# Project plan — ClickPortal

Evidence date: 2026-10-18.

Source repository: `git@bitbucket.org:overdrive/clickportal.git`.

Inspected revision: `master` at `0e2adfb` (2023-02-07 17:00:09 +0200, author Dirk `<dirk@overdrive.co.za>`, message "Initial commit"). That commit is the only commit on `origin/master`. No other branches and no tags were present.

The scan-host path named in the onboarding task (`~/projects/sonar_scan/repos/ClickPortal`) was not on this machine. Evidence comes from a read-only clone of `origin/master`.

`silicon_ark/ClickPortal/` did not exist before this set. The source repository has no product brief. `ClickPortal/ClientApp/README.md` is the Create React App boilerplate, not a project description.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The browser title, login title, and web-app manifest name the product **Click Foundation Portal** (`ClickPortal/ClientApp/public/index.html`, `manifest.json`, `AccountLoginPage.js`). The support screen title is **Click Foundation Support Portal**.

What the running UI does is let a signed-in person search for a learner and see, then copy, that learner's programme logins and password. Programme names that appear in the search result are **RE**, **Matific**, and **Refl**. The JWT issuer configured in `appsettings.json` is `clicklearning.org`.

Provenance: **Implemented** (titles, screens, and config). A written statement of organisational purpose is **Unknown / Requires Confirmation**.

## Branch reality

`origin/HEAD` is `master`. History is the single commit above. No release tags.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `0e2adfb`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Objectives (inferred from the application, not from a written plan)

No project plan or requirements document exists in the repository. The following are **Inferred** from the screens and API:

- Let support staff find a learner by cellphone or by school, grade, class, and name.
- Show the learner's RE, Matific, and Refl logins and password so staff can copy them.
- Sign staff in with Google, and only if that Google email is already an identity-user row.
- Send a learner who signs in with an RE username and password to a programme URL stored in the database.
- Give an external caller (a comment names Mobenzi) a learner's first and last name for a quiz.

## Scope

### In this repository

- One Visual Studio 2019 solution, `ClickPortal.sln`, with one ASP.NET Core 3.1 web project.
- A React 16 client under `ClickPortal/ClientApp`, served by the ASP.NET Core SPA host.
- Dapper calls to SQL stored procedures in a `portal` schema. The procedure bodies are not in this repository.
- Google sign-in for staff, JWT issuance, and a learner-login API.

### Not in this repository

- Stored-procedure and table definitions for `ClickDW` / `ClickSTAGING`.
- The learner-facing screen. `api/learner/login` exists. No routed React page calls it. Commented routes in `App.js` mention `/learnerlogin` and `/learner/login`.
- Mobenzi, Matific, Refl, and the RE programme as external systems. This repo only builds or returns URLs and login fields.
- A deployment pipeline, Dockerfile, or infrastructure definition.
- Sonar project files in git.

## System architecture

```text
Browser (React 16, react-router, axios)
  │  relative /api  (Bearer JWT from localStorage after Google sign-in)
  ▼
ASP.NET Core 3.1 (ClickPortal)
  Controllers → Services / Repositories (Dapper)
  │
  ├─ DWSqlConnection      → connection "DefaultConnection"  → database name ClickDW
  └─ StagingSqlConnection → connection "StagingConnection"  → database name ClickSTAGING
       (registered in Startup; no repository uses it)

External, called from this code:
  Google sign-in (react-google-login + Google.Apis.Auth token check)
  Font Awesome kit script in index.html
  Google Analytics snippet (measurement id is empty in the committed env files)
```

Production static files are published from `ClientApp/build`. In Development the host starts the React dev server (`npm start`).

`ClickPortal/ClientApp/.env` sets `PUBLIC_URL=/admin/`. `.env.development` sets `PUBLIC_URL=/`. Serilog's file sink path in `appsettings.json` is `c:/websites/portal/logs/log.txt`. Together those are the only deployment clues. Provenance: **Inferred** that a production build is hosted under `/admin/` on IIS/Windows. No deploy script confirms it.

