# Project plan — paymyfines-frontend-new

Evidence date: 2026-10-07.

Source: `git@bitbucket.org:overdrive/paymyfines-frontend-new.git`, branch `main` at `a335e20` (2025-02-27, "bitbucket-pipelines.yml edited online with Bitbucket"). Full hash `a335e20139975fffafe50478d1b884fe49b30668`. `origin/HEAD` points at `main`. The only remote branch is `origin/main`.

History on that remote is five commits, all dated 2025-02-27:

| Commit | Author | Subject |
|---|---|---|
| `916a00b` | Jaco Brits | Initial commit (`.gitignore` only) |
| `f7711bf` | Jaco Brits | `bitbucket-pipelines.yml` created online with Bitbucket |
| `67f6607` | Jaco Brits | `sonar-project.properties` created online with Bitbucket |
| `5777512` | Jaco Brits (`jaco@netstart.co.za`) | `new commit` — bulk import of the React application, `build/`, GitHub Actions workflows, and scanner output |
| `a335e20` | Jaco Brits | `bitbucket-pipelines.yml` edited online with Bitbucket |

The scan-host path `~/projects/sonar_scan/repos/paymyfines-frontend-new` was not on this machine. Findings are from the git revision above.

There is no prior Silicon Ark directory for `paymyfines-frontend-new`. The source `README.md` is three short sections. Behaviour below is recovered from the React tree, static copy, and the pipeline files committed on `main`.

Silicon Ark already documents `pmf-frontend-ah`, `pmf-backend-ah`, `paymyfines-worker`, and `paymyfines-pdf-application`. This repository does not name those directories. Whether they are the same product, a predecessor, or unrelated is **Unknown / Requires Confirmation**.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Documented.** `README.md` titles the application **Paymyfines** and says it is "An application used by individuals to search, pay and manage their fine information." The browser title is `PayMyFines` (`public/index.html`).

**Documented.** Terms copy in `src/components/TermsAndConditions.js` names the operator as TMT Services & Supplies (Pty) Ltd, registration `2000/022850/07`, referred to as PayMyFines. The same copy names the website `https://all.paymyfines.co.za` and describes a service to check outstanding traffic fines and pay them online, provided no warrant of arrest has been issued.

**Implemented.** The UI can search two fine sources returned by a backend API (eNatis / AARTO and iForce / CPA), hold a cart in browser storage, and post a card payment to iVeri (Nedsecure Lite). Signed-in users can open outstanding fines, a profile, and transactions. `SUPER_ADMIN` and `ADMIN` can open a dashboard and settings.

**Implemented.** The home route currently renders a maintenance notice instead of the search form. The search function is still in `src/components/LandingPage.js` and is not called from the rendered markup.

Whether `https://www.paymyfines.co.za`, `https://all.paymyfines.co.za`, the Amplify hostname in the analytics snippet, or the S3 website in `public/iveri.html` is the host this build serves is **Unknown / Requires Confirmation**.

## Objectives (inferred from the implementation, not from a written plan)

- Let a visitor look up a notice number or a South African ID number and open AARTO or CPA detail. The lookup code exists. The home screen does not currently show the form.
- Let a person register with email, name, ID, and mobile number, confirm the email in Amazon Cognito, and create a user record on the Unity API.
- Let a signed-in customer list fines from eNatis and iForce, filter them, and add payable fines to a cart.
- Charge a configurable convenience fee per cart line and take payment in South African Rand through iVeri.
- Show the iVeri return status and clear the cart when the return query says success.
- Let the customer edit profile details, extra ID numbers, and their Cognito password, and list past transactions.
- Let an admin edit settings returned by the API (including email templates and the convenience fee) and dashboard graph definitions, and view graphs and a finance report for a date range.

## Scope

### In the tree on `main`

1. Create React App UI (React 17, React Router 5, React Bootstrap).
2. Cognito sign-in, sign-up, email confirmation, password change, and password reset.
3. Calls to one Amplify API named `unity` (API Gateway URL in `src/aws-config.js`).
4. Fine list and detail for eNatis and iForce payloads returned by that API.
5. Cart and iVeri Lite checkout.
6. Admin dashboard (`/getgraphs`, `/reports`) and admin settings (`/getsettings`, `/postsettings`, graph settings).
7. Static About, Terms, Privacy, and a Contact Us form.
8. GitHub Actions files that build with Yarn and sync `build/` to S3. A QA workflow is in the tree. A production workflow is manual (`workflow_dispatch` only).
9. A Bitbucket pipeline on `{main}` that runs a SonarQube scan and does not deploy.

