# Project plan — buddyfinance (Buddy Finance)

Evidence date: 2026-10-19.

Source repository: `git@bitbucket.org:overdrive/buddyfinance.git`.

This plan describes what the repository contains. It does not decide what the product should become.

The task-creation path `~/projects/sonar_scan/repos/buddyfinance` was not present on this machine. Evidence is a clone of `origin/master`.

## Product

Buddy Finance is a South African peer-lending platform. A person registers as a lender or a borrower. A lender deposits money and publishes a loan offer. A borrower requests an amount against one or more offers. Staff approve profiles, record deposits, accept or reject withdrawals, and move a loan from pending to active by accepting it and allocating a payout. The platform charges fees, scores borrowers through TransUnion, and keeps a platform profile that receives those fees.

Provenance: **Inferred** from the solution, the seeded lookup data in `BuddyFinance.Database/dbo/Scripts/Script.PostDeployment1.sql`, and the integrators under `BuddyFinance.Integration/Integrators`. There is no README and no product specification in the repository or in Silicon Ark.

The lender-approval email in `ProfilesIntegrator.ApproveProfile` names the legal entity Thorough Capital and the account name Buddy Finance at Standard Bank, Greenstone. Provenance: **Implemented**. Whether that entity is still the operating company is **Unknown / Requires Confirmation**. Account numbers in that email are not repeated here.

## Branch reality

Default branch is `master`. `origin/HEAD` points at `master`.

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` | `8d0ae20` | 2022-10-05 | "setup", author Lloyd. Third commit. Parents are `059779d` ("first commit") and `e100c3c` ("Initial commit") |
| `origin/RenierDEV` | `b144142` | not dated in this note | 14 commits ahead of `master`, 0 behind. Not merged |

This documentation set is based on `master` at `8d0ae20`. `origin/RenierDEV` adds a different loan process, a revised interest calculation, document-upload rules, SendGrid email changes, a Stitch client, and cron-job endpoints. Those behaviours are listed as unmerged. Which branch, if any, is deployed is **Unknown / Requires Confirmation**.

The task-creation scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is in `master`. Provenance: **Unknown** — they may have been untracked files on the scan host.

## Scope in the repository

In scope of what is implemented on `master`:

- ASP.NET Core 3.1 web application `BuddyFinance.Admin`: public registration and login, lender and borrower pages, and an `Admin` area for staff.
- ASP.NET Web API 2 application `BuddyFinance.WebApi` (.NET Framework 4.8) used by the web application.
- Business logic in `BuddyFinance.Integration`, shared models in `BuddyFinance.Integration.Models`, and an Entity Framework 6 model in `BuddyFinance.Model`.
- SQL Server database project `BuddyFinance.Database` (schema provider SQL Server 2012 / `Sql110`).
- TransUnion consumer credit enquiry through a MEF export in `BuddyFinance.Integration.Transunion`.
- Three console processes: monthly lender service-fee billing, arrears email, and expiry of new loan requests after 30 days.
- SSRS report project `BuddyFinance.Reports` (`Statement.rdl`, `Transactions.rdl`).
- Android WebView shell `BuddyFinance.Mobile` that loads `https://buddyfinance.co.za/qa`.

Out of scope of the code that was found, or not present as a committed application:

- A native mobile product. The Android project is a WebView plus Firebase crash and performance libraries.
- An automated repayment collector or bank-file import. Deposits and repayments are recorded by API and admin actions.
- A written roadmap, milestone plan, or in-repo product document.
- `BuddyFinance.Billing` and `BuddyFinance.Mobile` are not projects in `BuddyFinace.sln`. The billing-arrears and expire-loan-request consoles are in the solution. The monthly billing console is not.

## System architecture

```text
Browser or Android WebView (https://buddyfinance.co.za/qa)
  → BuddyFinance.Admin (ASP.NET Core 3.1)
      → cookie session, calls Web API with a bearer token
      → SQL Server (BuddyFinanceDbContext) for login activity and some reads
  → BuddyFinance.WebApi (.NET Framework 4.8, OWIN OAuth at /Token)
      → BuddyFinance.Integration (integrators)
          → Entity Framework 6 (BuddyFinance.Model) → SQL Server
          → SMTP mail and SMSPortal SMS
          → TransUnion Consumer SOAP (MEF plugin)
          → email templates in BuddyFinance.Integration/Notifications/*.txt
Console jobs (billing, arrears, expire requests) → same database and mail
SSRS reports → Statement and Transactions
```

Solution folders in `BuddyFinace.sln` group projects as `0 - Cross Cutting`, `1 - Data Access`, `2 - Business Logic`, `3 - Interfaces`, `4 - API`, `5 - Processes`, `MEF`, and `_UnitTests`. The solution file name omits the second "n" in Finance. The billing-arrears project folder is spelled `BuddyFianance.BillingArrears`.

