# Technical documentation — ieb-inde-3 Evidence date: 2026-10-13. Inspected revision: `main` at `ce71caf`. Credential values are omitted. Paths below are relative to `INDE-3/Evolution Software Unified Framework/Evolution Software Unified Framework/` unless they start with `INDE-3/` or are the repository root. ## What this repository is A Bitbucket import of an Evolution Software Unified Framework working copy. The website project is `core_custom/INDE-3`. The readme does not name that project. Custom code implements IEB examination authoring and moderation. Two commits on `main` (both 2025-07-09): - `f403eb4` — root `.gitignore` only. - `ce71caf` — the `INDE-3/` tree. The nested folder name is repeated: `INDE-3/Evolution Software Unified Framework/Evolution Software Unified Framework/`. `INDE-3.sln` is the smaller solution: `business`, `library`, `constructor`, `scheduler`, the INDE-3 website, and `service`. Visual Studio 16. Website target `.NETFramework,Version=v4.5`. IIS Express port `35474` for the website and `58913` for the service. Team Foundation metadata points at `https://dev.azure.com/evolutionsoft`. `EvolutionSoftwareUnifiedFramework.sln` also includes `mobile`, `exporter`, `data` (`data.sqlproj`), `core`, `core-dev`, and the INDE-3 website. ## Application structure ```text .gitignore INDE-3/ ReadME.txt bitbucket-pipelines.yml sonar-project.properties Evolution Software Unified Framework/ Evolution Software Unified Framework/ INDE-3.sln EvolutionSoftwareUnifiedFramework.sln core_custom/INDE-3/ website core/ other website core-dev/ business/ library/ service/ WCF mobile/ tools/ constructor, scheduler, exporter, dataImporter, CEP data/ SQL project and Scripts SchedulerTool/ components/ packages/ release/ .vs/ committed IIS Express config ``` The INDE-3 website is a Web Site project (no `.csproj`). Entry pages include `Default.aspx`, `Canvas.aspx`, `Admin_SignIn.aspx`, and the `Admin_*` pages. Examination behaviour is under `controls/surface_custom` and `App_Code/classes`. Custom surface files: - `ExaminationAuthoringandModeration_{form,grid,view}` - `ExaminationDocumentPack_{form,grid,view}` - `ExaminationDocumentPack_ExamDocs_form` - `ExaminationDocumentPack_InternalMod_form` - `ExaminationDocumentPack_ExternalMod_form` - `SubjectManagement_{form,grid,view}` `App_Code/objects` holds `oExaminationAuthoringandModeration`, `oExaminationDocumentPack`, `oSubjectManagement`, `oComplianceFeedbackCRITERION`, and `oCollabDetailParcel`. ## Frameworks and languages - C# and ASP.NET Web Forms. - `library/library.csproj` targets .NET Framework 4.5. The INDE-3 `Web.config` sets `compilation targetFramework="4.5"` and `debug="true"`. - `httpRuntime maxRequestLength="10048"` (about 10 MB). No `targetFramework` attribute was on that element. - `sessionState timeout="20"`. - `customErrors mode="Off"`. - Website `packages.config` lists only `Microsoft.CodeDom.Providers.DotNetCompilerPlatform` 2.0.0 for `net45`. - The readme tells a developer to re-add AjaxControlToolkit, Telerik.Web.UI, and SharpZipLib from `components`, and to reinstall the compiler platform package. EPPlus and NReco.VideoConverter are called out for the library project. Ionic.Zip is called out under an INDE-2 heading. - Scheduler `Build/` contains committed copies of Google APIs, Newtonsoft.Json, EPPlus, NReco.VideoConverter, PdfMetamorphosis, Telerik.Web.UI, and the framework DLLs. - Library assembly: title `framework_library`, product `Evolution Software Framework`, company `Evolution SoftWare`, version `1.0.0.0`, copyright 2016. ## Data access Custom surfaces use `xData.GetTypedByCriteriaSpecific`, `SaveTyped`, `UpdateTyped`, `GetCustomTypedTable`, and `GetTypedTableByProc`. Published rows use `publ_` (`publ_ExaminationDocumentPack`, and the examination and subject types loaded with that prefix). Users use `pal_` with the extra boolean argument. There is no `INDE-3` folder under `data/Scripts`. Folders that are present include `INDE-1`, `INDE-2`, `INDE-6`, `STUD-1`, `CAPI-1`, `SHOU-1`, and several other