# Technical documentation — formulys-frontend

Evidence date: 2026-10-14.

Source: `git@bitbucket.org:overdrive/formulys-frontend.git`, `main` at `e34274ca1758e5f7da35a03c8bc874763631a1d1` (2023-12-21, Jason Wandrag, "Initial boilerplate push"). Default branch `main`. No other remote branches. The commit has no parent.

The scan-host path `~/projects/sonar_scan/repos/formulys-frontend` was not on this machine. Facts below come from a clone of `e34274c`. No secrets are stored in git.

This inspection did not run `npm install`, the dev server, the production build, or ESLint. Parse and import notes were read from source.

## Stack

| Layer | Choice | Evidence |
|---|---|---|
| UI | React 18.2.0 (`react`, `react-dom`; range `^18.2.0`) | `package.json`, `package-lock.json` |
| Bundler | Vite 5.0.10 (range `^5.0.8`), `@vitejs/plugin-react` `^4.2.1` | `package.json`, `vite.config.js` |
| Language | JavaScript, JSX, ESM (`"type": "module"`) | `package.json`. No `.ts` or `.tsx` sources. `@types/react` and `@types/react-dom` are devDependencies only |
| Routing | `react-router-dom` 6.21.0 (range `^6.21.0`), `BrowserRouter` | `src/main.jsx`, `src/App.jsx` |
| State | Zustand 4.4.7 (range `^4.4.7`) | `src/store/authStore.js` only. That file is not imported |
| HTTP | `fetch` inside `authStore.login` | Same unused file. No axios dependency |
| CSS | Tailwind 3.4.0 (range `^3.4.0`), PostCSS, Autoprefixer | `tailwind.config.js`, `postcss.config.js`, `src/index.css` |
| Lint | ESLint 8.56.0 (range `^8.55.0`), `eslint-plugin-react`, react-hooks, react-refresh | `.eslintrc.cjs`, `package.json` |
| Package name | `formulys-frontend` `0.0.0` private | `package.json` |

`vite.config.js` is the default React plugin config. No alias, proxy, `base`, or server port.

There is no TypeScript config, test runner, CSS preprocessor, UI kit, or form library.

## Repository layout

```text
.eslintrc.cjs
.gitignore
README.md                      stock Vite + React text
index.html
package.json
package-lock.json              lockfileVersion 3
postcss.config.js
public/vite.svg                favicon
src/App.css                    empty
src/App.jsx                    routes and sidebar gate
src/assets/images/background.png   141651 bytes
src/assets/images/logo.png         90160 bytes
src/components/forms/LoginForm.jsx
src/components/forms/RegisterForm.jsx
src/components/navigation/SidebarNav.jsx
src/index.css
src/lib/constants.js
src/main.jsx
src/pages/Home.jsx
src/pages/Login.jsx
src/pages/Message.jsx
src/pages/NotFound.jsx
src/pages/Notification.jsx
src/pages/ProcessHub.jsx
src/pages/Profile.jsx
src/pages/Register.jsx
src/pages/Settings.jsx
src/pages/Tasklist.jsx
src/store/authStore.js
tailwind.config.js
vite.config.js
```

31 tracked files, all added in `e34274c`. Not present: `bitbucket-pipelines.yml`, `Dockerfile`, `sonar-project.properties`, `sonarqube_scan.bat`, `.env`, `example.env`, and any `*.test.*` or `*.spec.*` file.

**Discrepancy:** the onboarding scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. They are not in the only commit. Provenance: **Unknown**.

`.gitignore` ignores logs, `node_modules`, `dist`, `dist-ssr`, `*.local`, and common editor files. It does not ignore `.env`. No `.env` file is tracked.

## Application structure

```text
index.html
  #root
  /src/main.jsx
    React.StrictMode
    BrowserRouter
      App
        renderSidebarNav() → SidebarNav | null
        Routes (see prd.md)
```

`SidebarNav` is a static list of `Link`s. Page components other than `Login` and `NotFound` are one-line placeholders. `Login` re-exports `LoginForm`.

Tailwind `content` globs are `./index.html` and `./src/**/*.{js,ts,jsx,tsx}`. `theme.extend` is empty. No plugins.

`src/index.css` applies Tailwind layers, a universal margin/padding reset, `box-sizing: border-box`, and a full-viewport background image.