### Present in the tree and not on the main navigation

- `QuickFineSearch` is routed at `/quickfinesearch` with `canNavigate: false`.
- `AdminAnalytics` is routed at `/adminAnalytics` with `canNavigate: false`. Its nav child is commented out. The component loads Google `gapi` auth and a report whose view id is the placeholder `YOUR_VIEW_ID`.
- `AdminDashboardTest` and its route are commented out in `src/config/RoutingConfig.js`. The component and `src/components/dashboardTestData.js` remain in the tree.
- Pivot table files (`Pivot.js`, `PivotTable.jsx`, `PivotTableUI.jsx`, `Utilities.js`, renderers) are not imported by the route table.
- `src/components/RequestsAPI.js` (a `fetch` wrapper) has no callers in `src`.
- The home search handler is unused by the JSX that `LandingPage` returns.

### Not in this repository

- The Unity API implementation, databases, and payment settlement.
- How a paid fine is written back to eNatis or iForce. The UI tells the user that external update can take up to 4 hours. That sentence is in `OutstandingFines.js`. The worker that would do the update is not in this repo.
- Assignment of `strRole`. The UI stores whatever `/user/details` returns.

## System architecture

```text
Browser (Create React App)
  ├─ Amazon Cognito (user pool selected in src/aws-config.js)
  ├─ Amplify API name "unity" → API Gateway (eu-west-1)
  │     └─ paths such as /getpaginatedfines, /postiveritransaction, /register
  ├─ Amplify Storage → S3 invoice bucket named in aws-config.js
  └─ iVeri Lite form POST → https://portal.nedsecure.co.za/Lite/Authorise.aspx
        return URLs → API Gateway /iveripayment
        documentation/iveri.php redirects the query string to /paymentNotification

Role gate: localStorage key "roles", filtered in src/utils/index.js
Cart and profile: browser localStorage
Analytics snippets in public/index.html: Matomo and Google Analytics
```

Environment choice is the page origin. `https://www.paymyfines.co.za` selects the `prod` block in `src/aws-config.js`. Every other origin, including localhost, selects `dev`.

## Major components

| Area | Location | Role |
|---|---|---|
| Routes and roles | `src/config/RoutingConfig.js`, `src/config/Roles.js`, `src/routes/` | Which screen a role may open |
| AWS clients | `src/index.js`, `src/aws-config.js` | Cognito, S3, API Gateway |
| API helper | `src/components/unityRequests.js` | GET/POST to the `unity` endpoint |
| Home | `src/components/LandingPage.js` | Maintenance notice; unused search function |
| Fines | `OutstandingFines.js`, `AARTOFineDetails.js`, `CPAFineDetails.js`, `QuickFineSearch.js` | List and detail |
| Cart and payment return | `Cart.js`, `PaymentNotification.js`, `public/iveri.html`, `documentation/iveri.php` | Checkout and return |
| Account | `Login.js`, `Register.js`, `ForgotPassword.js`, `Profile.js`, `Transactions.js` | Cognito and Unity user |
| Admin | `AdminDashboard.js`, `AdminSettings.js` | Graphs, finance report, settings |
| Content | `About.js`, `ContactUs.js`, `TermsAndConditions.js`, `PrivacyPolicy.js` | Static pages and contact form |

## Milestones

No milestone plan, roadmap, or issue tracker is in the repository.

What the git history shows:

1. **2025-02-27** — repository created with a Bitbucket `.gitignore`.
2. **2025-02-27** — SonarQube pipeline files added on Bitbucket.
3. **2025-02-27** — application tree imported in one commit (`5777512`), including a production `build/` directory, `.scannerwork/`, `.vs/`, GitHub Actions workflows, and `yarn.lock` plus `package-lock.json`.
4. **2025-02-27** — Bitbucket pipeline memory setting added (`definitions.services.docker.memory: 3072`).

There are no commits after that date on `origin/main`.

## Implementation plan

No written implementation plan exists in the repository. The running shape is the imported React app plus a SonarQube pipeline on `main`.

## Known dependencies

- Node tooling expected by the GitHub workflows: Node `12.x`, Yarn, `react-scripts` `4.0.3`.
- Amazon Cognito, API Gateway, and S3 in `eu-west-1`.
- iVeri / Nedsecure Lite.
- Backend responses shaped as eNatis and iForce payloads. The UI names those systems. It does not call them directly.
- Google reCAPTCHA v2 site key in `src/config/google.js`, verified by `POST /recaptcha`.
- Matomo at `analytics.siliconsoftware.net` (site id `2`) and Google Analytics `G-6M1WRZYG8D`.

## Current project status

**Implemented** as a frontend snapshot on `main`, last touched 2025-02-27 for pipeline configuration.

**Implemented** home screen: maintenance copy, telephone `+27 21 126 0600`, email `payments@tmt.africa`.

**Unknown / Requires Confirmation:** whether this snapshot is what is deployed to production, whether the GitHub Actions workflows still run (the Bitbucket remote has no `development`, `qa`, or `master` branch), and whether the maintenance notice is intentional ongoing behaviour.