# Features — sawis_api_old

Evidence date: 2026-10-04. Source: `git@bitbucket.org:overdrive/sawis_api_old.git`, `master` at `1124919`.

Status words used here:

- **Current** — present on `master` at `1124919` and reachable as a `NemoAPI` method or a top-level script.
- **Present, not the API** — file exists; `api.php` does not call it.
- **Commented** — source keeps the code in a comment.
- **Not in git** — named by an include or a link, and no file exists at `1124919`.

Version labels (v1.3, v1.4, v1.6, v1.7, CIS v1.0) are the labels in the header comments of `_framework/_nemo.api.cls.php`. Git does not tag them. The whole PHP tree arrived in one commit on 2020-08-24.

## Current — HTTP surface

| Feature | Location | Notes |
|---|---|---|
| API front controller | `api.php` | Builds `NemoAPI($VendorKey, $call, $Page, $xmlData, $Token)` and calls `processApi()` |
| CORS allow-list | `api.php` | Five origins. Credentials and max-age 86400 |
| Fixed password-reset entry | `api.user.php` | Always vendor `WOLINE`, call `resetPassword`, fixed token |
| REST verb switch | `Rest.inc.php` | GET, POST, PUT, DELETE. Other verbs return 406 |
| Request-to-global copy | `_framework/system.functions.inc.php` | `localize`. Non-empty POST clears `$_GET` |
| Boot and MySQL | `system.php`, `system.server.PROD.php` | Database `sawis_api`. QA and DEV includes are **Not in git** |
| Call log | `NemoAPI::record` | Table `apiLog`. Deletes rows older than 3 months |
| Vendor gate | `checkVendor` | `apiVendor.blnActive = 1` |
| Token issue and check | `authenticate`, `generateToken`, `checkToken` | Table `apiToken`. Lifetime 3 days, refreshed on use |
| Column include list | `cleanVendorRST` | `apiVendorField` where `strLastUser = 'INCLUDE'` |
| XML and JSON bodies | `NemoAPI::xml`, `NemoAPI::json` | Default XML. `type=json` or `type=text` |
| Page counts | `getListPages` | Optional `List` argument narrows to one call |

## Current — read calls

Each row is a private method on `NemoAPI`. The FROM clause is `$arrCallFROM` unless the method builds its own SQL. Paging uses `sysSettings.PageSize` except where noted.

