# Technical documentation — cognitive_behaviour_therapy

Evidence date: 2026-10-18. Source: `git@bitbucket.org:overdrive/cognitive_behaviour_therapy.git` at `836e710` (`master`, 2022-10-05). Full hash `836e710cd6a9b7b502a2f4e3f65d8117a752f799`.

The scan-host checkout named in the onboarding task was not on this machine. This document is from a clone of `origin/master`.

The StatCounter security string is in the HTML and is not copied here.

## Architecture

Static website. A web server would map URLs onto files. Nothing in the repository executes on a server: no PHP, no ASP.NET, no Node, no database, no queue, no background worker.

Pages are HTML with layout tables, authored in Adobe Dreamweaver (template comments and `Templates/tmpx.dwt`). Navigation and a few widgets run in the browser.

```text
HTTP host (not defined in this repo)
  /index.htm and sibling *.htm
    Templates/tmpx.dwt  (authoring template; browsers do not need it)
    styles.css
    scripts/menu_array.js
    scripts/mmenu.js
    SpryAssets/
    js/  prototype, scriptaculous, lightbox, YUI, morelinks
    css/ lightbox.css, readmore.css
    images/
  /docs  /dl  /PDF  /emailer  /signatures  /PSD
  mailto: handled by the visitor's mail client
  page script -> http://www.statcounter.com/counter/counter_xhtml.js
```

Character set on templated pages: `iso-8859-1`. Signature HTML uses `utf-8`.

## Repository shape

| Item | Value |
|---|---|
| Remote | `git@bitbucket.org:overdrive/cognitive_behaviour_therapy.git` |
| Branch | `master` only. `origin/HEAD` -> `origin/master` |
| Tip | `836e710` (2022-10-05, liam-ovd, "Email address updates") |
| Tags | None |
| History | 4 commits, all 2022-10-05. See below |
| Tracked files | About 276 files excluding `.git`. Counted by extension on this clone: 81 jpg, 74 pdf, 33 htm, 22 gif, 21 doc, 11 js, 7 docx, 6 html, 6 png, 6 psd, 4 css, 2 pages, 1 dwt, 1 xml, 1 gitignore |
| CI | No `bitbucket-pipelines.yml`, no GitHub Actions, no Sonar properties file |
| Tests | None |
| Root gitignore | Atlassian example (Node, Java, Python, logs, IDE, media extensions such as mp4). It does not ignore the PDFs, documents, or Photoshop files that are committed |

History, oldest first:

1. `a04c349` — Jaco Brits — `.gitignore` only.
2. `529a0d0` — Rachel Mogano (`rachel@overdrive.co.za`) — import of the site tree.
3. `accefc4` — liam-ovd — reception email on `ask_a_therapist.htm`.
4. `836e710` — liam-ovd — reception email on 33 HTML files, including `Templates/tmpx.dwt`. 70 insertions, 70 deletions.

The page content predates Git. Folder names and in-page dates run from 2010 to 2020.

## Application structure

```text
cognitive_behaviour_therapy/
  *.htm, *.html          public pages and two Google HTML files
  sitemap.xml
  styles.css             site CSS, linked beside css/
  PROOF.jpg              unreferenced root image
  Templates/tmpx.dwt     Dreamweaver template
  scripts/               menu definition and menu engine
  js/                    third-party browser libraries and morelinks.js
  css/                   lightbox and read-more CSS
  SpryAssets/            Adobe Spry Collapsible Panel
  images/                logo, banners, photos, menu art, map, workshop_pics/
  docs/                  course documents, year folders 2010-2016
  dl/2019/12/            2020 practicum PDFs
  PDF/201603, PDF/201610 membership and 2017 practicum files
  emailer/               2016-2018 mailer HTML and forms
  signatures/            clinician HTML signatures
  PSD/                   design sources
  13January2012/         one saved mailout and its images
```

Dreamweaver editable regions used by the template: `doctitle`, `keywords`, `description`, `main_pic`, `left_detail`, `heading`, `content`.

There is no router. The file name is the URL. `sitemap.xml` assumes the host `http://www.cognitive-behaviour-therapy.co.za` and extensionful paths (`meet_the_team.htm`, not a rewritten slug). No `.htaccess`, `web.config`, or nginx file is in the repository. **Unknown** whether the live host rewrites `index.htm` to `/`. The sitemap's home URL is `/`.

## Front end

| Piece | File | Role |
|---|---|---|
| Layout and type | `styles.css` | Site styles. Also linked a second time from the template |
| Menu data | `scripts/menu_array.js` | Colours, labels, targets. Submenu image `images/arrow_menu.jpg` |
| Menu engine | `scripts/mmenu.js` | DHTML menu. Branches for Netscape 4, Netscape 6, Opera, IE, Konqueror. No package name in the file header |
| Show/hide copy | `js/morelinks.js` | Looks up id `content`, class `more`. Labels "Read more" and "Hide this Information" |
| YUI (minified) | `js/yahoo-min.js`, `event-min.js`, `dom-min.js` | Required by `morelinks.js` |
| Prototype | `js/prototype.js` | Header copyright 2005 Sam Stephenson. Used by Lightbox |
| Scriptaculous | `js/scriptaculous.js`, `js/effects.js` | Effects. Template loads `scriptaculous.js?load=effects` |
| Lightbox | `js/lightbox.js`, `css/lightbox.css` | Image overlay |
| Spry | `SpryAssets/SpryCollapsiblePanel.js` and `.css` | Collapsible panel widget |
| Dreamweaver behaviours | Inline in the template | `MM_swapImage`, `MM_preloadImages`, `MM_findObj` for the therapist button rollover |

No bundler, no npm, no TypeScript, no CSS preprocessor. Libraries are committed as source or as already-minified files.

