# Project plan — por (Purchase Order Requisition)

Evidence date: 2026-10-06.

Source repository: `git@bitbucket.org:overdrive/por.git`.

Inspected revision: `master` at `6fabdc090d2a3693f369f9fe50dea47990109349` (2026-06-23, message `#88_po system Key account Fix #xx_Contact information save Fix`). The scan-host path `~/projects/sonar_scan/repos/por` was not on this machine. The tree was read from that git revision. A shallow clone was used, so commits before the tip were not walked.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Documented.** `README.md` titles the repository **Purchase Order Requisition (POR)** and calls it a "Legacy PHP application for RGBC purchase order requisitions."

**Implemented.** `include/system.inc.php` sets `$SYSTEM` to `Purchase Order Requisition`. The shell shows an RGBC logo. The footer string is `Version 1.3.0` and `1 Sep 2018`, and adds `[Dev]` when `SERVER_NAME` is `sqlsrv02`.

There is no separate product-requirements document in the source repository. Behaviour is recovered from PHP, SQL, `README.md`, `CHANGELOG.md`, and `web.config`.

**Discrepancy:** the onboarding snapshot recorded last commit `8fceb0a` (2025-06-27, "receipt fixes"). Current `master` is the 2026-06-23 commit above. The snapshot is older than the inspected tip.

## Objectives (inferred from the implementation, not from a written plan)

- Let an RGBC Windows user who exists in `mstUser` with a POR user group open the application.
- Capture a purchase-order requisition (header, line items, quote document) and submit it for approval.
- Approve, decline, cancel, copy, or close a requisition according to user-group access limits and special flags.
- Record goods receipts against an approved purchase order, including invoice number and supporting documents.
- Onboard a vendor through a separate status path, with documents and queued follow-up jobs.
- Let Admin and Dev users import approval limits and GL allocations, and download two Excel reports.
- Let a special user edit `POR%` rows in `sysQuery`, including the fiscal-period setting used by receipts.
- Queue work in `sysCronJob` for a processor that is not in this repository.

## Scope

### In scope of `master`

1. IIS/PHP pages for login, purchase-order list and form, receipts list and form, vendor list and form, two Excel imports, two reports, and a settings grid.
2. ODBC access to a SQL Server catalog (example name `Superbowl` in `.env.example`).
3. Session gate on the full-page layout.
4. Cascading GL lookups and vendor/customer searches via `ajax.functions.php`.
5. CSV and HTML-as-Excel exports of purchase orders, and an invoiced-PO CSV from the receipts list.
6. Document uploads under `include/documents/`.
7. Composer dependency `phpoffice/phpspreadsheet` for the two reports.
8. SonarQube project file `sonar-project.properties`.

### Out of scope of this repository

- The worker that reads `sysCronJob` and posts purchase orders, receipts, or vendors into the accounting system. The GL warning text names Accpac. No Accpac client is in this tree.
- Creation and maintenance of `mstUser`, `mstUserGroupPOR`, `mstVendor`, `mstGLCode`, `mstBranch`, `dwdCustomer`, and related views, except where this app reads or writes them.
- Active Directory itself. Login reads `$_SERVER['LOGON_USER']`. The bundled `ldap/` library is included on some email-link paths and is not called to bind or search.
- A formal milestone plan, backlog, or release process. None is in the repository.

## System architecture

Browser pages are classic PHP scripts. Each page includes `include/system.inc.php`, which loads `.env` or process environment, opens ODBC, and starts a PHP session. List and form classes build HTML. The full layout (`include/layout.full.inc.php`) refuses to render when `$_SESSION['USER']` is missing.

```text
IIS + PHP (FastCGI paths in web.config)
  login.php  -- LOGON_USER --> mstUser + mstUserGroupPOR
  requisition.php / requisitionForm.php
  receipts.php / receiptsForm.php
  vendors.php / vendorForm.php
  import.UGAccess.php / import.UGGLCodes.php
  report.php
  settingsForm.php
  ajax.functions.php
        |
        v
  PorOdbc (include/database/odbc.cls.php)
        |
        v
  SQL Server catalog (shared RGBC database)
        |
        v
  sysCronJob rows  -->  processor not in this repo
```