| Call | Version label in comments | Source named in code |
|---|---|---|
| `getCultivarList` | early / v1.3 tested | `tblCultivar` |
| `getWineTypeList` | v1.3 tested | `tblWineType` |
| `getIrrigationList` | | `tblIrrigation` |
| `getTrellisList` | | `tblTrellis` |
| `getLocationList` | v1.3 tested | `dwdLocation` |
| `getMemberTypeList` | v1.3, `MemberTypeID > 0`, WIETA excludes `refWieta = 9` | `tblMemberType` |
| `getMemberList` | v1.3 tested. `MemberID > 0`. Vendor SQL in the PRD | `tblMember` join `tblMemberType` |
| `getMemberProfile` | v1.3. In the FROM map. Not in the `$arrCalls` page-count list | `tblMemberType`, `tblMember`, `tblMemberRelationship` |
| `getMemberAddressList` | v1.3 tested | `tblMember_Address` |
| `getMemberContactList` | | `tblMember_Contact` |
| `getFarmList` | Comment 2016-06-14: query rewritten | `tblFarm` plus a farm-to-member derivation. Member type codes `FRM000`, `FRMEST`, `FRMOWN` |
| `getVineyardBlockList` | | `tblBlock` |
| `getPackingMaterialList` | v1.3 | `tblPackingMaterial` |
| `getIncotermList` | v1.3 | `tblIncoterm` |
| `getCountryCodesList` | v1.3 | `tblCountryCode` |
| `getBg9_11_TypeList` | v1.3 | `tblBG911Type` |
| `getCertificateTransationCodeList` | v1.3. Spelling `Transation` is the method and table name | `tblCertificateTransationCode` |
| `getRejectCodesList` | v1.3 | `tblCertificateRejectionCode` |
| `getPackingCodesList` | v1.3 | `tblCertificatePackingCode` |
| `getCertificateStatusList` | v1.3 | `tblCertificateStatus` |
| `getCertificateResultsList` | v1.3 | `tblCertificateResult` |
| `getPackVolumeColourList` | v1.3 | `tblPackVolumeColour` |
| `getPackVolumeClosureTypeList` | v1.3 | `tblPackVolumeClosureType` |
| `getBottleDescriptionList` | v1.3 | `tblBottleDescription` |
| `getManufacturerList` | v1.3 | `tblManufacturer` |
| `getCertificationList` | v1.3 | `tblCertification` |
| `getCertificationResultsList` | v1.3 | `tblLabAnalysis` |
| `getTitleDeedsList` | v1.3. Excludes `EntityType` like `%TMP%` | `tblTitleDeed` |
| `getMagisterialDistrictList` | v1.3 | `tblMagisterialDistrict` |
| `getWIETAFarmList` | 2017-09-29 | `tblFarm` left join `tblBlock` |
| `getWietaMembershipList` | 2017-09-29 | `tblWietaCertification` |
| `getBlendMaster` | v1.3, 2018-03-06 | `tblBlendMaster` left join `tblMember` |
| `getWSB` | v1.3, 2018-03-08. Later comment adds fields | `tblBlendMaster` left join `tblMember` and `tblMemberType`. An older join through `tblHarvestItem` is **Commented** |
| `getWS` | v1.3, 2018-03-09. 2018-12-11 adds `tblHarvestItem.refMemberID` and `tblMember.strMember` | `tblHarvest`, cellar member, `tblHarvestItem`, `tblFarm`, producer member. `blnDeleted = 0` |
| `getMemberProfileLMS` | v1.7, 2018-11-06 and 2019-02-21 | `tblMember` join `tblMemberType`, then further farm queries in the method. Optional `MemberID` |
| `getMemberIDListLMS` | 2020-03-04 | `tblMemberRelationship` left join `tblMemberType`. Codes `FRMOWN`, `FRMTNT`, `FRMSCP` |
| `getWineMSFarmList` | v1.6 | `vieWMS` left join `dwdLocation` and `dwdSawisLocation`. Farm status `Active` |
| `getWineMSBlockGUID` | v1.6 | `vieWMS` |
| `getWineMSMemberList` | v1.6 | `vieWMS` |
| `getWineMSFarm` | v1.6 | `vieWMS` joins. `blnWineMS = 1`, `refWineMS` in `1`,`3`, active MR and farm |
| `getWineMSMember` | v1.6 | Same family, plus `opsMember` |
| `getWineMSSawis1` | v1.6 | `vieWMS` join `tblMemberType`. `blnWineMS = 1` |
| `getCGABlockList` | CIS v1.0, 2019-06-13. 2020-03-30 adds farm name | `tblBlock` left join `tblFarm`. Requires `FarmID`. Year is setting `CURENT_BLOCK_YEAR` |
| `getUser` | v1.4 | `sysUser` by `UserID` or email `Username` |

`authenticate` is also a method. It is listed with the read calls in `$arrCalls` and is excluded from `getListPages`.

## Current — write and login calls

These methods exist and `processApi` will dispatch them when the name matches. They are not all in `$arrCalls`.

| Call | Version label | Writes |
|---|---|---|
| `createUser` | v1.4 | `sysUser`. Group from vendor. Then reset-password mail |
| `updateUser` | v1.4 | `sysUser` by `UserID`. Builds `strUser` from name and surname |
| `setPassword` | v1.4 | `NemoPassword` for that user |
| `resetPassword` | v1.4 | New aged password and template `Reset Password` |
| `loginUser` | v1.4 | `sysLogin` via `tblLoginInsert` |
| `loginToken` | v1.4 | `sysLogin` on the branch described in the PRD |
| `setCertificationRecord` | v1.3 | `tblCertification` |
| `setCertificationResultsRecord` | v1.3. 2020-01-13 reads `TransactionID` from XML | `tblLabAnalysis` |
| `setWineExportRecord` | v1.3 | `tblExportTransaction`. Required-field check is a `TODO` |
| `setWietaMembership` | v1.3 | `tblWietaCertification`. Required-field check is a `TODO` |
| `setVinProMembers` | | `tmpVinPro`, then `tblMember.blnVinPro`. SQL says `TRUNCATE TABEL` |
| `setWineMSCellar` | v1.6 | Deletes then inserts `stg_wmsBlock` for `refCellarID` |
| `setWineMSBlockActivity` | v1.6 | `stg_wmsBlockActivity` |
| `setWineMSBlockGUID` | v1.6 | `wmsBlockGUID` |

