# Project plan — paymyfines-frontend

Evidence date: 2026-10-07.

Source: `git@bitbucket.org:overdrive/paymyfines-frontend.git`, branch `master` at `8279c82` (2025-02-27, "sonar-project.properties created online with Bitbucket"). Full hash `8279c82cf55d1fe86d34ed3538a802506e11d8d2`. `origin/HEAD` points at `master`. The only remote branch returned by `git branch -a` is `origin/master`.

The scan-host path `~/projects/sonar_scan/repos/paymyfines-frontend` was not on this machine. Findings are from a full clone of `master` at the hash above.

`git rev-list --count HEAD` is 810. The first commit is `2edff36` (2021-05-30, "Initial commit"). The last commit that is not a Bitbucket online pipeline or Sonar file edit is `256c11c` (2022-04-12, "Apply various fixes to production code"). Commits `b2049ed` and `8279c82` on 2025-02-27 add `bitbucket-pipelines.yml` and `sonar-project.properties`.

There is no prior Silicon Ark directory named `paymyfines-frontend`. The source `README.md` is three short sections. Behaviour below is recovered from the React tree, static copy, and the pipeline file on `master`.

Silicon Ark already documents `paymyfines-frontend-new`, `paymyfines-worker`, `paymyfines-pdf-application`, `pmf-frontend-ah`, and `pmf-backend-ah`. This repository does not name those directories. `paymyfines-frontend-new` is a separate snapshot: its home page is a maintenance notice, and this repository's home page is a notice-number search. Whether that other tree is a successor, a fork, or a parallel product is **Unknown / Requires Confirmation**.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Documented.** `README.md` titles the application **Paymyfines** and says it is "An application used by individuals to search, pay and manage their fine information." The browser title is `PayMyFines` (`public/index.html`).

**Documented.** Terms copy in `src/components/TermsAndConditions.js` names the operator as TMT Services & Supplies (Pty) Ltd, registration `2000/022850/07`, referred to as PayMyFines. The same copy names the website `https://all.paymyfines.co.za` and describes a service to check outstanding traffic fines and pay them online, provided no warrant of arrest has been issued.

**Implemented.** The home route renders a notice-number search ("Search by Notice Number" / "FIND YOUR FINES") and the heading "Pay your fines, and get back to the joy of driving." (`src/components/LandingPage.js`).

**Implemented.** The UI searches two fine sources returned by a backend API (eNatis / AARTO and iForce / CPA), holds a cart in browser storage, and posts a card payment to iVeri (Nedsecure Lite). Signed-in users can open outstanding fines, a profile, and transactions. `SUPER_ADMIN` and `ADMIN` can open a dashboard and settings.

**Implemented.** The footer lists payment email `payments@paymyfines.co.za`, other enquiries `help@paymyfines.co.za`, and postal address PO Box 234, Century City, Cape Town, South Africa, 7446. It also shows eNatis, RTIA, and AARTO images (`src/components/common/Footer.js`). The footer is not rendered when the path is `/`.

Whether `https://www.paymyfines.co.za`, `https://all.paymyfines.co.za`, the Amplify hostname in the analytics snippet, or the S3 website in `public/iveri.html` is the host this build serves is **Unknown / Requires Confirmation**.

## Objectives (inferred from the implementation, not from a written plan)

- Let a visitor look up a notice number and open AARTO or CPA detail.
- Let a person register with email, name, ID, and mobile number, confirm the email in Amazon Cognito, and create a user record on the Unity API.
- Let a signed-in customer list fines from eNatis and iForce, filter them, and add payable fines to a cart.
- Charge a configurable convenience fee per cart line and take payment in South African Rand through iVeri.
- Show the iVeri return status and clear the cart when the return query says success.
- Let the customer edit profile details, extra ID numbers, and their Cognito password, and list past transactions.
- Let an admin edit settings returned by the API (including email templates and the convenience fee) and dashboard graph definitions, and view graphs and a finance report for a date range.

## Scope

### In the tree on `master`

1. Create React App UI (React 17, React Router 5, React Bootstrap).
2. Cognito sign-in, sign-up, email confirmation, password change, and password reset.
3. Calls to one Amplify API named `unity` (API Gateway URL in `src/aws-config.js`).
4. Fine list and detail for eNatis and iForce payloads returned by that API.
5. Cart and iVeri Lite checkout.
6. Admin dashboard (`/getgraphs`, `/reports`) and admin settings (`/getsettings`, `/postsettings`, graph settings).
7. Static About, Terms, and Privacy pages.
8. A Bitbucket pipeline on `{master}` that runs a SonarQube scan and does not deploy.
9. A Windows SonarScanner batch file (`sonar-scanner.bat`) that expects a local scanner install at `C:\sonar-scanner`.

### Not in this tree

- No application server, database schema, or Lambda source. The API is an external HTTP dependency.
- No Dockerfile, no `.env` sample, and no committed `build/` directory.
- No GitHub Actions workflows.
- No contact-us form component and no `/contactus` route. Terms copy refers to a "Contact Us" service. That screen is **Unknown** in this repository.
- No route named `/quickidfinesearch`. Home search is notice-number only.
- `AdminDashboardTest` is imported in `src/config/RoutingConfig.js` only inside comments. It is not a reachable route.
- Pivot-table components, `RequestsAPI.js`, `useFormFields`, FullCalendar, and `react-trello` are present as files or dependencies. No screen in the route table imports them.

