# Project plan — track.mypass.zone

Evidence date: 2026-10-01.

Source repository: `git@bitbucket.org:overdrive/track.mypass.zone.git`.

Inspected revision: `master` at `ec4cf5d` (2022-08-25, "Update application.ini"). That commit is `origin/HEAD`. The remote has no other branches.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

**MyPass Track** is an operations screen for vehicle load-in and load-out permits at a SA Rugby event. A person who knows the shared PIN opens a dashboard of every permit for one fixed event, filtered by date and by load-in or load-out. The page title is "MyPass Track". The footer on the login page is "MyPass".

Provenance: **Implemented** (`application/modules/default/views/scripts/login/index.phtml`, `application/layouts/default.phtml`, `IndexController`).

The same tree also contains a supplier registration and permit-request application aimed at SA Rugby accreditation (`accreditation@sarugby.co.za`, company profiles, staff, B-BBEE fields). That application expects a company login (`Zend_Auth` against `CompaniesLogin`). The login form that is actually wired does not perform that login. See the branch-reality note below and FR-001 in `prd.md`.

FAQ copy was updated on 2022-08-25 from "HSBC World Rugby Sevens Series" to "RWC Sevens 2022". Provenance: **Documented** in `PermitsController::Questions()`, commit `b8652a3`.

## What this repository is

A Zend Framework 1 PHP application. Apache document root is `public/`. CodeDeploy copies the tree to `/mnt/data/www/html/mypass.zone/track.mypass.zone/`.

The database name in configuration is `teamwizz_SARU` on host `db.footprintapp.net`. Many model classes (fixtures, squads, tournaments, food sessions, news) are present and are not called by any controller in this repository. Provenance: **Inferred** that this tree was cut from a larger SARU / Teamwizz application and pointed at the shared database. Whether those tables are still shared with other products is **Unknown / Requires Confirmation**.

## History

Eleven commits, 2022-06-23 to 2022-08-25. Authors: Heinrich du Plessis (`379e8dd` "Initial commit"), then `heinrichoverdrive` and `liam-ovd`.

| Commit | Date | What changed |
|---|---|---|
| `379e8dd`, `8506afe` | 2022-06-23 / 06-24 | Initial application: controllers, views, Zend library, Limitless theme, CodeDeploy |
| `100a6e3`, `6df26fe` | 2022-06-30 | CodeDeploy destination and `application.ini` |
| `db14ee9` | 2022-07-22 | One-line change in `IndexController` |
| `42e3301`, `97a9342`, `3803660` | 2022-07-28 to 2022-08-17 | Login and layout styling and logos |
| `c6e1ef9` | 2022-08-16 | Terms and conditions modal on the login page |
| `b8652a3` | 2022-08-25 | Session event id changed from 44 to 367; permit email sign-off changed from "SA Rugby Event Administration" to "MyPASS Administration"; FAQ event name changed to "RWC Sevens 2022" |
| `ec4cf5d` | 2022-08-25 | `application.ini` only |

No commits after 2022-08-25. No open feature branches on the remote.

## Scope that is in this repository

- PIN gate that stores event id `367` in the `EVENT` session and opens the permit dashboard.
- Dashboard of permits for that event: totals, load-in versus load-out, date filter, status badges, zone weight totals, gate counts, Excel download control in the page.
- Permit profile, create, save, duplicate, and cancel actions, plus a FAQ page.
- Company registration, email confirmation, password reset, company profile, and staff profile screens.
- PDF render of a permit by pulling HTML from footprintapp.net.
- Deploy description for AWS CodeDeploy via Bitbucket Pipelines on branches `qa` and `prod`.

## Scope that is not established

- Who uses the dashboard in production, and whether event `367` is still the live event.
- Whether the supplier registration and company login are used on this host or only on `supplier.sarugby.online` / `sarugby.online`.
- Where permits are approved, declined, checked in, or checked out. Those status values are displayed here. This repository does not set statuses 4, 6, 7, 8, or 9.
- Whether `qa` or `prod` deployment branches ever existed. They are not on the remote that was cloned.
- SonarQube files. The onboarding brief listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master` at `ec4cf5d`. They may have been untracked on the scan host. Provenance: **Unknown**.

