# Project plan — sarugby (SA Rugby)

Evidence date: 2026-10-04.

Source repository: `git@bitbucket.org:overdrive/sarugby.git`.

Inspected revision: `master` at `6048eba` (2019-04-28, Mandus Momberg, "adding .htaccess files"). Parent commit: `8ef9258` (2019-04-28, same author, "First Commit. WTF is going on here?"). Only branch: `master`. `origin/HEAD` points at `master`.

The scan-host path `~/projects/sonar_scan/repos/sarugby` was not on the machine that produced this document. Facts below come from that git revision. Secret values in configuration and mail code are not repeated.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**Documented.** `Readme.md` titles the repository **SARugby Code Base** and says it is the code base for `https://sarugby.online/`. It says the site has its own frontend and an API backend for other SARU products. The same file says the tree was taken from an AWS S3 backup in `eu-west-1` (`evolve-backup-assets`, April 2019, object named `sarugby-backup-28-04-19.tar.gz`, stated size `883.1MiB`). The author says static content that was not needed to generate the site was removed, that multiple CSS, Bootstrap, and library copies remain, that the site was not rendered, and that the tree is believed to contain the files required to run but **has not been tested**.

**Implemented.** The page title in `application/layouts/default.phtml` is "SA Rugby - Official Home of the Springboks". Company-registration and permit emails sign as SA Rugby Event Administration and use `accreditation@sarugby.co.za`. The Blue Card page signs as The BokSmart Team.

**Unknown / Requires Confirmation:** whether `https://sarugby.online/` is still the live product, and whether this tree is the one that was last deployed.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `6048eba` | 2019-04-28 | Adds root `.htaccess` and `public/.htaccess` |
| parent | `8ef9258` | 2019-04-28 | First commit of the restored tree |

No other local or remote branches were present at inspection. There is no tag. History does not show a later release or a `develop` branch. Application behaviour was imported in the first commit. The second commit only adds the two Apache rewrite files.

**Discrepancy:** the task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in git at `6048eba`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from the implementation and the README, not from a written plan)

- Publish a public SA Rugby site: tournaments, fixtures, results, squads, lineups, commentary, and player stats.
- Keep JSON and image caches under `public/archives` so pages can read a last-update snapshot.
- Let companies register for event accreditation, confirm an email address, and sign in.
- Let a signed-in company manage members and request vehicle load-in / load-out permits.
- Show tournament catering menus, including nutrition and allergens, including via a QR code.
- Show a Blue Card form for a concussive injury.
- Push some accreditation applications to an external AppWiz endpoint and render permit PDFs. Several classes and routes that code calls are not in this tree.

## Scope

In this repository:

- Zend Framework 1.11.10 application under `application/`, `library/`, and `public/`.
- Modules `default`, `companies`, `company`, `bluecard`, and `menu`.
- MySQL access configured for database name `teamwizz_SARU`.
- Mail through `mail.sarugby.co.za` as `accreditation@sarugby.co.za` in the companies module, and `Zend_Mail` from `support@footprint.net` in the default login controller.

Out of this repository, or not established:

- The database backup itself. The README says it can be restored from S3. The SQL is not in git.
- `public/archives/` (gitignored). Runtime JSON and generated images are expected there.
- A PDF controller at `/pdf/a6/id/{id}`. Cron fetches that URL. No such controller is in the tree.
- Modules and layouts named in `application.ini` but absent from the tree: `admin`, `union`, `referee`, `gir`, `accreditations`.
- SonarQube project files named by the task scan.
- Any automated test suite. None was found.
- Proof that the suggested HHVM Docker command runs the site. The README says it was not tried.

