# Project plan — sawis_api_old

Evidence date: 2026-10-04.

Source repository: `git@bitbucket.org:overdrive/sawis_api_old.git`.

The scan-host path `~/projects/sonar_scan/repos/sawis_api_old` was not on this machine. The tree was read from a git clone of that origin. The database password in `system.server.PROD.php` is not reproduced. The token hardcoded in `api.user.php` is not reproduced.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

There is no README and no product requirements document in the repository or in Silicon Ark before this set.

The repository name is `sawis_api_old`. The only branch is `master`. Two commits exist:

| Commit | Date | Author | Subject |
|---|---|---|---|
| `6b26d3d` | 2020-08-24 | JacquesOverdrive | ini commit |
| `1124919` | 2020-10-14 | JacquesOverdrive | test api repo |

`1124919` changes only `api.php`, adding a `//test` comment. `origin/HEAD` is `master` at `1124919`.

The application is a PHP HTTP API. `api.php` constructs `NemoAPI` and calls `processApi()`. Comments in `_framework/_nemo.api.cls.php` date the calls from 2016 through 2020 and label groups v1.3 (reference and certification lists), v1.4 (user API), v1.6 (WineMS), v1.7 (LMS), and v1.0 (CIS `getCGABlockList`). The class header calls the service a SAWIS API. `wsdl/wsdl.php` says "A service for Sawis", author overdrive.co.za, version 1.1, history dated 2016-08-02 and 2016-10-02.

Error pages `403.html`, `404.html`, and `500.html` use the title "SAWIS Online" and a favicon URL under `http://lamp/sawis/webadmin/`.

**Unknown / Requires Confirmation:** the official product name, the product owner, whether this tree is the API that was deployed, and whether a newer API replaced it. The repository name says "old". The last commit is 2020-10-14.

## Objectives (inferred from the implementation, not from a written plan)

- Serve lookup lists of wine-industry reference data (cultivar, location, member, farm, vineyard block, certification codes, and related tables) to a caller that presents a vendor key and a session token.
- Restrict which columns each vendor receives, using `apiVendorField`.
- Accept XML writes for users, certification, lab results, export certificates, WIETA membership, VinPro flags, and WineMS block data.
- Authenticate a vendor with a password stored on `apiVendor`, then issue a token stored on `apiToken`.
- Log calls to `apiLog` and delete log rows older than three months.
- Provide a file-integrity script (`cron.fim.php`) that records paths, compares them, and sets directory and file modes.

## Scope

In this repository:

- HTTP entry `api.php` and a second entry `api.user.php` that always calls `resetPassword` for vendor `WOLINE`.
- Class `NemoAPI` in `_framework/_nemo.api.cls.php`, extending `REST` in `Rest.inc.php`.
- Boot file `system.php`, which loads server settings, starts a PHP session, and opens MySQL database `sawis_api`.
- One connection file, `system.server.PROD.php`. `system.php` also includes `system.server.QA.php` and `system.server.DEV.php`. Those two files are not in git.
- Shared Nemo framework classes under `_framework/` (database, email, password, menus, lists, file-integrity monitor).
- `project.functions.inc.php`, included on every boot. Its header says "CLEAR THIS FILE FOR EVERY NEW PROJECT". The functions cover farm IDs, block copies, hectare maths, and a wine-of-origin location rollup. `NemoAPI` does not call them.
- Email read-receipt and read-online scripts, plus `emailTest.php`.
- A browser form at `test/index.php` that curls a short list of read calls.
- WSDL and NuSOAP files under `wsdl/`. The live call path in `api.php` is query-string HTTP, not a SOAP server.
- Static error pages and CSS/images copied from a SAWIS Online layout. Several CSS and JS files those pages link to are not in this repository.

Out of scope of this repository, as far as the tree shows:

- The MySQL schema and row data. Table and view names appear only inside SQL strings. There is no `.sql` dump.
- The SAWIS Online site that `resetPassword` links to (`resetPassword.php` on another base URL).
- A scheduler definition for `cron.fim.php`. None is in git.
- Bitbucket Pipelines, Composer, PHPUnit, and a README. None are in git.

The issue that created this task listed `sonar-project.properties` and `sonarqube_scan.bat` at the scan-host root. Neither file is in the git tree at `1124919`. **Unknown / Requires Confirmation:** whether those files existed only as untracked files on the scan host.

## System architecture

```text
Caller (browser, GIS page, or server)
  GET or POST api.php
    query/body fields become PHP globals (localize in system.functions.inc.php)
    system.php
      system.server.PROD.php   (QA and DEV includes are missing from git)
      mysqli → database sawis_api
      sysSettings rows copied onto $SystemSettings
    NemoAPI::processApi()
      apiVendor  (vendor key must be active)
      apiToken   (except the authenticate call, and except the ignore-token path)
      method named by the call
      apiVendorField include-list
      XML or JSON response
      apiLog
```

`cron.fim.php` is a separate script. It does not include `system.php`. It expects `$xdb` and `$DATABASE_SETTINGS` to already exist.

