# Technical documentation — ieb-inde-2

Evidence date: 2026-10-13. Inspected revision: `main` at `8e2b139`.

Credential values are omitted. Paths below are relative to `INDE-2/Evolution Software Unified Framework/Evolution Software Unified Framework/` unless they start with `INDE-2/` or are the repository root.

## What this repository is

A Bitbucket import of an Evolution Software Unified Framework working copy. The website project is `core_custom/INDE-2`. The readme names that project CRM. Custom code implements schools, contacts, subjects, and clusters.

Two commits:

- `bdc15c4` (2025-07-02) — root `.gitignore` only.
- `8e2b139` (2025-07-09) — the `INDE-2/` tree.

The nested folder name is repeated: `INDE-2/Evolution Software Unified Framework/Evolution Software Unified Framework/`.

`INDE-2.sln` is the smaller solution: `business`, `library`, `constructor`, `scheduler`, the INDE-2 website, `service`, and `core-dev`, plus a `core` website entry. Visual Studio 17. Website target `.NETFramework,Version=v4.5`. IIS Express port `60629` for the website, `58913` for the service, and `17901` for `core-dev`. Source-control fields in the solution are the placeholder `SAK`.

`EvolutionSoftwareUnifiedFramework.sln` also includes `mobile`, `exporter`, `data` (`data.sqlproj`), `core`, `core-dev`, and the INDE-2 website.

The committed `.vs/INDE-2/config/applicationhost.config` maps site `INDE-2` to `C:\DEV work\NEW_IEB\INDE-2\Evolution Software Unified Framework\Evolution Software Unified Framework\core_custom\INDE-2` on port 60629.

## Application structure

```text
.gitignore
INDE-2/
  ReadME.txt
  bitbucket-pipelines.yml
  sonar-project.properties
  Evolution Software Unified Framework/
    Evolution Software Unified Framework/
      INDE-2.sln
      EvolutionSoftwareUnifiedFramework.sln
      core_custom/INDE-2/     website
      core/                   other website
      core-dev/
      business/
      library/
      service/                WCF
      mobile/
      tools/                  constructor, scheduler, exporter, dataImporter, CEP, CAPI.Custom
      data/                   SQL project and Scripts
      SchedulerTool/
      components/
      packages/
      release/
      .vs/                    committed IIS Express config
```

The INDE-2 website is a Web Site project (no `.csproj`). Entry pages include `Default.aspx`, `Canvas.aspx`, `Admin_SignIn.aspx`, and the `Admin_*` pages. CRM behaviour is under `controls/surface_custom` and the typed objects in `App_Code/objects`.

Custom surface files (form, grid, and view unless noted):

- `Schools_`
- `SchoolAffiliations_`
- `SchoolContacts_`
- `SubjectManagement_`
- `ClusterLevels_`
- `ClusterInformation_`
- `ClusterMembers_`
- `ClusterResources_`
- `ClusterMeetings_`

`App_Code/objects` also holds examination types (`oExaminationAuthoringandModeration`, `oExaminationDocumentPack`, `oComplianceFeedbackCRITERION`, `oCollabDetailParcel`) and `App_Code/classes/examHandler.cs` plus `examNums.cs`. No matching examination surface file is under `surface_custom`.

`controls/module_custom` contains `billingInstructions` and `CriterionFeedback`.

About 5465 files are in the tree. `bin`, `obj`, and `.vs` index files are committed. The root `.gitignore` is the Bitbucket example list. It does not ignore those folders.

