# Project plan — ui-testing

Evidence date: 2026-09-30.

Source repository: `git@bitbucket.org:overdrive/ui-testing.git`.

Inspected revision: `main` at `bcdafbf` (2025-05-24, Joshua G-D, "Remove unused model"). The scan-host path `~/projects/sonar_scan/repos/ui-testing` was not on this machine. The tree below was read from that git revision. Secret values (passwords, tokens, encryption keys) are omitted.

This plan describes what the repository contains. It does not decide what the product should become.

There was no `silicon_ark/ui-testing/` directory before this set.

## Product

The repository is a CodeIgniter 4 web application that was adapted from an internal admin starter into a Selenium IDE (`.side`) test console.

Naming in the tree does not agree:

| Source | Name |
|---|---|
| `README.md` title | Admin Overdrive Starter |
| `composer.json` `name` | `codeigniter4/adminstarter` |
| `composer.json` `description` | Transactflow |
| `env` `app.siteTitle` | UI Testing |
| `docs/overview.md` | Transactflow |
| `install_lamp.sh` banner | UI Testing Installation |

**Inferred** product name for this repository: **UI Testing**. The other names are leftovers from the starter or from earlier Overdrive apps. **Unknown / Requires Confirmation:** which name is the official product name.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `main` (default; `origin/HEAD`) | `bcdafbf` | 2025-05-24 | Only branch. 45 commits from 2025-05-12 to 2025-05-24 |

No other local or remote branches were present at inspection.

Authors on `main`: Joshua G-D (31 commits), jacobrits (9), Jaco Brits (5).

History falls into two stretches:

- 2025-05-12 — Jaco Brits added the initial tree, Sonar properties, and the Bitbucket pipeline. jacobrits removed Adminer and expanded the pipeline. Joshua G-D then added LAMP and Selenium setup docs, the PHP WebDriver dependency, models, controllers, unit tests, and pipeline scans.
- 2025-05-14 to 2025-05-24 — Joshua G-D continued controller and test work, removed a SAWIS Slack integration, cleaned "cross site contamination", and ended with `bcdafbf` ("Remove unused model").

**Discrepancy:** the task-creation scan listed `sonarqube_scan.bat` at the repository root. That file is not in the tree at `bcdafbf`. A `builds/` directory is present; a recursive file search found nothing inside it.

## Objectives (inferred from the implementation and the README, not from a written plan)

- Give an operator a logged-in web console to upload Selenium IDE `.side` files and see test runs.
- Run those files in Firefox and/or Chrome through local `geckodriver` and `chromedriver` processes.
- Store tests, schedules, run logs, and step results in MySQL.
- Keep the admin starter's login, roles, menus, and system-settings screens.
- Scan the repository with SonarQube and detect-secrets on Bitbucket Pipelines.

## Scope

### In scope of `main`

1. CodeIgniter 4 application under `app/`, with public front controller `public/index.php`.
2. Selenium models, controllers, dashboard view, and the migration `2025-05-14-000001_create_selenium_tables.php`.
3. Admin starter features that still have controllers, views, and migrations: users, roles, menus, login, two-factor email codes, blocked users, system settings, developer menu and CRUD generator screens, server monitoring.
4. Setup docs `docs/lamp_setup.md`, `docs/selenium_setup.md`, `docs/selenium-controllers.md`, `docs/overview.md`, and `install_lamp.sh`.
5. PHPUnit tests under `tests/Controllers/` for the Selenium controllers, plus the CodeIgniter example session test and `tests/unit/HealthTest.php`.
6. Bitbucket Pipelines SonarQube and detect-secrets steps, and `sonar-project.properties`.

### Out of scope / not established

- A scheduler process that reads `selenium_schedules` and starts a browser run. Schedule create/update code exists. No command, cron function, or controller method was found that fires a due schedule.
- A working end-to-end path from the dashboard "Run" button to a browser. The view and `SeleniumController::execute` do not agree on the request shape. See the PRD.
- Production host, public URL, and who operates the console. `env` sets `app.baseURL` to `https://uitesting.php8`. Whether that host is live is **Unknown**.
- A written backlog. `README.md` links to a Jira board and a Confluence space. Those pages were not read.

## System architecture

```text
Browser (operator)
   |  session cookie, CSRF on some posts
   v
CodeIgniter 4 (PHP ^8.3)
   |-- Filters: CSRF, isLoggedIn, isGranted
   |-- Welcome / Users / SystemSettings / MenuManagement   (admin starter)
   |-- SeleniumTestController dashboard + JSON CRUD
   |-- SeleniumController starts chromedriver/geckodriver
   v
MySQL database `uitesting` (MySQLi)
   |-- users, roles, menus, sessions, 2FA, blocked users, login history
   |-- selenium_tests, selenium_schedules, selenium_test_logs, selenium_test_results

Local processes (only when a run reaches SeleniumController)
   |-- geckodriver or chromedriver on a port from 4444 upward
   |-- Firefox or Chrome
   v
Whatever URL the .side file opens

Bitbucket Pipelines (on the default pipeline)
   |-- SonarQube scan
   |-- detect-secrets
```

Mailgun, OWASP Dependency-Check, and a summary email are defined in `bitbucket-pipelines.yml` and are commented out of the pipeline that actually runs. Provenance: **Implemented** as unused step definitions. Commit `a05a427` message: "Removed email sending from pipeline".