## Major components

| Component | Path | Role |
|---|---|---|
| HTTP API | `api.php` | CORS for five origins, then `NemoAPI` |
| User reset entry | `api.user.php` | Fixed vendor, call, and token |
| API class | `_framework/_nemo.api.cls.php` | Auth, calls, field filter, XML/JSON |
| REST base | `Rest.inc.php` | Method parsing, `strip_tags`, status line |
| Boot | `system.php` | Errors on, session, mysqli, settings |
| Connection profile | `system.server.PROD.php` | Host keys and database `sawis_api` |
| Request globals | `_framework/system.functions.inc.php` | Copies POST, then GET, then COOKIE into `$GLOBALS` |
| Passwords | `_framework/_nemo.password.cls.php` | Hash, history, expiry settings inserted if missing |
| Mail | `_framework/_nemo.email.cls.php` | Templates, used by `resetPassword` and `emailTest.php` |
| File integrity | `cron.fim.php`, `_framework/_nemo.fim.cls.php` | Audit, compare, chmod |
| Manual tester | `test/index.php` | HTML form, curl to `/sawis_api_v1/api.php` |
| WSDL emitter | `wsdl/wsdl.php` | HTTP-GET WSDL for an early subset of list calls |

## Milestones visible in comments

These dates are comments inside `_framework/_nemo.api.cls.php`, not git tags. The git history does not show them as separate commits. The whole tree arrived in `6b26d3d` on 2020-08-24.

| Label in comments | Approx. dates | What the comments say was added |
|---|---|---|
| Early lists | 2016-06 to 2016-10 | Paging, API log page, vendor field stripping, vendor authentication |
| v1.3 | 2017-03 to 2018-04 | Member profile, packing and certificate code lists, certification and export writes, WIETA farm and membership, blend and harvest reads |
| v1.4 | 2017-06 to 2017-07 | User create, update, login, set password, login token, reset password |
| v1.6 WineMS | 2019-01 to 2019-02 | Farm, member, block GUID, cellar, and block activity calls |
| v1.7 LMS | 2018-11, 2019-02, 2020-03 | `getMemberProfileLMS`, `getMemberIDListLMS` |
| CIS | 2019-06, 2020-03 | `getCGABlockList`, farm name added 2020-03-30 |

## Implementation plan

No written implementation plan is in the repository. The code comments are the only plan. They include unfinished markers:

- `setWineExportRecord` and `setWietaMembership` say `//TODO!!!` on required-field checks. The key field is still checked.
- A second `authenticate` method that would bind a member to `apiVendorMember` is commented out and marked `//wip`.
- `SessionExpire` is `"3 DAY"` with the comment `CHANGE BACK AFTER TESTING!!!!!`.
- `setVinProMembers` prints the XML with `print_rr` and runs `TRUNCATE TABEL tmpVinPro` (the SQL word is `TABEL`).

## Known dependencies

- PHP with `mysqli`, `simplexml`, `session`, GD (`email.read.receipt.php` builds a 1×1 JPEG), and the removed-in-later-PHP function `get_magic_quotes_gpc` (called from `Rest.inc.php` and `gpc_extract`).
- MySQL database name `sawis_api`, reached as user `root` on `127.0.0.1` when `SERVER_NAME` is `api.sawisonline.co.za` or `10.0.0.173`.
- Tables and views named in SQL, including `apiVendor`, `apiVendorField`, `apiToken`, `apiLog`, `sysSettings`, `sysUser`, `sysLogin`, `sysSecurityGroup`, `tblMember`, `tblFarm`, `tblBlock`, `tblCertification`, `tblLabAnalysis`, `tblExportTransaction`, `tblWietaCertification`, `stg_wmsBlock`, `stg_wmsBlockActivity`, `wmsBlockGUID`, `vieWMS`, `dwdLocation`. The full list is in the technical document.
- SMTP settings read from `sysSettings` keys `SMTP Send As Sawis3` and `SMTP BCC` during password reset. The mail transport class is `NemoEmail`. Host and credentials are not in this repository.
- jQuery 2.2.0 from `ajax.googleapis.com` on `test/index.php` only.
- NuSOAP under `wsdl/test/lib/`, used by the WSDL tester, not by `api.php`.

Silicon Ark already documents `sawis_staging` and `sawis_reporting`. `sawis_staging` project plan says that repository copies records into a MySQL profile whose database name is `sawis_api`. This repository's connection file also names database `sawis_api`. **Inferred:** the two repositories were meant to share that database. Whether they still do is **Unknown / Requires Confirmation**.

## Current project status

**Implemented in git, not bootable from git alone.** `system.php` includes `system.server.QA.php` and `system.server.DEV.php` before it connects. Only `system.server.PROD.php` is in the tree. A request that loads `system.php` from this commit fails on the missing include.

`display_errors` is `1`. `error_reporting` is `E_ALL` without `E_STRICT`, `E_NOTICE`, and `E_WARNING`.

There is no deploy script, no pipeline file, and no test suite. `phpinfo.php` calls `phpinfo()`.

Path names disagree. The session directory and `test/index.php` use `/sawis_api_v1/`. `wsdl/wsdl.php` uses `/sawis_api/api.php`. `system.server.PROD.php` sets `env_root` to `DOCUMENT_ROOT` for `api.sawisonline.co.za` and to `DOCUMENT_ROOT/sawis_api_v1/` for `10.0.0.173`.