# Features — ui-testing

Evidence date: 2026-09-30.

Source: `git@bitbucket.org:overdrive/ui-testing.git`, `main` at `bcdafbf` (2025-05-24).

Status words: **Current** means present and wired enough to name. **Partial** means code exists and does not meet the behaviour the UI or the pseudo-code doc describes. **Inherited** means it arrived with the admin starter and is not part of the Selenium design doc. **Removed** means a commit says it was removed, or the file is gone.

## Current

### Login, logout, and password reset

- **Status:** Current.
- **What:** Username and password login, logout, forgot-password, reset-password, forbidden page.
- **Where:** `app/Controllers/Welcome.php`, views under `app/Views/common/`, routes in `app/Config/Routes.php`.
- **Provenance:** **Implemented**. `README.md` lists authentication as a feature.

### Email two-factor step

- **Status:** Current, delivery **Unknown**.
- **What:** If `users.2fa_enabled` is on (migration default 1), login can require an email code before the session is marked logged in.
- **Where:** `Welcome::twoFactorValidationForm`, `Welcome::confirmCode`, migration `2024-09-12-123957_AddTwoFactorAuthenticationTable.php`.
- **Provenance:** **Implemented**. SMTP settings in `env` are commented out.

### Roles, users, and menu permissions

- **Status:** Current.
- **What:** Four seeded roles. Screens to create users and roles and to change menu permissions. Sidebar is built from `user_menu_category`, `user_menu`, and `user_access`.
- **Where:** `app/Controllers/Users.php`, `app/Controllers/Developers/MenuManagement.php`, seeds under `app/Database/Seeds/`.
- **Provenance:** **Documented** in `README.md` ("Menu Management with auto create controller and view file"). **Implemented** in the controllers. Auto-creation of a controller file was not verified line by line.

### Selenium dashboard shell

- **Status:** Current as a page. Actions on it are **Partial** (see below).
- **What:** Two DataTables (test files and test logs), upload modal, run, run-all, view log, delete.
- **Where:** route `seleniumDashboard`, `SeleniumTestController::dashboard`, `app/Views/test/seleniumDashboard.php`. Menu seed title "Selenium Dashboard", URL `seleniumDashboard`, icon `play-circle`, category General.
- **Provenance:** **Implemented**.

### Selenium test JSON API

- **Status:** Current, with mismatches against the dashboard.
- **What:** List (DataTables JSON), show, create from upload, update name and description, soft delete (`is_active` = 0), download, statistics.
- **Where:** `app/Controllers/SeleniumTestController.php`, `app/Models/SeleniumTest.php`, route group `seleniumTestController`.
- **Provenance:** **Implemented**.

### Selenium run log and step-result JSON API

- **Status:** Current on the methods that exist.
- **What:** Log list, create, show, delete. Result list, show, failed, by status, screenshots, step times, error summary, delete, get screenshot, get error details.
- **Where:** `SeleniumTestLogController`, `SeleniumTestResultController`, models `SeleniumTestLog` and `SeleniumTestResult`.
- **Provenance:** **Implemented**. Routes also name `view` and `getResults`, which these classes do not define. See Partial.

### WebDriver command runner

- **Status:** Current as a class. **Partial** as a product feature, because the dashboard does not call it with the body it requires.
- **What:** Starts geckodriver or chromedriver, runs the first test's commands, writes step rows and PNG screenshots.
- **Where:** `app/Controllers/SeleniumController.php`. Commands listed in `prd.md` FR-005.
- **Provenance:** **Implemented**. Design narrative in `docs/selenium-controllers.md` is pseudo-code and does not match the method signatures.

### Schedule JSON API

- **Status:** Partial. See below.
- **Where:** `SeleniumScheduleController`, `SeleniumSchedule`, table `selenium_schedules`.

### Server monitoring page and CLI loop

- **Status:** Current as code. **Inherited**.
- **What:** HTTP page `monitoring` plus spark command `monitor:system`, which loops `top` every 5 seconds and logs CPU at or above 5% and memory at or above 50%.
- **Where:** `app/Controllers/ServerMonitoring.php`, `app/Commands/MonitorSystemUsage.php`.
- **Provenance:** **Implemented**. The CPU threshold of 5 is a comment "hardcoded for now" in the command. Not a confirmed business rule.

### System settings screens

- **Status:** Current as routes and views. Several actions query tables that have no migration here.
- **Where:** `app/Controllers/SystemSettings.php`, `app/Views/systemSettings/`.
- **Provenance:** **Inherited**.

### Developer CRUD generator and DB admin screens

- **Status:** Current as routes.
- **Where:** `Developers\CRUDGenerator`, `Developers\DbTableDataView`, `DbAdmin`.
- **Provenance:** **Documented** as menu management in the README. CRUD generator behaviour beyond the route was not exercised.

### SonarQube and secret scan

- **Status:** Current on the default pipeline.
- **Where:** `bitbucket-pipelines.yml`, `sonar-project.properties` (`sonar.projectKey=overdrive_ui-testing_9033316d-0744-4893-80ab-0b153ade50be`).
- **Provenance:** **Implemented**.

### PHPUnit coverage of Selenium controllers

- **Status:** Current as files. Not executed during this inspection.
- **Where:** `tests/Controllers/Selenium*Test.php`, `tests/Traits/SeleniumTestTrait.php`, `phpunit.xml.dist`.
- **Provenance:** **Implemented**. `composer.json` script `test` runs PHPUnit. The pipeline does not.

