# Technical documentation — sawis_reporting

Evidence date: 2026-10-04.

Source: `git@bitbucket.org:overdrive/sawis_reporting.git`, `master` at `520145d` (2020-10-12 12:00:11 +0200, author Selwin Matthyse `<selwin@sawis.co.za>`, message "first commit"). Parent: `db8c5ca` (2020-10-12 09:10:21 +0000, Jaco Brits `<jaco@overdrive.co.za>`, "Initial commit"). Only branch: `master`. `origin/HEAD` points at `master`. No tags.

The scan-host path `~/projects/sonar_scan/repos/sawis_reporting` was not on the machine that produced this document. Facts below come from that git revision.

## Architecture

Two static entry points at the repository root. They do not call each other.

```text
Browser
  index.html
    fonts.googleapis.com     Roboto + Material Icons
    code.getmdl.io/1.3.0     material.cyan-light_blue.min.css
                             material.min.js
    styles.css               path not in git
    images/*                 paths not in git

PHP runtime
  index.php                  echo "hello world"

Committed and unreferenced by those URLs
  assets/js/styles.css
  assets/images/*.png|jpg
```

There is no framework bootstrap, router, database client, queue, or background worker.

## Repository layout

Nine tracked paths:

| Path | What it is |
|---|---|
| `.gitignore` | Bitbucket's example ignore file from `db8c5ca`. Comment says to customize it. Patterns cover Node, Java, Python, logs, Maven, JetBrains, PHPUnit-style `TEST*.xml`, OS junk, `*.exe`, `*.war`, and common video types. No `.env` pattern, and no `.env` file is committed |
| `index.html` | 250-line MDL dashboard document. Apache 2.0 header, Copyright 2015 Google Inc. |
| `index.php` | Five-line PHP file. The only statement is `echo "hello world";` |
| `assets/js/styles.css` | 215-line dashboard stylesheet. Same Apache 2.0 / Google 2015 header. The directory name is `js`; the file is CSS |
| `assets/images/android-desktop.png` | Binary. Referenced by the HTML as `images/android-desktop.png` |
| `assets/images/dog.png` | Binary. CSS background for `.demo-updates .mdl-card__title` |
| `assets/images/favicon.png` | Binary |
| `assets/images/ios-desktop.png` | Binary |
| `assets/images/user.jpg` | Binary. Avatar in the drawer |

No `README`, `LICENSE`, `composer.json`, `package.json`, `Dockerfile`, `appspec.yml`, pipeline file, test directory, or environment sample.

## Languages and frameworks

| Item | Evidence |
|---|---|
| HTML5 | `<!doctype html>`, `lang="en"` |
| CSS | `assets/js/styles.css`. Also one `<style>` block in `index.html` for `#view-source` |
| PHP | `index.php` only. Full `<?php` tags. No version, no extensions, no autoload |
| Material Design Lite 1.3.0 | CDN links in `index.html`. Not a copy in git |
| JavaScript owned by this repo | None. Behaviour comes from `material.min.js` on the CDN |

The HTML and CSS match the public MDL dashboard template structure (the page's own View Source URL points at `google/material-design-lite` `templates/dashboard` on branch `mdl-1.x`). A line-by-line diff against that upstream snapshot was not taken. **Unknown / Requires Confirmation:** whether any byte of `index.html` or `styles.css` was edited after the copy. Visible product text is still the template's (title, example.com addresses, lorem sentence, 82% labels).

## Asset resolution

`index.html` is at the root, so its relative URLs resolve at the root:

- `styles.css` → `/styles.css` when the site root is the repo root. Tracked file: `assets/js/styles.css`.
- `images/user.jpg` and the other `images/` icons → `/images/...`. Tracked files: `assets/images/...`.
- `images/touch/ms-touch-icon-144x144-precomposed.png` → no tracked file.

