# Project plan — pernod_ricard

Evidence date: 2026-10-07.

Source repository: `git@bitbucket.org:overdrive/pernod_ricard.git`.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The application is the Pernod Ricard South Africa supplier portal. The supplier home caption is "Welcome to the PRSA Supplier Portal". The site root sends the browser to `http://www.prsa-supplierportal.co.za/supplier`. Host keys in `supplier/system.php` and `webadmin/system.php` are `debian`, `lamp`, `dev.overdrive.co.za`, and `www.prsa-supplierportal.co.za`. A bare host `prsa-supplierportal.co.za`, or a missing server name, is rewritten to the `www` host.

Signed-in suppliers capture invoices and upload supporting files. Pernod Ricard users work in `/webadmin/`: they maintain suppliers, users, invoices, remittances, reports, email templates, FAQ, settings, security groups, and AP teams. A daily script assigns due dates, moves invoice status, reads a JDE payment file from disk, and sends escalation mail.

Provenance: **Implemented** (`index.php`, `supplier/index.php`, `supplier/my.invoice.php`, `webadmin/invoice.php`, `webadmin/cron.daily.php`). There is no product requirements document in the source repository. Inline comments dated 2014–2018 describe behaviour that predates this Git history.

Silicon Ark also has `pernod-ricard-prod/`, documented from `git@bitbucket.org:overdrive/pernod-ricard-prod.git` (tip inspected 2026-06-11). That repository uses the same public host and the same supplier / webadmin split. This document set is only `pernod_ricard` at `24c1e12`. Whether one repository was copied from the other is **Unknown / Requires Confirmation**.

## Branch reality

Default branch is `master`. `origin/HEAD` points at `master`. After a full fetch, only `master` is present on the remote. There are no tags.

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` | `24c1e12` | 2020-11-18 | "bitbucket-pipelines.yml edited online with Bitbucket". 20 commits from `9d529ab` (2020-11-16, "Initial commit") |

This documentation set is based on `master` at `24c1e1273886b76f61492eeba2ac6b4be38086e5`.

The last application change on that history is `e6500d1` (2020-11-18, "added submit button to submit invoice to JDE"), which edits `supplier/my.invoice.php`. Later commits on the same day only edit `bitbucket-pipelines.yml`.

`bitbucket-pipelines.yml` also defines a `development` pipeline. That branch is not on the remote.

The onboarding scan that created this task recorded the same tip `24c1e12` and listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in the tree at `24c1e12`. Provenance of those two names: **Unknown** — they may have been untracked on the scan host.

Which environment is deployed, and whether production still matches `24c1e12`, is **Unknown / Requires Confirmation**.

## Scope in the repository

In scope of what is implemented on `master`:

- Two PHP applications that share configuration for one MySQL database: `supplier/` and `webadmin/`.
- A custom page framework whose classes are named `Nemo*` (`_framework/` in each application).
- Email-and-password sign-in for both applications. Supplier sign-in does not send a one-time code. Webadmin sign-in does not use Microsoft Azure AD.
- Invoice capture, document upload, manual pay and undo, invoice query email, remittances, two reports, FAQ maintenance, email templates, users, security groups, settings, and AP teams.
- A daily script, `webadmin/cron.daily.php`, for due dates, status changes, a JDE payment CSV import, and emails.
- Bitbucket Pipelines that deploy with `git ftp` to a QA host path.

Out of scope of the code that was found, or not present as a committed application:

- A JDE voucher-match or invoice-submit API. The supplier toolbar shows "Submit Invoice". No action handler and no outbound JDE call for that button were found.
- A download of the JDE payment file. `cron.daily.php` sets the download directory to the literal `???` and leaves `download_files` commented. Import reads files already in `webadmin/documents/payments/`.
- Automated product tests. No test project was found. `.gitignore` mentions `TEST*.xml`.
- SonarQube project files. They are not in this commit.
- A migration runner or committed schema dump. Table shapes are implied by SQL in the PHP classes. Whether those tables exist in any environment is **Unknown / Requires Confirmation**.

