# Features — supplier.sarugby.online

Evidence date: 2026-10-01. Source: `master` at `6f0e6c2` (2021-04-29).

Status words: **Current** means the code path is present and reachable. **Dormant** means the repository has not changed since 2021-04-29; whether production still serves it is Unknown. **Unused** means the file exists and no controller in this repository constructs it. **Documented only** means the text states the rule and the code does not enforce it.

## Current (implemented, dormant repository)

| ID | Feature | Where | Notes |
|---|---|---|---|
| F-001 | Login, logout | `LoginController`, `login/index.phtml` | Email and MD5 password against `CompaniesLogin`. Already-authenticated users are sent to `/`. |
| F-002 | Login override | `LoginController::indexAction` | A hardcoded password loads the stored hash for the typed email and signs in as that user. Value omitted. |
| F-003 | Forgot and reset password | `login/forgot`, `login/reset` | Reset link by email. New password is MD5-stored and emailed in clear text. |
| F-004 | Company registration | `RegisterController`, `register/index.phtml` | Rejects a duplicate registration number, ID number, or email. Creates member, company, and a `Company_Events` row for event 44. |
| F-005 | Email confirmation | `RegisterController::validateemailAction` | Link uses `Validate_Key`. Sets `AllowLogin` and `Email_Confirmed`. |
| F-006 | Dashboard | `IndexController::indexAction`, `index/index.phtml` | Staff count, permit count, event count, permits grouped by load type, accreditation name in the header. |
| F-007 | Request a permit | `PermitsController::createAction`, `addpermitAction`, `permits/create.phtml` | Load-in or load-out, service type, vehicle, driver, occupants. Inserts status 2 and emails the applicant address from `Permits_view`. |
| F-008 | Permit profile and edit | `profileAction`, `savepermitAction`, `permits/profile.phtml` | Company-scoped read. Edit does not change status. Form locks from the cutoff. |
| F-009 | Duplicate a permit | `duplicatepermitAction`, dashboard script in `index/index.phtml` | New status-2 row, new permit number, posted date and reference. |
| F-010 | Cancel a permit | `cancelAction` | Sets status 5 and a cancel message. No email, despite a comment that says one will be sent. |
| F-011 | Status badges | `index/index.phtml` | Pending (<4), Approved (4), Cancelled (5), Declined (6), Checked-In (7), Delayed (8), Checked-Out (9). |
| F-012 | FAQ | `questionsAction`, `Questions()` | Static SA Rugby / HSBC Sevens copy, including the health-and-safety file list. |
| F-013 | Company profile | `CompanyController::profileAction` | Updates `Companies_Profile`. Lists B-BBEE levels, company types, countries. |
| F-014 | Company logo | `CompanyController::uploadAction`, `LoginController::companypicAction` | Base64 JPEG under `public/archives/companies/{CID}_image.jpg`. `companypicAction` serves the file or a built-in placeholder and does not require the usual login `init` (login `init` does not check auth). |
| F-015 | Staff list, add, edit, photo | `UsersController` | Roles: Administrator, Director, Management, Operations, Driver, Technician, General Staff. Photo under `public/archives/accreditation/{MID}_image.jpg`. |
| F-016 | Authenticated chrome | `application/layouts/default.phtml` | Title "SA Rugby - Load-in and Load-out". Links: Dashboard, Company, Staff, FAQ, My profile, Logout. Header shows trading name and accreditation name. |
| F-017 | Permit PDF | `IndexController::getpermitpdfAction` | Fetches HTML from footprintapp.net and streams a Dompdf file. |
| F-018 | HTTPS redirect | `modules/default/controllers/Bootstrap.php` | Redirects when `SERVER_PORT` is not 443. |
| F-019 | CodeDeploy | `appspec.yml`, `scripts/`, `bitbucket-pipelines.yml`, `codedeploy_deploy.py` | Pipelines on branches `qa` and `prod` only. |
| F-020 | Error page | `ErrorController`, `error/error.phtml` | 404, not authorised, and generic application error. |

