# Technical documentation — ieb-inde-5

Evidence date: 2026-10-12. Inspected revision: `main` at `c854df0` (`92789a4` is the parent, "Initial commit", same day).

Credential values, tokens, and passwords are omitted on purpose. They are present in `core_custom/INDE-5/Web.config`.

## Repository layout

```text
.gitignore
INDE-5/
  .gitignore
  .vs/                          IIS Express config, including a site named INDE-5
  bitbucket-pipelines.yml
  sonar-project.properties
  ReadME.txt
  Evolution Software Unified Framework/
    Evolution Software Unified Framework/
      EvolutionSoftwareUnifiedFramework.sln
      INDE-5.sln
      business/                 class library
      library/                  class library
      service/                  WCF website
      core/                     website, session timeout 60
      core-dev/                 website, session timeout 60
      core_custom/INDE-5/       the INDE-5 website
      mobile/
      tools/constructor/
      tools/scheduler/
      data/                     SQL project; Scripts has no INDE-5 folder
      packages/
      components/
      release/
      SchedulerTool/
```

The scan that opened OVER-149 listed `sonarqube_scan.bat` beside `INDE-5`. It is not in this commit.

## Application structure

`INDE-5.sln` is a Visual Studio solution with:

| Project | Kind | Path |
|---|---|---|
| business | class library | `business/business.csproj` |
| library | class library | `library/library.csproj` |
| service | website | `service` |
| core-dev | website | `core-dev` |
| core | website | `http://localhost:45935` in the solution entry |
| constructor | class library | `tools/constructor` |
| scheduler | class library | `tools/scheduler` |
| INDE-5 | website | `core_custom/INDE-5` |

The INDE-5 site is an ASP.NET Web Site (App_Code compilation), not a web application project. `website.publishproj` is present. `Web.config` compiles C# with language version 6 via `Microsoft.CodeDom.Providers.DotNetCompilerPlatform` 3.6.0.

Target framework on the website and on `packages.config` is **.NET Framework 4.5**. `pages controlRenderingCompatibilityVersion` is `4.0`.

## Frameworks and libraries

From `core_custom/INDE-5/packages.config` and `Web.config`:

| Package | Version in packages.config |
|---|---|
| Microsoft.AspNet.Mvc | 5.2.7 |
| Microsoft.AspNet.WebApi (+ Client, Core, Owin, WebHost) | 5.2.7 |
| Microsoft.AspNet.Razor / WebPages | 3.2.7 |
| Microsoft.CodeDom.Providers.DotNetCompilerPlatform | 3.6.0 |
| Microsoft.Net.Compilers | 1.0.0 (development dependency) |
| Microsoft.Owin | 2.0.2 |
| Newtonsoft.Json | 11.0.1 |
| Owin | 1.0 |
| SharpZipLib | 1.3.2 |
| System.Net.Http | 4.3.4 |

`Web.config` redirects Newtonsoft.Json to 13.0.0.0, and MVC / WebPages / Helpers to the 3.x or 5.2.7 versions. The package list and the binding redirect for JSON do not match. **Unknown / Requires Confirmation** which JSON assembly is deployed.

`ReadME.txt` says every INDE project must re-add `AjaxControlToolkit.dll`, `Telerik.Web.UI.dll`, and `ICSharpCode.SharpZipLib.dll` from a `components` folder, and reinstall `Microsoft.CodeDom.Providers.DotNetCompilerPlatform`. The INDE-1 steps also mention `EPPlus.dll` and `NReco.VideoConverter.dll`. Those steps are written for the family, not proven as a build script.

Telerik handlers are registered for dialogs, web resources, spell check, and upload progress.

UI script `js/datatables.min.js` is in the site. A false search hit on "INDE-5" inside that minified file is font data, not product code.

## Website shape

Public and admin pages in `core_custom/INDE-5` include `Default.aspx`, `Canvas.aspx`, `Admin.aspx`, `Admin_SignIn.aspx`, `Reset.aspx`, `Error.aspx`, `Search.aspx`, `Products.aspx`, `Cart.aspx`, `Media.aspx`, `Unsubscribe.aspx`, `WebMethods.ashx`, and `SessionHeartbeat.ashx`.

Masters: `Core.master`, `Administration.master`.

CPS-specific UI is not a set of standalone pages. It is generated surface controls:

`controls/surface_custom/{ClusterInformation,ClusterLevels,ClusterMeetings,ClusterMembers,ClusterResources,CollaborativeProblemSolvingTeams,SchoolAffiliations,SchoolContacts,Schools,SubjectManagement}_{form,grid,view}.ascx`

Each `*_form.ascx.cs` is on the order of 1.4 million characters. Most of that file is generated field binding. Handwritten behaviour is in regions marked `//*** Custom Include ***//`, and in `PerformCustomSaveAddOn` / `PerformCustomPopulateAddOn`.

