# Project plan — permits.mypass.zone Evidence date: 2026-10-07. Source repository: `git@bitbucket.org:overdrive/permits.mypass.zone.git`. Inspected revision: `master` at `16d1793` (2022-07-01, "Updated codedeploy"). That commit is `origin/HEAD`. This plan describes what the repository contains. It does not decide what the product should become. Secrets hardcoded in the tree (database password, SMTP password, shared login PIN, a sample identity number, a personal mailbox in a test action) are not copied into this document. ## Product **permits.mypass.zone** is a walk-in desk for creating vehicle load-in and load-out permits at one SA Rugby event. A person who knows the shared PIN opens a company picker. Choosing a company asks for that company's `passkey`, then opens a "New Permit" form. Submitting the form inserts a row in `Accreditation_Permits` with status `2` and emails the applicant from `accreditation@sarugby.co.za`. Provenance: **Implemented** (`LoginController::indexAction`, `IndexController::init`, `WalkinsController`, `PermitsController::addpermitAction`, `views/scripts/login/index.phtml`, `views/scripts/walkins/`). The login page title is "SA Rugby - Load-in and Load-out". The authenticated layout title is `{AccreditationName} - Permits`. Provenance: **Implemented** (`login/index.phtml`, `application/layouts/default.phtml`). The same tree contains a supplier registration site, a company-member admin, a full permit dashboard, and a large set of rugby models (fixtures, squads, tournaments, food, news). Those pieces are present. The PIN session never establishes the `Zend_Auth` identity they expect, and `IndexController::init` redirects every session that has an event id to `/walkins` before the dashboard action can run. See `prd.md` FR-001. A sibling repository, `track.mypass.zone`, shares this controller and model set and was later pointed at a tracking dashboard. That relationship is **Inferred** from matching class and table names and from the Silicon Ark document for track. The two trees are not the same revision. Track's PIN session uses a different event id and lands on `/`. This repository's PIN session uses event id `45` and lands on `/walkins`. ## What this repository is A Zend Framework 1.11.10 PHP application. Apache document root is `public/`. CodeDeploy copies the tree to `/mnt/data/www/html/mypass.zone/permits.mypass.zone/`. The database name in configuration is `teamwizz_SARU` on host `localhost`. Many model classes are not called by any controller action that the PIN flow can reach. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at that shared database. Whether those tables are still shared with other products is **Unknown / Requires Confirmation**. ## History Three commits, 2022-06-23 to 2022-07-01. | Commit | Date | Author | What changed | |---|---|---|---| | `cd72ab2` | 2022-06-23 | Heinrich du Plessis | Initial commit | | `2230b19` | 2022-06-24 | heinrichoverdrive | Initial commit | | `16d1793` | 2022-07-01 | heinrichoverdrive | CodeDeploy: `appspec.yml`, `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `scripts/` | No application-code commit exists after the initial import. Provenance: **Implemented** (git history). ## Scope that is in this repository - Shared-PIN gate that stores event id `45` in session namespace `EVENT`. - Redirect of `/` to `/walkins` when that session exists. - Company list for the session event, with search. - Company `passkey` check, then a walk-in permit form. - Insert of a permit, permit number `PM` plus a zero-padded id, confirmation email. - FAQ text, permit profile screens, duplicate / save / cancel actions. - Supplier self-registration that links the new company to event id `44` and emails a confirmation link on `supplier.sarugby.online`. - AWS CodeDeploy packaging for Bitbucket branches `qa` and `prod`. ## Scope that is not established - Who operates the desk (SA Rugby staff, venue security, or a supplier). The code does not name a role for the PIN holder. - Whether event `45` is still the live event, and what its accreditation name is. The id is hardcoded. The name is read from `Accreditation_List` at runtime. - Whether the `prod` branch has been deployed, and whether the site is still served. - Who sets `Company_Events.passkey`. Registration does not write it. - A product owner, a support process, and a roadmap. None are in the repository. ## Architecture (as implemented) ```text Browser -> Apache public/.htaccess -> public/index.php (timezone Africa/Johannesburg, env production) -> Zend_Application (application/configs/application.ini) -> module default LoginController PIN, password reset, unauthenticated event switch IndexController init redirects to /walkins; dashboard code is unreachable WalkinsController company picker and new-permit form PermitsController create, save, duplicate, cancel, FAQ, profile RegisterController supplier registration UsersController company staff (requires Zend_Auth) CompanyController company profile (requires Zend_Auth) -> Zend_Db PDO MySQL (teamwizz_SARU on localhost) -> SMTP mail.sarugby.co.za -> optional HTTP GET to footprintapp.net for a permit PDF HTML body ``` One module: `application/modules/default`. Custom library namespace `PG_` under `library/PG`. Zend Framework is vendored at `library/Zend`. ## Major components | Component | Role | Evidence | |---|---|---| | PIN login | Sets `EVENT.EID = 45` | `LoginController::indexAction` | | Walk-in desk | Lists companies and opens the permit form | `WalkinsController`, `walkins/*.phtml` | | Permit write | Inserts `Accreditation_Permits`, emails the applicant | `PermitsController::addpermitAction` | | Registration | Creates member, company, and `Company_Events` for event `44` | `RegisterController` | | Dashboard | Permit lists, zone weight, status badges | `IndexController::indexAction`, `index/index.phtml`. Unreachable after login | | Shared schema models | Rugby, food, news, GIR, accreditation | `application/models/` | | CodeDeploy | Zip, S3, CodeDeploy on `qa` and `prod` pushes | `bitbucket-pipelines.yml`, `appspec.yml` | ## Milestones visible in Git 1. 2022-06-23 — application imported. 2. 2022-06-24 — second initial commit. 3. 2022-07-01 — CodeDeploy scripts added on `master`. No later milestone is in this repository. ## Current status Last commit on `master` is 2022-07-01. Remote branches: `master`, `prod`, `ui-changes`. There is no `qa` branch. The pipeline file only runs on `qa` and `prod`, so the `master` tip does not deploy by itself. Provenance: **Implemented** (git refs and `bitbucket-pipelines.yml`). Whether `prod` or `ui-changes` match `master`, and whether any environment is still running, is **Unknown / Requires Confirmation**. ## Known dependencies - PHP with the `mcrypt` extension (`mcrypt_create_iv` in registration and password reset). That extension was removed in PHP 7.2. The server PHP version is **Unknown / Requires Confirmation**. - Zend Framework 1.11.10, vendored. - MySQL database `teamwizz_SARU`, including views `Permits_view` and `CompaniesLogin` (used only by an unwired login adapter). - Apache (`httpd`), installed by `scripts/install_dependencies`. - AWS CodeDeploy, S3, and Bitbucket pipeline variables for the `prod` (and a missing `qa`) branch. - SMTP `mail.sarugby.co.za`. - `https://www.footprintapp.net/pdf/getpermit/id/{id}` for PDF HTML. The call site is on the unreachable dashboard controller. - Public assets: Limitless theme, dompdf, CKEditor. Google Fonts and Font Awesome are loaded from the internet by the login page. ## Human confirmation 1. Is event id `45` still the event this site should open, and should registration keep using event id `44`? 2. Is the walk-in desk the intended product, or should `/` show the permit dashboard the way `track.mypass.zone` does? 3. Who is allowed to hold the shared PIN, and who sets each company's `passkey`? 4. Is `prod` deployed, and is the site still in use? 5. Should the hardcoded database password, SMTP password, and PIN be rotated and removed from the repository?