`js/morelinks.js` calls `YAHOO.util.Event.onAvailable`. The template includes the YUI files before `morelinks.js`, which matches that dependency.

## Data

No database and no schema.

Content is the HTML body of each page plus binary documents. Important document groups:

- Training applications and outlines, by year, under `docs/`, `dl/`, `PDF/`, and `emailer/`.
- BMABCT membership forms under `PDF/201603/` and older copies under `docs/`.
- Two Apple Pages files: `docs/2013/Application Form Advanced Practicum Cape Town 2014.pages` and `docs/2013/Application Form Primary Practicum Cape Town 2014.pages`.

`training.htm` does not point at `dl/2019/12/`. It points at `gallery.mailchimp.com` URLs for the 2020 PDFs. The `dl/2019/12/` files are a local copy of application and content PDFs with 2020 in the filename.

Design sources under `PSD/` (banners, emailer, "NEW_DESIGN") are not web pages.

## APIs

This site exposes no API.

Outbound browser calls that are in the pages:

| Call | From | Notes |
|---|---|---|
| `http://www.statcounter.com/counter/counter_xhtml.js` | Templated pages | Project `3703718`, partition `44`, invisible. HTTP, not HTTPS |
| `mailto:` | Throughout | Not an HTTP API |
| `https://gallery.mailchimp.com/c237c09e9974d009f762f7aaa/files/...` | `training.htm` | File download links for the 2020 practicum. Account id is in the URL path |
| Ordinary `http://` links | `links.htm`, venue links | Other organisations' websites |

No webhook, no REST client, no SOAP client.

## Integrations

See the table in `prd.md`. Summary for operators:

- Email is the visitor's mail client. There is no SMTP configuration, no SPF record, and no form-to-mail script in the repo.
- StatCounter is a third-party script tag. The security token is client-visible by design of that snippet.
- Google: `google6187686757bc4227.html` is a site-verification file (the file body is the verification line). `googlee9d76de06cf317a6.html` is an empty HTML document and is not a verification file.
- Mailchimp appears as hosted PDFs and as a saved mail in `13January2012/mailchimp.htm`. There is no Mailchimp JavaScript embed and no API key.

## Infrastructure and deployment

**Unknown / Requires Confirmation.**

Not in the repository:

- Host, DNS, or TLS certificate.
- Web server configuration.
- Deploy script, FTP notes, or pipeline.
- Environment variables. There is no `.env`.
- Staging versus production. One tree, one branch.
- Monitoring, other than the StatCounter snippet. No health check, no log config, no uptime probe.
- Backup policy.

A static host can serve the repository root. That is a deployment option, not evidence of where it is hosted.

The sitemap and logo use `http://` rather than `https://`. Whether the live site redirects to HTTPS is **Unknown**.

## Authentication and access

None. No cookies are set by project code. No login form. No basic-auth file.

If the repository root is the web root, `pics.htm`, `PROOF.jpg`, `signatures/`, `PSD/`, `Templates/`, and every document directory are URL-addressable. **Inferred** from the layout. The server might block some of those paths. Nothing in Git says so.

## Storage

Files in Git are the only store. Uploads are not a runtime feature. New training PDFs were added by replacing files in the tree, historically outside Git, then imported in `529a0d0`.

`PROOF.jpg` is about 678 KB. Larger office documents are in `PDF/` and `docs/` (some `.doc` files are a few hundred kilobytes). The gitignore's media rules do not cover these types.

## Security observations

These describe the tree. They are not a penetration test.

- No server to patch inside this repository. Risk sits in the host and in third-party script tags.
- StatCounter is loaded over HTTP from an HTTPS-capable site, so a browser on HTTPS would mix content. The pages themselves reference the site as HTTP.
- The StatCounter security string is world-readable in every templated page.
- Mailto links and published telephone numbers are intentional public contact data. Signature files also contain mobile numbers. Those numbers are not repeated in this document.
- `pics.htm` is an internal note left in the web root.
- There is no input validation because there is no input handler.
- Document downloads are unrestricted by the application, because there is no application.
- Dreamweaver template path comments reveal `/Templates/tmpx.dwt`.

## Development and testing

No test suite, no fixture, no linter, no formatter, no README, and no contribution guide.

The authoring tool evidenced by the files is Dreamweaver (template, `MM_` image-swap functions). Design edits also exist as Photoshop files.

The 2022 email change was a text replace of `cognitivetherapy@telkomsa.net` with `reception@centreforcbt.org`. It did not change `jacorossouw@telkomsa.net` or `info@snow-media.co.za`.

How to preview: open `index.htm` in a browser from the repository root so relative image and script paths resolve. A local web server is enough. No install step.

## Configuration

There is no config file for the practice. Contact details are hardcoded in each HTML page and in the template. Changing the telephone means editing every footer, or editing the template and re-applying it in Dreamweaver. The 2022 email commit edited the generated pages and the template separately, which is consistent with that.

Menu labels live only in `scripts/menu_array.js`.

`sitemap.xml` is hand-written. It is not generated by a tool in this repository (no generator script, and the XML has no generator comment).

## Monitoring

StatCounter snippet only. `sc_invisible=1` so the counter is not shown to the visitor. The `noscript` block is an empty `div` with class `statcounter`.

No application log, no error tracker, no server metric.

## Background work

None. No cron, no queue, no scheduler, no mailer daemon. `emailer/` is a folder of HTML and documents used as mail content, not a sending program.