# Technical documentation — ieb-inde-1

Evidence date: 2026-10-13. Inspected revision: `main` at `9bf5ac3`.

Credential values, SMTP passwords, SMS passwords, connection strings, and the contents of secret files are omitted on purpose.

## What this repository is

One commit on `main` (2025-07-03, author `maanie`, message "Initial commit") adds a working copy of **Evolution Software Unified Framework** customised as **INDE-1 / Exams**.

```text
.gitignore
INDE-1/
  bitbucket-pipelines.yml
  sonar-project.properties
  ReadME.txt
  Evolution Software Unified Framework/
    Evolution Software Unified Framework/
      EvolutionSoftwareUnifiedFramework.sln
      INDE-1.sln
      business/  components/  core/  core-dev/  core_custom/INDE-1/
      data/  library/  mobile/  packages/  release/
      SchedulerTool/  service/  tools/
```

`sonarqube_scan.bat` was named by the onboarding scan and is not in this revision.

The nested folder name is repeated: `INDE-1/Evolution Software Unified Framework/Evolution Software Unified Framework/`. Paths below are relative to that inner folder unless they start with `INDE-1/`.

The root `.gitignore` is the Bitbucket template (Node, Java, Python, logs, media). It does not ignore `.vs`, `obj`, `Bin`, or `*.pfx`. Those are in the tree.

## Application structure

ASP.NET Web Forms site. Pages are `.aspx` with code-behind. Reusable UI is `.ascx` under `controls/`. Much of the screen layout is not hardcoded: a canvas points at a module, and a surface's fields are rows the generic renderer draws. Exams add hand-written behaviour beside that generator output.

| Area | Path | Notes |
|---|---|---|
| INDE-1 site | `core_custom/INDE-1/` | Website project in both solution files. |
| Generic site | `core/` | Solution binds it to `http://localhost:45935`. |
| Dev site | `core-dev/` | Second website project. |
| Exam classes | `core_custom/INDE-1/App_Code/classes/examHandler.cs`, `examNums.cs` | Status mail, log mail, roles, compliance HTML. |
| Exam objects | `App_Code/objects/oExaminationAuthoringandModeration.cs`, `oExaminationDocumentPack.cs`, `oSubjectManagement.cs`, `oComplianceFeedbackCRITERION.cs`, `oCollabDetailParcel.cs` | Surface entities and the log parcel. |
| Generated surfaces | `controls/surface_custom/*_{form,grid,view}.ascx` | Form code-behind files are about 18,000–25,000 lines. They are generator output plus a custom-include region. |
| Notes | `controls/module/surfaceNotes.ascx.cs` | `HandleEmailLog`. |
| Attachments | `controls/admin/attachments.ascx.cs` | Role checks dated 2018-02-10. |
| Library | `library/library.csproj` | Assembly `framework_library`, target v4.5. |
| Business | `business/business.csproj` | Enums in `business/enums/pNums.cs`. |
| Service | `service/framework_service.svc` | WCF service host. |
| SQL project | `data/data.sqlproj` | Scripts grouped by client code. |

`App_Code` is compiled by the website, not by the class-library projects.

Generated surface files:

| Surface | Files |
|---|---|
| Examination authoring and moderation | `ExaminationAuthoringandModeration_{form,grid,view}` |
| Document pack | `ExaminationDocumentPack_{form,grid,view}` |
| Exam documents | `ExaminationDocumentPack_ExamDocs_form` |
| Internal moderation | `ExaminationDocumentPack_InternalMod_form` |
| External moderation | `ExaminationDocumentPack_ExternalMod_form` |
| Subject management | `SubjectManagement_{form,grid,view}` |

`controls/module_custom/` also contains `CriterionFeedback.ascx` and `billingInstructions.ascx`.

## Frameworks and languages

- C# and ASP.NET Web Forms. Website `Web.config` compilation `targetFramework="4.8"` and `debug="true"`. Library `TargetFrameworkVersion` is v4.5.
- SQL Server scripts and a SQL Server Data Tools project (`data.sqlproj`).
- Telerik.Web.UI, Ajax Control Toolkit, EPPlus, NReco.VideoConverter, ICSharpCode.SharpZipLib. `INDE-1/ReadME.txt` says several of these DLLs must be re-added from `components` or `packages` before a build, and that `Microsoft.CodeDom.Providers.DotNetCompilerPlatform` must be reinstalled. Ionic.Zip is listed under INDE-2, not under the INDE-1-specific steps.
- jQuery UI, DataTables, and date-picker assets under `css/` and `js/`.
- Pipeline image `maven:3.8.3-jdk-11` is only there to run the Sonar scanner. The application is not a Maven build.