## Frameworks and languages

- C# and ASP.NET Web Forms.
- `library/library.csproj` and `business/business.csproj` target .NET Framework 4.5. The INDE-2 `Web.config` sets `compilation targetFramework="4.5"` and `debug="true"`.
- A comment above `system.web` shows an example `httpRuntime targetFramework="4.6.2"`. The active `httpRuntime` element only sets `maxRequestLength="10048"` (about 10 MB).
- `sessionState timeout="60"`.
- `anonymousIdentification enabled="true"`.
- `customErrors` is not set in this file.
- `globalization` is `uiCulture="en"` and `culture="en-US"`. App setting `defaultCulture` is `en-ZA`, and that key appears twice.
- Website `packages.config` lists `Microsoft.CodeDom.Providers.DotNetCompilerPlatform` 1.0.0 and `Microsoft.Net.Compilers` 1.0.0 for `net45`. The codedom compiler option uses `langversion:6`.
- The readme tells a developer to re-add AjaxControlToolkit, Telerik.Web.UI, and SharpZipLib from `components` for all projects, and to reinstall the compiler platform package. EPPlus and NReco.VideoConverter are called out for the library project. Ionic.Zip is called out under the INDE-2 heading. `fileExplorer.ascx.cs` constructs `Ionic.Zip.ZipFile`.
- Library assembly: title `framework_library`, product `Evolution Software Framework`, company `Evolution SoftWare`, version `1.0.0.0`, copyright 2016.
- Telerik dialog, web resource, spell-check, and upload handlers are registered.

## Data access

Custom surfaces use `xData.GetTypedByCriteriaSpecific`, `SaveTyped`, `UpdateTyped`, `GetCustomTypedTable`, and `VerifyExists`.

Published CRM rows use `publ_` (`publ_ClusterInformation`, `publ_ClusterMembers`, `publ_ClusterResources`, `publ_ClusterMeetings`, `publ_ClusterLevels`, `publ_SubjectManagement`, `publ_SchoolContacts`, `publ_Schools`). Users use `pal_` with the extra boolean argument. One resource query joins `pal_vUserShared`.

`data/Scripts/INDE-2` contains only:

- `INDE-2-1.0.0-alter-school-contacts-subject-field-20032020.sql` — points field `495` at `publ_SubjectManagement` and backfills `SchoolContacts_SchoolContacts_Subjectifapplicable` from the subject name. The script's `UPDATE` names catalog `Framework_INDE-2_Demo`.
- `INDE-2-1.0.0-update-school-contacts-fields-25032020.sql` — grid flags and sequence for surface `3044`.

Other folders under `data/Scripts` include `INDE-1`, `INDE-6`, `STUD-1`, `CAPI-1`, `SHOU-1`, and several other customer codes, plus archive folders. Those scripts are in this tree. They are not INDE-2 product scripts.

Active app setting `conn` uses catalog `Framework_INDE-2_Demo` on `156.38.132.194` with SQL authentication. A commented block uses catalog `Framework_INDE-2` with integrated security on the local server, and the same catalog on `156.38.132.194`. The user id and password are in the file and are not repeated here. No `connectionStrings` entries were present.

Surface ids hardcoded in the CRM forms:

| Id | Use |
|---|---|
| 3044 | School contacts grid script |
| 3046 | New cluster member button |
| 3048 | New cluster resource, including the template copy |
| 3076 | New cluster meeting button |
| 495 | School-contact subject field in the 2020-03-20 script |

Several custom queries concatenate the selected id, level, email, or code prefix into SQL text. Examples: cluster-code `COUNT(*)`, `BindSubjectNames`, the school-contact subject query, `BindUserPicklist`, and `BindResourceUserPicklist`.

## File storage

Cluster information has a document-library string. Cluster meetings have a meeting-documents string. The uploader control type was not opened.

Child import reads an Excel file from `~/upload/data/` via `utils.getDataTableFromExcel`, then deletes the session key `fileToUpload`.

`fileExplorer.ascx.cs` writes a zip under the process temp path.

The site tree contains the framework `upload` folder, including a sample product image also present under `core` and `core-dev`.

