# Features — sabullion (SA Bullion)

Evidence date: 2026-09-28. Source: `git@bitbucket.org:overdrive/sabullion.git`.

Status words:

- **Current on `master`** — present at `a5cd347` (2024-03-12), the default branch.
- **On `development` only** — present at `fcabece` (2021-03-01) and not the `master` tree described below.
- **Removed from `master`** — history shows the file, `master` does not.
- **Not in git** — named by the task-creation scan, but no blob exists.

"Current" means current in that git tree. Deployment is **Unknown / Requires Confirmation**.

## Current on `master`

### Public site

| Feature | Location | Notes |
|---|---|---|
| Home copy | `content/home-content.txt` | "SA BULLION OFFERS AN ALTERNATIVE TO CASH IN THE BANK". Links into BullionGold and HasanaGold savings and investment. The home template that includes this file was not a root `index.php` (that file was removed). |
| BullionGold investment | `investment/bullion-gold/` | Overview, pricing and features, calculator, minted-bar calculator. |
| HasanaGold investment | `investment/hasana-gold/` | Overview, pricing and features, calculator. Copy still uses Baraka variable prefixes in `content/baraka-*.txt`. |
| BullionGold savings | `savings/bullion-gold/` | Overview, pricing and features, calculator. |
| HasanaGold savings | `savings/hasana-gold/` | Same three pages. |
| Buy Krugerrand | `krugerrand/buy/index.php` | Public buy page. Upload helper `helpers/upload-krugerrand-buy.php`. |
| Sell Krugerrand wizard | `krugerrand/sell/index.php` | Steps `sell-to-us`, `seller-details`, `sell-review`. Older `index-old.php` and `index-bkp.php` are still in the tree. |
| Schedule drop-off | `scheduler/index.php` | Title "Schedule Drop Off". |
| Gold pricing page | `gold-pricing/index.php` | Template `templates/all/gold-pricing.php`. |
| Partner overview and calculators | `partner/` | FAQ link still uses `index.php?pageReq=pfaq`. |
| Downloads | `downloads/index.php` | Nav points Brochures, Gold Reports, Forms, and Library here. `download_files/` holds `SA-Bullion-Partnership-Brochure.pdf` and `international-brochure.pdf`. |
| Story and facilities links | `templates/includes/sitenav.php` | Still `index.php?pageReq=as` and `pageReq=af`. Router removed. |
| Help / FAQ link | same | `index.php?pageReq=hp`. |
| POPI notice route | `POPINotice/index.php` | Loads `content/popi-notice.txt`, which is a Harry's terms template, not a POPI notice. |
| Terms route | `terms/index.php` | Loads `content/terms-of-use.txt`, same Harry's template. |
| Privacy copy | `content/privacy-policy.txt` | Harry's privacy template. |
| Client mandate template | `templates/all/client-mandate.php`, `dashboard/templates/all/mandate.php` | SA Bullion I.S. fee and cut-off wording. |
| Fractional ownership route | `Krugerrand-Fractional-Ownership-Programme/index.php` | Page title variable is "Disclaimer". Template path `/all/krugerrand-fractional-ownership.php`. Content variable points at `content/client-mandate.txt`, which is also the Harry's template. |
| Sign in | Nav links to `/dashboard` | |
| Page cache | Each public `index.php` | Present and set to `$cache = false`. |

