# Features — timesheet

Evidence date: 2026-10-01.

Source: `git@bitbucket.org:overdrive/timesheet.git`, `master` at `3baa25ba` (2025-07-16).

There is no features document in the source tree. Status below means what the code contains, not a product roadmap. Menu visibility is stored in MySQL and was not readable from git.

## Current features

| Feature | What it does | Source | Status |
|---|---|---|---|
| Login | Email, password, external PIN, login audit | `login.php`, `sysLogin` via `tblLoginInsert` | Current |
| Forgot password | Email a reset link | `ajaxfunctions.php` `SendResetEmail`, `resetPassword.php` | Current |
| Session shell | Header, logout, database-driven menu, last visited, toolbar, filters, paging | `_nemo.cls.php`, `_nemo.menu.cls.php`, `layouts/` | Current |
| Home | Optional today's bookings and a two-day usage log | `index.php` | Current. Booking class file was not found in the listing |
| Timesheet list | Filter by date, user, client, notes. Day totals. eIT flag. Excel export | `timesheet.php`, `includes/timesheet.cls.php` | Current |
| Timesheet edit | Clock range, hour override, no-bill extra line, ticket item picker | `timesheet.php` | Current |
| Ticket timesheet | Second capture page on the same table | `timesheet_ticket.php` | Current |
| Target banner | Office and "my" hours and rand versus target for the month | `Timesheet::getUserOfficeTotal` | Current |
| Tickets | List and edit. Status and priority filters. Complete a ticket item | `ticket.php`, `includes/ticket.cls.php`, `TicketItemComplete` | Current |
| Ticket updater panel | Side panel on the timesheet list | `getTicketUpdater` in `project.functions.inc.php` | Current. Display rules not fully traced |
| Clients | Search, active filter, project count, soft delete, add project | `client.php`, `includes/client.cls.php` | Current |
| Projects | Filter by client, status, text. Soft delete. Create ticket from project | `project.php`, `includes/project.cls.php` | Current |
| Project items | Item detail, rate lookup | `project.item.php`, `includes/project.item.cls.php` | Current |
| Project templates | Pick a template on project create. Maintain templates | `Project::getTemplateList`, `project.templates.php` | Current |
| Overview | Month target dashboard for users with `blnOverview = 1` | `overview.php`, `includes/overview.cls.php` | Current |
| Reports | Ten reports listed in the PRD | `report.php`, `includes/*.rpt.php` | Current |
| Mark as invoiced | Bulk set `blnInvoiced` | `Timesheet::markAsInvoiced` | Current |
| IIF export | Client-grouped export of selected lines | `includes/iifExport.cls.php`, `includes/iifExportTicket.cls.php` | Current |
| QuickBooks hand-off | POST filtered lines to `qb.overdrive.co.za` and redirect | `timesheet.php` `QB Invoice` | Current |
| Copy to eIT | Single and bulk | `Timesheet::CopyToEit` | Current |
| Convergence time push | On timesheet save, when a task id resolves | `SaveConvergenceTime` | Current |
| Overrun email | 50 / 75 / 100 percent of estimate, once each | `Timesheet::Save`, `SendOverRunEmail` | Current |
| Hour reminder cron | Morning and afternoon under-target mail | `cron.reminder.php` | Current in code. Schedule **Unknown** |
| Rates | Named amounts | `rate.php`, `includes/rate.cls.php` | Current |
| SLA contracts | Hours and date range | `sla.contracts.php` | Current |
| Public holidays | Holiday list used by reminders and overview | `public.holidays.php` | Current |
| Users | Active staff, targets, eIT user id, picture, password reset | `user.php`, `includes/user.cls.php` | Current |
| Security groups | Per-page view, new, save, delete, special | `security.group.php` | Current |
| System settings | Key/value editor, excluding `vie%` names at load | `settings.php`, `system.php` | Current |
| Email log and templates | View, notes, resend, send | `email.php`, `email.template.php` | Current |
| Account lockout | Five bad passwords deactivate the user | `CheckSecurityLock` | Current |
| Password policy | Salted SHA-256, history, length and character class check in JS | `_nemo.password.cls.php` | Current. Policy switches come from `sysSettings` |
| FIM | Hash files and email a report | `fim_2.0/` | Current |
| Deploy | Zip `master` to S3. CodeDeploy spec present | `bitbucket-pipelines.yml`, `appspec.yml` | Current for the zip step |
| Sonar project | Project key only | `sonar-project.properties` | Current. No scanner step in the pipeline file |

