# Project plan — pmf-frontend-ah (PayMyFines)

Evidence date: 2026-10-06.

Source repository: `git@bitbucket.org:overdrive/pmf-frontend-ah.git`.

Inspected revision: `master` at `3e8d2a5` (2022-05-06, message `After handover commit`). The only other commit is `ae541e8` the same day (`Initial commit`). Remote branches: `origin/master` only. The scan-host path `~/projects/sonar_scan/repos/pmf-frontend-ah` was not on this machine. The tree was read from that git revision.

There is no prior Silicon Ark directory for this project. The source `README.md` is three short sections. Behaviour below is recovered from the React tree, GitHub Actions workflows, and static copy.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Documented.** `README.md` titles the application **Paymyfines** and says it is "An application used by individuals to search, pay and manage their fine information." The browser title is `PayMyFines` (`public/index.html`).

**Documented.** Terms copy in `src/components/TermsAndConditions.js` names the operator as TMT Services & Supplies (Pty) Ltd, registration `2000/022850/07`, trading as PayMyFines, and names the website `https://all.paymyfines.co.za`. The service described there is checking outstanding traffic fines and paying them online, provided no warrant of arrest has been issued.

**Implemented.** The UI searches two fine sources (eNatis / AARTO and iForce / CPA), holds a cart, and posts a card payment to iVeri (Nedsecure Lite). Signed-in users see outstanding fines, a profile, and transactions. `SUPER_ADMIN` and `ADMIN` see a dashboard and settings.

Whether `https://all.paymyfines.co.za` is what this build serves in production is **Unknown / Requires Confirmation**. The repo also names an Amplify host and an S3 website (see technical documentation).

## Objectives (inferred from the implementation, not from a written plan)

- Let a visitor search a notice number without an account and see AARTO or CPA detail.
- Let a person register with email, name, ID, and mobile number, confirm the email in Amazon Cognito, and link a Unity user record.
- Let a signed-in customer list fines from eNatis and iForce, filter them, and add payable fines to a cart.
- Charge a configurable convenience fee per cart line and take payment in South African Rand through iVeri.
- Show the iVeri return status and clear the cart on success.
- Let the customer edit profile details, extra ID numbers, and their Cognito password, and list past transactions.
- Let an admin change email templates, the convenience fee, and dashboard graph definitions, and view graphs and a finance report for a date range.

## Scope

### In scope of `master`

1. Create React App UI (React 17, React Router 5, React Bootstrap).
2. Cognito sign-in, sign-up, email confirmation, password change, and password reset.
3. Calls to one Amplify API named `unity` (API Gateway URL hardcoded in `src/aws-config.js`).
4. Fine search and detail for eNatis and iForce payloads returned by that API.
5. Browser-local cart and checkout form posted to `https://portal.nedsecure.co.za/Lite/Authorise.aspx`.
6. Admin dashboard graphs and settings screens.
7. Static About, Terms, and Privacy pages.
8. GitHub Actions that build with Yarn on Node 12 and sync `build/` to S3. Production also invalidates CloudFront.

### Out of scope of this repository

- The Unity / Lambda API that implements `/getfinesearch`, `/register`, `/postiveritransaction`, and the other paths this UI calls.
- eNatis, iForce, and iVeri themselves, beyond the request and form fields this UI sends.
- How a user's `strRole` is assigned. The UI only reads it.
- Whether a warrant of arrest is enforced. The terms state it. The UI only reacts to `paymentNotAllowedCode` and `customerPaymentAllowed`.
- A contact form. The footer is mailto links only.

## System shape

```text
Browser (React SPA)
  ├─ Amazon Cognito (eu-west-1 user pool in aws-config.js)
  ├─ API Gateway "unity" (production stage URL in aws-config.js)
  │    └─ returns eNatis and iForce fine payloads, users, settings, graphs, transactions
  ├─ iVeri Lite (portal.nedsecure.co.za) — card form POST
  │    └─ return URLs point at {apiGateway}/iveripayment, which is expected to land on /paymentNotification
  ├─ S3 bucket tmt-pmf-prod-invoices (Amplify Storage config; no upload call found in src/)
  └─ Matomo (analytics.siliconsoftware.net, site id 2) and Google Analytics G-6M1WRZYG8D
```

Role gating is client-side. `src/utils/index.js` treats a missing `localStorage.roles` value as `GUEST` and shows routes whose `permission` array intersects the parsed roles. Empty `permission` arrays are shown to everyone (`/aartofinedetails`, `/cpafinedetails`).

