# Project plan — contacts (FTI Consulting Intranet Contacts v2.2)

Evidence date: 2026-10-18.

Source repository: `git@bitbucket.org:overdrive/contacts.git`.

Inspected revision: `master` at `c1b9e91` (2020-12-11 10:39:50 +0200, message "Initial commit"). That is the only commit and the only branch (`origin/HEAD` points at `origin/master`). The scan-host path `~/projects/sonar_scan/repos/contacts` was not on this machine. The tree was read from that git revision.

There is no README, project plan, or requirements document in the source repository, and there was no `silicon_ark/contacts/` set before this onboarding. Statements below are recovered from the Classic ASP pages, `web.config`, includes, and file names. Credentials that appear in source are named by file and are not reproduced.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The browser title in `title.htm` is **FTI Consulting Intranet - Contacts - v2.2**. The login page shows `images/FTI_Logo_Color_300.jpg`. The footer line on the login form says the site is best viewed at 1024x768.

Other names are present in the same tree:

| String | Where | Provenance |
|---|---|---|
| FTI Consulting Intranet - Contacts - v2.2 | `title.htm`, included as the page title | **Implemented** page title. The only version string in the product UI |
| FTI logo | `images/FTI_Logo_Color_300.jpg`, used by `index.asp` | **Implemented** |
| FD Beachhead logo | `images/FD-BEACHHEAD-logo.jpg` | **Implemented** file. No page in the tree references this filename |
| BMSA | `contact_email.asp` sets the FCKeditor toolbar to `BMSA`. Upload paths include `c:\inetpub\wwwroot\bmsa\contacts\`. `email.asp` uses a `bmsa.co.za` from-address. `new.asp` opens a database named `bmsa` | **Implemented** leftovers from an earlier deployment name |
| FD | `contact_email.asp` hard-codes a copy recipient at `fdsouthafrica@fd.com` | **Implemented** mail routing |

**Unknown / Requires Confirmation:** which organisation operates this system now (FTI, FD, BMSA, or Silicon Overdrive as custodian only), and whether v2.2 is still the live release name.

## What the system is

**Inferred** from the screens and tables: an intranet directory of journalists and the publications they work for, with beats, distribution lists, saved searches, and bulk email.

A signed-in person can:

1. Browse publications and contacts by category (`home.asp`, `leftmenu.asp`, `contactlist.asp`).
2. Open a contact card with a Journalist tab and a Publication tab (`contactdetail.asp`).
3. Build, save, run, and print a custom contact query, then email the selected rows (`search.asp`, `rpt_custom.asp`, `runQuery.asp`, `contact_email.asp`).
4. Maintain lookup lists, publications, shows, and contacts (`admin.asp`).

There is no public website, API, or mobile client in the tree.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `c1b9e91` | 2020-12-11 | Only branch. One commit: "Initial commit" |

Comments and archives inside that commit are older than the git date:

- `contact_emailBCC.asp` contains a comment dated 20.10.2009.
- `admin_tools.asp` offers a button labelled "Update database 2011/09/12".
- `admin_contact.asp` and `contactdetail.asp` carry the comment `20130128 - changed "Car Reg" to "Twitter Handle" - pj`.
- `contacts.201301.zip` sits at the repository root.

The git history does not record those edits as separate commits. Provenance of the dates: **Implemented** as comments and filenames inside the single snapshot.

## Scope that is in the repository

1. Classic ASP pages (`.asp`) served as a frameset intranet.
2. Microsoft SQL Server database `Contacts`, opened from `sql_connect.asp`.
3. Lookup maintenance for beat, category, city, country, designation, distribution list, language, suburb, and title.
4. Publication, show/section, and contact maintenance, including contact-to-beat and contact-to-distribution-list links.
5. User accounts with two types stored as `lngType` 47 (labelled Admin) and 33 (labelled Viewer).
6. A per-user query builder over `tblFields` / `tblQuery` / `tblQueryFields`.
7. HTML email through CDO to SMTP on `localhost` port 25, with FCKeditor 2.3.2 and aspSmartUpload attachments.
8. A system-wide email disclaimer in `tblSystem`.

## Scope that is not in the repository

- No automated tests, CI pipeline, Dockerfile, or infrastructure-as-code.
- No schema script, migration tool, or seed data. Table shape is known only from the SQL strings in the pages.
- No application README.
- `admin_letters.asp` does not render the A–Z bar. The bar is written by `letters.js`. The ASP file is an empty shell with commented PHP.
- Files prefixed `z` (`zcontactdetail.asp`, `zcontact_email.asp`, `zcontact_email.asp.old`, `zadmin_publication.asp`), `printer_friendly.backup.asp`, `printer_friendly2.asp`, and `contact_emailBCC.asp` are not linked from any other page in the tree.