customer codes, plus archive folders. `data/data.sqlproj` is the SQL project. A backup file `Framework_STUD-1.bak` is in `data/`. It is not an INDE-3 backup. Active app setting `conn` uses catalog `Framework_INDE-3_Demo` on a remote SQL Server host. The user id and password are in the same attribute. A commented setting uses catalog `Framework_INDE-3` with integrated security on the local server. No `connectionStrings` entries were present. Values are not repeated here. Surface ids hardcoded in the examination forms: | Id | Use | |---|---| | 3037 | New examination document pack | | 3038 | New examination document | | 3062–3074 | Internal criterion feedback and evidence buttons | | 3088–3100 | External criterion feedback and evidence buttons | `examHandler` calls stored procedure `sp_INDE_GetCriterionFeedbackData`. The procedure body is not in an INDE-3 script folder. The pack revision query is a concatenated `SELECT Count(*)` against `publ_ExaminationDocumentPack`. The subject grid filter concatenates `user.userDisplay` into the filter string. ## File storage Examination document fields are strings on the document-pack object. `ExaminationDocuments_ExaminationDocuments_DocumentUploadComplete` is the upload-complete flag as a string property. The uploader control type was not opened. The site tree contains the framework `upload` folder. Sample banner, gallery, and product files elsewhere in the framework were not inventoried for this site. `examHandler` does not write files. A generated report branch in the exam-documents form can write a PDF under `~/upload/documents/` for an SBF profile report. That branch is the framework report switch, not the examination upload-complete case. ## Mail, SMS, and service endpoints From the INDE-3 `Web.config`: | Setting | Value observed | |---|---| | `from` | `ieb.web@assetonline.co.za` | | SMTP | host `email-smtp.eu-west-1.amazonaws.com`, port `2587`, same from address. User name omitted | | `WebAddy` | `http://localhost:35474` | | `subject` | `IEB:: Website - {content}` | | `website` | `IEB:: Website` | | `DateFormat` | `yyyy-MM-dd hh:mm tt` | | `defaultCulture` | `en-ZA` | | `AllowCustomProgress` | `false` | | `support`, `admin`, `bcc` | Populated mailbox addresses. Omitted here | | `cc` | Empty | | WCF | `http://localhost:58913/framework_service.svc` named `Iframework_service` | | SMS | `http://sms.netgen.co.za/SMS_V2.asmx` named `sendeasy_service`. SMS user and password app settings are present and omitted | | MediSwitch | Three QA gateway hosts under `wsgateway.mediswitch.co.za`, `wsgateway1`, and `wsgateway2`. `MediSwitchResponses` = `0` | | Country service | `www.webservicex.net` country ASMX methods | | reCAPTCHA | `https://www.google.com/recaptcha/api/siteverify`. Site and private keys present and omitted | No endpoint named `Iframework_serviceLive` was found in this file. Which endpoint the running site uses beyond the localhost client is **Unknown / Requires Confirmation**. Status mail does not use the `subject` app setting. It builds `IEB: {subject name} ({status})` in code. The from address on that message is `setup.communicationEmail`, not necessarily the SMTP `from` value. **Implemented.** ## Authentication Users are `oUser` rows. Examination role checks compare `recId` to the subject resource fields. Role enum `pNums.UserType`: WebsiteUser 1, PowerUser 2, SuperUser 3, AdminUser 4, CustomUser 5. `Admin_SignIn.aspx` and `Reset.aspx` exist. A captcha control was not traced on the examination surfaces. reCAPTCHA keys are in config. Session heartbeat is `SessionHeartbeat.ashx`. No Rocket.Chat helper, setting, or call was found under `core_custom/INDE-3`. The document password is generated in the form and stored on the subject. It is not the user's login password. ## Background work, queues, storage, monitoring `tools/scheduler` and `SchedulerTool` are in the tree. No examination or INDE-3 job was identified inside them during this inspection. **Unknown** which scheduler jobs this site depends on. `SchedulerTool` and `tools/scheduler` each contain `GoogleSheetAPISecretes.json`. `business/client_secrets.json` is also committed. Contents were not copied. No application-insights, health-check, or log-sink configuration was found for INDE-3. Custom surface failures call `exception.HandleException` and redirect to `/error`. The handler spells that prefix `examHanlder`. Where the helper writes is the framework `exception` type. **Unknown.