## Mail, SMS, and service endpoints

From the INDE-2 `Web.config`:

| Setting | Value observed |
|---|---|
| `from` | `no-reply@evolutionsoftware.co.za` |
| SMTP | host `smtp.evolutionsoftware.co.za`, port `25`, from `mailer@evolutionsoftware.co.za`. User name and password omitted |
| `WebAddy` | `http://localhost:60629` |
| `subject` | `IEB (INDE-2 Local) - {content}` |
| `website` | `IEB (INDE-2 Local)` and, on a second key, `IEB CRM` |
| `DateFormat` | `yyyy-MM-dd hh:mm tt` |
| `defaultCulture` | `en-ZA` (twice) |
| `support`, `admin`, `cc`, `bcc`, `loyaltyEmailAddy` | Populated mailbox addresses. Omitted here |
| `loyaltyEmail` | `0` |
| `MediSwitchResponses` | `0` |
| MediSwitch | QA gateway hostnames are active. Live hostnames are commented |
| SMS | `smsU` and `smsP` are set. Values omitted. Client endpoint `http://sms.netgen.co.za/SMS_V2.asmx` |
| WCF | `http://localhost:58913/framework_service.svc` and `http://service.ieb.co.za/framework_service.svc`. `wsHttpBinding` security mode is `None`. Send timeout on that binding is 10 minutes. JSON `maxJsonLength` is 50000000 |

Cluster mail does not use the `subject` app setting. It sets the subject strings in code. When `website` looks like a local, dev, or demo name, the recipient is replaced with `admin`.

## Auth

Sign-in is the framework page `Admin_SignIn.aspx`. This `Web.config` does not declare a forms-authentication mode. Session timeout is 60 minutes. Anonymous identification is enabled.

Cluster checks compare `oUser.recId` with `ClusterResources_ClusterResourceDetails_ResourceName` and compare `userType` with `pNums.UserType`. Passwords for imported members are random and stored through the framework encryption helper. The helper's constructor argument is in source and is omitted here.

The WCF client binding uses `security mode="None"`.

## Background work

`tools/scheduler` and `SchedulerTool` are in the solution. No INDE-2 cluster or school class was found that enqueues a job. `loyaltyEmail` is `0`. Whether the scheduler process is deployed for this site is **Unknown / Requires Confirmation.**

## Pipeline, quality, and monitoring

`INDE-2/bitbucket-pipelines.yml` runs `sonarsource/sonarqube-scan:3.0.2` on branches `main` and `develop`, and on every pull request. The image is `maven:3.8.3-jdk-11`, size `8x`. Clone depth is 50. There is no compile or test step.

The pipe sets `-Dsonar.projectKey=my-project`. `INDE-2/sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`. Which key the scanner keeps was not executed. **Unknown / Requires Confirmation.**

Exclusions in the pipe: `**/*.test.js`, `**/node_modules/**`, `**/vendor/**`. This repository is not a Node project.

No application-insights, health-check, or log-shipping configuration was found for the CRM site. Surface exceptions go through `exception.HandleException`.

The task-creation listing included `sonarqube_scan.bat` at the repository root. It is not in the git tree.

## Security notes (observed, not a penetration test)

- Database, SMTP, and SMS secrets are stored in `Web.config` in the repository. They are not copied into this document.
- The active SQL login is a SQL user on a remote host, and a commented block uses the same style of secret.
- WCF client security mode is `None`.
- `compilation debug` is `true`.
- Custom SQL is concatenated.
- Imported users receive a random password. How that password is delivered to the person was not found in the import block.

## Development and testing

The readme is the only setup document: re-add the named DLLs, reinstall the compiler package, and for INDE-2 add the Ionic.Zip package and reference.

No test assembly covers the cluster or school workflow. `CEP.ConsoleTests` is present and is not an INDE-2 test project.

`develop` is named in the pipeline and was not a remote branch. The only branch seen was `main`.

## Deployment

No publish profile specific to a production INDE-2 host was established beyond the website `website.publishproj` and the framework `App_Data/PublishProfiles` folders, which were not opened as a release process. `WebAddy` is localhost. The live WCF address is `service.ieb.co.za`. Whether the website itself is hosted at an IEB hostname is **Unknown / Requires Confirmation.**

There is no Docker, Terraform, or CI deploy step in this repository.