`assets/js/styles.css` line 181 sets `background-image: url('images/dog.png')`. Relative to that CSS file, the URL is `assets/js/images/dog.png`, which is not tracked. The image is `assets/images/dog.png`. The HTML never links `assets/js/styles.css`, so this rule is not applied on a normal load.

MDL component classes (`mdl-layout`, `mdl-navigation`, `mdl-card`, and the rest) are defined by the CDN CSS, not by `styles.css`. If the CDN CSS loads and the local file does not, the visitor still gets MDL's default component look, without the demo chart colours, drawer sizing, and dog image from `styles.css`.

## PHP

```php
<?php

echo "hello world";

?>
```

- No `declare`, namespace, or include.
- No superglobals.
- No headers. The `Content-Type` is whatever the PHP host defaults to (often `text/html`). That default is **not** set in this file.
- Closing tag is present. Bytes after `?>` depend on whether the file ends with a newline. The statement output is the string `hello world`.

## Data

No database, schema, migration, CSV, or JSON document. The only persistent content is the git tree itself. Checkbox state is not written anywhere.

Chart numbers and the area-chart polygon are literals in `index.html`.

## Authentication and sessions

None. See business rule BR-001 in `business-rules.md`.

## External services

| Host | Resource | Loaded by |
|---|---|---|
| `fonts.googleapis.com` | Roboto CSS and Material Icons CSS | `index.html` |
| `code.getmdl.io` | `/1.3.0/material.cyan-light_blue.min.css` and `/1.3.0/material.min.js` | `index.html` |
| `github.com` | MDL dashboard template page | User click on `#view-source` only |

No API key, webhook, or outbound call from PHP.

## Infrastructure and deployment

**Unknown / Requires Confirmation.** The repository does not contain:

- a web-server vhost, `.htaccess`, or rewrite rule
- a container or compose file
- a Bitbucket pipeline or other CI definition
- a hosting name, domain, or environment variable

`index.php` requires a PHP-capable host if that file is the one served. `index.html` can be served as a static file. Which one answers a directory URL is a server setting and is not in git.

## Configuration

No config file. Colours, labels, and the greeting are source literals.

`.gitignore` does not change runtime behaviour.

## Background work

No cron, queue, worker, or scheduler.

## Monitoring and quality

No health endpoint, log statement, or metrics hook.

`sonar-project.properties` and `sonarqube_scan.bat` were listed at the root of the scan-host working copy when this onboarding task was created (2026-09-28). They are not in commit `520145d`. Their contents were not readable from git. A SonarQube project key, host, or quality gate for this repository is **Unknown / Requires Confirmation**.

## Security

Observed in the tree:

- No passwords, tokens, or private keys.
- No user input reaches PHP, so the script has no injection sink.
- The dashboard loads JavaScript from `code.getmdl.io` without a `integrity` attribute and without SRI. The script runs with the page's origin.
- The View Source link uses `target="_blank"` and does not set `rel="noopener"`.
- There is no CSRF surface: no state-changing form.
- `.gitignore` would ignore `*.exe` and `*.war` if someone added them. It would not ignore a future `.env`.

**Unknown / Requires Confirmation:** whether the scan-host Sonar files or an uncommitted deploy config contain secrets. They were not in the clone.

## Development and testing

No test runner, fixture, or documented setup. The CSS TODO about IE10/11 is the upstream template comment (`assets/js/styles.css`), using an old IE selector hack (`_:-ms-input-placeholder`). It is not a test.

A local check that does not require a server: confirm `index.php` contains only the echo, and confirm every relative URL in `index.html` fails to match a tracked path except the CDN URLs.

## Git history

```text
db8c5ca  2020-10-12  Initial commit   .gitignore only
520145d  2020-10-12  first commit     dashboard + index.php   ← master
```

Remote inspected: `https://bitbucket.org/overdrive/sawis_reporting.git`. The issue's recorded SSH remote is `git@bitbucket.org:overdrive/sawis_reporting.git`. Both names refer to the same repository. The clone used for this document was the HTTPS URL.