## Documented only (stated to the user, not enforced here)

| ID | Statement | Where it is written | What the code does |
|---|---|---|---|
| F-021 | Activation can take up to 48 hours and an administrator reviews the company first | Registration email | `Companies_Profile.Active` is set to 1 on insert |
| F-022 | A delivery permit cannot exceed 2 hours | FAQ | Time in and time out are free text fields |
| F-023 | A work permit requires a health and safety file on site | FAQ | No file upload or approval flag in this repository |
| F-024 | Only one company administrator | FAQ | Staff add allows role Administrator with no count check |
| F-025 | One permit per day per vehicle | FAQ | No uniqueness check on vehicle and date |
| F-026 | Changes and cancellations until 1pm | Permit notification email | Create/dashboard use 12:00 the day before; profile lock uses 13:00 the day before |
| F-027 | Accreditation for event days is a separate portal | FAQ ("every staff member ... via the accreditation application portal") | The portal URL in the answer is the placeholder `[www]` |

## Present and not the product

| ID | Item | Evidence |
|---|---|---|
| F-028 | Plesk default site | Root `index.html` ("Domain Default page"), `css/`, `img/`, `favicon.ico`, `test/` FastCGI, PHP, and SSI pages |
| F-029 | Limitless theme catalogue | `default/` HTML samples and `default.zip` (about 27 MB) |
| F-030 | Second theme tree | `public/FILESTO DOWNLOAD/` including another Dompdf tree |
| F-031 | Unused domain models | `Fixture`, `FixtureScores`, `Squad`, `Tournament`, `TournamentFoodSession`, `FoodSessionItems`, `Nutritions`, `Allergens`, `MenuVenues`, `MatchReport`, `NewsArticles`, `GirProfile`, `Positions`, `Ethnicity`, `Unions`, `ComentryAndCiting`, `Logs`, `Profile`, `BBEETypes` (the registration form uses `AccreCompanyTypes`, not `BBEETypes`). No `new Model_` for these in `application/modules`. |
| F-032 | Unused PG plugins | `library/PG/Controller/Plugin/` holds FPDF, match report, image uploaders, and similar classes. The only plugin registered in `application.ini` is `LayoutPicker`. |
| F-033 | Empty or mismatched controllers | `AuthonController` actions are empty. `OrgController` and `OrganisationController` do not implement registration. `EventsController` is declared as class `Companies_EventsController`, so the Zend `events` route would not load that class name. `IndexController::validateemailAction` is empty. `CompanyController::getmembersAction` is empty. `PermitsController::emailtestAction` sends a test message to a hardcoded address. |
| F-034 | Alternate registration | `IndexController::newcompanyAction` validates via `www.sarugby.online`. No view posts to it. |
| F-035 | Footprint email relay | `postEmailToFp` posts to `https://footprintapp.net/email/send`. The call in `addpermitAction` is commented out. |
| F-036 | Maintenance splash | Commented out at the top of `public/index.php`. |
| F-037 | Copy files | `application/models/Copy of Fixture.php`, `views/scripts/index/Copy of index.phtml`. |

## Not in this repository

| ID | Feature | Evidence |
|---|---|---|
| F-038 | Approve, decline, check-in, delay, check-out | Badges exist. No action sets status 4, 6, 7, 8, or 9. Columns `ApprovedBy`, `DeclinedBy`, and similar are cleared when duplicating, which shows they exist on the table. |
| F-039 | Operations PIN dashboard | That behaviour is documented for `track.mypass.zone`, which is a different repository and a later event id. |
| F-040 | Automated tests | `test/` is the Plesk test-page folder, not PHPUnit. |
| F-041 | SonarQube project file | Not in `master` at `6f0e6c2`. |

## Changed or removed

Git history on `master` is nine commits. The only message that names a user-visible change after the initial commit is `e0414fb` (2020-03-20), "Added trusted site mark to login page". The contents of the five "no message" commits on 2020-01-10 were not diffed for this document.

No removed-feature list is recorded in the repository. Commented blocks (older permit email with December 2018 load-in times, footprint email POST, maintenance page, root HTTPS rewrite) are retired copy still in the files, not a separate product version.

## Planned

No roadmap, TODO issue list, or "planned" document exists in the repository. Nothing in the code is marked as a future feature. The FAQ sentence about an accreditation application portal describes another site, not a feature of this repository.