# Technical documentation — ieb-inde-4

Evidence date: 2026-10-13. Inspected revision: `main` at `e2be9d5`.

Credential values are omitted. Paths below are inside the repository unless noted.

## What this repository is

A Bitbucket import of an Evolution Software Unified Framework working copy, with the website project `core_custom/INDE-4` named Docs by `INDE-4/ReadME.txt`.

Committed root:

```text
.gitignore
INDE-4/
  .gitignore
  .vs/
  ReadME.txt
  bitbucket-pipelines.yml
  sonar-project.properties
  Evolution Software Unified Framework/
    Evolution Software Unified Framework/
      INDE-4.sln
      EvolutionSoftwareUnifiedFramework.sln
      business/
      library/
      service/
      core/
      core-dev/
      core_custom/INDE-4/
      mobile/
      tools/
      data/
      components/
      packages/
      release/
      SchedulerTool/
```

`sonarqube_scan.bat` is not in this tree. The 2026-09-28 onboarding scan listed it at the repository root.

Some NuGet package folders and `.vs` index folders exceed the Windows path limit on the machine used for this inspection. Those blobs are in git. Directory listing of the working tree warned that it could not open them. Findings below use `git` object reads for the source that was inspected.

## Application structure

`INDE-4.sln` is the site solution. It includes:

| Project | Kind |
|---|---|
| `business`, `library` | Class libraries |
| `service` | WCF website project |
| `core`, `core-dev` | Framework websites. `core` is bound in the solution to `http://localhost:45935` |
| `INDE-4` | Website at `core_custom/INDE-4` |
| `constructor`, `scheduler` | Tools |

`EvolutionSoftwareUnifiedFramework.sln` is the larger solution. It adds `mobile`, `exporter`, `data/data.sqlproj`, and the same `INDE-4` website under a different project GUID.

The INDE-4 website is ASP.NET Web Forms: `.aspx` pages, `.master` pages, `.ascx` controls, and `App_Code`. Custom product controls live in:

- `controls/surface_custom/` — schools, contacts, affiliations, subjects, clusters
- `controls/module_custom/` — `CriterionFeedback`, `billingInstructions`
- `controls/surface_custom_backup/` — excluded copies of school-contact code-behind dated 2018-05-15 in the file name

`App_Code/objects/` holds the published-surface classes (`oSchools`, `oClusterInformation`, and the examination objects). `App_Code/classes/examHandler.cs` and `examNums.cs` hold examination ids and mail.

Surface forms are very large generated files. Hand-written behaviour sits in regions marked `Custom Include`, mostly dated May 2018.

## Frameworks and languages

- C# and ASP.NET Web Forms.
- `business/business.csproj` and the library project target .NET Framework 4.5.
- INDE-4 `Web.config` sets `httpRuntime targetFramework="4.6.2"` and `maxRequestLength="10048"` (about 10 MB).
- UI libraries present as binaries or packages: Telerik.Web.UI, AjaxControlToolkit, Bootstrap, jQuery 1.11.3, DataTables, EPPlus, Ionic.Zip, SharpZipLib, Newtonsoft.Json, Google APIs (Sheets), NReco.VideoConverter, PdfMetamorphosis.
- The readme tells a developer to re-add AjaxControlToolkit, Telerik.Web.UI, and SharpZipLib from `components`, and to reinstall `Microsoft.CodeDom.Providers.DotNetCompilerPlatform`. EPPlus and NReco are called out for the library project. Ionic.Zip is called out under an INDE-2 heading.

## Data access

Custom surfaces use `xData.GetTypedByCriteriaSpecific`, `SaveTyped`, `UpdateTyped`, `VerifyExists`, and `GetCustomTypedTable`.

Published surface rows use the `publ_` prefix (`publ_ClusterInformation`, `publ_SchoolContacts`, `publ_SubjectManagement`, `publ_ClusterResources`). Users use the `pal_` prefix (`pal_User`) and a second boolean argument that selects that prefix.

There is no `INDE-4` folder under `data/Scripts`. Folders that are present include `INDE-1`, `INDE-2`, `INDE-6`, `STUD-1`, and several other customer codes, plus archive folders. `data/data.sqlproj` is the SQL project. A backup file `Framework_STUD-1.bak` is in `data/`. It is not an INDE-4 backup.