## Major components

| Component | Location | Role |
|---|---|---|
| Login and session | `app/Controllers/Welcome.php`, `app/Filters/Authentication.php` | Username/password, optional email 2FA, session flag `isLoggedIn` |
| Menu authorisation | `app/Filters/Authorization.php`, menu seeds | Role must have a menu row whose URL matches the first URI segment, except listed paths |
| Selenium dashboard | `app/Views/test/seleniumDashboard.php` | Upload, list, run, delete. Server-rendered shell, DataTables over AJAX |
| Test catalogue | `SeleniumTestController`, `SeleniumTest` | Store `.side` file text in `selenium_tests.file_contents` |
| Runner | `SeleniumController` | Start a driver process and walk commands in the first test of the `.side` JSON |
| Schedules | `SeleniumScheduleController`, `SeleniumSchedule` | CRUD against `selenium_schedules`. No runner |
| Run log and steps | `SeleniumTestLog`, `SeleniumTestResult` | Status enum and per-step rows |
| Admin starter | Users, SystemSettings, Reports, CronJobs, ServerMonitoring, developers | Inherited screens and routes. Several still reference tables and classes that are not in this repository |
| Pipeline | `bitbucket-pipelines.yml` | SonarQube and detect-secrets |

## Milestones visible in git

There is no project plan in the source repository. The commit sequence is the only timeline:

1. 2025-05-12 — repository created and pipeline added.
2. 2025-05-12 — LAMP and Selenium driver install docs, WebDriver dependency.
3. 2025-05-13 to 2025-05-14 — Selenium tables, models, controllers, pseudo-code doc, first unit tests.
4. 2025-05-14 — pipeline email removed; dependency-check and detect-secrets added, then dependency-check left commented out of the default pipeline.
5. 2025-05-22 — "Cleanup cross site contamination and integrations"; "More cleanup"; Selenium views.
6. 2025-05-24 — last commit. No commits after that through the inspection date.

## Implementation plan

No forward plan is written in the repository. **Unknown / Requires Confirmation** whether further work is expected.

What the current tree still needs before the documented Selenium flow can run as the dashboard describes is recorded as discrepancies in `prd.md` and `business-rules.md`. Those gaps are observations, not an approved backlog.

## Known dependencies

- PHP `^8.3` with intl, mbstring, mysqlnd, xml, curl, simplexml (`README.md`, `composer.json`).
- CodeIgniter 4 (`codeigniter4/framework` `^4.0`). The installed patch version is not pinned; `vendor/` is not in git.
- MySQL or MariaDB. `env` names the schema `uitesting` and the driver MySQLi.
- Firefox, Chrome, `geckodriver` 0.36.0, and a Chrome-for-Testing chromedriver matching the installed Chrome (`docs/selenium_setup.md`).
- `php-webdriver/webdriver` `^1.15` and `symfony/process` `^7.2`.
- Composer packages also required but not part of the Selenium path: `mpdf/mpdf`, `phpoffice/phpspreadsheet`, `league/csv`, `orhanerday/open-ai`. No OpenAI call site was found under `app/`.
- PHPUnit 9 for tests. The pipeline does not run PHPUnit.
- SonarQube and detect-secrets in Bitbucket. Host URL and tokens are pipeline variables, not in git.

`README.md` still lists `aws/aws-sdk-php`. That package is not in `composer.json`.

## Current project status

**Implemented, incomplete.** The admin shell, schema, Selenium JSON controllers, dashboard view, setup docs, and security-scan pipeline are in `main`. The dashboard, the runner, the schedule controller, and the migration do not use the same field names or routes, so a run started from the dashboard is not expected to succeed. Details are in `prd.md`.

No open branches. Last change 2025-05-24.

## Human confirmation

1. Official product name (UI Testing, Admin Overdrive Starter, or Transactflow).
2. Whether `https://uitesting.php8` is a real environment, and who uses it.
3. Whether the Selenium runner is still wanted, given the wiring gaps and the stop in May 2025.
4. Whether inherited admin screens (reports, cron jobs, fault settings, companies) should stay.
5. Rotate secrets that are committed: `env` encryption key, `phpunit.xml.dist` tests database password, `CronJobs` security-key constant, commented token in `public/deploy.php`, and the short password literal in `app/Database/Seeds/Users.php`. Values are not copied into Silicon Ark.