# Project plan — supplier.sarugby.online

Evidence date: 2026-10-01.

Source repository: `git@bitbucket.org:overdrive/supplier.sarugby.online.git`.

Inspected revision: `master` at `6f0e6c2` (2021-04-29, "Merge branch 'qa'"). That commit is `origin/HEAD`. History reachable from `master` is nine commits, 2019-12-18 to 2021-04-29. Author of every commit after the initial one is `heinrichoverdrive`. The initial commit `a5ca941` is authored `root`.

This plan describes what the repository contains. It does not decide what the product should become.

Silicon Ark already documents a later relative of this tree in `track.mypass.zone/`. That site is an operations dashboard with a shared PIN and a different event id. This repository is the company-login supplier portal. They are not the same deployment.

## Product

**SA Rugby Load-in and Load-out** is the supplier portal at `supplier.sarugby.online`. A company registers, confirms an email address, signs in, and requests vehicle permits for one event. Signed-in users see a dashboard, the company profile, staff, and an FAQ.

The authenticated layout title is "SA Rugby - Load-in and Load-out". Mail is signed "SA Rugby Event Administration" and sent from `accreditation@sarugby.co.za`.

Provenance: **Implemented** (`application/layouts/default.phtml`, `RegisterController`, `LoginController`).

On a successful login the code stores event id `61` in the `EVENT` session. Registration attaches the new company to event id `44`. Those two ids are not the same. Which event a supplier actually works against in production is **Unknown / Requires Confirmation**.

## What this repository is

A Zend Framework 1 PHP application. The root `.htaccess` sends requests that are not already under `/public/` into `public/`. `public/.htaccess` sends non-file requests to `public/index.php`. CodeDeploy copies the tree to `/mnt/data/www/html/sarugby.online/supplier.sarugby.online/` and sets owner `apache`.

The database name in configuration is `teamwizz_SARU` on host `db.footprintapp.net`. Many model classes (fixtures, squads, tournaments, food sessions, news, match reports) are present and are not constructed by any controller in `application/modules`. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at the shared database. Whether those tables are still shared with `track.mypass.zone`, `sarugby.online`, or footprintapp.net is **Unknown / Requires Confirmation**.

## History

| Commit | Date | What the message says |
|---|---|---|
| `a5ca941` | 2019-12-18 | initial commit of full repository |
| `9c0f0b8`, `ec7e29b`, `8f4afbb`, `6464166`, `3006155` | 2020-01-10 | "no message" |
| `ccfc664` | 2020-01-10 | Merge branch 'qa' into prod |
| `e0414fb` | 2020-03-20 | Added trusted site mark to login page |
| `6f0e6c2` | 2021-04-29 | Merge branch 'qa' |

No commits after 2021-04-29 are on `master`. The diffs inside the "no message" commits were not re-reviewed line by line. The product behaviour in this document is the tree at `6f0e6c2`.

## Scope that is in this repository

- Public registration of a company and its first user, with email confirmation.
- Email and password login, logout, forgot-password, and reset. Passwords are stored as MD5.
- Dashboard of the signed-in company's permits for the session event: staff count, permit count, event count, permit lists grouped by load type.
- Create, edit, duplicate, and cancel a permit. FAQ page.
- Company profile (including B-BBEE level and company type) and company logo upload.
- Staff list, add, and profile, including a photo upload.
- PDF stream of a permit by fetching HTML from footprintapp.net and rendering it with Dompdf.
- Deploy description for AWS CodeDeploy via Bitbucket Pipelines on branches `qa` and `prod`.

## Scope that is not established

- Whether the site is still deployed, and whether event `61` or event `44` is the live event.
- Where permits are approved, declined, checked in, delayed, or checked out. This repository displays statuses 4, 6, 7, 8, and 9 and does not set them. New requests are inserted with status `2`.
- Whether `qa` and `prod` still exist as remote branches. History contains merges of those names. The clone used here tracked `origin/master` only.
- SonarQube files. The onboarding brief listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master` at `6f0e6c2`. They may have been untracked on the scan host. Provenance: **Unknown**.
- The SQL behind views `CompaniesLogin`, `Permits_view`, `Accreditations_view`, and table `Permit_Status`. They are queried. Their definitions are not in this repository.

## Architecture (as implemented)

```text
Browser
  -> root .htaccess (rewrite into public/)
  -> Apache (public/.htaccess rewrites to public/index.php)
  -> Zend_Application (APPLICATION_ENV, default production)
  -> default module controllers
  -> Zend_Db (pdo_mysql, teamwizz_SARU)
  -> views (Limitless / Bootstrap theme under public/)
```

`Default_Bootstrap::_initForceSSL` redirects any request whose port is not 443 to `https://` on the same host. The root `.htaccess` HTTPS rule is commented out.

