# Features — webportal (Aloecate)

Evidence date: 2026-09-28. Source: `master` at `0cd0456` (2023-04-24).

Status words: **Current** means present on `master` and reachable from code. **Dormant** means present but unused or commented out. **Removed** means a commit message or a commented menu says it was taken out, and no controller remains.

## Current

### Staff shell

AdminLTE layout, sidebar, session login, remember-me, optional reCAPTCHA, profile (name, password, photo, language), permission-denied page.

Evidence: `application/views/includes/`, `Login.php`, `Profile.php`, `Logout.php`, `assets/`.

### Dashboard

Shows BulkSMS credit, an "Items Processed" percentage, the count from `User_model::countAllActive` (table `app_user`), signups grouped by `location`, cash-outs with `processed=0`, and the latest cron timestamp labelled "Last Processed".

Evidence: `Dashboard.php`, `application/views/dashboard.php`, `User_model::countAllActive`.

### App users

List, add, edit, view, delete, status change. Separate Referred Code List and a per-code view. `addpoint` adds 3 to a balance and sends SMS.

Permission codes: `user_list`, `user_add`, `user_edit`, `user_view`, `user_delete`. Sidebar shows the item only for `user_list`.

Evidence: `App_user.php`, `application/views/app_user/`.

### Admin users, roles, permissions

Classic template CRUD on `users`, `roles`, `permissions`. Sidebar label "Admin Users". Nested under Settings, which itself requires `company_settings`.

Evidence: `Users.php`, `Roles.php`, `Permissions.php`. `User.php` is a second controller with the same method names as `App_user` and checks `user_*` permissions. It loads views under `user/`. It is not linked from `nav.php`. Provenance: Implemented, not in the sidebar.

### Jobs

Staff list of `app_user_jobs`. API `jobs_get` and `job_add_post`. Adding a job overwrites `app_user.location` with the employer name.

Evidence: `Jobs.php`, `App_user_jobs_model.php`, `Api.php`.

### Items report

Sidebar "Items Report" → `aloecate_items`. List, search, `rebate_process`, `all` (JSON of every item).

Evidence: `Aloecate_items.php`, `application/views/aloecate_items/`.

### Aloecation Engine

Sidebar "Aloecation Engine". Create a rule (product, location, dates, rebate amount, status `active`). View runs the item search for that rule.

Evidence: `Aloecate_engine.php`, `db/update.4.liam.sql`, `db/update.5.liam.sql`.

### Transactions

List screen. API `transactions_get` per app user. Writers found: slip upload (amount 0) and cash-out processing.

Evidence: `Transactions.php`, `Transactions_model.php`.

### Receipts

Sidebar "Receipts List". Year filter 2023. View line items. Manual Textract via `files/process/{id}`. Edit item fields.

Evidence: `Files.php`, `application/views/files/`.

### Cash-out

Sidebar "Cash out List". API creates a request and sends SMS. Staff `submit` reduces balance and writes a transaction. List is limited to 2023. `view` opens the receipt screen for an item id, not a cash-out id.

Evidence: `Cashout.php`, `Cashout_model.php`, `Api::cashout_post`.

### SMS manager

Sidebar "SMS Manager". Compose to selected app users, optional copy to the staff member, send through BulkSMS.

Evidence: `Messages.php`, `Messages_model.php`, `db/update.2.liam.sql`.

### Activity log

List and view, permission-gated. Type column from `db/update.3.liam.sql`.

Evidence: `Activity_logs.php`, `Activity_model.php`.

### Settings and backup

General, company, login theme, email templates, company info, DB admin screen, database export.

Evidence: `Settings.php`, `Backup.php`, `Templates_model.php`.

### Mobile API

Registration, verify, login, password reset, profile and bank update, slip upload, jobs, transactions, balance, cash-out, unauthenticated user list. See FR-003 in `prd.md`.

Evidence: `application/controllers/Api.php`.

### Deployment

Bitbucket Pipelines on `master` and `staging` zip the tree and run AWS CodeDeploy. `appspec.yml` copies the repo to `/var/www/html/webportal`.

Evidence: `bitbucket-pipelines.yml`, `appspec.yml`.

## Completed in git, already on master

These branches have no commits beyond `master`. The work they named is the current behaviour, not a pending merge:

- `aloecate-engine` — rebate rules (merged in `00fb77c`, pull request #11).
- `activity-log-type` — log type column (merged in `dfc93d4`, pull request #10).
- `aloecate-items-report` — items search and report.
- `messages-dev`, `messages-dev-2` — SMS manager.
- `cash-out-confirm` — cash-out processing.
- `backend-validation`, `login-tweaks`, `uriel_changes`.

## Dormant or template leftover

- `Starter` controller and blank page. Menu link is commented out.
- AdminLTE demo views under `application/views/adminlte/` (mailbox, gallery, widgets). No route points at them (`routes.php` adminlte line is commented).
- `Rest::test_post` — sample REST method.
- Tables with no `application/` references found: `job`, `reciept_details`, `user_reciept`, `file_old`. `keys` and `logs` match the REST library schema; `rest_enable_keys` is false, so they are unused at runtime.
- `Aloecate_items_model::save` writes a `reciepts` table (name, mrp, price, available) from raw JSON. No controller calls `save`. The table is not in the dump. Provenance: Implemented method, unused by the controllers that were read.
- Products menu item is commented out. Commit `3c1d17c` message is "remove products". No `Products` controller remains.
- Receipt images and Emails menu items are commented out.
- Xero parameter names in `aws_helper.php` are comments only.

## Not in this repository

- The mobile client.
- Sonar project file and `sonarqube_scan.bat` (named by the onboarding scan, absent from `master`).
- PHPUnit or any other test suite.
- A README.

## Recently changed (end of history)

Last five commits on `master`, all by Jaco Brits in the run-up to 2023-04-24:

- `0cd0456` Update auto add
- `d47e7c7` update auto load values
- `803aee8` Update cash out
- `e42d478` Update Files filter
- `33d1959` update app users

What "auto add" changes inside the diff was not line-reviewed beyond the message. The files filter and cash-out behaviour documented elsewhere match the tree at this tip, including the 2023 year filter.

## Planned

No issue list, TODO file, or roadmap is in the repository. Unmerged branch work: none. **Unknown / Requires Confirmation** whether anyone intends to continue the product.