# Features — track.mypass.zone

Evidence date: 2026-10-01. Source: `master` at `ec4cf5d` (2022-08-25).

Status words mean:

- **Active in the PIN flow** — reachable after the shared PIN sets event `367`.
- **Present, disconnected** — code and screens exist, but they require `Zend_Auth` identity or are not linked from the PIN login.
- **Unused in this app** — files exist and no controller here calls them.
- **Removed / inactive** — left in the tree commented out or replaced.

## Current features

### F-01 — PIN login and logout

Active in the PIN flow.

`/login` posts a password field labelled as a PIN. A match stores `EVENT.EID = 367` and redirects to `/`. Any other value shows "Bad entered credentials". `/login/logout` destroys the session.

Evidence: `application/modules/default/controllers/LoginController.php` (`indexAction`, `logoutAction`), `views/scripts/login/index.phtml`. Event id changed from 44 to 367 in `b8652a3`.

### F-02 — Event permit dashboard

Active in the PIN flow.

`/` lists permits for the session event, defaulting to load-in (`LoadType` 1) and to today's date when today is one of the event's active load dates, otherwise the first active date. Counts, status badges, a date select, a load-in / load-out select, zone weight, and gate totals are rendered in `index/index.phtml`. `/index/getdata` returns the same fragment for a posted type and date.

Evidence: `IndexController::indexAction`, `getdataAction`, `views/scripts/index/index.phtml`, `getdata.phtml`.

An "Download XLS Report" item calls `DownloadExcel()` in that view. Whether the function produces a file was not fully traced beyond the menu label. Treat the control as present in the UI. Completeness of the export is **Unknown / Requires Confirmation** if a tester needs a file contract.

### F-03 — Permit detail

Active in the PIN flow for reading.

`/permits/profile/key/{id}` loads one permit for any company (`getPermit_admin`) and shows driver, occupants, and a lock flag.

Evidence: `PermitsController::profileAction`, `views/scripts/permits/profile.phtml`.

`profiletestAction` is the same screen filtered by `getPermit($id, identity.CID)`. It needs an auth identity the PIN does not create.

### F-04 — Permit PDF

Active in the PIN flow if `getpermitpdf` is requested. It is not a status check: approval is not tested before the download.

Evidence: `IndexController::getpermitpdfAction`. HTML source is footprintapp.net. Library is `public/dompdf`.

### F-05 — Terms modal

Active on the login page.

Evidence: `login/index.phtml`, commit `c6e1ef9` (2022-08-16). Content is loaded from footprintapp.net. Acceptance is not recorded.

### F-06 — FAQ

Reachable once the event session exists. `/permits/questions` prints the question list in `PermitsController::Questions()`.

The event name in the accreditation answer was changed to "RWC Sevens 2022" in `b8652a3`. The portal URL is the literal placeholder `[www]`.

### F-07 — MyPass branding

Active.

Login image `/limitless/assets/images/MyPASS_POS_PORT_WEB.png`. Layout image `/assets/images/MyPASS_POS_LAND_WEB.png`. Title "MyPass Track". Logo and colour commits: `42e3301`, `97a9342`, `3803660` (2022-07-28 to 2022-08-17). Permit mail sign-off "MyPASS Administration" since `b8652a3`.

## Present, disconnected from the PIN login

These features run only when `Zend_Auth` has an identity, or they are alternate entry points the login form does not call.