### Client, IFA, and house portal (`dashboard/`)

| Feature | Location | Notes |
|---|---|---|
| Login | `dashboard/login.php`, `dashboard/api/login/` | Destroys the portal session unless a successful web-admin global-admin session is handing off. |
| Role shell | `dashboard/index.php` | `GLOBAL_ADMIN`, `HOUSE`, `IFA`, `CLIENT`, `UNAPPROVED-CLIENT`. |
| Unapproved client documents | `dashboard/templates/client/docs.php` | Forced template for `UNAPPROVED-CLIENT`. |
| Client portfolio | `dashboard/templates/client/sidebar.php` | Overview, summary statement, detailed statement, PDF hooks. |
| IFA portfolio | `dashboard/templates/ifa/sidebar.php` | Overview, clients, saving calculator, investment calculator. Gold-price and quarterly-report links leave the PHP tree. |
| House portfolio | `dashboard/templates/house/sidebar.php` | Overview, advisors, clients, calculators. |
| Global admin portfolio | `dashboard/templates/global_admin/sidebar.php` | All advisors, all clients. |
| Client signup | `dashboard/templates/login/client/{sa-natural,sa-legal,non-sa-natural,non-sa-legal}/` | Multi-step. SA natural posts `strEntityType=SA NATURAL`. |
| IFA signup | `dashboard/templates/login/ifa/{natural,legal}/` | |
| Signup API | `dashboard/api/signup/signup.php` plus per-type `email/index.php` | Writes the registration. |
| Investment calculator API | `dashboard/api/calc/index.php` | Premium from `tblProductPricing` product `1850`. Initial fee hardcoded at 1%. Annual figure starts at 1.5. |
| Minted-bar calculator API | `dashboard/api/calc/minted-bar-index.php` | Hardcoded refining premium 2.5 on one path and 3 on the debit-order history path. Uses a 3.215 ounce factor (100 g bar). |
| Alternate calculator | `dashboard/api/altcalc/` | Present. Not compared line by line with `api/calc/`. |
| PDF and email | `dashboard/api/pdf/`, `dashboard/api/pdf-and-email/` | |
| Adviser email | `dashboard/api/email/ifa/` | |

### Web admin (`webadmin/`)

| Feature | Location | Notes |
|---|---|---|
| Admin home | `webadmin/index.php` | Tiles plus CT and Bedford calendars. |
| Staff login | `webadmin/login.php` | `sysUser` join `sysSecurityGroup` where the group is active. Sets `GLOBAL_ADMIN` user type. |
| Users | `user.php`, `includes/user.cls.php` | Security group dropdown from `sysSecurityGroup`. |
| Security groups | `security.group.php` | Edits `sysMenuLevel2.strEntity` labels. |
| Registrations | `registration.php`, `active.registration.php`, `cancelled.registration.php` | Document approve gate. |
| ID verification | `id.verification.php` | Approve, upload to web access, resend application, EFT reminder. |
| Product prices | `product.prices.php` | Nemo CRUD. A "Reset Password" action is wired to `ProductPrice::ResetPassword`. That action name does not match a price screen. **Requires Confirmation**. |
| Product stock | `product.stock.php` | |
| Gold sales | `gold.sales.php`, `includes/gold.sales.cls.php` | The class is named `Appointment`. |
| Appointments | `appointment.php` | Same class name `Appointment` in `includes/appointment.cls.php`. |
| Storage facility | `storage.facility.php` | Deliver action. Added in spirit by commit `e5fe893` (2023-03-28, "storage facility changes"). |
| FAQ and FAQ console | `faq.php`, `faq.console.php` | |
| Email templates | `email.template.php`, `email.php` | |
| Audit log | `audit.log.php` | |
| Settings | `settings.php` | |
| Documents | `showDocument.php`, `showOnlineDocument.php` | |
| Reports | `report.php` | |
| Profile and password reset | `profile.php`, `resetPassword.php` | |
| FNB payment validation | `validateFNBPayment.php` | Live FNB endpoint. Redirects to `/checkout` and `/cart`. |
| Gold price cron | `cron.gold.price.php` | Scrapes Sharenet, writes `wp_postmeta` prices. Commented FNB sandbox experiment in the same file. |
| After-hours gold price | `after_hours.cron.gold.price.php` | |
| Silver price cron | `cron.silver.price.update.php` | Product id 1846. |
| Document reminder | `cron.documents.reminder.php` | Comment: every 48 hours. |
| Outstanding EFT reminder | `cron.outstanding.payments.php` | Selects `Active Client - EFT outstanding`. Header comment still says document reminder / 48 hours; inline comment says 1 day. |
| Client balance refresh | `cron.client.balance.php` | Query restricted to `ID = 1436`. |
| Data mismatch check | `cron.data.mismatches.php` | Compares `tblDate` with `web_gold_pricing`. |
| Nemo framework | `webadmin/_framework/` | The includes use this directory. `_framework8.0/` and `_frameworkX/` are extra copies. |
| Dated backups | `*.php20231124`, `*.php20231114`, and similar | Previous versions kept beside the live files. Not a feature. |