## Current — other scripts

| Feature | Location | Notes |
|---|---|---|
| Read receipt pixel | `email.read.receipt.php` | Sets `tblEmail.strStatus` to `Read` unless status is `Error`. Returns a 1×1 JPEG |
| Read mail in browser | `email.read.online.php` | Comment says not in use on the API. Same status update. Layout file is **Not in git** |
| Mail smoke script | `emailTest.php` | Loads template `Reset Password` addressed to `maanie@overdrive.co.za`. Uses `$args` and `$np`, which this file does not set. Calls `Send()` |
| PHP info | `phpinfo.php` | `phpinfo()` |
| API form | `test/index.php` | Eight list calls. Curl path `/sawis_api_v1/api.php` |
| WSDL document | `wsdl/wsdl.php` | Emits HTTP GET bindings for an early subset (`getCultivarList`, `getMemberTypeList`, `getIrrigationList`, and further operations in the same file). Target path `/sawis_api/api.php`. Version text 1.1 |
| WSDL tester | `wsdl/test/index.php` | NuSOAP client against `generated.wsdl`. The live call is `getCultivarList` with a null parameter. Other SOAP examples are commented |
| NuSOAP library | `wsdl/test/lib/`, `wsdl/test/nusoap.php` | Third-party SOAP stack. Not included by `api.php` |
| File integrity | `cron.fim.php`, `_framework/_nemo.fim.cls.php` | Actions in the PRD. Default path records, compares, and chmods |
| Error pages | `403.html`, `404.html`, `500.html` | Title "SAWIS Online". Linked CSS other than `css/colourlessNEW.css` is **Not in git** |
| Rewrite samples | `deleted.htaccess`, `deletedagain.htaccess` | Identical rules that send requests to `api.php`. The names say deleted. No live `.htaccess` is in the root |

## Present, not the API

| Feature | Location | Notes |
|---|---|---|
| Farm and block helpers | `project.functions.inc.php` | `GetNewFarmID`, `CopyBlocks`, `calculateHectare`, `recordBlockMovement`, `bg1GetSmallestCommonLocation`. Header says to clear the file for a new project. No `NemoAPI` method calls them |
| Menus, lists, tabs, wizard, reports, details | `_framework/_nemo.menu*.php`, `_nemo.list*.php`, `_nemo.tabs.cls.php`, `_nemo.wizzard.cls.php`, `_nemo.report.cls.php`, `_nemo.details*.php` | Included from `system.php` (menu and translator) or available to the framework. No API route renders them |
| Root copy of the basic class | `_nemo.basic.cls.php` | Same size class as `_framework/_nemo.basic.cls.php`. `email.read.receipt.php` includes the root copy |
| Sample maths WSDL | `wsdl/SawisService.wsdl`, `wsdl/example.wsdl`, `wsdl/wsdl2.wsdl`, `wsdl/*.xml` | Not loaded by `api.php` |
| Images and one stylesheet | `images/`, `css/colourlessNEW.css`, `docs.css` | Layout assets. `images/Xprocure.png` and browser icons are in the tree |

## Commented or unfinished

| Item | Evidence |
|---|---|
| Field exclusion (the old filter) | `cleanVendorRST` exclude version is a block comment. The live function includes fields |
| Member authenticate | Private `authenticate($args)` joined to `apiVendorMember` is commented and marked `wip` |
| `getWSB` harvest join | Replaced by the blend-master join. Old SQL remains in a comment |
| LMS page size divided by 10 | Commented. Live limit is the normal `PageSize` |
| `FIM: PULL MASTER DATA` | Empty case |
| Required fields on export and WIETA writes | Comments say `TODO` |
| Token lifetime | `"3 DAY"` with `CHANGE BACK AFTER TESTING` |
| S3 base-URL block in `system.php` | Commented. Dates in the comment: 2017-08-01, 2017-09-19, 2017-10-05 |

## Not in git

| Name | Who references it |
|---|---|
| `system.server.QA.php` | `system.php` include |
| `system.server.DEV.php` | `system.php` include |
| `layout.online.email.incl.php` | `email.read.online.php` |
| `resetPassword.php` on the SAWIS site | Link built by `resetPassword` |
| `sonar-project.properties`, `sonarqube_scan.bat` | Named in the onboarding issue's scan listing. Absent from `1124919` |
| README, Composer, PHPUnit, Bitbucket Pipelines | No references that point at a file which was then omitted. They are simply absent |

## Planned

Nothing in the repository describes a future release. The unfinished markers above are the only forward-looking text. They are comments, not an approved plan.

## Recently changed

The only change after the initial commit is `1124919` (2020-10-14), which inserts a `//test` comment in `api.php`. No behaviour change.

## Deprecated / removed

No removal commit exists. The commented blocks in the current section are the only retired paths still visible.