# Technical documentation — glob-1 (Global Welness Centre)

Evidence date: 2026-10-13.

Source: `git@bitbucket.org:overdrive/glob-1.git`, `main` at `f26707a` (2026-04-14).

This document describes the tree that was inspected. It does not prescribe a target architecture.

## Stack

| Layer | What is in the repo |
|---|---|
| Language | C# |
| Web | ASP.NET Web Forms on .NET Framework. Site `compilation targetFramework` is 4.8. `httpRuntime targetFramework` is 4.6. CodeDom provider is Microsoft.CodeDom.Providers.DotNetCompilerPlatform 3.6.0.0, C# langversion 6 |
| Libraries | `business` and `library` class libraries, `TargetFrameworkVersion` v4.8, output `components/` |
| UI libraries | Telerik.Web.UI (dialog, web resource, spell check, RadUpload progress), AjaxControlToolkit, System.Web.Extensions |
| Data | SQL Server via `System.Data.SqlClient`. Catalog names are appSettings, not an ORM model for the tenant site. `tools/CAPI.Custom` and `tools/CEP` use their own entity style for a CAPI quotes catalog |
| Service | WCF (`wsHttpBinding`, security mode None) |
| Scheduler | Console exe, plus WinForms `SchedulerTool` |
| Solution | `GLOB-1.sln` (website project `GLOB-1(1)` → `core_custom/GLOB-1`, plus library, business, service, mobile, data). `EvolutionSoftwareUnifiedFramework.sln` lists many tenant websites whose folders are not in this clone |
| Tests | `tools/CEP/CEP.ConsoleTests` only. No practice-site test project |
| CI | No `bitbucket-pipeline.yml`, no `sonar-project.properties`, no `sonarqube_scan.bat` |

## Repository layout

```text
GLOB-1.sln
EvolutionSoftwareUnifiedFramework.sln
business/          framework_business
library/           framework_library, Payment/
core/              web copy, conn Framework_GLOB-1 @ NB-DEWALD
core-dev/          web copy, same catalog and data source
core_custom/GLOB-1 site used by GLOB-1.sln
core_custom/GLOB-3 Global Wellness Chiropractic site
service/           WCF, catalog Framework_EVOL-1
components/        built and third-party dlls
data/              data.sqlproj and Scripts/ for other tenant codes
tools/             scheduler, constructor, dataImporter, exporter, CAPI.Custom, CEP
mobile/
SchedulerTool/
publish/service, publish/SHOU-1
release/1.0.0.1, release/1.0.5
packages/          Newtonsoft.Json 12.0.1, 13.0.2, 13.0.3
```

`core_custom/GLOB-1` is a Web Site project (App_Code, CodeFile pages), not a precompiled web application. `GLOB-3` contains a `bin` and `PrecompiledApp.config`.

## Configuration

Active appSettings on `core_custom/GLOB-1/Web.config` that describe behaviour (secret values omitted):

| Key | Active value (non-secret) |
|---|---|
| `conn` | Catalog `Framework_GLOB-1`, data source `localhost`, integrated security |
| `connLive` | Commented. Catalog `Framework_STUD-1_Demo`. A SQL login is in the comment. Not copied |
| `DateFormat` | `yyyy-MM-dd hh:mm tt` |
| `from` | `no-reply@evolutionsoftware.co.za` |
| `WebAddy` | `http://localhost:21856` |
| `subject` | `Global Welness Centre (GLOB-1) - {content}` |
| `website` | Two entries: `Global Welness Centre (GLOB-1)`, then `Evolution Software Framework` |
| `defaultCulture` | `en-ZA` (key repeated) |
| `MediSwitchResponses` | `0` |
| `getCountriesFromWebService` | `0` |
| `loyaltyEmail` | `0` |
| `loyaltyEmailHour` | `20` |
| `Mediswitch.Gateway` / `Gateway1` / `Gateway2` | QA hosts under `https://wsgateway*.mediswitch.co.za/qa/...`. Live URLs commented |
| SMTP | Host `smtp.evolutionsoftware.co.za`, port 25, from `mailer@evolutionsoftware.co.za`. Password is committed and not copied |
| SMS | SOAP `http://sms.netgen.co.za/SMS_V2.asmx`. Username and password appSettings are committed and not copied |
| WCF client | `http://localhost:58913/framework_service.svc`. `http://service.mypalette.co.za/framework_service.svc` is commented |
| support, admin, cc, bcc, loyaltyEmailAddy | All set to the same Overdrive mailbox in the committed file |

`system.web`: debug compilation true, session 60 minutes, anonymous identification on, culture `en-US` / `en`, max request length 10048.

Other connection targets found, none of which are the GLOB-1 site's active `conn`:

| File | Catalog | Data source |
|---|---|---|
| `core/Web.config`, `core-dev/Web.config` | `Framework_GLOB-1` | `NB-DEWALD` |
| `core_custom/GLOB-3/Web.config` | `Framework_GLOB-3` | `.\SQLEXPRESS` |
| `service/Web.config` | `Framework_EVOL-1` | `localhost` |
| `publish/service/Web.config` | `Framework_EVOL-1` | `.` (a live key is also present and commented in the site file; the publish file has an active remote key — password not copied) |
| `publish/SHOU-1/Web.config` | `Framework_SHOU-1_Dev` | `NB-DEWALD` |
| `tools/scheduler/App.config` | `{catalog}` placeholder, plus commented `Framework_FAST-2`, and `connExt` `Framework_REAP-1` | `NB-DEWALD` for `conn` |
| `SchedulerTool/App.config` | `Framework_FAST-2` | `DESKTOP-J8ANBQA` |
| `tools/dataImporter/App.config` | `Framework_CAPI-1` | `ALICE\SQLEXPRESS` (SQL login committed, not copied) |
| `tools/exporter` | `EvolutionFramework` | `.` |
| `tools/constructor` | `FastTrack_Demo`, ext `Framework_REAP-1` | `.` |
| `tools/CEP` | `Framework_CAPI-1_Dev` | `.\SQLEXPRESS` |

## Auth

Login is form fields on `Core.master`, not ASP.NET Identity and not OAuth.

