# Project plan — snell-freestock-5.6 (Freestock Requisition)

Evidence date: 2026-10-02.

Source repository: `git@bitbucket.org:overdrive/snell-freestock-5.6.git`.

Inspected revision: `main` at `812337f` (2025-06-13, "filters fixes"). The scan-host path named in the onboarding task (`~/projects/sonar_scan/repos/snell-freestock-5.6`) was not present on this machine. Evidence comes from a read-only clone of `origin/main`.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The page title and footer name the system **Freestock Requisition** (`$SYSTEM` in `include/system.inc.php`). Staff sign in through IIS Windows logon, match that identity to a row in `mstUser`, then list, create, and authorise freestock requisitions (pink slips) for bill-to and ship-to customer accounts.

Provenance: **Implemented**. The repository README is the Bitbucket placeholder and does not describe the product. Inline comments date product work to 2010–2023 (Stephen, Yusiry, pj, maanie). Git history on Bitbucket starts only on 2025-06-05, when Uriel Balela imported the existing PHP tree.

The footer still prints version **2.0.1s** and date **31 May 2016**. The repository name is `snell-freestock-5.6`. What "5.6" refers to (PHP 5.6, a product release, or a folder name) is **Unknown / Requires Confirmation**.

## Branch reality

`origin/HEAD` is `main`. Five commits, all by Uriel Balela (`uriel` / `Uriel_Balela`), 2025-06-05 through 2025-06-13:

| Commit | Date | Message |
|---|---|---|
| `956aeae` | 2025-06-05 | Initial commit |
| `58b41f8` | 2025-06-05 | initial commit |
| `963515c` | 2025-06-06 | filters fixes & user fixes |
| `b196a4c` | 2025-06-06 | inactive user function fix |
| `812337f` | 2025-06-13 | filters fixes |

No other remote branches. No tags.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `main`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from the application, not from a written plan)

No project plan or requirements document exists in the repository. The following are **Inferred** from screens, SQL, and comments:

- Let a Snell user raise a freestock requisition against a region, a promotional bill-to account, and a ship-to account.
- Price requested cases and bottles from the product warehouse (`dwdProduct`) and show a rounded total.
- Route a submitted requisition to a manager, an alternate manager, and an executive manager copied from the requester's user row.
- Let a manager approve a pending requisition under R10 000, and an executive manager approve one at or above that amount.
- Hand notification work to rows in `sysCronJob` (`FSR_NewRequisition`, `FSR_RequisitionApproved`). The job runner is not in this repository.
- Let a user with `blnSpecial = 1` maintain the freestock user list, including marking users inactive.

## Scope

### In this repository

- PHP pages for login, logout, the requisition list, the requisition form, user maintenance, and XML AJAX helpers.
- Shared includes: layouts, session filters, an ODBC wrapper, a SQL Server table mapper (`sqlObject`), and a vendored adLDAP tree.
- Static assets: jQuery, a table sorter, a calendar control, menu scripts, and Snell / RGBC images.
- `web.config` setting `index.php` as the IIS default document.

### Not in this repository

- The SQL Server database, its schema scripts, and the data in `mstUser`, `dwdCustomer`, `dwdProduct`, and related tables.
- The process that reads `sysCronJob` and sends mail or updates status to `Completed`.
- IIS, the ODBC DSNs (`snell_fsr`, `snell_2015`), and Active Directory. This app trusts `$_SERVER["LOGON_USER"]`.
- Automated tests, a real README, deployment scripts, and Sonar configuration in git.

## System architecture

```text
Browser (Firefox or Chrome; IE 6–11 is refused by user-agent)
        |
        | IIS Windows authentication (LOGON_USER)
        v
PHP pages (login.php, requisition.php, requisitionForm.php, user.php, ajax.functions.php)
        |
        | ODBC
        v
SQL Server
  DSN snell_fsr, and on hosts other than "sql-server" a second connect to DSN snell_2015
  Tables: fsrRequisition, fsrItem, fsrRequestType, mstUser, mstUserGroupFreeStock,
          mstBranch, mstBrand, dwdCustomer, dwdProduct, mstUsageLog, sysCronJob
  View: vieRequsitionManager
        |
        | insert/update only (runner not in this repo)
        v
sysCronJob  -->  Unknown external job
```

Authenticated pages include `include/layout.full.inc.php`, which redirects to `login.php` when `$_SESSION[USER]` is missing. `ajax.functions.php` includes the system bootstrap and does not include that layout.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `login.php` | Windows logon, IE block, session via `LogginUser` | Implemented |
| `requisition.php` + `include/requisition.cls.php` | Filterable authorisation list | Implemented |
| `requisitionForm.php` | Create, edit, submit, approve, decline | Implemented |
| `user.php` + `include/user.cls.php` | User list and editor; menu link only when `blnSpecial = 1` | Implemented |
| `ajax.functions.php` | XML lookups for ship-to, bill-to, and products | Implemented |
| `include/system.inc.php` | ODBC connection, session path, version, R10 000 limit | Implemented |
| `ldap/adLDAP.php` | Vendored library. The `new adLDAP()` call in `login.php` is commented out | Dormant |

## Milestones visible in comments and git

There is no milestone plan in the repository. Dates below are comments or commits, not a roadmap.

| When | What the tree records |
|---|---|
| 2010-11-26 | Comment: login facility added by Stephen (`system.functions.inc.php`) |
| 2015-02-08 | Comment: cancel button hidden (`requisitionForm.php`) |
| 2015-10-13 | Comment: Internet Explorer block (Yusiry) |
| 2015-11-12 | Comment: user group 6 treated as Executive security group (pj) |
| 2015-11-23 | Comment: contact name and number no longer required (pj / Snell demo) |
| 2016-05-05 | Comment: approval-over-limit bug fix (pj) |
| 2016-05-31 | Footer version `2.0.1s`; comment: user management added (maanie/pj) |
| 2020-10-29 | Comment: stop user/manager/alt approving over the limit (maanie) |
| 2021-05-03 | Comment: escape single quotes in authorised-by text; snapshot `include/requisition.cls.20210503.php` |
| 2023-11-02 | Comment: no edits after approve |
| 2024-05-06 | Comment: stop clearing `dtStamp` on user save (maanie) |
| 2025-06-05 | Bitbucket import |
| 2025-06-06 | User active filter, "Make Inactive", requisition filter session fixes |
| 2025-06-13 | Requisition and user filters returned to `$_SESSION[PAGES]->Page[script]` array notation |

## Implementation plan

No forward plan is written in the repository. Current status is a maintained legacy PHP application whose last recorded change is the 2025-06-13 filter fix.

## Known dependencies

- PHP with the ODBC extension, running under IIS on Windows. Session files are stored under `DOCUMENT_ROOT\snell_freestock\Sessions` (or `\snell_freestock_PHP\Sessions` when the host name is `sql-server` or `localhost`).
- SQL Server reached by ODBC DSN. `sqlObject` reads column lists from `sys.sysobjects` / `sys.syscolumns`.
- IIS Windows authentication populating `LOGON_USER`.
- jQuery 1.4.2 (the header loads this file). jQuery 2.1.4 is also in `include/javascript/` and is not referenced by the header.
- Browser other than Internet Explorer 6–11.

## Current project status

**Implemented and in git on `main`.** The live site URL, the database name in production, and whether the hardcoded logon override is still enabled in the deployed copy are **Unknown / Requires Confirmation**. See the confirmation list in `prd.md`.