# Project plan — supplier.magus.events

Evidence date: 2026-10-01.

Source repository: `git@bitbucket.org:overdrive/supplier.magus.events.git`.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**SA Rugby Load-in and Load-out** is a supplier portal. A company registers, confirms an email address, signs in, and requests vehicle permits for one event. Signed-in users see a dashboard, the company profile, staff, and an FAQ.

The authenticated layout title is "SA Rugby - Load-in and Load-out". Mail is signed "SA Rugby Event Administration" and sent from `accreditation@sarugby.co.za`. The registration confirmation link is hard-coded to `http://supplier.sarugby.online/register/validateemail/id/{key}`.

Provenance: **Implemented** (`application/layouts/default.phtml`, `RegisterController`, `LoginController`).

CodeDeploy copies the tree to `/mnt/data/www/html/sarugby.online/supplier.sarugby.online/`. Provenance: **Implemented** (`appspec.yml`).

On a successful login the code stores event id `61` in the `EVENT` session. Registration attaches the new company to event id `44` with `Company_Events.Status = 2`. Those two ids are not the same. Which event a supplier actually works against is **Unknown / Requires Confirmation**.

## What this repository is

A Zend Framework 1 PHP application. The root `.htaccess` sends requests that are not already under `/public/` into `public/`. `public/.htaccess` sends non-file requests to `public/index.php`.

The database name in configuration on `master` and `prod` is `teamwizz_SARU` on host `db.footprintapp.net`. The `qa` branch points the same database name at `qadb.footprintapp.net`. Many model classes (fixtures, squads, tournaments, food sessions, news, match reports) are present and are not constructed by the supplier controllers. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at a shared database. Whether those tables are still shared with other products is **Unknown / Requires Confirmation**.

Silicon Ark already documents two relatives:

- `supplier.sarugby.online/` — same early history, and a later `master` tip (2021-04-29) that this remote does not have.
- `track.mypass.zone/` — a later operations dashboard (PIN login, different event id) cut from the same application shape.

They are separate remotes. This document covers `supplier.magus.events` only.

## Branch reality

File-level reading in this onboarding used `master` at `ccfc664` (2020-01-10, "Merge branch 'qa' into prod"). That is `origin/HEAD`.

The remote also has:

| Branch | Tip | Date | Message |
|---|---|---|---|
| `master` | `ccfc664` | 2020-01-10 | Merge branch 'qa' into prod |
| `qa` | `e0414fb` | 2020-03-20 | Added trusted site mark to login page |
| `prod` | `5c382ec` | 2020-03-20 | Merge branch 'qa' into prod |

Bitbucket Pipelines deploy the `qa` and `prod` branches, not `master`. `master` is behind both.

Diffs inspected:

- `master` (`ccfc664`) to `prod` (`5c382ec`): one change. `login/index.phtml` gains `<script src="https://cdn.ywxi.net/js/1.js" async>`. The commit message calls this a trusted-site mark.
- `qa` (`e0414fb`) to `prod` (`5c382ec`): the database host. `qa` uses `qadb.footprintapp.net`. `prod` and `master` use `db.footprintapp.net`.

No commits after 2020-03-20 are on any of these three branches. Whether `prod` is still the live site is **Unknown / Requires Confirmation**.

## History on master

Seven commits, 2019-12-18 to 2020-01-10. The initial commit `a5ca941` is the full repository. The five commits on 2020-01-10 before the merge have message "no message". Author of the merge tip is `heinrichoverdrive` (`heinrich@overdrive.co.za`). The diffs inside the "no message" commits were not re-reviewed line by line. Behaviour below is the tree at `ccfc664`, plus the two branch deltas above.

## Scope

In scope for this repository, as implemented on `master`:

- Public company registration and email confirmation.
- Email/password login, logout, forgot-password, and reset.
- Authenticated dashboard of the company's permits for the session event.
- Company profile edit and logo upload.
- Staff list, add, and edit, including a photo.
- Create, edit, duplicate, and cancel a load-in or load-out vehicle permit.
- Download a permit PDF rendered from HTML fetched from footprintapp.net.
- A static FAQ.

Out of scope for this repository, based on absence of an action that performs the work:

- Approving, declining, or rescheduling a permit. Columns for those outcomes exist and are cleared when a permit is duplicated. The email tells the supplier an administrator will review the request. No approve or decline action is in this tree.
- Health and safety file submission or approval. The FAQ describes it as a venue process.
- Choosing an event. The session event id is hard-coded at login.
- The rugby, fixture, squad, nutrition, and news models. They are in the tree and unused by the supplier controllers.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `public/index.php` | Front controller. Sets timezone `Africa/Johannesburg`, loads Zend, bootstraps `application.ini` | Implemented |
| `application/modules/default/controllers` | Registration, login, dashboard, company, staff, permits, FAQ | Implemented |
| `application/models` | `Zend_Db_Table` gateways, including unused rugby models | Implemented |
| `application/layouts/default.phtml` | Authenticated chrome: Dashboard, Company, Staff, FAQ, create-permit button | Implemented |
| `library/Zend` | Zend Framework 1 | Implemented |
| `library/PG` | Small plugin set. `LayoutPicker` forces the layout name to the module name (`default`) | Implemented |
| `public/dompdf` | HTML-to-PDF for the permit download | Implemented |
| `public/assets`, `public/limitless`, `public/global_assets` | Limitless / Bootstrap theme assets | Implemented |
| `appspec.yml`, `scripts/`, `codedeploy_deploy.py`, `bitbucket-pipelines.yml` | AWS CodeDeploy from Bitbucket Pipelines | Implemented |
| Root `index.html`, `css/`, `img/`, `test/` | Plesk "website is not available" placeholder and Plesk script test pages | Implemented. Not the supplier application |
| `default.zip` | About 27 MB, committed at the repository root. Contents were not opened | Unknown |

## Dependencies known from the tree

- PHP with the Zend Framework 1 library vendored under `library/Zend`. `mcrypt` is used for random ids (`mcrypt_create_iv`). That extension is not part of modern PHP.
- MySQL database `teamwizz_SARU`.
- Apache (`httpd`), installed and started by the CodeDeploy hooks.
- SMTP `mail.sarugby.co.za`, port 25, mailbox `accreditation@sarugby.co.za`.
- AWS CodeDeploy, S3, and Bitbucket Pipelines. Pipeline image is `python:3.5.1`. `boto3==1.3.0`.
- External HTML for the PDF: `https://www.footprintapp.net/pdf/getpermit/id/{id}`.
- A second mail path posts to `https://footprintapp.net/email/send`. The call site in `addpermitAction` is commented out. Provenance: **Implemented** as a function, **not called**.
- Google Fonts and Font Awesome from public CDNs in the registration and login views.
- On `prod` only: `https://cdn.ywxi.net/js/1.js` on the login page.

## Current status

The newest commit on any branch is 2020-03-20. There is no README, no application test suite, and no issue tracker inside the repository. `sonar-project.properties` and `sonarqube_scan.bat` were listed on the scan host when this task was created. They are not in git at `ccfc664`.

Plaintext database and SMTP credentials are committed in `application.ini` and in several controllers. A hard-coded password bypass exists in `LoginController::indexAction`. Those values are not copied into this documentation. They need human review and rotation. See `technical-documentation.md`.

## Milestones

No project plan, roadmap, or milestone list exists in the repository. The only sequence that can be stated is the git history above. Anything after March 2020 is **Unknown / Requires Confirmation**.

## Implementation plan

There is no forward implementation plan in the repository. This document does not add one.