## Form.io sketch

Only `src/lib/constants.js` and `src/store/authStore.js` mention a remote system.

| Item | Value |
|---|---|
| Host | `https://rzkiqpzlxxtfqjl.form.io` |
| Path the store builds | `/user/login` |
| Method | `POST` |
| Header | `Content-type: application/json; charset=UTF-8` |
| Body | `{ "data": { "email": <email>, "password": <password> } }` |
| Token read | response header `x-jwt-token` |
| User read | `res.json()` with no status check |

`constants.js` does not export `BASE_URL`. `authStore.js` does not import it, so `BASE_URL` is a free variable. `logout` is not valid syntax:

```js
logout: () => set({
  user: null,
  jwt, null
})
```

No mounted component calls `fetch`. The login form does not import the store.

The same host is documented for `formulys_simpleflow` (form path `simflowlogin`) and `pestelite_html`. Sharing a Form.io project is **Unknown / Requires Confirmation**.

## Auth

Mounted behaviour:

- `LoginForm` keeps `username` and `password` in `useState`.
- Submit logs both values and clears them.
- No JWT is stored. No `Authorization` header is set. No route reads auth state.

Unused store behaviour is described above. Zustand `create` is the only state library call in the repo. There is no `persist` middleware.

## Pipeline and deploy

None. No `bitbucket-pipelines.yml`, Docker file, FTP script, or hosting config.

Scripts in `package.json`:

| Script | Command |
|---|---|
| `dev` | `vite` |
| `build` | `vite build` |
| `lint` | `eslint . --ext js,jsx --report-unused-disable-directives --max-warnings 0` |
| `preview` | `vite preview` |

There is no `test` script. Whether a default Vite port (5173) was ever used is **Unknown**. The config does not set one.

## Environment

No `import.meta.env` usage. No committed env sample. The Form.io host is a source constant in an unused file.

Node version is not pinned (no `engines`, no `.nvmrc`).

## Defects visible in source

These are observations from reading the files. They are not a judgement that the product owner wants them fixed.

1. `src/store/authStore.js` is not valid JavaScript because `logout` uses `jwt, null` inside an object literal. Importing the module fails at parse time.
2. `BASE_URL` is referenced in that store and is neither declared there nor exported from `src/lib/constants.js`.
3. Nothing imports the store, so the running graph avoids both faults. The login button does not perform the `fetch` the store describes.
4. The form field is `username`. The store argument is `email`. They are not connected.
5. `App.jsx` imports `useNavigate` and does not call it. The sidebar gate reads `window.location.pathname` during render instead of `useLocation`, so it does not subscribe to client-side navigations.
6. `Home.jsx` imports `SidebarNav` and does not render it.
7. `Register.jsx` and `RegisterForm.jsx` are unreachable.
8. `src/App.css` is empty and is imported.
9. `index.html` title remains `Vite + React` while image alt text says `Simple Flow`.

`npm run lint` is configured with `--max-warnings 0`. Unused imports in `App.jsx` and `Home.jsx` are the kind of finding that rule set reports. Lint was not executed, so the warning count is **Unknown**.

## Security characteristics (from the code, not a pentest)

- The mounted login path prints the password to the browser console.
- There is no session, so there is also no session fixation or token storage on that path.
- The unused store would keep the JWT in memory only, and would accept any JSON body without checking `res.ok`.
- The Form.io URL is not a credential. No API key is committed.
- There is no captcha, rate limit, or security header configuration in this repository. Those would belong to a host that is not defined here.
- `.gitignore` would not stop a future `.env` from being committed. None is present now.

## Testing and quality gates

No automated tests. No CI. No Sonar project file in git. `npm run lint` is the only quality script, and it was not run for this document.

The onboarding scan's `sonarqube_scan.bat` is not in the commit. Whether someone ran Sonar from an untracked file on the scan host is **Unknown**.

## Related Silicon Ark documents

| Directory | Relationship visible from evidence |
|---|---|
| `formulys_simpleflow` | Later Vite app (from 2024-02-29) by the same author. Overlapping nav names, same Form.io host, working Form.io session. Not imported by this repo. Successor status is **Unknown / Requires Confirmation** |
| `formulys_simpleflow_backend` | Express + Socket.io + Mongoose scaffold. This front end never calls it. Role names do not appear here |
| `formulys-mobile-app` | Expo app branded Pest Elite. Different screens. Same era, same author on its commits. Not a client of this repository |

No Silicon Ark document referenced `formulys-frontend` before this set.