## System architecture

```text
Browser
  |
  |-- /  index.php  -->  http://www.prsa-supplierportal.co.za/supplier
  |-- /supplier/   PHP + Nemo framework   session key SUPPLIER
  |-- /webadmin/   PHP + Nemo framework   session key USER
  |
  +-- MySQL (mysqli)
        sysUser, sysSecurityGroup, sysSecurity, sysPassword, sysLogin, sysSettings
        tblInvoice, tblSupplier, tblAPTeam, tblPayment, tblEmail, ...
  |
  +-- filesystem sessions (SESSION/ under the app, path depends on host)
  +-- invoice files under the path in sysSettings SUPPLIER_Document_Path
  +-- JDE payment CSV files under webadmin/documents/payments/
  |
  +-- SMTP via NemoEmail, using sysSettings "SMTP Send As" and "SMTP BCC"
```

Provenance: **Implemented** in the entry scripts, `system.php` files, and the classes named above. The live contents of `sysSettings` and the menu tables are **Unknown**.

## Major components

| Component | Role |
|---|---|
| `index.php` | Redirects the site root to the supplier host path |
| `supplier/` | Supplier login, terms and password gate, own invoices, profile, reports, password reset |
| `webadmin/` | Staff login, invoices, suppliers, users, security, settings, remittances, reports, email, FAQ, AP teams, daily script |
| `_framework/` | Shared Nemo list, details, menu, email, password, and database classes. Each app has its own copy |
| `webadmin/PHPExcel/`, `webadmin/fpdi/`, `webadmin/Excel/` | Vendored spreadsheet and PDF libraries |
| `bitbucket-pipelines.yml` | `git ftp` deploy of `master` and a defined `development` pipeline |

## Milestones visible in comments and commits

These dates are comments or commit messages, not a signed project plan.

| When | What the repository records |
|---|---|
| 2014-11-26 | Comment: switch to mysqli (`system.php`) |
| 2016-04 to 2016-11 | Comments: invoice screens, department filter, password policy, terms on first login, pay and undo, file uploads |
| 2017-01 | Comments: credit-note upload, welcome email uses supplier email, default contact |
| 2017-11-02 | Comment: "Hetzner Breach Reset All FTP/DB details" |
| 2018-07 to 2018-10 | Comments: Phase 2 payment import, paid-invoice email, payments exception report, mailing-address change |
| 2020-11-16 | Git initial commit of the tree |
| 2020-11-18 | Submit Invoice toolbar button; Bitbucket Pipelines `git ftp` to QA |

There is no roadmap file and no open work marked as planned after `24c1e12`.

## Known dependencies

- PHP with the `mysqli` extension. No `composer.json` and no pinned PHP version.
- MySQL databases named in config: `pernodricard_2016` for the `debian`, `lamp`, and `dev.overdrive.co.za` keys; `pernoricard_2016` for `www.prsa-supplierportal.co.za`. The production spelling drops the `d` in "pernod". Whether that database name is intentional is **Unknown / Requires Confirmation**.
- Host-h.net MySQL hosts for QA and production. Local keys use `192.168.100.6` and `localhost`.
- `git-ftp` in the pipeline image `python:3.5.7`. The application itself is not Python.
- Email templates stored in the database and loaded by name (`Reset Password`, `Send Welcome Email`, `Invoice Query`, `Invoice Paid`, `Paid Invoices to Supplier`, `Payments Exception Report`, `Due Invoices`, `Overdue Invoices`).
- Pipeline secrets `FTP_USERNAME_QA`, `FTP_PASSWORD_QA`, and `FTP_HOST_QA`. The values are not in the repository.

## Current project status

The Git repository stopped on 2020-11-18. The tree is a complete PHP application, not a stub. Several behaviours in that tree are unfinished or switched off in code:

- "Submit Invoice" is drawn on the supplier invoice form and has no matching `Action` case and no JDE call.
- Inactive-account suspension (task 4) sits inside a `TESTING` case, and the SQL inside it is commented out. The default cron path does not run it.
- The paid-invoice supplier email (task 6) updates `tblPayment.strProcessStatus` to `Processed` and then leaves `$nemoEmail->Send()` commented out.
- The JDE download directory is the literal string `???`.

Provenance: **Implemented** as those code paths. Whether a later repository replaced this one in production is **Unknown / Requires Confirmation**. See `pernod-ricard-prod` in Silicon Ark for a 2026 codebase on the same public host.