## Completed features

Dated comments describe work that is in the tree now, not a separate completed backlog:

- 2016-10-03 password store and forgot password.
- 2016-09-06 office and user target banner.
- 2018-08 Convergence SaveTime.
- 2019-01 eIT copy, including the 2021-04-30 user-project id on the query string.
- 2023-02 overrun email.

## Planned features

No issue tracker, TODO roadmap, or unreleased feature flag file was found.

These comments describe behaviour that is not active code:

- `overview.php` save, edit, and delete cases are commented out. Overview is display-only in the active switch.
- `includes/timesheet.cls.php` contains a large commented-out earlier target banner. The live banner is `getUserOfficeTotal`.
- `system.php` contains a commented VPN database block for `192.168.100.6`.
- User-form password strength checks in `user.php` are commented out. Reset still uses `NemoPassword` on `resetPassword.php`.
- `bitbucket-pipelines.yml.bak.ftp` is an old FTP deploy. It is not the active pipeline.

Calling those "planned" would overstate them. They are **inactive code**.

## In development

Nothing in the tree is marked as a branch-only or unfinished feature. `zSandBox.php` assimilates `tblClient` and looks like a developer scratch page. **Inferred.** Do not treat it as a product screen until someone confirms it is on the menu.

`cron.daily.php` still implements workshop invites, vouchers, and course-start mail (`tblLearner`, `tblCourse`, `tblVoucher`, `xtblInvite`). The timesheet UI does not expose those entities. **Inferred:** leftover from another Nemo product that shared this framework. **Requires Confirmation** before calling it a live timesheet feature.

`project.functions.inc.php` still contains course-register SQL (`getRegisterCoursesSQL` and related). No timesheet page in the files read calls those functions. **Inferred** unused.

## Recently changed

The only commit visible in the shallow clone is `3baa25ba` (2025-07-16): `sonar-project.properties` with `sonar.projectKey=overdrive_timesheet_5ff9d63c-581f-496a-8808-f64ed976ecde`.

Older behaviour changes are known only from source comments, not from git history. A full `git log` was not retrieved.

## Deprecated or removed

| Item | Evidence | Reading |
|---|---|---|
| Clear-text password compare on login | `login.php` comment shows the old `strPasswordMD5 == md5(...)` check is replaced by `NemoPassword::checkPassword` | Superseded. `strPasswordMD5` still exists as a hidden user field and is used by `Action=Redirect` |
| Soft delete of timesheet rows | Commented SQL in `Timesheet::Delete` updating `sysTimesheet` | Replaced by hard `DELETE` from `tblUserProjectItem` |
| git-ftp deploy | `bitbucket-pipelines.yml.bak.ftp` | Not the pipeline file |
| Direct mysqli database selection block | Commented in `system.php` after the 2018-12-10 `mysqli_connect` change | Inactive |
| `client.totals.rpt.php.old` and `client.totals.rpt.php20200325` | Files next to `client.totals.rpt.php` | Old copies kept in the tree. The report loader includes `client.totals.rpt.php` only |
| `includes/overview.cls.php20230724` | Sibling of `overview.cls.php` | Old copy. `overview.php` includes `overview.cls.php` |

## Not features

- PHPExcel's own markdown manuals under `PHPExcel18/Documentation/`. Those document the library, not Timesheet.
- `Timesheet2.sublime-project` and `Timesheet2.sublime-workspace`. Editor metadata.
- `scripts/test.txt`. Not a test suite.