## Major components

| Component | Path | Role |
|---|---|---|
| Host | `ClickPortal/Program.cs`, `Startup.cs` | Web host, JWT, CORS, SPA, Serilog |
| Staff UI | `ClientApp/src/pages/account`, `pages/support` | Google login, find-learner |
| Learner API | `Controllers/LearnerController.cs` | RE login and support search |
| School API | `Controllers/SchoolController.cs` | Province / region / district, schools, classes |
| Identity | `Services/IdentityService.cs` | Google token check, JWT, login timestamp |
| Data | `Repositories/*`, `Data/DWSqlConnection.cs` | Stored procedures via SQL Server client |
| Quiz API | `Controllers/QuizController.cs` | Learner name lookup; comment says Mobenzi |

## Milestones

No milestone, issue tracker, or roadmap is in the repository.

Observed history:

| When | What | Evidence |
|---|---|---|
| 2023-02-07 | Entire tree committed once as "Initial commit" | `0e2adfb` |
| After that | No further commits on `origin/master` as of 2026-10-18 | `git log`, `git branch -a` |

Package version in `ClientApp/package.json` is `0.2.0`. What 0.1 was, and whether 0.2.0 matches a release, is **Unknown**.

## Implementation plan

There is no plan in the repository. Unfinished or unused pieces that are visible in the tree:

- Staff username/password sign-in is commented out in `AccountController.Authenticate` and in `AccountLoginPage.js`. `IdentityService.Authenticate` (password-hash check) remains.
- `api/config/startup` exists. The client does not call it. `ConfigService.js` returns a hardcoded Google client id, and `fetchStartupValues` is commented out.
- `StagingSqlConnection` is registered and unused.
- `dotnet-ef` 3.1.0 is in the local tool manifest. There is no EF `DbContext` and no migrations.
- `ClientApp/src/pages/learner/` is an empty folder included by the csproj.
- `NavMenu.js` is entirely commented and still contains the ASP.NET React template links (Counter, Fetch data).
- Quiz login builds a `dataURL` when the redirect programme is `QUIZ`, then the next statement replaces `RedirectToURL` with `redirectTo.URL`.

Whether any of those are intentional is **Unknown / Requires Confirmation**.

## Known dependencies

- .NET Core 3.1 (`netcoreapp3.1`), Visual Studio 2019 solution format.
- Node/npm for the SPA (Debug builds run `npm install` if `node_modules` is missing). `node_modules` is not committed. `package-lock.json` is.
- SQL Server client (`Microsoft.Data.SqlClient`) and Dapper, talking to databases named `ClickDW` and `ClickSTAGING`.
- Google OAuth client id and JWT settings in `appsettings.json`.
- Stored procedures under schema `portal` (not in this repo).

## Current project status

The repository is a single initial commit of a support portal that can be read and, given a database and the committed configuration, built. Nothing in git shows a pipeline, a release, or a commit after 2023-02-07.

Whether the portal is still deployed, who operates it, and whether the committed connection strings are current is **Unknown / Requires Confirmation**.

## Human confirmation

- Is Click Foundation Portal / clicklearning.org the name and audience this repository is supposed to serve, and is it still in use?
- Are RE, Matific, and Refl the approved programme set, and what systems do those logins open?
- Is returning and displaying learner passwords to signed-in support staff an approved rule?
- Was staff username/password login intentionally removed, or is the commented code unfinished?
- Is the quiz `RedirectToURL` overwrite a defect?
- Are the committed database connection strings, JWT signing key, and quiz shared secret still valid, and should they be rotated? Values are not copied into this document.
- Is the production host IIS under `/admin/` with logs at `c:/websites/portal/logs/`?
- What does the database do inside the `portal.p*` procedures, especially school-list filtering by user id?
- Were `sonar-project.properties` and `sonarqube_scan.bat` ever part of this project?