# Project plan — RGBC_ScoreCard

Evidence date: 2026-10-05.

Source repository: `git@bitbucket.org:overdrive/rgbc_scorecard.git`.

Inspected revision: `master` at `c1c7ceb` (2026-08-04 09:54:20 +0000, "Merged in feature/TASK-001-pdt-survey-hardening (pull request #2)"). `origin/HEAD` points at `origin/master`. Only `master` was present after fetch.

No `silicon_ark/RGBC_ScoreCard/` directory existed before these files.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The page title and heading in `Admin.Master` are **HR: People Development Tool**. The assembly title and solution name are **RGBC ScoreCard**. The logo image is `content/rgbc_logo.jpg` with alt text `RGBC`. Mail is sent as `People Development Tool <administrator@rgbc.co.za>`.

What the letters RGBC expand to is **Unknown / Requires Confirmation**. No expansion was found in code.

A comment in `Admin.Master.vb` (2017-02-16) says the Score Card was replaced by the People Balance Sheet, which the UI now calls the People Development Tool (PDT). Older pages `ScoreCard.aspx` and `SalesCapabilities.aspx` are still in the tree. Their menu items are commented out.

Provenance: **Implemented** branding in `Admin.Master`. **Documented** only as in-code comments and the page title. There is no README.

## Where the tree was read

| Location | What it is |
|---|---|
| Issue path `~/projects/sonar_scan/repos/RGBC_ScoreCard` | Recorded on OVER-259 at task creation (2026-09-28). That path is not on this machine |
| Fresh clone of `origin/master` | The tree that was read. `HEAD` is `c1c7ceb` |

The OVER-259 discovery snapshot said the last commit was `60534ed` (2025-06-06, "Session timeout fix") and listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Those two files are not on `c1c7ceb`. `master` has moved since that snapshot.

## History

| Commit | Date | Subject |
|---|---|---|
| `7cb5fc4` | 2021-05-07 | Initial commit |
| `0404a64` | 2021-05-07 | initial |
| `dcca35d` | 2021-10-15 | Update to current live project |
| `c75e6e9` | 2021-11-12 | update repo + GPS changes |
| `f6df4c3` | 2021-11-29 | Added manager comments |
| `60534ed` | 2025-06-06 | Session timeout fix |
| `ade70e9` | 2026-04-16 | Security Enhancements |
| `e9379e9` | 2026-04-17 | Security Enhancements small bugfix and peopleBalanceSheet items order by order update |
| `547c36b` | 2026-06-08 | mobile login, gps label and draft link fixes |
| `857df91` | 2026-06-11 | updated survey id logic, improved error handling and display and removed range 3 & 10 |
| `1b46af7` | 2026-07-08 | show the most recent PDT in the Last Performance Review column |
| `6a9426a` | 2026-07-31 | [TASK-001] Harden PDT survey save context and Home grid join |
| `c1c7ceb` | 2026-08-04 | Merged in feature/TASK-001-pdt-survey-hardening (pull request #2) |

Earlier comments inside `Admin.Master.vb` date the module from May 2012 (phase 1 demo) through September 2018 (version constant `1.2.0`). Assembly copyright is 2018. That older history is **not** in git. Git starts at the 2021 Bitbucket import.

`60534ed` removed a hardcoded domain login `RGBC\MAANIE` from `LogginUser` and called `Session.Clear()` at the start of the survey page load and save. Current `PeopleBalanceSheetNew.aspx.vb` does not clear the session on those paths. It re-runs login only when `Session("USER")` is empty. The 2025 change was superseded. Provenance: **Implemented** on `c1c7ceb`; the earlier commit is historical.

## Scope in the repository

In scope of what is present on `master`:

- An ASP.NET Web Forms site (VB.NET) titled HR: People Development Tool.
- Windows identity login matched to `mstUser.strDomainLogin`, with user groups `Admin`, `Dev`, `RSM`, and `User`.
- Home dashboard: own last GPS and performance dates, start links, and a team grid for managers.
- PDT survey engine on `PeopleBalanceSheetNew.aspx`: save as Draft, submit, GPS "Send to Manager", PDF, and email.
- Questionnaire and question maintenance, team setup (job role and manager), survey list, overall performance grid, help images.
- SQL Server access through a shared `db` class and `SqlDataSource` controls. Connection strings come from environment variables.
- A mobile master page chosen from the user-agent.

Out of scope of the live menu, or present only as leftover code:

- `ScoreCard.aspx` and `SalesCapabilities.aspx` (menu items commented out).
- `PeopleBalanceSheet.aspx`, `zPeopleBalanceSheet.aspx`, and `sandbox.aspx` (older survey copies; not in the menu).
- Menu item **HR Report (wip)** with no `NavigateUrl`.
- Brand QF cron jobs, promo audit log, and fiscal-year helpers in `ProjectFunctions.vb` / `SystemFunctions.vb`. No page calls them.
- ASP.NET Membership, roles, and profile providers in `Web.config`. `roleManager` is `enabled="false"`. Login does not use them.
- Entity Framework 5 is referenced. Pages use raw SQL.
- SonarQube project file and scan batch file named in the OVER-259 snapshot. Not on this revision.
- Automated tests, a README, and a Bitbucket Pipelines file. Not in the tree.

