# Project plan — unity-api

Evidence date: 2026-09-30.

Source repository: `git@bitbucket.org:overdrive/unity-api.git`.

Inspected revision: `master` at `eeafec9` (2019-08-30, author `siliconoverdrive`, subject "Including new db"). The scan-host path `~/projects/sonar_scan/repos/unity-api` was not on this machine. The tree below was read from that git revision.

This plan describes what the repository contains. It does not decide what the product should become.

There is no product requirements document in the source repository and no prior Silicon Ark set for `unity-api/`. `README.md` at `eeafec9` is the stock Laravel framework README. The first commit (`bed847e`, 2019-08-07, Jaco Brits) was the Bitbucket "edit a file / create a file / clone" starter README. That text was replaced when the Laravel tree arrived.

Silicon Ark already has other Unity-named directories (`unity-lambda-api`, `unityNodejsApi`, `unity-skeleton`, `unity-framework`, `unityCLI`, `unityAWS`, and others). This repository does not name them. Whether they are one product is **Unknown / Requires Confirmation**.

## Product

**Inferred** from the repository name, the commit subject "API first commit", and the routes under `/api`.

What the code actually does is a Laravel 5.8 application with two behaviours sitting side by side:

1. A small HTTP API: register a user, log in, issue a Laravel Passport personal access token, return the current user, and create, read, update, and delete rows in a `products` table (`name`, `detail`).
2. A phpMyAdmin dump, `db/unity.sql`, of a MySQL database named `unity`. That dump is a CRM, helpdesk, HR, SLA, and system schema with row data. No PHP file in this repository queries those tables.

No written statement of product purpose, owner, audience, or deployment target was found.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `eeafec9` | 2019-08-30 | Only branch. 3 commits from 2019-08-07 to 2019-08-30 |

No other local or remote branches were present at inspection. Nothing in git is dated after 2019-08-30. Whether the API is still deployed is **Unknown / Requires Confirmation**.

| Commit | Date | Author | Subject |
|---|---|---|---|
| `bed847e` | 2019-08-07 | Jaco Brits | Initial commit (Bitbucket starter README only) |
| `23fc561` | 2019-08-14 | siliconoverdrive | API first commit (Laravel 5.8 tree) |
| `eeafec9` | 2019-08-30 | siliconoverdrive | Including new db (`db/unity.sql`; README returned to the Laravel stock text) |

## Scope

### In this repository

- Laravel 5.8 HTTP application (`artisan`, `app/`, `routes/`, `config/`, `public/`).
- Passport-backed API guard (`config/auth.php` driver `passport`).
- Two register implementations and one login implementation.
- Product CRUD behind `auth:api`.
- Stock Laravel welcome page at `GET /`.
- Laravel Mix / Vue 2 scaffold (`resources/js`, committed `public/js/app.js` and `public/css/app.css`).
- Migrations for `users`, `password_resets`, and `products`.
- A full MySQL dump of database `unity` (schema and data), generated 2019-08-30 09:53 by phpMyAdmin 4.8.4 against MySQL 5.7.24.

### Not in this repository

- No Bitbucket Pipelines file, Docker file, or Homestead file (`.gitignore` ignores `Homestead.json` and `Homestead.yaml`).
- No queued jobs, scheduled commands, or mail-sending code of this application's own.
- No models, controllers, or queries for the `crm*`, `hr*`, `sys*`, `sla*`, or `dwf*` tables in the dump.
- Passport's own migration PHP files are not copied into `database/migrations`. The dump's `migrations` table records that those Passport migrations had been applied.
- The onboarding inventory listed `sonar-project.properties` and `sonarqube_scan.bat` at the scan-host root. Those paths are not in the git tree at `eeafec9`. Whether they were untracked local files is **Unknown / Requires Confirmation**.

## System architecture

```text
HTTP client
    │
    ├─ GET /                      → resources/views/welcome.blade.php
    │
    └─ /api/*   (prefix from RouteServiceProvider, middleware group "api")
           │
           ├─ POST /api/register          → API\RegisterController
           ├─ POST /api/v1/register       → Api\AuthController@register
           ├─ POST /api/v1/login          → Api\AuthController@login
           ├─ POST /api/v1/getUser        → Api\AuthController@getUser   (auth:api)
           ├─ GET  /api/user              → closure, returns request user (auth:api)
           └─ /api/products               → API\ProductController         (auth:api)
                    │
                    ▼
              MySQL via Eloquent
              tables: users, products
              Passport tables: oauth_*  (present in the dump, not in app migrations)

AuthServiceProvider calls Passport::routes() with no arguments.
Those routes are the locked package's defaults. They are not listed in routes/api.php.

db/unity.sql is a separate dump of database `unity`.
Application code does not reference it.
```

Global HTTP middleware includes `Spatie\Cors\Cors`. A second `App\Http\Middleware\Cors` is attached only to `POST /api/v1/login` and `POST /api/v1/register`. The repository root `.htaccess` also sets `Access-Control-Allow-Origin: *`.