## Partial

### Upload from the dashboard

The modal posts file field `sidefile`. `SeleniumTestController::create` validates `side_file`. **Implemented** on both sides, inconsistent with each other.

### Run and run-all

Run posts the test id in the URL and a CSRF form field. `execute` reads JSON (`test_id`, `browser`) and a column `test_file` that does not exist. Run-all posts `seleniumController/executeAll`, and that method does not exist.

### Log detail

The dashboard calls `view` and `getResults`. The controller implements `show` and does not implement `getResults`. Explicit routes still point at the missing methods.

### Schedules

Controller create uses `frequency`, `start_time`, `end_time`, and `hasConflict`. The table and model use `cron_expression`, `start_date`, `end_date`, and have no `hasConflict` method. Route `changeStatus` has no method. No worker consumes due rows.

`docs/selenium-controllers.md` describes cron validation and browser selection on create. That description matches the model better than the controller.

### Two-factor disable

`SeleniumTestController::disable2fa` is a stub whose body is the comment `// ... existing code ...`. Route: `POST seleniumTestController/disable2fa`. **Not implemented.**

### Same-target schedule conflict

`SeleniumTest::canScheduleAt` is implemented and unused. `target_url` is never set by `create`.

### Assertion commands

Outer switch accepts `assert` and `verify`. Inner switch accepts `assertText` and the other IDE names. A normal Selenium IDE export uses the inner names, so those steps are rejected as unsupported commands. **Implemented** defect. See `prd.md` WF-4.

## Inherited and not part of the Selenium docs

These files are in `main`. They are not described by `docs/selenium-controllers.md`. Several reference classes or tables that are absent.

| Feature | Where | Note |
|---|---|---|
| Reports (invoices, orders, BI charts) | `app/Controllers/Reports.php`, `app/Views/reports/` | No invoice or order migration |
| CSV upload | `Csv` controller, routes `csv/upload`, `csv/save` | **Inherited** |
| File and media upload | `Upload`, `UploadedFile`, `File`, `app/Views/mediaFile/` | **Inherited** |
| Email templates and pixel | `Email`, `EmailPixelTracking`, route `tracking-pixel` | Pixel route is public |
| Login history and blocked users | migrations in 2024-09, `LoginHistory`, `BlockedUsersModel` | **Implemented** schema |
| HTTP cron runner | `CronJobs` | Exits on weekends and outside 08:00–22:59. Looks up `cronjob_actions`. Imports missing models. Not the Selenium scheduler |
| Organisations comment block | bottom of `Routes.php` | Comment only. No `Organisations` controller. Filter still excepts `organisations` |
| Home dashboard counters | `Home::index` | Builds an empty parent/child list. Role ids 5 and 7 are referenced and not seeded |
| Site health | `SiteHealth` | **Inherited** |
| REST and API simulation | `Rest`, `ApiSimulation` | **Inherited**. Not traced |

## Planned

No issue tracker export, TODO file, or milestone list is in the repository.

`README.md` points at a Jira board (`siliconsoftware.atlassian.net` project SI) and a Confluence space `AO`. Those sites were not read. **Unknown / Requires Confirmation** whether they still describe this repository.

`docs/overview.md` ends with generic recommendations (API docs, caching, backups). Those are not scheduled work.

`SeleniumTestController::disable2fa` and the dashboard's `executeAll` look like unfinished methods, not a written plan.

## In development

Nothing. The only branch is `main`. The last commit is 2025-05-24.

## Recently changed (last commits on `main`)

| Commit | Date | Message | Product effect |
|---|---|---|---|
| `bcdafbf` | 2025-05-24 | Remove unused model | Last change. Model file removed; not re-opened in this pass |
| `c136edc` | 2025-05-24 | Clean up debug logs, fix menu name issue | Menu labelling |
| `d29b1e2` | 2025-05-23 | Fix login usses | Login |
| `1595c12` | 2025-05-23 | Fix display and poll errors on veiw | Dashboard view |
| `3a94144` | 2025-05-23 | more cleanup, controller and test updates, initial selenium views | Selenium views |
| `04cd5cd` | 2025-05-22 | Cleanup cross site contamination and integrations | Removal of donor-app behaviour. Extent is the commit message plus the missing SAWIS Slack code |
| `a05a427` | 2025-05-14 | Removed email sending from pipeline | Mailgun step left in the file and commented out of `pipelines.default` |

## Removed or disabled

| Item | Evidence |
|---|---|
| Adminer | Commit `c9c312f` "remove adminer" (2025-05-12) |
| SAWIS Slack integration | Commit `b81ab98` "remove sawis slack integration" |
| Pipeline summary email | Commit `a05a427`. Step `&send-email` remains in the YAML and is not referenced by `pipelines.default` |
| Dependency-Check pipeline step | `&dependency-scan` is defined. The default pipeline line that called it is commented |
| `public/deploy.php` git pull | The whole file body is inside a comment, including the token check and `shell_exec` |
| AWS SDK | Listed in `README.md`. Absent from `composer.json` |

## Deprecated

No deprecation notice is written in the repository. The donor-app controllers are unmarked. Treat them as **Inherited**, not as formally deprecated, until someone confirms they should be removed.