# Business rules — sawis_reporting

Evidence date: 2026-10-04.

Source: `git@bitbucket.org:overdrive/sawis_reporting.git`, `master` at `520145d` (2020-10-12).

No business-rules document exists in the source repository. The rules below are taken from `index.html`, `index.php`, `assets/js/styles.css`, and `.gitignore`. Anything marked **Inferred** is a conclusion from that evidence, not a written policy.

There is no domain rule for wine data, levies, reports, or SAWIS membership in this repository. A reader who needs those rules has to look at another system. This repository does not name that system.

## Identity and access

### BR-001 — The page does not identify the visitor

**Implemented.**

`index.html` always shows `hello@example.com` in the drawer. The account menu repeats that address, adds `info@example.com`, and shows "Add another account...". No password field, cookie, token, or server check exists.

**Inferred:** the account block is template decoration. It does not grant or deny access.

Evidence: `index.html` (drawer header and `#accbtn` menu).

### BR-002 — Both root files are public

**Implemented** absence of an access check.

`index.php` prints its string for any invocation. `index.html` has no login step before the dashboard.

**Unknown / Requires Confirmation:** whether a host in front of this tree adds authentication. Nothing in git does.

### BR-003 — Drawer labels do not authorize a destination

**Implemented.**

Inbox, Trash, Spam, Forums, Updates, Promos, Purchases, Social, and Help use `href=""`. They do not encode a permission or a route. Help is an icon with a visually hidden "Help" span and the same empty `href`.

Evidence: `index.html` navigation.

## Content rules

### BR-004 — Chart figures are constants

**Implemented.**

Each pie chart's text node is `82` plus a `%` tspan. The area chart is one inline SVG (`#chart`) drawn twice. No rule calculates a percentage from a measurement.

Evidence: `index.html` chart markup.

### BR-005 — View options are not stored

**Implemented.**

The four checkboxes (Click per object, Views per object, Objects selected, Objects viewed) have no `name` and are not inside a form. Nothing in the repository writes their state.

**Inferred:** a tick lasts only as long as the browser keeps the document.

Evidence: `index.html` View options card.

### BR-006 — Search does not define a query language

**Implemented** absence.

The field `#search` accepts text in the browser widget. No rule defines what a query matches, how results are ordered, or what an empty query does, because no search runs.

Evidence: `index.html`. There is no other script file.

### BR-007 — Updates copy is fixed

**Implemented.**

The card text is the template sentence `Non dolore elit adipisicing ea reprehenderit consectetur culpa.` "Read More" is `href="#"`. No feed, date, or author is attached.

Evidence: `index.html`. The dog illustration is a CSS background in `assets/js/styles.css` and is not reached by the URL the page loads (see BR-010).

## Request handling

### BR-008 — `index.php` ignores input

**Implemented.**

The script does not read `$_GET`, `$_POST`, or any other input. Every successful run prints `hello world`. There is no validation error and no alternate message.

Evidence: `index.php`.

### BR-009 — The PHP script and the dashboard are not one response

**Implemented.**

`index.php` does not `include` or redirect to `index.html`. `index.html` does not reference `index.php`.

**Unknown / Requires Confirmation:** which file a directory request returns when both exist.

### BR-010 — Local asset URLs do not match the tree

**Implemented.**

| Requested URL | File in git |
|---|---|
| `styles.css` | `assets/js/styles.css` |
| `images/user.jpg` | `assets/images/user.jpg` |
| `images/favicon.png` | `assets/images/favicon.png` |
| `images/android-desktop.png` | `assets/images/android-desktop.png` |
| `images/ios-desktop.png` | `assets/images/ios-desktop.png` |
| `images/dog.png` relative to the CSS file | `assets/images/dog.png` |
| `images/touch/ms-touch-icon-144x144-precomposed.png` | No file |

**Inferred:** the template was placed under `assets/` without updating the HTML and CSS URLs. The repository does not say that this was intentional.

## What is not a business rule

| Topic | Finding |
|---|---|
| Reporting periods, measures, or exports | Not in the source |
| Who may publish a number | Not in the source. BR-004 makes the only numbers constant |
| Retention, audit, or approval | Not in the source |
| `.gitignore` patterns | Housekeeping examples from the initial commit. They do not constrain a visitor. The header comment says the list should be customized; it was not |

## Human confirmation

- Whether any operational rule (who uses the page, what "82%" was meant to mean, which index file is live) exists outside this repository.
- Whether the Sonar files seen on the scan host encode a quality gate. They are not in `520145d`, so they are not rules of this revision.