# Project plan — userModule

Evidence date: 2026-09-29.

Source repository: `git@bitbucket.org:overdrive/usermodule.git`.

Inspected revision: `master` at `a8971a4` (2019-06-24, BaneleMlamleli01, "Able to Create user, Read all users, Update user and Delete user. I also created a login screen and encrypted passwords using MD5"). The scan-host path `~/projects/sonar_scan/repos/userModule` was not on this machine. The tree below was read from that git revision. The database password committed for the `lamp` host is omitted.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The README titles the work **Unity : userModule**. It is a PHP and MySQL exercise that registers a person, lists people, edits or deletes a person, and offers a login screen. The only product description in git is `README.md`. There is no separate plan, ticket export, or Silicon Ark set before this one.

Provenance: the four-phase list is **Documented** in `README.md`. The screens and SQL are **Implemented** in the PHP files on `master`. The word "Unity" is not used anywhere except that README heading. Whether userModule belongs to a larger product named Unity is **Unknown / Requires Confirmation**.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `a8971a4` | 2019-06-24 | Only branch. 38 commits from 2019-06-10 to 2019-06-24 |

No other local or remote branches were present at inspection. Nothing in git is dated after 2019-06-24. Whether anyone still runs this application is **Unknown / Requires Confirmation**.

Authors on the commits:

- Jaco Brits (`jaco@overdrive.co.za`) — initial commit, README, and the Smart Admin template, 2019-06-10 to 2019-06-11.
- `SILICONOVERDRIV\pieter` (`pj@overdrive.co.za`) — README styling, 2019-06-11.
- Banele Mlamleli — the application. Early commits use `mlamlelibanele@yahoo.com`. From 2019-06-12 the author email is `banele@overdrive.co.za` (names `BaneleMlamleli` and `BaneleMlamleli01`).

A comment in `projectFunction.php` credits Gael, on 20190615, for a debug parameter on `print_rr`. Gael is not a commit author. Provenance: **Documented** in that comment only.

Commit subjects cite task numbers `#161`, `#171`, `#172`, `#173`, `#174`, `#183`, `#187`, and `#194`. The tracker those numbers belong to is not in the repository. **Unknown / Requires Confirmation.**

## Objectives (from the README, not from a later decision)

`README.md` splits the work into four phases:

1. A user form (first name, last name, 13-digit ID number, male or female, user type, submit, cancel), validation, a MySQL database and user table, and a post of the ID number only into a PHP file under an `api` directory.
2. An HTML/JS table of all users. Clicking a row edits and saves that user.
3. A separate table of user types: add a type, archive a type, and link the type to the user module.
4. Username and password, MD5 on the post, authentication, and a login screen.

The README ends with one note: "Theme include in template".

## Scope

### In scope of `master`

1. Four PHP screens: `userForm.php`, `registrationForm.php`, `editUser.php`, `login.php`.
2. Shared include `dbconnection.php` and helper `projectFunction.php`.
3. Client checks in `clientsideUserFormValidation.js`.
4. `formValidation.php`, which is not included by the screens.
5. `README.md` as the phase list.
6. A vendored Smart Admin 2.0 HTML theme under `template/` (415 tracked files). The PHP screens do not load it.
7. `.gitignore` and a tracked `.vscode/launch.json` for Xdebug on port 9000.

426 files are tracked. Eleven of them sit at the repository root or under `.vscode/`. The rest are the template.

### Out of scope / not in this repository

- A `CREATE TABLE` script, migration, or dump. Commit `8861c85` says "Created Database with tables and fields" and only changes `README.md` and `usersForm.html` (later renamed). The live table definition is **Unknown**.
- An `api/` directory. Phase 1 asks for one. It does not appear in git history.
- A user-type table, archive action, or admin UI for types. Phase 3 is not started.
- Sessions, role checks, email delivery, queues, workers, tests, Docker, and a Bitbucket pipeline.
- `sonar-project.properties` and `sonarqube_scan.bat`. The onboarding scan listed both at the repository root. Neither file is in git history. Provenance: **Unknown** — they may have been untracked files on the scan host.

## What landed against the README

| README phase | What `master` contains |
|---|---|
| Phase 1 form and validation | Create forms exist and are wider than the README: date of birth, email, password, confirm password, notes, and active/inactive checkboxes were added in June 2019. Validation is client-side. The server escapes input and does not repeat those checks. |
| Phase 1 "post only the ID to `api/`" | Not implemented. Create forms POST every field into the same PHP file and insert a full row. |
| Phase 1 MySQL table `use_id`, `use_date_created` | The PHP expects a table named `` `user` `` and column names `intUserID`, `txtFirstname`, `txtLastname`, `txtIDNumber`, `txtDOB`, `txtGender`, `txtUserType`, `txtEmail`, `txtPassword`, `txtUserDateCreated`, `txtStatus`, `txtUserNote`. No schema file confirms types or keys. |
| Phase 2 list, click, edit, save | `editUser.php` lists every row and copies a clicked row into a form, then updates or deletes. `userForm.php` shows only the values just posted, as a single table row. |
| Phase 3 type catalogue | Not implemented. Three type labels are hardcoded `<option>` elements. |
| Phase 4 username, MD5, auth, login | Login exists and compares email plus an MD5 digest. There is no username column. A matching login calls `header("Location: userForm.php")` and does not start a session. `userForm.php` and `editUser.php` do not check that anyone logged in. |