## Major components

| Component | Path | Role |
|---|---|---|
| API routes | `routes/api.php` | Register, login, current user, product resource |
| Web routes | `routes/web.php` | Welcome view only. Laravel's `Auth::routes()` is not called |
| Auth API | `app/Http/Controllers/API/AuthController.php` | Register, login, getUser. Namespace is `App\Http\Controllers\Api` |
| Register API | `app/Http/Controllers/API/RegisterController.php` | Second register action. Namespace is `App\Http\Controllers\API` |
| Products | `app/Http/Controllers/API/ProductController.php`, `app/Product.php` | CRUD on `products` |
| Response helper | `app/Http/Controllers/API/BaseController.php` | JSON envelope `success`, `data`, `message` |
| User model | `app/User.php` | Passport `HasApiTokens`, `MustVerifyEmail`, fillable `name`, `email`, `password` |
| HTTP kernel | `app/Http/Kernel.php` | API throttle `60,1`; Passport guard; global Spatie CORS |
| Auth config | `config/auth.php` | `api` guard driver `passport` |
| SQL dump | `db/unity.sql` | phpMyAdmin dump of database `unity`, about 103,000 lines |

Stock Laravel controllers under `app/Http/Controllers/Auth/` (login, register, password reset, email verification) are present and are not referenced by `routes/web.php` or `routes/api.php`.

## Milestones visible in git

1. **2019-08-07** — Empty Bitbucket repository with the starter README.
2. **2019-08-14** — Laravel 5.8 application committed, including Passport, Spatie CORS, product CRUD, and the API auth controller.
3. **2019-08-30** — `db/unity.sql` added. README replaced with the stock Laravel README.

No later milestone, release tag, or deployment record is in the repository.

## Known dependencies

Locked in `composer.lock` unless noted as a constraint:

| Package | Constraint / lock | Use in this repo |
|---|---|---|
| PHP | `^7.1.3` | `composer.json` |
| `laravel/framework` | `5.8.*`, locked `v5.8.28` | Application framework |
| `laravel/passport` | `^7.3`, locked `v7.3.2` | API guard and `Passport::routes()` |
| `spatie/laravel-cors` | `^1.5`, locked `1.5.1` | Global CORS middleware |
| `laravel/tinker` | `^1.0` | Dev console. No project-specific tinker code |
| PHPUnit | `^7.5` | `tests/Feature/ExampleTest.php`, `tests/Unit/ExampleTest.php` |

Front-end devDependencies in `package.json` (not a lockfile in the repo): `axios` `^0.18`, `bootstrap` `^4.1.0`, `laravel-mix` `^4.0.7`, `vue` `^2.5.17`, `jquery`, `lodash`, `popper.js`, `sass`. The only Vue component is `resources/js/components/ExampleComponent.vue`.

`.env.example` sets `DB_CONNECTION=mysql`, host `127.0.0.1`, database name `homestead`, user `homestead`. The SQL dump's database name is `unity`. `config/database.php` falls back to database name `forge` when `DB_DATABASE` is unset. Which name a deployment used is **Unknown / Requires Confirmation**.

## Current project status

**Implemented** as of `eeafec9`, and unchanged in git since 2019-08-30.

The PHP API and the dumped CRM schema are not connected. The API's `products` table is not `crmproduct`. The API's `users` table is not `sysuser`.

The dump contains operational row data: client and staff fields, password hashes on `users`, rows in `oauth_access_tokens`, and a `syspassword` table. Those values are omitted from this documentation. Whether that file should remain in git is **Unknown / Requires Confirmation**.

## Implementation plan

There is no plan document in the repository. Nothing in code or commits describes a next phase. Any statement that this API was meant to expose the Unity CRM would be an inference from the file living next to the dump, and that inference is not confirmed: the PHP never reads the dump's tables.