## Major components

| Component | Role |
|---|---|
| `BuddyFinance.Admin` | Website and staff console. Config key `apiRootUrl` is `https://www.buddyfinance.co.za/service/api/`. `env` is `qa` |
| `BuddyFinance.WebApi` | HTTP API. OAuth resource-owner password at `/Token`. Access tokens last 14 days. `AllowInsecureHttp` is true |
| `BuddyFinance.Integration` | Registration, profiles, offers, requests, loans, cash, scoring, security, documents, notifications |
| `BuddyFinance.Integration.Transunion` | MEF `ICreditBureauIntegrator` for TransUnion |
| `BuddyFinance.Model` | EF6 EDMX `Model.edmx` |
| `BuddyFinance.Database` | Tables, one stored procedure `ProfileTransactions`, post-deployment seed |
| `BuddyFinance.Billing` | Debits the seeded service fee from approved lenders on the day-of-month of `BillingDate`, and credits the platform profile |
| `BuddyFianance.BillingArrears` | Emails approved lenders whose `AvailableFunds` are below zero |
| `BuddyFinanceExpireLoanRequests` | Sets loan requests that are still `New` after 30 days to `Expired` |
| `BuddyFinance.Reports` | SSRS. Debug configuration targets folder `BuddyFinance/QA/` on `http://localhost/reportserver` |
| `BuddyFinance.Mobile` | Android application id `buddyfinance.za.co.buddy3`, version 1.0 |

## Milestones and implementation plan

No milestone plan is documented. Git history on `master` is three commits, ending 2022-10-05 with subject "setup". Comments inside integrators refer to work in 2017 and 2018 (for example loan-offer term comments dated 05 Jan 2017, and earning-bracket comments dated 10 January 2018).

`origin/RenierDEV` is the only other remote branch. Its commit subjects, in order after `8d0ae20`, describe:

1. A branch point before feature changes.
2. Supporting-document rules: ID as a photo, other documents as PDF.
3. Landing page: remove the interest bar and default interest at 5 percent, described as a maximum.
4. A repayment-amount formula change.
5. The same loan process and landing-page notes again.
6. Document validation on register and on service activation.
7. Document validation for all images.
8. Interest rate read from the database.
9. SendGrid email, a loan calculator that shows an exact amount, and "Buddy Finance Approved".
10. Email changed from an awaitable method to a normal method.
11. Loan process: lender creates an offer without an interest control; borrower requests the offer; admin approves or declines.
12. A familiarisation commit.
13. "Commit for Maanie" (`b144142`).

The diff of `origin/RenierDEV` against `master` is 58 files, about 2286 insertions and 772 deletions. New types include `StitchIntegrator`, `StitchController`, `CronJobIntegrator`, and `CronJobController`. Provenance: **Implemented on `origin/RenierDEV` only**. It is not treated as the current product.

## Known dependencies

- SQL Server, Entity Framework 6.1.3, ASP.NET Identity / OWIN OAuth on the API.
- ASP.NET Core 3.1, EF Core 3.1.17, and FluentValidation 7 on the website.
- TransUnion consumer SOAP service.
- SMTP (port 587 in `NotificationsIntegrator.SendEmail`) and an optional SendGrid path (`SendEmailSendGridAsync`).
- SMSPortal HTTP API for SMS and OTP.
- Application Insights packages on the Web API (2.18.0).
- Android support libraries, Firebase crash, core, and performance on the mobile shell.
- SSRS 2008 R2 in the Debug report configuration and SSRS 2016 in DebugLocal and Release.

NuGet `packages` folders and Admin `wwwroot/lib` vendor scripts are in the tree. They are dependencies, not product behaviour.

## Current project status

The repository looks like a complete peer-lending implementation that was snapshotted onto `master` in October 2022. There is no later commit on `master`. Automated tests do not assert product behaviour: `BuddyFinance.UnitTests` calls a TransUnion `HelloWorld`, and `ScoringIntegratorUnitTests` is commented out with a note that the test fails on missing OWIN assemblies.

Committed configuration points the website `env` at `qa` while `BuddyFinance.Admin/appsettings.json` names catalog `BuddyFinanceDb_Prod`, and `BuddyFinance.Integration/App.config` names catalog `BuddyFinanceDB_QA`. Which catalog is live is **Unknown / Requires Confirmation**.

Connection strings in those files contain SQL passwords. A commented connection string in `App.config` points at a different host and catalog `BuddyFinanceDB`. Passwords are not copied into this documentation.

## Human confirmation

- Whether customers use `master`, `origin/RenierDEV`, or another tree.
- Whether `https://buddyfinance.co.za/qa` and `https://www.buddyfinance.co.za/service/api/` are still the live site and API.
- Whether Thorough Capital is still the legal entity that receives lender deposits.
- Which SQL catalog is production.
- Whether the monthly billing, arrears, and loan-expiry consoles are scheduled anywhere. No scheduler, Windows service, or cron definition is in the repository.
- Whether the missing Sonar files on the scan host should be documented as part of the product.