# Features — supplier.magus.events

Evidence date: 2026-10-01. Source revision: `master` at `ccfc664` (2020-01-10), with branch deltas called out. No feature list existed in the repository.

Status words used here:

- **Current** — present on `master` and reachable from a controller that Zend will dispatch.
- **Present, not dispatched** — code exists, but the class name does not match the file name, or the action is empty.
- **Documented only** — described in email or FAQ copy, with no action in this repository.
- **Unused model** — a `Zend_Db_Table` class that no supplier controller constructs.

## Current

| Feature | What the user can do | Where |
|---|---|---|
| Company registration | Submit company and first administrator; duplicate registration number, ID number, or email is rejected | `RegisterController`, `views/scripts/register/index.phtml` |
| Email confirmation | Open the link, which sets `AllowLogin` and `Email_Confirmed` | `RegisterController::validateemailAction` |
| Login | Email and password against `CompaniesLogin`; session event id 61 | `LoginController::indexAction`, `LoginNow` |
| Login bypass | One hard-coded password signs in as any email found in `CompaniesLogin` | `LoginController::indexAction` |
| Logout | Clear auth and session | `LoginController::logoutAction` |
| Forgot password | Email a reset link when the address exists on `Company_Members` | `LoginController::forgotAction` |
| Reset password | Set a new MD5 password and email it in clear text | `LoginController::resetAction` |
| Dashboard | Staff, permit, and event counts; permits grouped by load type and date; accreditation and zones | `IndexController::indexAction`, `views/scripts/index/index.phtml` |
| Company profile | View and update `Companies_Profile` | `CompanyController::profileAction` |
| Company logo | Upload and display `{CID}_image.jpg` | `CompanyController::uploadAction`, `LoginController::companypicAction` |
| Remote logo upload | Update a company image by `cid` without an auth check | `LoginController::uploadremotecompanyAction` |
| Staff list | Members of the signed-in company | `UsersController::indexAction` |
| Add staff | Create a member, optional login flag, optional photo | `UsersController::addAction` |
| Edit staff | Update a member by id, including a photo | `UsersController::profileAction` |
| Create permit | Form of dates, services, and vehicle types; POST creates status 2 and emails the applicant | `PermitsController::createAction`, `addpermitAction` |
| Permit profile | View one company-owned permit; lock the form on status or cutoff | `PermitsController::profileAction`, `views/scripts/permits/profile.phtml` |
| Save permit | Update occupants and applicant-modified fields | `PermitsController::savepermitAction` |
| Duplicate permit | New status-2 copy with a new reference and request date | `PermitsController::duplicatepermitAction` |
| Cancel permit | Set status 5 and a cancel message. No email | `PermitsController::cancelAction` |
| Permit PDF | Fetch HTML from footprintapp.net and stream a landscape A4 PDF | `IndexController::getpermitpdfAction`, `public/dompdf` |
| FAQ | Fixed question and answer list | `PermitsController::questionsAction`, `Questions()` |
| Authenticated navigation | Dashboard, Company, Staff, FAQ, floating create-permit button, profile menu, logout | `application/layouts/default.phtml` |
| Deploy | Zip, S3, CodeDeploy on `qa` and `prod` | `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `appspec.yml` |
| Trusted-site script | Login page loads `cdn.ywxi.net/js/1.js` | `prod` only, commit `e0414fb`, file `login/index.phtml` |

## Present, not dispatched or empty

| Feature | Evidence | Note |
|---|---|---|
| Events list | `EventsController.php` class `Companies_EventsController` | Class name does not match the file. `indexAction` dumps events where the argument to `getEvents` is `2` |
| Organisation profile | `OrganisationController::profileAction` empty | Layout does not link here |
| Org controller | `OrgController.php` class `Company_OrgController` | Actions empty. Class name does not match the file |
| Authon registration | `AuthonController` | `indexAction` and `newcompanyAction` are empty |
| Second registration on Index | `IndexController::newcompanyAction` | Does not hash the password. Validation link points at `www.sarugby.online`. `IndexController::validateemailAction` is empty |
| Demo sidebar | `views/scripts/menu/main_menu.phtml` | Placeholder links. Not the layout that `default.phtml` renders |
| Plesk placeholder site | Root `index.html`, `css/`, `img/`, `test/` | "Domain Default page". Not the supplier portal |
| Permit profile test | `PermitsController::profiletestAction` | Same data load as profile, with a different driver check (`Driver == 1` instead of `Driver > 0`). No evidence it is linked from the layout |
| Email test | `PermitsController::emailtestAction` | Sends a test message to a hard-coded personal address. Not a product feature |
| Index test | `IndexController::testAction` | Prints a permit reference and exits |