| Id | Feature | Evidence |
|---|---|---|
| F-10 | Company self-registration and email confirm | `RegisterController`, `views/scripts/register/index.phtml`, `validateemail.phtml` |
| F-11 | Forgot-password and reset | `LoginController::forgotAction`, `resetAction`, `login/forgot.phtml`, `login/reset.phtml` |
| F-12 | Email/password company login | `LoginController::LoginNow`, `getAuthAdapter` on table `CompaniesLogin`. Not called by `indexAction`. Would set event id 44 |
| F-13 | Create permit | `PermitsController::createAction`, `addpermitAction`, `permits/create.phtml` |
| F-14 | Save permit edits | `savepermitAction` |
| F-15 | Duplicate permit | `duplicatepermitAction` |
| F-16 | Cancel permit (status 5) | `cancelAction`. No cancellation email is sent |
| F-17 | Company profile and logo upload | `CompanyController` |
| F-18 | Staff list, add, and profile, with role labels | `UsersController` |
| F-19 | Second registration API on the home controller | `IndexController::newcompanyAction`. Confirm action is empty. Link host is `www.sarugby.online` |

Registration still writes `Company_Events.EID = 44` after the dashboard event moved to 367 (`b8652a3` did not change `RegisterController`).

## Unused or stub features in this tree

| Item | Evidence | Note |
|---|---|---|
| `AuthonController` | Actions empty or `exit` | Views under `views/scripts/authon/` include a register form |
| `OrganisationController` | `profileAction` empty | View `organisation/profile.phtml` exists |
| `OrgController.php` class `Company_OrgController` | `indexAction` empty | Class name does not match the file, so the route is not registered as `OrgController` |
| `EventsController.php` class `Companies_EventsController` | `indexAction` prints `AccreditationList::getEvents(2)` | Same class-name mismatch. Redirect target in `init` is `/companies/login/`, which is not a controller in this repository |
| Rugby, tournament, squad, fixture, food, nutrition, allergen, news, GIR, ethnicity models | `application/models/` | No controller in this repository instantiates them |
| `public/wp-content`, `public/wp-includes` | Static tree | No reference from application PHP that was searched via controller use |
| `library/PG` match report, image upload, FPDF helpers | Plugin files | Layout picker is the plugin named in `application.ini` |
| `PermitsController::postEmailToFp` | curl to footprintapp.net `/email/send` | Call site in `addpermitAction` is commented out |
| `PermitsController::emailtestAction` | Sends a test message to a hardcoded mailbox | Debug action behind the event session only |
| `IndexController::testAction` | Prints one `Company_Members` row for a hardcoded ID number | Debug action behind the event session |
| Commented maintenance page | `public/index.php` | Not executed |
| Commented company totals on the dashboard | `IndexController::indexAction` | Not executed |
| Layout names `admin`, `union`, `referee`, `gir`, `accreditations` | `application.ini` | Only `application/layouts/default.phtml` and `layout.phtml` exist. `LayoutPicker` sets the layout to the module name (`default`) |

## Planned features

None found. No issue list, changelog, or unreleased branch.

## Recently changed (last commits on master)

| Date | Change | Feature |
|---|---|---|
| 2022-08-25 | `application.ini` | Configuration only (`ec4cf5d`) |
| 2022-08-25 | Event session 44 → 367; mail sign-off; FAQ names RWC Sevens 2022 | F-01, F-06, F-13 email (`b8652a3`) |
| 2022-08-17 | Logos and styling | F-07 |
| 2022-08-16 | Terms modal | F-05 |
| 2022-07-28 | Custom styling | F-07 |
| 2022-07-22 | `IndexController` one line | F-02 |
| 2022-06-30 | CodeDeploy path and ini | Deployment, not a user feature |
| 2022-06-24 | Initial commit of the application | F-01 through F-19 as they exist now, with event id 44 |

## Deprecated or removed

Nothing was deleted after the initial commit except the behaviour changes above. The SA Rugby email sign-off was replaced by MyPASS Administration. Event id 44 remains in registration and in the unused `LoginNow`.

`public/assets_old` is an extra theme tree. It is not referenced by the layout links that were read (`/assets`, `/limitless`, `/global_assets`).

## Not features of this product

Models and public files for fixtures, player profiles, menus, and WordPress are in the checkout. They are not wired to a route that this application's controllers implement. Do not treat them as MyPass Track features unless a human confirms they are served from this host on purpose.