`Web.config` sets `globalization` culture `en-US` and app setting `defaultCulture` `en-ZA`. `DateFormat` is `yyyy-MM-dd hh:mm tt`.

## Solutions and build outputs

`EvolutionSoftwareUnifiedFramework.sln` includes library, business, service, mobile, constructor, exporter, scheduler, data, core, core-dev, and `core_custom\INDE-1`.

`INDE-1.sln` includes INDE-1, business, library, service, core-dev, core, constructor, and scheduler. It does not list the data SQL project or the exporter.

Publish profiles under `core_custom/INDE-1/App_Data/PublishProfiles/`:

| Profile | Publish URL in the file | Configuration |
|---|---|---|
| `INDE-1.pubxml` | `C:\Users\graha\Dropbox (Evolution Software)\Development\Evolution Software Unified Framework\publish\INDE-1` | Release. Precompile. Delete existing files. Exclude `App_Data`. |
| `INDE-1-IEB.pubxml` | `C:\Projects\ieb_publish` | Release. Precompile. Delete existing files. Exclude `App_Data`. |
| `PaletteOne.pubxml` | Present. Not read as an INDE-1 requirement. | |

No Bitbucket step builds or publishes these profiles.

`release/1.0.0.1` and `release/1.0.5` each contain `files.zip` and `scripts.zip`. They were not unpacked.

## Data access

Active connection app setting `conn` uses catalog `Framework_INDE-1_Demo`. Commented alternatives in the same file name catalogs `Framework_INDE-1` and `Framework_EVOL-1`. The host address and passwords are omitted.

Application data access goes through `xData` / `xDataHelper` (`framework_library`):

- `pal_` prefix for configuration objects (users, templates, lookups, setup).
- `publ_` prefix for published surface tables (`publ_ExaminationAuthoringandModeration`, `publ_ExaminationDocumentPack`, `publ_SubjectManagement`).

INDE-1 scripts in `data/Scripts/INDE-1`:

| Script | Effect evidenced by the SQL text |
|---|---|
| `2020-05-04-DP-INDE-1-update-template.sql` | `UPDATE pal_Template` for `Examination Moderation Log`, then for `Examination Moderation Status`. |

`examHandler.GetCriterionData` calls `xData.GetTypedTableByProc` with procedure `sp_INDE_GetCriterionFeedbackData` and parameters `SurfaceId`, `ParentSurfaceItemId`, and `userID`. A search of `data/` did not find that procedure. **Requires Confirmation** that it exists only in the database.

Other script folders in `data/Scripts` belong to other client codes (CAPI, CHUU, CLOS, INDE-2, INDE-6, OLIV, REAP, ROBI, SCHO, SHEN, SHOU, STUD) plus archived framework majors. They are in this repository because the SQL project is shared. They are not INDE-1 migrations. There is no `INDE-3`, `INDE-4`, or `INDE-5` script folder in this tree. The readme still names those products.

Document-pack revision and pack lookup use a concatenated SQL string: `Select Count (*) FROM publ_ExaminationDocumentPack where ParentSurfaceItemId = {id} AND isActive = 1`.

## File storage

Attachment files are mapped under `~/upload/{folder}/file/` or `~/upload/{folder}/image/`.

`FileProtectionHandler` (`App_Code/FileProtectionHandler.cs`) is an `IHttpHandler` and `IReadOnlySessionState`, registered in `system.webServer/handlers` as:

```text
name=FileProtectionHandler  verb=*  path=upload  type=Handler.FileProtectionHandler
```

GET without a session user redirects to `{WebAddy}/admin`, except the root URL and the admin URL.

`maxRequestLength` is `10048` KB. Anonymous identification is enabled. Session timeout is 20 minutes.

`ApplicationLog_20250325.txt` is checked in at the website root. It was not used as a requirements source.

## Mail, SMS, and service endpoints

`system.net/mailSettings` SMTP host `smtp.assetonline.co.za`, port 587, from `ieb-exams@assetonline.co.za`. Password omitted.

App settings relevant to the exam site:

| Key | Role |
|---|---|
| `WebAddy` | `http://localhost:27559`. Links inside templates are prefixed with this. |
| `from` | `ieb-exams@assetonline.co.za`. Exam status mail uses setup `communicationEmail` instead. |
| `support`, `admin`, `cc` | `maanie@overdrive.co.za`. |
| `bcc` | Empty. Copied onto exam emails. |
| `subject` | `IEB:: Exams (INDE-1) - {content}`. |
| `website` | `IEB:: Exams (INDE-1)`. |
| `conn` | Demo catalog. See data access. |
| `DateFormat` | `yyyy-MM-dd hh:mm tt`. |
| `defaultCulture` | `en-ZA`. |
| `AllowCustomProgress` | `false`. |

SMS user and password keys are present. Values omitted. No exam class that was read sends SMS.