## Architecture in one picture

```text
Browser (framesets, HTML 4.01)
        |
        | cookie ckyUserID = UserID|lngType
        v
IIS + Classic ASP
  index.asp          login
  home.asp           category browse
  search.asp         saved queries
  admin.asp          maintenance
        |
        | ADODB, ODBC Driver 17 for SQL Server
        v
SQL Server host reddb03, database Contacts
        |
        | CDO.Message, SMTP localhost:25
        v
Mail recipients, plus a hard-coded copy address
```

`web.config` turns on ASP.NET impersonation, removes the `x-frame-options` header, and enables directory browsing. The application pages themselves are Classic ASP, not ASP.NET.

## Major components

| Component | Entry | Role |
|---|---|---|
| Login | `index.asp`, `md5.asp`, `md5.js` | Username and password check against `tblUser` |
| Shell | `home.asp`, `search.asp`, `admin.asp`, `topmenu.asp` | Frames: top menu, left menu, body |
| Directory | `leftmenu.asp`, `contactlist.asp`, `contactdetail.asp` | Category, publication, contact card |
| Search | `rpt_custom.asp`, `rpt_custom_1.asp`, `editCriteria.asp`, `runQuery.asp`, `printer_friendly.asp` | Saved queries and print |
| Mail | `contact_email.asp`, `fAttach.asp`, `fAttach.cls.asp`, `FCKeditor/` | Compose, attach, send |
| Admin lookups | `admin_*.asp` listed in `admin_leftmenu.asp` | CRUD |
| Users and settings | `admin_user.asp`, `admin_user_lite.asp`, `admin_system.asp`, `admin_tools.asp` | Accounts, disclaimer, one-off schema button |
| Connection | `sql_connect.asp` | Shared ADO connection. `db_connect.asp` is a separate probe and is not included by the other pages |

## Milestones visible in the snapshot

There is no milestone plan in the repository. The dates that can be read from the files are:

| When | Evidence | Status |
|---|---|---|
| By 2009-10-20 | Testing comment in `contact_emailBCC.asp` | **Implemented** comment on an unlinked page |
| 2011-09-12 | `admin_tools.asp` button that adds `strLastUser` / `strLastEdit` columns when missing | **Implemented** maintenance action |
| 2013-01-28 | UI label change from Car Reg to Twitter Handle; column remains `strCarReg` | **Implemented** comment and labels |
| 2013-01 | `contacts.201301.zip` at the repo root | Archive present. Contents were not unpacked for this onboarding |
| 2020-12-11 | Entire tree committed once to Bitbucket | **Implemented** git history |

Nothing in the tree describes work after 2020-12-11.

## Current project status

**Implemented** as a complete Classic ASP application in a single commit. Whether it is deployed, who uses it, and whether `reddb03` is still the database host are **Unknown / Requires Confirmation**.

The connection include names host `reddb03` and database `Contacts`. A commented line in the same file names the previous host `reddb02` and the older `{sql server}` driver. The active driver string is `{ODBC Driver 17 for SQL Server}`.

## Known dependencies

| Dependency | Evidence |
|---|---|
| IIS with Classic ASP | `.asp` pages, `web.config` `system.webServer` |
| Microsoft SQL Server and ODBC Driver 17 | `sql_connect.asp` |
| ADODB | `server.createobject("adodb.connection")` |
| CDO (`cdosys.dll`) | `contact_email.asp`, `testemail.asp` |
| Local SMTP on port 25 | CDO configuration in `contact_email.asp` |
| aspSmartUpload (`aspSmartUpload.dll`, `aspSmartUploadUtil.dll`) | `fAttach.cls.asp` |
| FCKeditor 2.3.2 (build 1082, copyright 2003–2006) | `FCKeditor/fckeditor.js` |
| Scripting.FileSystemObject | Attachment folder `tmp_upload` |
| Client-side MD5 | `md5.js` on the login form; server-side `md5.asp` on login and user save |

## Implementation plan

No forward plan is documented in the repository. This onboarding does not add one.

## Human confirmation

1. Is FTI Consulting Intranet Contacts v2.2 still in production, and on which host?
2. Is SQL Server `reddb03` / database `Contacts` still the system of record?
3. Should the committed SQL passwords in `sql_connect.asp`, `db_connect.asp`, and `new.asp` be rotated? They are in git history. This document does not repeat them.
4. Is the hard-coded mail copy to `fdsouthafrica@fd.com` still required?
5. Are the unlinked `z*` pages, `contact_emailBCC.asp`, `email.asp`, `testemail.asp`, `new.asp`, `default.asp`, and `db_connect.asp` safe to treat as unused?
6. Is the Viewer role (`lngType` 33) intended to open the Admin area in read-only mode? The type-47 gate in `admin.asp` is commented out; save and delete on the lookup pages are still limited to type 47.
7. Should `strCarReg` stay the Twitter handle column, or was a later rename planned and never committed?