## Architecture (as implemented)

```text
Browser
  -> Apache (public/.htaccess rewrites to public/index.php)
  -> Zend_Application (APPLICATION_ENV, default production)
  -> default module controllers
  -> Zend_Db (pdo_mysql, teamwizz_SARU)
  -> views (Limitless / Bootstrap theme in public/)
```

External calls that the code actually makes or prepares:

| System | Direction | Where |
|---|---|---|
| MySQL `teamwizz_SARU` | Read and write | `application.ini` |
| SMTP `mail.sarugby.co.za` as `accreditation@sarugby.co.za` | Outbound mail | Login, Register, Index, Permits controllers |
| `https://footprintapp.net/api/mypass/gettermsandconditions/` | Browser GET for terms HTML | Login page script |
| `https://footprintapp.net/pdf/getpermit/id/{id}` | Server fetches HTML, Dompdf renders PDF | `IndexController::getpermitpdfAction` |
| `https://footprintapp.net/email/send` | Prepared POST; the call in `addpermitAction` is commented out | `PermitsController::postEmailToFp` |
| AWS S3 + CodeDeploy | Deploy artifact | `bitbucket-pipelines.yml`, `codedeploy_deploy.py`, `appspec.yml` |

## Major components

| Path | Role |
|---|---|
| `public/index.php` | Front controller. Timezone `Africa/Johannesburg`. Forces `display_errors` on. |
| `application/configs/application.ini` | ZF1 resources: MySQL, session, locale `af_ZA`, module directory, layout |
| `application/modules/default/controllers/` | Product actions |
| `application/models/` | `Zend_Db_Table` models. Accreditation models are used. Rugby, food, and news models are not referenced by controllers |
| `application/layouts/default.phtml` | Authenticated shell, title "MyPass Track" |
| `public/limitless`, `public/assets`, `public/global_assets` | Theme and images, including `MyPASS_POS_PORT_WEB.png` and `MyPASS_POS_LAND_WEB.png` |
| `public/dompdf` | PDF library used by the permit PDF action |
| `library/Zend` | Zend Framework 1 |
| `library/PG` | Local plugins, including `PG_Controller_Plugin_LayoutPicker` |
| `scripts/`, `appspec.yml`, `codedeploy_deploy.py` | CodeDeploy hooks and Bitbucket deploy script |

`public/wp-content` and `public/wp-includes` are present. No controller references them. Their role is **Unknown**.

## Milestones visible in Git

There is no project plan, issue tracker, or roadmap in the repository. The only milestones are the commits above. The last product change that names an event is `b8652a3` ("Changes for event 367") on 2022-08-25.

## Current status

The repository is dormant on `master`. Last change 2022-08-25. No tests. No README. Pipelines are declared for `qa` and `prod` only, and those branches are absent, so a push to `master` does not deploy.

Credentials (database and mailbox) are stored in source. Values are omitted from Silicon Ark. A human should treat them as exposed and rotate them. See `technical-documentation.md`.

## Known dependencies

- PHP with the `mysql` PDO driver, `mcrypt` (`mcrypt_create_iv` in registration and password reset), and `curl` (the unused footprint email helper).
- Zend Framework 1, vendored under `library/Zend`.
- Apache with `mod_rewrite`.
- The shared MySQL database and the footprintapp.net HTTP endpoints.
- AWS account variables consumed by the pipeline (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_DEFAULT_REGION`, `APPLICATION_NAME`, `DEPLOYMENT_GROUP_NAME`, `S3_BUCKET`). `codedeploy_deploy.py` also reads `DEPLOYMENT_CONFIG`. That variable is not exported by `bitbucket-pipelines.yml`. Provenance: **Implemented** mismatch.

## Human confirmation

1. Is event id `367` still the event this site should show, and is the site still deployed at `track.mypass.zone`?
2. Is the supplier registration flow in scope for this host, or does it belong to `supplier.sarugby.online`?
3. Which system writes permit statuses Approved, Declined, Checked-In, Delayed, and Checked-Out?
4. Should the committed database password, SMTP password, and shared PIN be rotated? (Values are not repeated here.)
5. Were `sonar-project.properties` and `sonarqube_scan.bat` ever part of this repository, or only untracked files on the scan host?