## System architecture

```text
Browser (Create React App)
  ├─ React Router + localStorage roles
  ├─ Amazon Cognito (user pool in src/aws-config.js)
  ├─ Amplify API name "unity"
  │    └─ API Gateway eu-west-1, stage path /development
  ├─ iVeri Lite form POST
  │    └─ https://portal.nedsecure.co.za/Lite/Authorise.aspx
  ├─ Return URLs on the same API Gateway (/iveripayment)
  └─ Analytics
       ├─ Matomo at analytics.siliconsoftware.net (site id 2)
       ├─ Google tag G-6M1WRZYG8D
       └─ Admin page Google Analytics Reporting API (placeholder view id)
```

S3 bucket `tmt-pmf-uploads` and a storage block are configured in Amplify. No `Storage.` call was found under `src/`. Whether uploads happen is **Unknown**.

`public/iveri.html` is a static redirect to `http://pay-my-fines.s3-website-eu-west-1.amazonaws.com/PaymentNotification` plus the query string. `documentation/iveri.php` redirects to the `veriLocation` query value plus `/PaymentNotification`. `Cart.js` comments out a `video.medmin.co.za/iveri.php` URL and posts return URLs to the API Gateway `/iveripayment` path instead. Which of these return paths is live is **Unknown / Requires Confirmation**.

## Major components

| Area | Location |
|---|---|
| Route table and roles | `src/config/RoutingConfig.js`, `src/config/Roles.js`, `src/utils/index.js` |
| Shell | `src/App.js`, `src/routes/`, `src/components/common/TopNav.js`, `Footer.js` |
| Search | `LandingPage.js`, `QuickFineSearch.js` |
| Fine detail | `AARTOFineDetails.js`, `CPAFineDetails.js` |
| Account | `Login.js`, `Register.js`, `ForgotPassword.js`, `Profile.js` |
| Pay | `OutstandingFines.js`, `Cart.js`, `PaymentNotification.js` |
| Admin | `AdminDashboard.js`, `AdminSettings.js`, `AdminAnalytics.js` |
| API helper | `src/components/unityRequests.js` |
| Endpoints and Cognito ids | `src/aws-config.js` |

## Milestones

No written milestone plan is in the repository. The commit history is the only timeline:

| When | What the history shows |
|---|---|
| 2021-05-30 | `2edff36` Initial commit |
| 2021-06 | Early pages, login, and package fixes (`93ce43b`, `dfe4f22`, `98dd02b`, and following commits) |
| 2022-02-03 | ID number and cart field fixes, and merged `ui_fixes` pull requests (`7762da6`, `03ffb10`, `#182`–`#184`) |
| 2022-02-17 to 2022-02-18 | Forgot-password validation and `updateregistration` (`65f8afc`, `cbe19bf`) |
| 2022-04-12 | `256c11c` "Apply various fixes to production code" |
| 2025-02-27 | SonarQube pipeline files only |

A feature-by-feature reconstruction of all 810 commits was not done. Anything between those markers that is not visible in the current tree is **Unknown**.

## Known dependencies

Runtime libraries are in `package.json` (see technical documentation). External systems the UI calls:

- Amazon Cognito user pool `eu-west-1_8MkXacpCX`, app client `k607qc16a64ln1jq44kth31li`
- API Gateway `https://h8vzvoqq9c.execute-api.eu-west-1.amazonaws.com/development`
- iVeri / Nedsecure Lite
- Google reCAPTCHA (site key in `src/config/google.js`, verified by `POST /recaptcha`)
- Matomo and Google Analytics / Google Sign-In for the admin analytics page
- eNatis and iForce, only as payload keys returned by the Unity API. This repository does not call those systems directly.

`README.md` says the benefit of the app is "Using Amplify / lambda". Lambda source is not in this repository.

## Current project status

**Implemented** as a client application on `master`, last application-looking commit 2022-04-12, with Sonar configuration added in 2025. There is no deploy step in `bitbucket-pipelines.yml`. Hosting is implied by the Matomo domain filter `*.master.d39rr3ejryd4rk.amplifyapp.com` and by the S3 website URL in `public/iveri.html`. Which environment this commit is deployed to is **Unknown / Requires Confirmation**.

`package.json` name is `role-based-access-control` version `0.1.0`. `Roles.js` comments that the role names are placeholders. The product name in the UI is Paymyfines.

## Items requiring confirmation

- Whether this repository is still the production PayMyFines site, or whether `paymyfines-frontend-new` replaced it.
- The live hostname, and whether the API stage path `/development` is used in production.
- The meaning of `paymentNotAllowedCode` value `3`.
- The shape of `strRole` returned by `GET /user/details` (the UI `JSON.parse`s it).
- Whether a warrant of arrest blocks payment in the API. The terms say it does. This UI does not test a warrant field before enabling Add to Cart.
- Whether email templates, convenience fee, and graph SQL edited in admin settings are an approved operational process.
- The Google Analytics view id. `AnalyticsReport.js` still contains the placeholder `YOUR_VIEW_ID`.