External calls that the code actually makes or prepares:

| System | Direction | Where |
|---|---|---|
| MySQL `teamwizz_SARU` | Read and write | `application.ini` |
| SMTP `mail.sarugby.co.za` as `accreditation@sarugby.co.za` | Outbound mail | Login, Register, Index, Permits controllers |
| `https://www.footprintapp.net/pdf/getpermit/id/{id}` | Server fetches HTML, Dompdf renders a landscape A4 PDF | `IndexController::getpermitpdfAction` |
| `https://footprintapp.net/email/send` | Prepared POST; the call in `addpermitAction` is commented out | `PermitsController::postEmailToFp` |
| AWS S3 + CodeDeploy | Deploy artifact | `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `appspec.yml` |

## Major components

| Path | Role |
|---|---|
| `public/index.php` | Front controller. Timezone `Africa/Johannesburg`. Forces `display_errors` on. A maintenance banner is commented out. |
| `application/configs/application.ini` | ZF1 resources: MySQL, session cookie lifetime 864000 seconds, locale `af_ZA`, module directory, layout `default` |
| `application/modules/default/controllers/` | Product actions. Only the `default` module exists. |
| `application/models/` | `Zend_Db_Table` models. Accreditation, company, and user models are used. Rugby, food, and news models are not referenced by controllers. |
| `application/layouts/default.phtml` | Authenticated shell. Navigation: Dashboard, Company, Staff, FAQ. |
| `public/assets`, `public/global_assets` | Limitless theme. A second copy lives under `public/FILESTO DOWNLOAD/`. |
| `public/dompdf` | PDF library used by the permit PDF action. |
| `library/Zend` | Zend Framework 1, vendored. |
| `library/PG` | Local plugins. `PG_Controller_Plugin_LayoutPicker` is registered and sets the layout to the module name. |
| `index.html`, `css/`, `img/`, `default/`, `test/`, `default.zip` | Plesk default page, Plesk test pages, and a Limitless HTML theme dump. Not the application. |
| `scripts/`, `appspec.yml`, `codedeploy_deploy.py` | CodeDeploy hooks and the Bitbucket deploy script. |

## Milestones visible in Git

There is no project plan, issue tracker, or roadmap in the repository. The only milestones are the commits above. The last change on `master` is the merge of `qa` on 2021-04-29.

## Current status

The repository is dormant on `master`. Last change 2021-04-29. No application test suite. No README. Pipelines are declared for `qa` and `prod` only, so a push to `master` does not run the pipeline described in `bitbucket-pipelines.yml`.

Credentials (database and mailbox) and a login override are stored in source. Values are omitted from Silicon Ark. A human should treat them as exposed and rotate them. See `technical-documentation.md`.

## Known dependencies

- PHP with the `mysql` PDO driver, the `mcrypt` extension (`mcrypt_create_iv` in registration, staff passwords, and password reset), and `curl` (the unused footprint email helper). `mcrypt` was removed from PHP 7.2. The PHP version on the server is **Unknown**.
- Zend Framework 1, vendored under `library/Zend`.
- Apache with `mod_rewrite` and `httpd` (the install hook runs `yum install -y httpd` and the start hook runs `service httpd start`).
- The shared MySQL database and the footprintapp.net HTTP endpoint used for permit HTML.
- AWS account variables consumed by the pipeline (`QA_` or `PROD_` prefixed `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_DEFAULT_REGION`, `APPLICATION_NAME`, `DEPLOYMENT_GROUP_NAME`, `S3_BUCKET`). `codedeploy_deploy.py` also reads `DEPLOYMENT_CONFIG`. That variable is not exported by `bitbucket-pipelines.yml`. Provenance: **Implemented** mismatch.

## Human confirmation

1. Is this site still deployed at `supplier.sarugby.online`, and which event id should the session use (`61` on login, `44` on registration, or another)?
2. Which system writes permit statuses Approved, Declined, Checked-In, Delayed, and Checked-Out?
3. Is the supplier portal still the product, or has `track.mypass.zone` replaced it for operations?
4. Should the committed database password, SMTP password, and login override be rotated? (Values are not repeated here.)
5. Were `sonar-project.properties` and `sonarqube_scan.bat` ever part of this repository, or only untracked files on the scan host?
6. Do remote branches `qa` and `prod` still exist, and is either of them what production runs?