- User row: `pal_` prefix, email and encrypted password.
- Encryption helper: `encryption` constructed with a hardcoded key in `Core.master.cs`. The key is not repeated here. The comparison is equality of ciphertext, so the scheme is reversible.
- Tenant check: `customerCode == setup.code`, or EVOL-1 with `userType > PowerUser`.
- Extra gate: GLOB-1 and MEDI-1 Website Users must have `isActive` true.
- WCF binding security mode is None.
- reCAPTCHA keys exist on GLOB-3 only. GLOB-1 `Web.config` has no reCAPTCHA entries.

## Service contract

`service/App_Code/Iframework_service.cs`:

- `ProcessInteraction(byte[] interactionData, string connectionKey, bool isTransactional, string tablePrefix, bool isCollection)` → `byte[]`
- `GetVersion(string customerCode, string licenceKey, string versionNo, string file)` → `byte[]`
- `SaveVersion(byte[] versionData, string versionNo, string file)` → `bool`

The site calls this through the client endpoint in `Web.config`. Version bundles on disk are `release/1.0.0.1` and `release/1.0.5`.

## Background work

`tools/scheduler/Program.cs` is the entry point. See BR-023 in `business-rules.md`.

It is not an IIS application and not a Windows service project. Nothing in the repo registers it with Task Scheduler. How it is launched in production is **Unknown / Requires Confirmation**.

`SchedulerTool` is a separate WinForms project whose config points at `Framework_FAST-2`.

## Data

- Tenant catalog expected by the GLOB-1 site: `Framework_GLOB-1`.
- Service catalog: `Framework_EVOL-1`.
- Users read with table prefix `pal_`.
- Account rows are `oAccount`. Surface metadata is `oSurface`, `oSurfaceField`, `oSurfaceItem`, `oSurfaceFieldData`. Visit log is `oMedicalPatientVisitLog`.
- `data/data.sqlproj` is an SSDT project. `data/Scripts` has no GLOB-1 directory. Script folders that do exist are named for other tenants and for old "archive major" releases. A GLOB-1 schema cannot be rebuilt from this repo alone.
- Patient and billing fields used by GLOB rules are string column names on surface query results (listed in `business-rules.md`). They are created by surface definitions in the database.

## Integrations

See the integration table in `prd.md`. Hosts that are active in the GLOB-1 config: localhost SQL, localhost WCF, MediSwitch QA, Netgen SMS, Evolution SMTP, and (if called) webservicex.net. Google credentials are files, not appSettings.

## Security notes (no secret values)

The following are committed and should be reviewed by a person. This document does not repeat passwords, API keys, or key JSON.

- SMTP password and SMS password on `core_custom/GLOB-1/Web.config`.
- Commented SQL login on `connLive` in that file, and similar commented or active SQL logins on service, publish, scheduler, and dataImporter configs.
- `business/client_secrets.json`.
- `tools/scheduler/GoogleSheetAPISecretes.json` (filename spelling is "Secretes").
- `tools/scheduler/scheduler_TemporaryKey.pfx`.
- reCAPTCHA private key on `core_custom/GLOB-3/Web.config`.
- Hardcoded password-encryption key in `Core.master.cs`.
- WCF security mode None, and `compilation debug="true"`.

`publish/service/Web.config` contains an active remote SQL login. Treat published configs as live-capable.

## Build and run

No README describes a setup. From the projects:

1. Open `GLOB-1.sln` in Visual Studio with .NET Framework 4.8 targeting pack.
2. Build `library` and `business` so `components/` receives the framework dlls. The site bin already contains copies of many third-party dlls.
3. The GLOB-1 site expects SQL Server catalog `Framework_GLOB-1` on localhost and a WCF host at `http://localhost:58913/framework_service.svc`.
4. `WebAddy` is `http://localhost:21856`. The unified solution's `core` entry uses `http://localhost:45935`. Which IIS Express port the GLOB-1 site uses was not verified by running it.

There is no Docker compose file and no pipeline.

## Monitoring and operations

No application-insights, health-check, or log-shipping config was found for the site. The scheduler writes text logs under its startup `logs` folder and deletes files older than 14 days. Web exceptions in the controls that were read call `exception.HandleException` and redirect to `/error`. Where those exceptions are stored is **Unknown** (the handler is in the framework).

## Development process

Git history on `main` is two commits by Renier van Rooyen: `.gitignore` on 2026-04-10, then the full tree on 2026-04-14. No pull request merge commits exist in this clone. No issue tracker file exists in the repo.

Sibling Silicon Ark documents (`ieb`, `SHOU-1`) describe the same Palette framework with other tenant folders. They are evidence of the product family, not of this remote's deploy process.

## Unknown / requires confirmation

- Production URL, production SQL host, and whether QA MediSwitch is still what production uses.
- Whether `core` or `core_custom/GLOB-1` is the deployed folder.
- Whether the unified solution's missing tenant directories were omitted on purpose.
- How `Framework_GLOB-1` is created and migrated.
- Whether committed secrets are still valid. They should be treated as exposed.