single course record. The model is not scoped by a course id inside this process.
- Several controllers call `mongoose.connect` again at load (`controllers/modules/pinlocations.js`, `controllers/modules/messaging.js`) in addition to `app.js`.

## Human confirmation

- Confirm what `orginal_code` is relative to the live Tagmarshal course API.
- Confirm whether the unauthenticated device and course-change routes are intentional.
- Confirm and rotate any live secret in the tracked `.env`, the Monday.com token, and the Gmail SMTP password.
- Confirm the scan-host files that are absent from git (`sonar-project.properties`, `sonarqube_scan.bat`, `controllers/ngrinder.js`).
- Confirm whether the Socket.IO tee-time handler and the empty Jest test are unfinished work.