MediSwitch QA gateway URLs are in app settings (`wsgateway.mediswitch.co.za` and two numbered hosts, path `/qa/wsgateway/MediswitchGatewayV2`). `MediSwitchResponses` is `0`. Country lookup URLs point at `www.webservicex.net`. These are framework settings. The exam custom regions that were read do not call them.

Status and log mail go through `communication.SendAnEmail`. Failure is an exception handled inside `examHandler`, which returns false.

## Auth

Sign-in is the framework admin sign-in page (`Admin_SignIn.aspx`). Exam code reads the user from `handler.ReturnUser()` / session key `user`.

Two layers:

- Framework `pNums.UserType` (WebsiteUser 1 through CustomUser 5).
- Subject resource ids compared by `examHandler.GetSubjectResourceRole`.

Session timeout is 20 minutes. There is no separate exam login. Password storage and the sign-in hash were not re-derived for this document. **Unknown / Requires Confirmation** beyond the framework page being present.

`FileProtectionHandler` treats a missing session user as anonymous for `upload` GETs.

## Background jobs

`tools/scheduler` is a .NET Framework 4.5 executable in the solution (`scheduler.csproj`). Classes include campaigns, loyalty, MediSwitch, and surface data import. None of the exam custom regions call it.

`tools/scheduler/GoogleSheetAPISecretes.json` and `tools/scheduler/scheduler_TemporaryKey.pfx` are checked in. Contents were not copied here. Human review should decide whether those files belong in Git.

`SchedulerTool/` at the framework root is a separate small folder (17 files). It was not part of the exam path.

No queue product (Hangfire, MSMQ, Service Bus) was identified on the exam path.

## Security notes visible in the tree

- `Web.config` `debug="true"` on the site that has the demo connection.
- Connection strings, SMTP password, and SMS password are in `Web.config` in Git. Not repeated here.
- Document-pack counts are string-concatenated SQL.
- Upload handler allows the request through when a session user exists. Finer per-file checks are in the attachment control, not in the handler.
- A Google API secret JSON and a scheduler `.pfx` are in the scheduler project.
- `.vs` folders, including Copilot index databases, are committed.

## Pipelines and analysis

`INDE-1/bitbucket-pipelines.yml`:

- Clone depth 50.
- Branches `main` and `develop`, and every pull request, run one step: `sonarsource/sonarqube-scan:3.0.2` on image `maven:3.8.3-jdk-11`, size `8x`.
- `SONAR_HOST_URL` and `SONAR_TOKEN` come from pipeline variables.
- Extra args set `sonar.projectKey=my-project`, sources `.`, and exclusions for `*.test.js`, `node_modules`, and `vendor`.
- JVM opts `-Xmx4g` and embedded Java forced.

`INDE-1/sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`.

The pipeline key and the properties key disagree. The pipeline passes `EXTRA_ARGS` including a project key, which is the key the pipe is written to use. **Requires Confirmation** which key SonarQube actually has.

There is no test, package, or deploy step.

## Development and testing process

Documented setup is `INDE-1/ReadME.txt`: re-add the named DLLs and reinstall the CodeDom compiler package. The readme says the same DLL steps apply to INDE-1 through INDE-7, then lists an INDE-2-only Ionic.Zip step.

No INDE-1 unit-test project exists. `tools/CEP/CEP.ConsoleTests` covers quotes for another product. `core/Test.aspx` is a page, not an automated suite.

Local run URL in config is `http://localhost:27559`. The generic `core` project is bound to port 45935 in the solution.

## Monitoring

No application-insights, health-check, or log-shipping config was found for the exam site. Exceptions go through `exception.HandleException`. A log file `ApplicationLog_20250325.txt` is in the website project. What writes it was not traced.

## Environment configuration

| Setting | Checked-in value | Provenance |
|---|---|---|
| Active SQL catalog | `Framework_INDE-1_Demo` | Implemented |
| Commented catalogs | `Framework_INDE-1`, `Framework_EVOL-1` | Implemented as comments |
| Public site URL | `http://localhost:27559` | Implemented |
| Mail host | `smtp.assetonline.co.za:587` | Implemented |
| Pipeline | Sonar scan only, on `main`, `develop`, and pull requests | Implemented |
| Branch that exists | `main` only | Implemented |

Production host, production catalog, and who deploys the publish profiles are **Unknown / Requires Confirmation**.