## System shape

```text
Browser
  -> Apache (.htaccess: HTTPS, www, then public/)
    -> public/index.php (Zend_Application, env production unless APPLICATION_ENV is set)
      -> modules: default | companies | company | bluecard | menu
      -> MySQL teamwizz_SARU (credentials in application.ini; not repeated here)
      -> files under public/archives (UPDATE_PATH)
      -> SMTP mail.sarugby.co.za (companies mail)
      -> HTTPS POST to fsrugby.appwizard.co.za (cron, accreditation category 14)
```

`PG_Controller_Plugin_LayoutPicker` sets the layout name to the current module name. Layout files exist for `default`, `companies`, `company`, `bluecard`, `menu`, plus `admin`, `food`, and `repo`. `application.ini` also names layouts `union`, `referee`, `gir`, and `accreditations`. Those four files are not in `application/layouts/`.

## Major components

| Component | Role | Evidence |
|---|---|---|
| Public site (`default`) | Home, tournaments, news, login leftover, ajax cache writer, cron | `application/modules/default/` |
| Companies portal | Registration, login, users, permits, events | `application/modules/companies/` |
| Company module | Second registration path, thinner than `companies` | `application/modules/company/` |
| Blue Card | Concussion incident form page | `application/modules/bluecard/` |
| Menu | Venue dates, menus, nutrition, allergens, QR code | `application/modules/menu/` |
| Models | `Zend_Db_Table` classes and SQL views | `application/models/` |
| Zend library | Framework 1.11.10 plus `library/PG` and `library/Other` | `library/Zend/Version.php` |
| Theme | Sportsline / WordPress-shaped HTML, title overridden to SA Rugby | `application/layouts/default.phtml` |

## Milestones visible in git

There is no milestone document.

| Date | Commit | What landed |
|---|---|---|
| 2019-04-28 18:12 UTC | `8ef9258` | Restored application tree |
| 2019-04-28 18:45 UTC | `6048eba` | Root and `public` rewrite rules |

The README dates the S3 backup to 28 April 2019, the same day as both commits.

## Implementation plan

No forward plan is written in the repository. The README's only suggested bring-up is:

1. Download the S3 backup (command is in `Readme.md`).
2. Restore the database backup from S3.
3. Change `application.ini`.
4. Run an untested container: `docker run --rm -ti -v $(pwd):/var/www -p 8080:80 hhvm/hhvm-proxygen:3.27-lts-latest`.

That sequence is **Documented** as the author's suggestion and **not verified** by this inspection. There is no Dockerfile, `appspec.yml`, or pipeline file in the tree.

## Known dependencies

- PHP with the Zend Framework 1.11.10 tree that is vendored in `library/Zend`. `mcrypt` is called for random ids (`mcrypt_create_iv`). That extension is absent from current PHP.
- Apache with `mod_rewrite`.
- MySQL database `teamwizz_SARU` on the host named in `application.ini`. PDO MySQL adapter.
- SMTP server `mail.sarugby.co.za`, port 25, account `accreditation@sarugby.co.za`. The password is in source and is not repeated here.
- Optional: HHVM 3.27 image named in the README.
- Optional external: `https://fsrugby.appwizard.co.za/scripts/AppWiz.dll`. A commented URL points at `https://footprintapp.net/test/recievedata`.
- Google Chart Image API for menu QR codes (`chart.googleapis.com`).
- dompdf under `public/dompdf`, required by cron with a relative path.

## Current project status

**Implemented in git, last changed 2019-04-28, not shown to be running.**

The README states the restore was not tested. Several controllers call classes, constants, and URLs that are not defined in this tree (`Model_Credentials`, `Model_AccreditationsApplications`, `Model_AccreditationZone`, `Model_Assessments`, `Model_DbTable_Countries`, `UPDATES_PATH`, `IMG_PATH`, `/pdf/a6/...`). The public homepage writes JSON under `public/archives`, which is gitignored and empty in this checkout.

Treat the repository as a recovered snapshot, not as a confirmed production build.

## Human confirmation

- Is this snapshot still the source of `https://sarugby.online/`?
- Should the plaintext database password, SMTP password, and hardcoded login bypass strings be rotated and removed from git?
- Which accreditation event ids (`14` in cron, `27` in permits) are current?
- Is the 48-hour administrator review in the registration email still the rule, given that email confirmation sets `AllowLogin` immediately?
- Were the missing models and the PDF route dropped on purpose when the backup was trimmed?