Active app setting `conn` uses catalog `Framework_INDE-4_Demo`. Commented settings use catalog `Framework_INDE-4`. The readme's INDE-2 user table is not a second connection string.

Surface ids hardcoded in the cluster form:

| Id | Use |
|---|---|
| 3046 | New cluster member button |
| 3048 | Cluster resources child surface and template copy |
| 3076 | New cluster meeting button |

`examHandler` calls stored procedure `sp_INDE_GetCriterionFeedbackData`. The procedure body is not in an INDE-4 script folder.

## File storage

Cluster Document Library renders `controls/module/fileUploader.ascx` for field `ClusterDocumentLibrary_Library_Documents`. The object property is a string.

Cluster meeting documents are the string `ClusterMeetings_ClusterMeetingDocuments_ClusterMeetingDocuments`. The control type on that field was not opened.

Spreadsheet import reads `~/upload/data/` plus a session file name, via `utils.getDataTableFromExcel`. The upload handler writes an `.xlsx` into that folder.

The site tree also contains sample files under `upload/banner`, `upload/file`, `upload/gallery`, `upload/image`, and `upload/products`. Those look like framework sample content, not an INDE-4 document archive.

## Mail, SMS, and service endpoints

From INDE-4 `Web.config`:

| Setting | Value observed |
|---|---|
| `support`, `admin`, `cc`, `bcc`, `loyaltyEmailAddy` | `graham@evolutionsoftware.co.za` |
| `from` | `no-reply@evolutionsoftware.co.za` |
| SMTP | host `smtp.evolutionsoftware.co.za`, port 25, from `mailer@evolutionsoftware.co.za` |
| `WebAddy` | `http://localhost:21552` |
| `subject` | `IEB (INDE-4 Local) - {content}` |
| `website` | `IEB (INDE-4 Local)` and, later in the same file, `IEB CRM` |
| `defaultCulture` | `en-ZA`, declared twice |
| WCF | `http://localhost:58913/framework_service.svc` named `Iframework_service` |
| WCF live name | `http://service.ieb.co.za/framework_service.svc` named `Iframework_serviceLive` |
| SMS | `http://sms.netgen.co.za/SMS_V2.asmx` |
| MediSwitch | QA gateway URLs active in config. Live URLs commented. `MediSwitchResponses` = `0` |
| Country service | `www.webservicex.net` country ASMX. `getCountriesFromWebService` = `0` |
| Loyalty email | `loyaltyEmail` = `0`, hour `20` |

WCF bindings set `maxReceivedMessageSize` to `2147483647`. Security mode was not fully read. Timeouts are 5 minutes, with send timeout 10 minutes.

Which of the two WCF endpoints the site uses at runtime was not traced. **Unknown / Requires Confirmation.**

## Authentication

Users are `oUser` rows. Custom code filters them with `customerCode = handler.ReturnSetup().code`.

Role enum `pNums.UserType`: WebsiteUser 1, PowerUser 2, SuperUser 3, AdminUser 4, CustomUser 5. Several grid columns treat CustomUser through `mimicUserType`.

Imported users receive a random 8-character password encrypted with a passphrase that is a source literal in the import methods. The passphrase is not repeated here.

`Admin_SignIn.aspx` exists. A captcha control was not found in the custom surface files that were read. Session heartbeat is `SessionHeartbeat.ashx`.

No Rocket.Chat helper, setting, or call was found under `core_custom/INDE-4`.

## Background work, queues, storage, monitoring

`tools/scheduler` and `SchedulerTool` are in the tree. No INDE-4-specific job was identified. **Unknown** which scheduler jobs this site depends on.

`loyaltyEmailHour` is configured while `loyaltyEmail` is `0`.

No application-insights, health-check, or log-sink configuration was found for INDE-4. Custom surface failures call `exception.HandleException` and redirect to `/error`. Where that helper writes is the framework `exception` type. **Unknown.**

## Security notes from the tree

These are facts about the tree. Values are not repeated.

