# Project plan — Paterson & Cooke Management System

Evidence date: 2026-10-08.

Source repository: `git@bitbucket.org:overdrive/patersoncooke.git` (also reachable as `https://bitbucket.org/overdrive/patersoncooke.git`).

Inspected revision: `master` at `008c5ac` (2022-02-24, Liam Kleyn, "Fix last insert id"). The scan-host path `~/projects/sonar_scan/repos/patersoncooke` was not on this machine. The tree was read from that git revision.

There is no prior Silicon Ark directory for this project. The source README is a dependency list only. This plan describes what the repository contains. It does not decide what the product should become.

## Product

The browser title is **Paterson & Cooke Management DB**. The home page and footer call it **Paterson & Cooke Management System**. The footer stamps the build as **v1.2.1, 4 Jan 2010** (`include/version.inc.php`).

The application is a server-rendered PHP system for a professional-services firm. People record weekly time, review and sign off timesheets, and turn signed time plus disbursements into project invoices. Offices, clients, projects, fee structures, and billing rates are maintained in the same application. A report console prints or exports utilisation, leave, project, and invoice reports.

Provenance: **Implemented** (page titles, class names, and workflows). The firm name is **Documented** only as on-screen copy. No product brief exists in the repository.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `008c5ac` | 2022-02-24 | Only branch. Four commits. |

History:

| Commit | Date | Author | Subject |
|---|---|---|---|
| `bb18910` | 2022-02-21 | Jaco Brits | Initial commit |
| `67ef126` | 2022-02-21 | Jaco Brits | first commit |
| `0eb150f` | 2022-02-21 | Liam Kleyn | Fix php upgrade, default func args, mysql -> mysqli, mysqli changes |
| `008c5ac` | 2022-02-24 | Liam Kleyn | Fix last insert id |

Git history starts when the tree was imported in February 2022. Comments and backup class names inside the tree (`20100107`, `20100824`, footer date 4 Jan 2010) place the application itself around 2009–2010. Those dates are **Implemented** as comments and file names, not as git history.

No `develop` branch, tag, or release is present.

## Scope that is in the tree

- Login against personnel records, then a cookie session.
- Reference data: offices, workgroups, currencies, fee structures, billing codes, billing rates, activity categories, activity codes, project statuses, security levels, clients, contacts.
- Projects: status, manager, director, client, offices, fee structure, proposal items, project billing rates.
- Weekly timesheets with a half-hour grid, review, sign-off, reminder email, and reopen.
- Invoices: time selection, fees, site allowance, internal disbursements, external disbursements, fixed-price fees.
- Report console and the report pages it opens.
- One system setting: rows per list page.

## Scope that is not in the tree

- No database schema dump, migration, or seed. Table shapes are implied by SQL strings.
- No deployment, Docker, CI, or environment file. The README names Apache and PHP 7.4.
- No automated tests.
- Navigation labels live in `tblmenulevel0` and `tblmenulevel1`. Those rows are not in git.
- No mobile client, API, or queue.

## Architecture (as implemented)

One PHP process per request. Each root `*.php` file is a page. It includes `include/system.inc.php`, which opens MySQL database `pcce`, copies request values into globals, and loads the signed-in person from cookie `ckyPCCE`. Page classes under `include/` render HTML and run SQL from `include/database/sql.inc.php`.

The menu is built at the bottom of each logged-in page by querying the menu tables and handing the result to `include/javascript/menu.js`.

There is no framework, no router, and no separate frontend build.

## Major components

| Area | Entry pages | Class location |
|---|---|---|
| Session and utilities | `login.php`, `index.php` | `include/system.inc.php` |
| Personnel | `personnel.php` | `include/personnel/personnel.cls.php` |
| Timesheet | `timesheet.php`, `timesheetreview.php`, `completedtimesheet.php` | `include/personnel/timesheet/` |
| Projects | `project.php` | `include/project/project.cls.php` |
| Invoicing | `invoice.php`, `disbursement.php`, `invoicetimesheet.php` | `include/invoice/`, `include/personnel/timesheet/invoicetimesheet.cls.php` |
| Reference data | `office.php`, `client.php`, `contact.php`, `currency.php`, `feestructure.php`, `billingcode.php`, `billingrate.php`, `activitycategory.php`, `activitycode.php`, `workgroup.php`, `projectstatus.php`, `securitylevel.php`, `settings.php` | `include/general/`, `include/client/` |
| Reports | `reportconsole.php` and one page per report | `include/reports/` |

## Milestones visible in the code

These are observations, not a planned roadmap.

1. **Around January 2010** — footer version 1.2.1. Backup copies of the timesheet classes dated `20100107`. A comment in the timesheet class says year-start week dates were fixed that day.
2. **24 August 2010** — comment in the report console: "new Dashboard rpt".
3. **21–24 February 2022** — tree imported to Bitbucket. Connection layer switched from the old `mysql_*` API to `mysqli_*`. Insert-id call updated to pass the connection.

Nothing in git after `008c5ac` describes further work.

## Current status

**Implemented** and present on `master`. Whether it is still deployed, and against which database, is **Unknown / Requires Confirmation**.

The README states the runtime is Apache with PHP 7.4 and `short_open_tag = on`. The 2022 commits are consistent with a PHP upgrade (mysqli, and removal of a behaviour that broke on newer PHP). No composer file, no `php.ini`, and no vhost are in the tree.

## Known dependencies

| Dependency | Evidence | Status |
|---|---|---|
| Apache | `README.md` | **Documented** |
| PHP 7.4 | `README.md` | **Documented**. Not pinned in code |
| `short_open_tag = on` | `README.md`. Most class files open with `<?` | **Documented** and required by the source style |
| MySQL / MariaDB, database name `pcce` | `include/database/mysql.cls.php` `setDatabase("pcce")` | **Implemented** default |
| PHP `mail()` | Timesheet reminder in `completedtimesheet.cls.php`; test script `temp.php` | **Implemented**. Mail transport is **Unknown** |
| Browser with JavaScript | Menu, timesheet grid, MD5 of the password before submit (`include/javascript/md5.js`) | **Implemented** |

## Implementation notes that affect any future work

- Connection defaults (host, user, and password) are compiled into `include/database/mysql.cls.php`. The password value is not copied into this document.
- A second, older class at the repository root, `mysql.cls.php`, still calls `mysql_*` and is not included by `system.inc.php`.
- `projectbillingrate.php` includes `include/project/projectbillingrate.cls.php`. That file is not in the tree. The class body is in `include/project/zzprojectbillingrate.cls.php`. Project billing rates that are reached from `project.php` use `project.cls.php` instead.
- `user.php` calls `checkSecurity("90")` and `include/general/user.cls.php`. The SQL helpers `sql_user_*` are not defined. Personnel is the live account store.
- Several report pages leave `checkLogin()` commented out (`leave.php`, `incompletetimesheet.php`, `internaldisbursement.php`, `externaldisbursement.php`).
- `phpinfo.php`, `temp.php`, and `write.php` are reachable scripts with no login check.

## Human confirmation

- Is this system still in production, and which host and database does it use?
- Are the menu rows and security-level rows still the operational configuration?
- Should the 2010 dated class copies and the broken `user.php` / `projectbillingrate.php` paths be treated as retired?
- Was the February 2022 mysqli change deployed?