## System architecture

```text
Browser (desktop or mobile user-agent)
  → IIS, Windows authentication
      → Index.aspx login
          → LogginUser matches DOMAIN\user to mstUser.strDomainLogin
          → Session USER / USERID / USERGROUP
      → Admin.Master or Mobile.Master
          → Web Forms pages
          → db.generic (SQL Server) and SqlDataSource
          → On submit: LocalReport PDF + SMTP (My.Settings.SMTPHost)
```

There is no separate API, queue, or background worker in this repository. Email is sent inline from the survey page. PDF files may also be written under `Reports/PDF`.

## Major components

| Component | Role |
|---|---|
| `RGBC_ScoreCard/RGBC_ScoreCard.sln` | Visual Studio solution. One web project |
| `RGBC ScoreCard.vbproj` | Web application, `TargetFrameworkVersion` v4.6.1 |
| `Web.config` | Compilation target 4.6.2, Windows auth, empty connection strings, app settings |
| `SecureConfig.vb` | Loads a parent-folder `.env` and reads connection environment variables |
| `Index.aspx` | Login. Clears session, then calls `LogginUser` |
| `Home.aspx` | Welcome, self-review links, team grid |
| `PeopleBalanceSheetNew.aspx` | Current PDT survey |
| `Questionnaire.aspx` / `QuestionEdit.aspx` | Question bank |
| `TeamSetup.aspx` / `TeamSetupEdit.aspx` | Job role and manager |
| `Survey.aspx` | Survey search |
| `OverallPerformance.aspx` | Three-year potential and performance grid |
| `HelpPeopleBalanceSheet.aspx` | Rating definition images |
| `db.generic.vb` | Shared SQL connection and query helpers |
| Typed DataSets under `Data Sources` | PDF report queries |
| `PeopleBalanceSheetReport.rdlc` | PDF layout |

## Milestones visible in comments and git

These are historical notes in source, not an approved roadmap.

| When | Note | Where |
|---|---|---|
| 2012-05 | Project start, phase 1 demo | `Admin.Master.vb` |
| 2017-02 | Score Card replaced by People Balance Sheet; PDF email | `Admin.Master.vb` |
| 2017-05 | Dynamic survey engine and team setup | `Admin.Master.vb` |
| 2018-05 | Peer concept removed; menu revamp | `Admin.Master.vb` |
| 2018-09 | Master version constant `1.2.0` | `Admin.Master.vb` |
| 2021-05 | Repository imported to Bitbucket | git |
| 2021-11 | GPS manager notification and manager comments | git subjects and `btnAlert_Click` comment |
| 2025-06 | Session timeout fix (later superseded) | `60534ed` |
| 2026-04 | Security enhancements (connection strings moved to environment variables) | git; `SecureConfig.vb`; empty `<connectionStrings>` |
| 2026-06 to 2026-08 | Survey id handling, most-recent PDT column, TASK-001 save hardening | git through `c1c7ceb` |

No future milestone is written in the repository.

## Known dependencies

- .NET Framework. Project file says 4.6.1. `Web.config` compilation says 4.6.2. **Requires confirmation** which runtime is deployed.
- SQL Server. Database name is not in the repo. Connection strings are environment variables. See technical documentation.
- IIS with Windows authentication. **Inferred** from `<authentication mode="Windows" />` and `Request.LogonUserIdentity`.
- SMTP host `10.0.0.17` in `Web.config` application setting `SMTPHost`.
- NuGet packages in `packages.config` (jQuery 2.0.3, jQuery UI 1.10.3, Entity Framework 5, 51Degrees.mobi 2.1.19.4, Web Optimization, DotNetOpenAuth, Newtonsoft.Json 5).
- Microsoft ReportViewer (`Microsoft.Reporting.WebForms`) for the PDT PDF. The package is not listed in `packages.config`. How the assembly is supplied on the server is **Unknown / Requires Confirmation**.

## Current project status

**Implemented** and recently changed (through August 2026): Windows login, PDT survey save/submit, GPS send-to-manager, team setup, questionnaires, survey list, overall performance, env-based SQL credentials.

**Stale labels:** master page version `1.2.0` dated 1 September 2018. Assembly version `1.0.0.1`.

**Not implemented in this tree:** HR Report, automated tests, CI pipeline, README, deployment definition beyond two local filesystem publish profiles (`C:\Scorecard` and `C:\Users\PJ\Desktop\SrC`).

**Discrepancies that need a human decision** (detail in `business-rules.md` and `prd.md`):

- Review season. A 2019 comment and the blocked-period message say 1 April to 30 June. Settings `dtSeasonStart` / `dtSeasonEnd` are `01-01` and `12-31`, so the month check allows a new review in every month.
- GPS versus Potential. Questionnaire id `3` and the name `Potential` are treated as the GPS review in some screens and as Potential in others.
- Overall Performance reads `SuperbowlConnectionStringDEV` and scores years from 1 April, dividing by 6.
- Commit `857df91` says ranges 3 and 10 were removed. The question editor offers only `Range6`. The survey page still renders `Range3` and `Range6`. `SalesCapabilities.aspx.vb` still writes `Range10`.