# Project plan — permits.magus.events

Evidence date: 2026-10-07.

Source repository: `git@bitbucket.org:overdrive/permits.magus.events.git`.

Inspected revision: `master` at `4617ab1` (2022-06-01, "Initial commit"). That commit is `origin/HEAD`. The only remote branch is `master`.

This plan describes what the repository contains. It does not decide what the product should become.

Secrets hardcoded in the tree (database password, SMTP password, shared login secret, a sample identity number, a personal mailbox in a test action) are not copied into this document.

## Product

**permits.magus.events** is a walk-in desk for creating vehicle load-in and load-out permits against one event stored in the shared SA Rugby / Teamwizz database.

A person who knows the shared secret opens a company picker. Choosing a company asks for that company's `passkey`, then opens a "New Permit" form. Submitting the form inserts a row in `Accreditation_Permits` with status `2` and attempts to email the applicant from `accreditation@sarugby.co.za`.

Provenance: **Implemented** (`LoginController::indexAction`, `IndexController::init`, `WalkinsController`, `PermitsController::addpermitAction`, `views/scripts/login/index.phtml`, `views/scripts/walkins/`).

The login page title is "SA Rugby - Load-in and Load-out". The page heading calls the field a PIN. The authenticated layout title is `{AccreditationName} - Permits`, and the footer is "© Sun International". The FAQ names the HSBC World Rugby Sevens Series. Those four labels are all in this tree. Which name is the live product is **Unknown / Requires Confirmation**.

The same tree contains a supplier registration site, a company-member admin, a full permit dashboard, and a large set of rugby models (fixtures, squads, tournaments, food, news). Those pieces are present. The shared-secret session never establishes the `Zend_Auth` identity the company-admin screens expect, and `IndexController::init` redirects every session that has an event id to `/walkins` before the dashboard action can run. See `prd.md` FR-001.

Silicon Ark already documents two relatives:

- `permits.mypass.zone` — the same walk-in controllers and event id `45`, at a later tip (2022-07-01) that also contains CodeDeploy files. This repository has no `appspec.yml` and no pipeline file. Its database host is `teamwizz.com`.
- `supplier.magus.events` — an earlier supplier portal (registration, email login, company permits) cut from the same application shape, with a different session event id.

They are separate remotes. Whether this tree was copied from one of them is **Inferred** from matching class and table names. This document covers `permits.magus.events` only.

## What this repository is

A Zend Framework 1.11.10 PHP application. The root `.htaccess` redirects toward `https://www.{host}` and then sends the request into `public/`. `public/.htaccess` sends non-file requests to `public/index.php`.

The database name in `application/configs/application.ini` is `teamwizz_SARU` on host `teamwizz.com`. Many model classes are not constructed by any controller the walk-in flow can reach. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at that shared database. Whether those tables are still shared with other products is **Unknown / Requires Confirmation**.

No CodeDeploy spec, Bitbucket pipeline, Docker file, or README is in the committed tree. Where this site is hosted is **Unknown / Requires Confirmation**.

## History

Two commits. `c779b77` (2022-05-31, Heinrich du Plessis, `heinrich@overdrive.co.za`) is an empty Bitbucket initial commit whose tree is only `.gitignore`. `4617ab1` (2022-06-01, heinrichoverdrive) adds the application. There are no later commits and no other branches.

| Commit | Date | Author | What changed |
|---|---|---|---|
| `c779b77` | 2022-05-31 | Heinrich du Plessis | Initial commit. Tree is `.gitignore` only. |
| `4617ab1` | 2022-06-01 | heinrichoverdrive | Initial commit. Full application tree. |

## Scope that is in this repository

- Shared-secret gate that stores event id `45` in session namespace `EVENT`.
- Redirect of `/` to `/walkins` when that session exists.
- Company list for the session event, with search.
- Company `passkey` check, then a walk-in permit form.
- Insert of a permit, permit number `PM` plus a zero-padded id, and an attempt to send a confirmation email.
- FAQ text, permit profile screens, duplicate / save / cancel actions.
- Supplier self-registration that links the new company to event id `44` and emails a confirmation link on `supplier.sarugby.online`.

