# Business rules — formulys-frontend Evidence date: 2026-10-14. Source: `git@bitbucket.org:overdrive/formulys-frontend.git`, `main` at `e34274c` (2023-12-21). No business-rules document exists in the source repository. Rules below are only those the code enforces or sketches. Each rule is labelled. Rules that are not in the code are not invented. The mounted UI does not authenticate, authorise, or persist a user. Most of the interesting text sits in `src/store/authStore.js`, which does not parse and which nothing imports. Those lines are recorded as unused source, not as rules the product enforces. ## Identity ### BR-001 — Login fields are mandatory in the browser **Implemented.** `LoginForm` marks username and password `required`. The browser blocks submit while either is empty. There is no email-format check, length check, or custom message. Evidence: `src/components/forms/LoginForm.jsx`. ### BR-002 — A successful login form submit does not create a session **Implemented.** `handleSubmit` logs `{ username, password }` and resets both fields to `""`. It does not set state outside the form, write storage, or change the route. Evidence: `LoginForm.jsx`. `authStore` is not imported anywhere. ### BR-003 — The unused store would log in with email, not username **Present and unused. Inferred** as a sketch of Form.io user login, because the URL is `https://rzkiqpzlxxtfqjl.form.io/user/login` and the body is `{ data: { email, password } }`. If the file were corrected and called, `login` expects `{ email, password }`. The form collects `username`. Those names are not mapped. The response header read is `x-jwt-token`. The JSON body becomes `user`. HTTP status is not checked, so a non-OK response that still returns JSON would still be stored. `logout` clears nothing today, because the object literal `jwt, null` is a syntax error and the module cannot load. Evidence: `src/store/authStore.js`, `src/lib/constants.js`. This is not an enforced product rule. ### BR-004 — No remembered session **Implemented.** No mounted file reads or writes `localStorage`, `sessionStorage`, or a cookie. Reloading the page does not restore a user. Evidence: search of the source for storage APIs. Only the unused store holds `user` and `jwt`, in Zustand memory. ## Access ### BR-005 — Every route is open **Implemented.** `App.jsx` does not read a user, token, or role. `/`, `/process-hub`, `/tasklist`, `/notifications`, `/messages`, `/profile`, `/settings`, `/login`, and unknown paths all render for any visitor. Evidence: `src/App.jsx`. ### BR-006 — The sidebar is omitted on the login path at render time **Implemented.** When `App` renders and `window.location.pathname === '/login'`, it returns null instead of `SidebarNav`. Every other path, including the 404 page, gets the sidebar. The check is not `useLocation`. `useNavigate` is imported and unused. An in-app navigation that does not re-render `App` would leave the sidebar as it was on the previous `App` render. That interaction was not executed. Provenance of the stale-sidebar case: **Inferred**. Evidence: `src/App.jsx`. ### BR-007 — Navigation labels are not permissions **Implemented.** The seven links are static. Settings and profile are not limited to an admin. There is no role string in the repository (`Simflow Admin`, `Project Manager`, `tenantAdmin`, and similar names from the other Formulys documents do not appear here). Evidence: `src/components/navigation/SidebarNav.jsx`. ### BR-008 — Register is not an available action **Implemented.** `Register` and `RegisterForm` are not routed and not linked. Opening `/register` shows the 404 page. A requirement that users must register, or must not register, was not found. Provenance of product intent: **Unknown / Requires Confirmation**. Evidence: `src/pages/Register.jsx`, `src/components/forms/RegisterForm.jsx`, `src/App.jsx`. ## Screens ### BR-009 — Named areas do not yet carry domain behaviour **Implemented.** Process hub, task list, notifications, messages, profile, and settings render a label and nothing else. They do not filter, sort, assign, or submit work. Evidence: the page components under `src/pages/`. No rule about what a task is, when a process may start, or who may see a message can be taken from this repository. ## Data handling ### BR-010 — Login values are written to the console **Implemented.** The submit handler logs the username and password in clear text to the developer console. There is no masking beyond the password input's `type="password"` on screen. Evidence: `LoginForm.jsx` line that calls `console.log`. ### BR-011 — The Form.io host is a fixed string **Present and unused.** `constants.js` sets `BASE_URL` to `https://rzkiqpzlxxtfqjl.form.io` and does not export it. No mounted module reads it. There is no environment switch for dev, test, or production. Evidence: `src/lib/constants.js`. ## Rules that are not in this repository The following exist in related Silicon Ark documents and are absent here. They are not rules of `formulys-frontend`: - `formulys_simpleflow` role checks for `Simflow Admin` and `Project Manager`, task badges, company branding, and SendGrid suppression lists. - `formulys_simpleflow_backend` role names `tenantUser`, `tenantAdmin`, and `platformAdmin`. - Any pipeline rule that only `master` builds, or that a Sonar project key must be scanned. This repository has no pipeline file. The scan-host names `sonar-project.properties` and `sonarqube_scan.bat` are not in git. Whether those other rules were meant to apply to this front end is **Unknown / Requires Confirmation**.