## Major components

| Area | Location | Status |
|---|---|---|
| Route table and roles | `src/config/RoutingConfig.js`, `src/config/Roles.js` | Implemented |
| Auth screens | `src/components/Login.js`, `Register.js`, `ForgotPassword.js` | Implemented |
| Public search | `src/components/LandingPage.js`, `QuickFineSearch.js` | Landing search implemented. Quick Fine Search route exists with `canNavigate: false` |
| Fine lists and detail | `OutstandingFines.js`, `AARTOFineDetails.js`, `CPAFineDetails.js` | Implemented |
| Cart and payment return | `Cart.js`, `PaymentNotification.js` | Implemented |
| Profile and transactions | `Profile.js`, `Transactions.js` | Implemented |
| Admin | `AdminDashboard.js`, `AdminSettings.js` | Implemented |
| Admin analytics route | `AdminAnalytics.js` at `/adminAnalytics` | Routed with `canNavigate: false`. Not in the Admin menu |
| Dashboard test | `AdminDashboardTest.js` | Present. Route entries are commented out |
| Marketing / legal | `About.js`, `TermsAndConditions.js`, `PrivacyPolicy.js`, `common/Footer.js` | Implemented as static copy |
| iVeri HTML/PHP helpers | `public/iveri.html`, `documentation/iveri.php` | In the repo. Checkout does not use them |

## Milestones visible in git

| When | Commit | What it shows |
|---|---|---|
| 2022-05-06 | `ae541e8` Initial commit | First commit on `master` |
| 2022-05-06 | `3e8d2a5` After handover commit | Current tip. No later commits on `origin/master` |

There is no milestone plan, changelog, or issue tracker in the repository.

## Implementation plan

No forward plan is written in the repository. Workflows still exist for branches `dev` and `qa`, but those branches are not on the remote. Treat further environments as **Unknown / Requires Confirmation**.

## Known dependencies

- Node 12 and Yarn, as used by `.github/workflows/*.yml`. `package.json` also has `package-lock.json`.
- `react-scripts` 4.0.3, `aws-amplify` 3.x, React 17, React Router 5, Bootstrap 5 plus a Bootstrap 4 CDN stylesheet in `public/index.html`.
- Amazon Cognito, API Gateway, S3, and (production workflow only) CloudFront. Account IDs, bucket names, and distribution IDs for deploy are GitHub Actions secrets, not in the repo.
- Unity API at the production URL in `src/aws-config.js`.
- iVeri Lite merchant application id and terminal hardcoded in `Cart.js`.
- Google reCAPTCHA v2 site key in `src/config/google.js`.
- eNatis and iForce, reached only through the Unity API.

## Current project status

- **Implemented** on `master` as of the 2022-05-06 handover commit. No commits after that date were on the remote when this document was written.
- **Not a running service description.** This repository cannot show whether the S3/CloudFront site, the Amplify URL, or `all.paymyfines.co.za` is live.
- Sonar scanner scripts named in the 2026-09-28 onboarding snapshot (`sonar-project.properties`, `sonarqube_scan.bat`, `sonar-scanner.bat`) are **not** in git at `3e8d2a5`. `.scannerwork/` and `.vs/` **are** committed.
- `README.md` still says the benefit is "Using Amplify / lambda" and the start commands are `yarn install` and `yarn start`.

## Human confirmation

1. Which host is production: `https://all.paymyfines.co.za`, the Amplify domain in the Matomo snippet, the S3 website in `public/iveri.html`, or the CloudFront distribution used by the master workflow.
2. Whether `dev` and `qa` workflows are still used.
3. Whether the Unity API behind `src/aws-config.js` is still the production API.
4. Whether the 2022 handover tree is still the tree customers use.