- Database, SMTP, and SMS secrets are committed in `Web.config`.
- The password encryption passphrase is a source literal in the school and cluster import methods.
- `compilation` debug mode was not compared between `Web.config` and `Web.Debug.config`.
- Cluster code generation and several picklist queries concatenate values into SQL text, including the cluster-code prefix and school-contact parent ids.
- School and cluster filters for users below PowerUser are application checks, not database row-level security policies in this repository.
- IIS Express config committed under `.vs/INDE-2` points at another project's directories on a developer machine.

## Development and testing

`INDE-4/ReadME.txt` is the only setup document. It lists DLL repairs for the library and for "all projects", including codes INDE-3 and INDE-7 that are not in the project table at the top of the same file. It does not give a URL, a database publish order, or an INDE-4-specific step beyond the project name.

Publish profile `App_Data/PublishProfiles/INDE-4.pubxml` publishes to a Dropbox folder under a developer profile: `...\publish\INDE-4`. The profile also includes an `INDE-1.pubxml` and a `PaletteOne.pubxml` in the same website. Provenance: **Inferred** leftover profiles from the shared website copy.

`.vs/INDE-2/config/applicationhost.config` defines sites whose physical paths are under `C:\DEV work\NEW_IEB\INDE-2\...`:

| Path | Binding observed |
|---|---|
| `service` | `*:58913:localhost` |
| `core-dev` | `*:17901:localhost` |
| `core_custom\INDE-2` | `*:60629:localhost` |

There is no `applicationhost.config` site whose physical path ends in `core_custom\INDE-4`. The INDE-4 `WebAddy` port is `21552`, which is not one of those bindings.

No `[Test]`, `[Fact]`, or `TestMethod` attribute was found in the paths git could search. Long paths under `packages/` were skipped by the working tree.

## Sonar and pipeline

`INDE-4/bitbucket-pipelines.yml`:

- Runs on branches `main` and `develop`, and on all pull requests.
- Single step, "SonarQube analysis", image `maven:3.8.3-jdk-11`, size `8x`.
- Pipe `sonarsource/sonarqube-scan:3.0.2`.
- Clone depth 50.
- Extra args force embedded Java, a 4 GB JVM, exclusions for `*.test.js`, `node_modules`, and `vendor`, sources `.`, and `sonar.projectKey=my-project`.

`INDE-4/sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189` and nothing else. The pipeline extra arg overrides the key when both are passed. **Requires Confirmation** which key the SonarQube server expects.

There is no compile step, no test step, and no deploy step. The remote had no `develop` branch at inspection.

Both `.gitignore` files are the generic Bitbucket template (Node, Java, Python, Maven, JetBrains, media). They do not ignore `.vs`, `Web.config`, or `packages/`.

## Source layout note for agents

Prefer `git grep` and `git cat-file` over a full working-tree walk. Nested folder names (`Evolution Software Unified Framework` twice, plus long NuGet paths) hit Windows `MAX_PATH` even when `core.longpaths` is set for checkout.

The product behaviour that is specific to this site is in `core_custom/INDE-4/controls/surface_custom/*` inside `Custom Include` regions, plus `Web.config`, `ReadME.txt`, and `App_Code`. The rest of the tree is the shared framework and other customers' SQL scripts.

## Discrepancies to review

| Topic | What the tree shows |
|---|---|
| Product name | Readme: Docs. Custom UI: schools, clusters, a document-library uploader, a discussion-forum field. |
| User table | Readme: INDE-2 user table. Config: `Framework_INDE-4_Demo`. Code: `pal_User` by setup customer code. |
| Website title | `IEB (INDE-4 Local)` and `IEB CRM` are both `website` keys. |
| Working copy origin | Build outputs and IIS Express config point at `INDE-2` directories, while the website project folder is `INDE-4`. |
| Sonar project key | Pipeline `my-project` versus properties file `overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`. |
| Scan file | `sonarqube_scan.bat` was reported on the scan host and is not in git. |
| SQL scripts | No `INDE-4` script folder. `INDE-2` scripts are present. |
| Examination and billing modules | Compiled into the site folder. No custom surface under `surface_custom` hosts an examination form. |