## Scope that is not established

- Who operates the desk. The code does not name a role for the person who knows the shared secret.
- Whether event `45` is still the live event, and what its accreditation name is. The id is hardcoded. The name is read from `Accreditation_List` at runtime.
- Whether any host still serves this tree. No deploy manifest is in Git.
- Who sets `Company_Events.passkey`. Registration does not write it.
- A product owner, a support process, and a roadmap. None are in the repository.
- The files `sonar-project.properties` and `sonarqube_scan.bat` were listed on the scan host when this task was created. They are not in the Git tree at `4617ab1`.

## Architecture (as implemented)

```text
Browser
  -> root .htaccess (www + https redirect, then /public/)
  -> public/.htaccess
  -> public/index.php (timezone Africa/Johannesburg, env production, display_errors on)
  -> Zend_Application (application/configs/application.ini)
  -> module default
       LoginController     shared secret, password reset, unauthenticated event switch
       IndexController     init redirects to /walkins; dashboard code is unreachable
       WalkinsController   company picker and new-permit form
       PermitsController   create, save, duplicate, cancel, FAQ, profile
       RegisterController  supplier registration
       UsersController     company staff (requires Zend_Auth)
       CompanyController   company profile (requires Zend_Auth)
  -> Zend_Db PDO MySQL (teamwizz_SARU on teamwizz.com)
  -> SMTP mail.sarugby.co.za
  -> optional HTTP GET to footprintapp.net for a permit PDF HTML body
```

One module: `application/modules/default`. Custom library namespace `PG_` under `library/PG`. Zend Framework is vendored at `library/Zend`.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Shared-secret login | Sets `EVENT.EID = 45` | `LoginController::indexAction` |
| Walk-in desk | Lists companies and opens the permit form | `WalkinsController`, `walkins/*.phtml` |
| Permit write | Inserts `Accreditation_Permits` and tries to email the applicant | `PermitsController::addpermitAction` |
| Registration | Creates member, company, and `Company_Events` for event `44` | `RegisterController` |
| Dashboard | Permit lists, zone weight, status badges | `IndexController::indexAction`, `index/index.phtml`. Unreachable after login |
| Shared schema models | Rugby, food, news, GIR, accreditation | `application/models/` |

## Milestones visible in Git

1. 2022-05-31 — empty repository created.
2. 2022-06-01 — application imported as one commit.

No later milestone is in this repository.

## Current status

Last commit on `master` is 2022-06-01. There is no `qa`, `prod`, or feature branch. There is no pipeline file, so nothing in this repository deploys itself.

Whether a host still runs this code is **Unknown / Requires Confirmation**.

## Known dependencies

- PHP with the `mcrypt` extension (`mcrypt_create_iv` in registration and password reset). That extension was removed in PHP 7.2. The server PHP version is **Unknown / Requires Confirmation**.
- Zend Framework 1.11.10, vendored.
- MySQL database `teamwizz_SARU` on `teamwizz.com`, including the view `Permits_view` and the table `CompaniesLogin` (used only by an unwired login adapter).
- Apache with `mod_rewrite`. No install script is in this repository.
- SMTP `mail.sarugby.co.za`, port 25, from `accreditation@sarugby.co.za`.
- `https://www.footprintapp.net/pdf/getpermit/id/{id}` for PDF HTML. The call site is on the unreachable dashboard controller.
- Public assets: Limitless theme, dompdf. The login page loads Roboto from Google Fonts.

## Human confirmation

1. Is event id `45` still the event this site should open, and should registration keep using event id `44`?
2. Is the walk-in desk the intended product, or should `/` show the permit dashboard?
3. Which brand is current: SA Rugby load-in, Sun International, or the HSBC World Rugby Sevens Series named in the FAQ?
4. Who is allowed to hold the shared secret, and who sets each company's `passkey`?
5. Is this site still served anywhere? The Git tree has no deploy manifest.
6. Should the hardcoded database password, SMTP password, and shared secret be rotated and removed from the repository?
7. Were `sonar-project.properties` and `sonarqube_scan.bat` local scanner files only, or should they be treated as part of the product?