## Major components

| Component | Role |
|---|---|
| `login.php`, `logout.php` | Windows logon check, Internet Explorer block, session end |
| `include/requisition.cls.php` plus form | Purchase-order list, save, submit, approve, decline, cancel, copy, close, complete |
| `include/receipts.cls.php` plus form | Receipt list and draft/submit/re-receipt |
| `include/vendors.cls.php` plus form | Vendor onboarding statuses and documents |
| `include/system.functions.inc.php` | Login match, session filters, user-group access challenge |
| `ajax.functions.php` | XML lookups for GL segments, vendors, customers, receipt quantity |
| `import.*.php` | Spreadsheet staging into `porUGAccess` and `porUGGL` |
| `include/report.cls.php` | GL allocation and vendor allocation workbooks |
| `include/SecureConfig.php` | Connection settings from environment |
| `sysCronJob` | Outbound queue. Types are written here; nothing in this repo consumes them |

## Milestones

No milestone document exists. Dated comments in the PHP are implementation notes, not an approved plan. Notable markers still visible in code:

| When (from comments or commits) | What the code says was added |
|---|---|
| 2017-05 | Login path comment on `login.php` |
| 2018-07 | User-group access model, imports, reports |
| 2018-09 | Copy purchase order |
| 2019-01 | Receipt draft rules, fiscal-period lock, cancel related receipts |
| 2019-02 | Close PO, settings page |
| 2019-04 | AP export, captured-by on submit |
| 2021-02 | "Completed" balance action |
| 2024-11 | Re-receipt (`[DS20241107]`) |
| 2025-06-12 | PhpSpreadsheet comment on `report.cls.php` |
| 2026-06-23 | Tip commit: key-account fix and contact-information save fix |
| Unreleased (`CHANGELOG.md`) | Credentials moved to environment variables |

The footer still says version `1.3.0` dated `1 Sep 2018`. That string was not updated with later behaviour.

## Implementation plan

There is no forward implementation plan in the repository.

**Unknown / Requires Confirmation:** whether further work is scheduled, and which environment (`rgbc_por_qa` is named in the README) is the current deployment target.

## Known dependencies

- PHP with the ODBC extension. `SecureConfig.php` says it targets PHP 7.0+. `web.config` registers FastCGI handlers for PHP 8.2.4 and 8.4.8 paths, plus older `C:\PHP\php-cgi.exe`. Which handler IIS actually uses is **Unknown**.
- A SQL Server ODBC DSN and catalog. Example values in `.env.example`: DSN `rgbc_php`, catalog `Superbowl`, user `rgbc_php`.
- Windows / IIS identity in `LOGON_USER`.
- Shared RGBC tables and views in that catalog.
- `phpoffice/phpspreadsheet` `^4.3` (Composer). A full `PHPExcel/` tree is still in the repository. Reports load Composer autoload, not `PHPExcel/`.
- jQuery 1.9.1 and jQuery UI 1.9.1 from the Google ajax CDN, and Select2 4.0.3 from cdnjs.
- A file share or site path used by `test_folder_share_read.php` (`//superbowl_pdf/...`). That script is a hardcoded sample link, not a workflow.

## Current project status

**Implemented** and still the default branch tip as of 2026-06-23. `CHANGELOG.md` has a single **Unreleased** security section and no released version entries. The README describes local `.env` setup and production preference for IIS environment variables.

Silicon Ark had no `por/` documents before this onboarding.

## Human confirmation

- Whether `master` at `6fabdc0` is what production runs.
- What consumes `sysCronJob`, and which statuses (`Partially Receipted`, receipt `Processed`) that worker sets.
- Whether the hardcoded user ids on the vendor form are still the intended operators.
- Whether `cursor_security_updates_implementation.md` was committed by mistake. Its body is a plan for an RGBC Promotions VB application, not for this PHP application.