## Documented only

| Feature | Where it is described | What is missing in this repository |
|---|---|---|
| Administrator review before the company may connect to an event | Registration email | Confirmation sets `AllowLogin` immediately |
| Administrator approval or decline of a permit | Permit email; status `4` is labelled Approved in the profile view | No action sets status to 4 or writes `ApprovedBy` / `DeclinedBy` |
| Administrator changes the requested date or time | Permit email | No action in this tree |
| Health and safety file checklist and venue approval | FAQ `Questions()` | No upload or workflow |
| Printed permit and vehicle access pass checked at the gate | FAQ | Operational, not a software feature here |
| Event-day accreditation on a separate portal | FAQ, the portal URL is the placeholder text `[www]` | Not this application |
| One administrator per company | FAQ | Staff add does not enforce it |
| Delivery permit limited to 2 hours, work permit requires a safety file | FAQ | Not enforced in `addpermitAction` |
| Map of the venue on the dashboard and on the permit | FAQ | Not found in `IndexController`. May be inside the footprintapp.net PDF HTML. **Unknown** |

## Unused models

These classes extend `Zend_Db_Table` and are not constructed by `RegisterController`, `LoginController`, `IndexController`, `CompanyController`, `UsersController`, or `PermitsController`:

`Tournament`, `TournamentFoodSession`, `Squad`, `Profile`, `Positions`, `Nutritions`, `NewsArticles`, `MenuVenues`, `MatchReport`, `Logs`, `GirProfile`, `FoodSessionItems`, `Fixture`, `FixtureScores`, `Ethnicity`, `ComentryAndCiting`, `Unions`, `Copy of Fixture.php` (also declares `Model_Fixture`, which collides with `Fixture.php` if both are loaded).

`Allergens`, `BBEETypes` (`B_BBEE_Types`), and the gates query result are loaded in places and then not passed to the view. `AccreditationGates` is constructed in `PermitsController::profileAction` and `createAction` and the result is not assigned. Registration uses `BBEELevel` and `AccreCompanyTypes`, not `BBEETypes`.

Provenance: **Inferred** unused, from the absence of `new Model_*` in the supplier controllers. A view helper could still construct one. Confidence: Medium.

## Changed, planned, removed

- **Changed across branches:** trusted-site script on the login page (`qa` and `prod`, not `master`). Database host `qadb.footprintapp.net` on `qa` versus `db.footprintapp.net` on `master` and `prod`.
- **Planned:** no TODO, roadmap, or ticket in the repository describes future work.
- **Removed:** nothing in the commit messages on these branches says a feature was removed. The five "no message" commits on 2020-01-10 were not diffed line by line.

## Reference data the UI depends on

| Data | Table | Used by |
|---|---|---|
| Countries | `countries` | Registration, company profile |
| B-BBEE levels | `BBEE_Level` | Registration, company profile |
| Company types | `Accre_Company_Types` | Registration, company profile |
| Accreditation / event | `Accreditation_List` | Dashboard, permit create. Keyed by `AC` |
| Loading zones | `Accreditation_Loading_Zones` | Dashboard (`AID` = event id) |
| Load service types | `Accreditation_Load_Services_Types` | Permit create and profile |
| Vehicle types | `vehicletypes` | Permit create and profile |
| Permit rows | `Accreditation_Permits` | Create, update, cancel |
| Permit read model | `Permits_view` | Dashboard and permit profile |
| Permit status labels | `Permit_Status` | `getStatus()` exists. The profile view overwrites the label in PHP |
| Company login | `CompaniesLogin` | Authentication and the password bypass |
| Company profile | `Companies_Profile` | Registration and profile |
| Members | `Company_Members` | Registration, staff, password reset |
| Company-event link | `Company_Events` | Registration insert, dashboard count |