# Project plan — webportal (Aloecate) Evidence date: 2026-09-28. Source repository: `git@bitbucket.org:overdrive/webportal.git`. Inspected revision: `master` at `0cd0456` (2023-04-24, "Update auto add"). The scan-host path named in the onboarding task (`~/projects/sonar_scan/repos/webportal`) was not present on this machine. Evidence comes from a read-only clone of `origin/master`. This plan describes what the repository contains. It does not decide what the product should become. ## Product **Aloecate** is a staff web portal plus a mobile JSON API. App users register with a cellphone number, photograph till slips, and hold a balance that staff can pay out. Staff review receipt line items, define rebate rules (the "Aloecation Engine"), send SMS, and manage app users, referrals, and employment history. Provenance: **Implemented**. The public base URL in `application/config/config.php` is `https://webportal.aloecate.co.za/`. SMS copy says "Welcome to aloecate". The sidebar labels the rebate screen "Aloecation Engine". No README or product brief exists in the repository, so the purpose above is recovered from the screens and the API. The admin shell started as an AdminLTE / AdminPRO template. Seed settings still name the company "AdminPRO" and the timezone "Asia/Kolkata" (`db/starter.sql`). Whether production `settings` rows were changed after that seed is **Unknown / Requires Confirmation**. The page title uses `setting('company_name')`. ## Branch reality `origin/HEAD` is `master`. Last commit `0cd0456` by Jaco Brits, 2023-04-24. History has 172 commits, from `2f69943` (2022-01-19, "Initial commit") through that tip. Authors across all branches: Jaco Brits (126), liam-ovd (20), Uriel Balela (13), uriel (5), JacquesOverdrive (4), Liam Kleyn (4). Remote branches `activity-log-type`, `aloecate-engine`, `aloecate-items-report`, `backend-validation`, `cash-out-confirm`, `login-tweaks`, `messages-dev`, `messages-dev-2`, and `uriel_changes` have no commits that are not already in `master`. They are merged feature branches, not a second product line. No release tags were found. The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master`. Provenance: **Unknown** — they may have been untracked files on the scan host. ## Objectives (inferred from the application, not from a written plan) No project plan or requirements document exists in the repository. The following are **Inferred** from the menu, API, and SQL: - Let venue or brand staff see which promoted products appear on photographed till slips. - Credit an app-user balance and pay that balance out to a bank account the user supplied. - Let an app user prove a cellphone number with a one-time SMS code. - Let staff broadcast SMS and see the BulkSMS credit balance. - Reward a referrer when staff mark a referral as processed. - Keep an employment history (employer, reference, dates) against an app user, and copy the employer name onto the user's location. ## Scope ### In scope of this repository - CodeIgniter 3.1.11 admin UI (AdminLTE) for staff. - JSON API under `application/controllers/Api.php` for the mobile app. The app itself is not in this repository. - MySQL schema scripts under `db/`, including a full dump dated 17 June 2022. - AWS S3 upload and Textract helpers, Secrets Manager lookups, and a Bitbucket Pipeline that deploys with AWS CodeDeploy. ### Out of scope / not in this repository - The mobile application that calls the API. **Unknown / Requires Confirmation** where that app lives. - The MySQL server. Connection values are read at runtime from AWS Secrets Manager. - BulkSMS, the S3 buckets, and Textract as operated services. This repo only contains the client calls. - Automated tests, a README, and Sonar configuration in git. ## System architecture ```text Staff browser → https://webportal.aloecate.co.za/ (CodeIgniter 3, session login) → MySQL database named aloecate in the SQL scripts → AWS Secrets Manager (eu-west-1) for DB credentials → S3 bucket aloecate-staging-uploads (slip images) → AWS Textract (manual "process" action on a receipt) → BulkSMS HTTP API (registration codes, cash-out SMS, broadcasts, balance) Mobile app (not in this repo) → /api/ JSON, CORS *, no API key → same database and the same S3 bucket ``` Hosting path in `appspec.yml` is `/var/www/html/webportal` on Linux, owner `www-data`. Provenance: **Implemented** deployment spec. The inference that this is an EC2 instance is supported by the comment in `application/helpers/aws_helper.php` ("EC2 has Secrets Manager Role attached") and by CodeDeploy. The instance id and region of that host are **Unknown**. ## Major components | Component | Role | |---|---| | `Dashboard` | SMS credit, item-processed figure, user count, last cron timestamp, signups by location, cash-outs still to process | | `Aloecate_items` | Receipt line items and a search/report | | `Aloecate_engine` | Rebate rules: product, location, date range, rebate amount | | `Files` | Receipt images for calendar year 2023, Textract trigger, line-item edit | | `Cashout` | Pay-out queue and processing | | `Transactions` | Balance movements | | `Messages` | SMS manager | | `App_user` | Mobile users, referral codes, manual +3 balance | | `Jobs` | Employment records (`app_user_jobs`) | | `Users` / `Roles` / `Permissions` | Staff accounts and access | | `Api` | Mobile registration, login, slips, jobs, cash-out, balance | | `Backup` | Database export for staff who have `backup_db` | Commented-out menu entries that are not reachable from the sidebar: blank starter page, registered-users list, products, receipt images, emails. ## Milestones visible in git There is no milestone document. The commit sequence is the only timeline. 1. 2022-01-19 — initial commit (Jaco Brits). 2. 2022-02 — REST API, SMS and email, app-user profile, registration (JacquesOverdrive joins). 3. 2022-03 to 2022-06 — receipts, cash-out, jobs, referrals. `db/FullDBdump17062022.sql` is a snapshot of database `aloecate` on 17 June 2022. 4. 2022-06 onward — Liam and Uriel commits (activity-log type, engine, reports, messages, login tweaks, cash-out confirm). Those branches are merged. 5. 2023-04-24 — last commit on `master` ("Update auto add"). ## Implementation plan No forward plan is written in the repository. **Unknown / Requires Confirmation** whether further work is expected. What the code shows as unfinished or inconsistent: - Slip upload inserts a line item with rebate `10` and amounts `10`, and the Textract call inside `submit_slip_detail_post` is commented out. OCR runs only if a staff user opens `files/process/{id}`, which `var_dump`s the result. - Receipt and cash-out lists are hardcoded to `YEAR(...) = 2023`. - `Aloecate_engine::save` flashes "New Message Created Successfully". - `Cashout::view` loads a receipt file view, not a cash-out record. - The `staging` pipeline step uses variable names that say production (`AWS_ACCESS_KEY_ID_PROD`, `APPLICATION_NAME_PROD`, `S3_BUCKET_PRODUCTION`). - CodeDeploy version label is the literal `my-app-1.0.0` on every run. - Several tables in the June 2022 dump (`job`, `reciept_details`, `user_reciept`, `file_old`, `keys`, `logs`) have no references in `application/`. ## Known dependencies - PHP with CodeIgniter 3.1.11. The `index.php` header checks PHP 5.3 for error-reporting flags. The runtime version on the server is **Unknown**. - Composer package `aws/aws-sdk-php` `^3.212`. `vendor/` is committed. - MySQL / MariaDB, database name `aloecate` in the SQL scripts. Driver `mysqli`. - AWS Secrets Manager secret id `db_password` (keys `host`, `username`, `password`, `dbName`) and `s3_textract` (keys `Access_key_ID`, `Secret_access_key`), region `eu-west-1`. - S3 bucket name hardcoded as `aloecate-staging-uploads` on the slip-upload and Textract process paths. - BulkSMS `api.bulksms.com` (send is `http://`, balance is `https://`). Credentials are hardcoded. Values are omitted here. - Google reCAPTCHA for staff login only when `settings.google_recaptcha_enabled` is `1`. The starter seed stores a site key and secret. Those values are omitted here. - AdminLTE, jQuery, Bootstrap 4, DataTables, SweetAlert2, and other assets under `assets/`. Ionicons are loaded from `code.ionicframework.com`. ## Current project status **Dormant in git since 2023-04-24.** - Default branch is the only product line, and the feature branches are already merged. - No tests and no README. - `db/FullDBdump17062022.sql` contains personal data (names, cellphone numbers, email addresses, bank details, and passwords). This documentation does not repeat those rows. Human review is required before that file is copied further. - BulkSMS credentials are hardcoded in `Api.php`, `Messages.php`, `App_user.php`, and `basic_helper.php`. They are not repeated here. They need rotation and removal from git. - `application/config/email.php` still points at `smtp.example.com` with a placeholder password. ## Human confirmation required 1. Is `https://webportal.aloecate.co.za/` still the live staff site, and does it run `master` at `0cd0456`? 2. Where is the mobile app, and is it still calling this API? 3. Should the 2023 year filters on receipts and cash-outs be treated as a defect? 4. Is a rebate of 10 on every uploaded slip the intended credit, or a placeholder left in `submit_slip_post`? 5. Are the hardcoded BulkSMS credentials still valid, and who will rotate them? 6. Should `db/FullDBdump17062022.sql` be removed from the repository because it contains personal data? 7. What do the Xero key names in the `aws_helper.php` comment refer to? No Xero client code is in this repository.