** ## Security notes from the tree These are facts about the tree. Values are not repeated. - The active SQL connection string, SMTP user, SMS password, and reCAPTCHA private key are committed in `core_custom/INDE-3/Web.config`. - `compilation debug` is `true` and `customErrors` is `Off` in that file. - Google client secret JSON files and `tools/scheduler/scheduler_TemporaryKey.pfx` are committed. - The subject grid filter and the pack-count query concatenate values into SQL text. - `EmailExamStatus` and `SaveCollaborationLog` contain a commented assignment that would send mail to a personal mailbox. The live assignment uses the role address. - The generated document password is a short random string, stored in the subject row and shown on the form. ## Development and testing `INDE-3/ReadME.txt` is the only setup document. It is written as steps for INDE-1, then lists DLL repairs for all of INDE-1 through INDE-7. It does not give a URL, a database publish order, or an INDE-3-specific step. `tools/CEP/CEP.ConsoleTests` is a .NET Framework 4.5 console project about quotes, lead times, and inventory (`QuoteTests.cs`, `TestQuoteProcess.cs`). It is not referenced by the examination forms. No `[Test]`, `[Fact]`, or `TestMethod` attributes were found in the tree. `applicationhost.config` binds site name `INDE-3` to `C:\DEV work\NEW_IEB\INDE-3\...\core_custom\INDE-3`. The service and `core-dev` sites in the same file use sibling folders under that `NEW_IEB\INDE-3` working copy. That path is a machine path from the committed IIS Express config. It is not a deployment manifest. ## Sonar and pipeline `INDE-3/sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`. `INDE-3/bitbucket-pipelines.yml` runs `sonarsource/sonarqube-scan:3.0.2` on branches `main` and `develop`, and on pull requests, using a Maven JDK 11 image at size 8x. `EXTRA_ARGS` includes `-Dsonar.projectKey=my-project` and `-Dsonar.sources=.`, plus exclusions for test JavaScript, `node_modules`, and `vendor`. Clone depth is 50. **Discrepancy:** the pipeline argument `my-project` does not match `sonar-project.properties`. Which key SonarQube actually used is **Unknown / Requires Confirmation**. The root `.gitignore` and `INDE-3/.gitignore` are the Bitbucket template (Node, Java, Python, Maven, JetBrains). They do not ignore `.vs`, `Bin`, `packages`, or `*.pfx`. `sonarqube_scan.bat` is not in the git tree. ## Source layout note for agents Prefer `git grep` and `git cat-file` over a full working-tree walk. Nested folder names (`Evolution Software Unified Framework` twice, plus `.vs` and NuGet paths) hit Windows `MAX_PATH` on checkout even when long paths are enabled for some files. The checkout of `ce71caf` reported 5451 files and failed on at least one `.vs` Copilot index path. ## Discrepancies to review 1. Readme: Exams = INDE-1. This website's custom surfaces are examination authoring under INDE-3. INDE-3 is only in the "all projects" setup list. 2. Active catalog `Framework_INDE-3_Demo` versus commented `Framework_INDE-3`. 3. Reviewer can edit status; users below SuperUser cannot save. 4. Form stores resource roles as `recId`. Grid filters `userDisplay`. 5. Pipeline Sonar key `my-project` versus `sonar-project.properties`. 6. `develop` is named in the pipeline and was not on the remote. 7. `sonarqube_scan.bat` was reported at discovery and is not in git. 8. No `data/Scripts/INDE-3`, while `sp_INDE_GetCriterionFeedbackData` is called. 9. `WebAddy` is localhost. No production URL is configured in the settings that were read. 10. Secrets and a code-signing pfx are committed. See the security notes.