### Other systems on `master`

| Feature | Location | Notes |
|---|---|---|
| File integrity monitor | `fim_2.0/` | Record, compare, ignore, update. Dev, qa, and live config files. Commit `4fc096f` (2020-05-05) "impliment fim to SABullion QA". |
| WordPress magazine | `magazine/` | Core, `wp-config.php`, theme `sa_bullion_magazine`, default themes, ACF, ACF Repeater, Akismet, ricg-responsive-images. |
| WordPress package backup | `sabullion.co.za-20240215-172951-8h6xci.wpress` | Filename date 2024-02-15. Not unpacked. |
| eCommerce folder | `eCommerce/` | Logo images only. No shop code. |
| Server checks | `server-checks/` | `phpinfo.php`, `fopen.php`. |
| Vendored UI | `vendors/`, `assets/` | Bootstrap, DataTables, Chart.js, and similar. |
| PDF library | `vendor/mpdf`, copies under dashboard and webadmin | |

## On `development` only

Not merged to `master`. Tip `fcabece`, 2021-03-01, author rachelmogano, message "Update repo with new site".

| Feature | Evidence |
|---|---|
| WordPress at repository root | `wp-admin`, `wp-content`, `wp-includes`, `wp-config.php` variants, `xmlrpc.php` on `origin/development` |
| README | "New SA Bullion WordPress website." Temp URL `sabullion.co.za.www18.jnb2.host-h.net` |
| Bitbucket pipeline file | `bitbucket-pipelines.yml` on that branch |
| Child theme work | Commit messages "Child Theme changes", "redesign", "form redesigns for my account sections", "login code" (2021, on this branch's history) |

`master` is 29 commits ahead of this branch as well, so `development` is not a superset.

## Removed from `master`

| Item | Evidence |
|---|---|
| Root `index.php` (the `pageReq` front controller) | `git log -- index.php` ends at `642b0da` "Wordpress cleanup" (2023-03-13). Not in the `a5cd347` tree. |
| `bitbucket-pipelines.yml` | Present in history through 2020 and absent from `HEAD`. Last log touch listed under `50eecb2` "SA Bullion repo updates" and earlier pipeline commits. |
| Root WordPress core as a first-class app | `.gitignore` ignores `/wp-admin/*`, `/wp-content/*`, `/wp-includes/*`. `development` still has them. `master` keeps a full copy under `magazine/` instead. |

## Not in git

| Item | Evidence |
|---|---|
| `sonar-project.properties` | Named in the task-creation scan. `git log --all -- sonar-project.properties` is empty. |
| `sonarqube_scan.bat` | Same. |
| Crontab / hosted cron definitions | Scripts exist. No schedule file. |
| Database contents (security group names, live VAT, live premium for product 1850) | Queries exist. Rows do not. |

## Changed features worth naming

- HasanaGold replaced Baraka in visible headings (`content/home-content.txt` uses HasanaGold). Baraka filenames remain.
- Krugerrand premium in `dashboard/api/calc/index.php` was changed on 2023-11-07 to read `tblProductPricing.dblPremium` for product 1850. The old `$Refining_and_minting_premium = 3` is commented out.
- Minted-bar premium was set to 2.5 on 2019-06-11 in `dashboard/api/calc/minted-bar-index.php` (comment by Gael). A later block in the same file still uses 3.
- VAT source moved to `sysVat` with a 2018 comment about 14% to 15%.
- PHP 8.1 updates landed on `master` in October 2023 (`f98ae21`, `bfdeb94`). The running include path is still `_framework/`, not `_framework8.0/`.
- Facility application forms changed in July 2023 (`bbf8065`, `ebd7e4e`).
- Storage facility delivery was added or changed in March 2023 (`e5fe893`).

## Deprecated or leftover

- `pageReq` URLs after root `index.php` was deleted.
- Duplicate class name `Appointment` in gold sales and appointments.
- Harry's legal boilerplate in the POPI, terms, privacy, and `client-mandate.txt` content files.
- Three Nemo trees: `_framework`, `_framework8.0`, `_frameworkX`.
- `dashboard/dashboardx/` — a second copy of dashboard API plugins (seen in the tree listing).
- Public page cache implementation left in place and switched off.
- `eCommerce/` with no code, while FNB validation redirects into a shop that is not in the PHP tree.