## System architecture

```text
Browser
  |  Bootstrap 4.3.1, jQuery 3.4.0, Popper 1.14.7 (public CDNs)
  |  clientsideUserFormValidation.js on every screen
  v
login.php | registrationForm.php | userForm.php | editUser.php
  |  include dbconnection.php
  |       include projectFunction.php (print_rr, never called)
  |       mysqli, database name usermodule
  v
MySQL table `user`
```

`template/` is a separate static Smart Admin 2.0 site. Nothing in the PHP links to `template/`.

Host selection is a `switch` on `$_SERVER["SERVER_NAME"]` with cases `localhost` and `lamp` only. Any other host leaves the connection fields empty and the page dies after an alert.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `README.md` | Phase 1–4 task list and the "Unity : userModule" title | Only product document |
| `login.php` | Email and password form; loads every `user` row and compares in PHP | No session |
| `registrationForm.php` | Public create form, same insert as the home form | Linked from the login page |
| `userForm.php` | Second create form, plus a one-row echo of the POST | Linked as "Home" from itself and from edit |
| `editUser.php` | List, row click, update, delete | Update and delete use GET |
| `clientsideUserFormValidation.js` | `validation()` for the create forms | Also called from Login and Update, where the elements it reads are missing |
| `dbconnection.php` | mysqli connection by server name | Credentials are in source |
| `projectFunction.php` | `print_rr` | Included, never called |
| `formValidation.php` | Echoes an undefined `$msg` and the text "PHP file executed" | Not included |
| `template/` | Smart Admin 2.0 demo pages and assets | Added in `c3de433` (`#161`) |

## Milestones

No milestone plan is written beyond the README phases. The commits are the timeline:

| Date | What landed |
|---|---|
| 2019-06-10 | `3d28163` Jaco Brits, initial commit, `README.md` only |
| 2019-06-11 | README phases rewritten for readability; Smart Admin template added (`c3de433`) |
| 2019-06-12 to 2019-06-14 | `usersForm.html`, then client validation, date field, notes, date of birth, active/inactive, and a successful mysqli connection (`10c6ab5`, subjects `#171` `#173` `#174`) |
| 2019-06-16 to 2019-06-18 | HTML renamed to `userForm.php`; cancel button; table of the posted row; prepared insert; "dormant" checkbox added then replaced by inactive |
| 2019-06-19 to 2019-06-20 | `login.php` and `registrationForm.php` (`#187`); login walks every row |
| 2019-06-21 to 2019-06-24 | `editUser.php` lists rows; ID-number duplicate check; MD5; update and delete (`#194`); HEAD `a8971a4` |

## Known dependencies

- PHP with the `mysqli` extension. No `composer.json` and no pinned PHP version. `.vscode/launch.json` listens for Xdebug on port 9000.
- MySQL (or MariaDB — the code only shows `mysqli`) with a database named `usermodule` and a table named `` `user` `` whose columns match the names in the insert statement.
- For `SERVER_NAME` `localhost`: host `localhost`, user `root`, empty password, database `usermodule`.
- For `SERVER_NAME` `lamp`: host `lamp`, user `root`, database `usermodule`, and a non-empty password stored in `dbconnection.php`. The value is omitted from this document.
- Browser access to `cdnjs.cloudflare.com`, `maxcdn.bootstrapcdn.com`, and `ajax.googleapis.com` for Bootstrap, Popper, and jQuery.
- The Smart Admin files are already in git. They are not loaded by the application pages.

## Current project status

**Implemented** on `master`: create (two screens), list on the edit screen, update, delete, client-side checks on the create forms, MD5 of the password, and a login comparison.

**Documented and not built:** `api/` post of the ID only, a user-type table with add and archive, a username distinct from email, and a session that later pages enforce.

**Present and unused by the screens:** `template/`, `formValidation.php`, `print_rr`.

**No automated tests, no pipeline, no deploy config.**

**Human review:**

- Confirm whether "Unity" is a product name or only a README heading.
- Confirm the live `user` table definition. It is not in git.
- Confirm whether Phase 3 is still wanted.
- Confirm whether the committed `lamp` database password and the MD5 storage are accepted.
- Confirm whether `sonar-project.properties` and `sonarqube_scan.bat` from the scan host should be treated as part of this project.
- Confirm which tracker issued `#161` and the other task numbers.