Typed row classes live in `App_Code/objects/`. Rocket.Chat lives in `App_Code/rocketChat/`. Exam mail lives in `App_Code/classes/examHandler.cs` and `examNums.cs`.

## Data

There is no `data/Scripts/INDE-5` directory. The SQL project under `data` does contain script folders for other codes, including `INDE-1`, `INDE-2`, and `INDE-6`. Those scripts were not treated as the INDE-5 schema.

Published surface rows are written with the `publ_` prefix. Framework users use the `pal_` prefix (`pal_User` appears in the cluster picklist SQL).

Active connection, from app setting `conn`:

- Catalog: `Framework_INDE-5_Demo`
- A host is set. It is omitted here.
- SQL authentication. User and password omitted.

Commented alternative: local data source, integrated security, catalog `Framework_INDE-5`. The comment says to rename `connLive` to `conn` to point at live. The commented keys are both local integrated security, one named `connLive` and one named `conn`. There is no separate uncommented production connection string. **Unknown / Requires Confirmation** what production uses.

Hardcoded surface ids in cluster code: `3048` resources, `3046` members button, `3076` meetings button. These ids are primary keys in the framework surface table, not in git.

CPS team grid and the profile update run SQL with concatenated email and telephone values (`RunCustomQuery` and the grid filter). That is the implementation. It is not parameterised in the lines that were read.

## Auth

Framework users are `oUser` rows. Passwords are encrypted with the framework `encryption` helper. The passphrase is a string literal in the website code (team import, cluster import, master page, and `RocketChatHelper`). The literal is omitted here. The decrypted password is sent to Rocket.Chat and is compared with the old-password box on the master page.

`RocketChatLogin` sends the user's email and the decrypted password to `login` on Rocket.Chat. Website users and users at or above PowerUser share that call. Session key `RocketChatData` stores the returned user id and auth token.

No captcha, OAuth, or ASP.NET membership provider was found in the INDE-5 `Web.config`. `core/Web.config` sets anonymous identification and a 60-minute session. The INDE-5 `Web.config` sets neither. Deployed session timeout is **Unknown / Requires Confirmation**.

`Admin_SignIn.aspx` exists. The sign-in implementation is the shared framework page. This inspection did not re-document the generic login query.

## Integrations

### Rocket.Chat

Base URL app setting `RocketChatServerURL`: `https://chat.ieb.co.za`.

Calls in `RocketChatHelper.MakeRequest`: `login`, `logout`, `users.info`, `users.create`, `users.list`, `users.update`, `groups.create`, `groups.info`, `groups.kick`, `groups.invite`.

Admin calls send the admin id and token from app settings. User login does not. Values omitted.

Moderator username, email, and password are app settings. The username is added to every new group. The moderator password was not read as being used by `RCCreateGroup`.

`RocketChatSelfAuth` is `true`.

### Mail

SMTP host `smtp.evolutionsoftware.co.za`, port 25, from `mailer@evolutionsoftware.co.za`. Network user and password omitted.

App settings: `from` = `no-reply@evolutionsoftware.co.za`; `support`, `admin`, `cc`, and `bcc` = `graham@evolutionsoftware.co.za`. Subject pattern key: `IEB (INDE-5 Local) - {content}`. A second `website` value is `IEB CRM`.

`WebAddy` is `http://localhost:3083`. Exam templates rewrite image sources and `{WebAddress}` with that value.

### WCF and SMS

| Name | Address | Binding |
|---|---|---|
| `Iframework_service` | `http://localhost:58913/framework_service.svc` | wsHttpBinding, security mode `None`, send timeout 10 minutes, max received message size `int.MaxValue` |
| `Iframework_serviceLive` | `http://service.ieb.co.za/framework_service.svc` | Same binding |
| `sendeasy_service` | `http://sms.netgen.co.za/SMS_V2.asmx` | basicHttpBinding |

Which endpoint the library calls for a given action was not traced in this pass. **Unknown / Requires Confirmation** for runtime selection. SMS credentials are app settings `smsU` and `smsP`. Values omitted.

### Other configured endpoints

- MediSwitch QA hosts under `Mediswitch.Gateway`, `Gateway1`, and `Gateway2`. Live hosts are commented. `MediSwitchResponses` = `0`.
- Country services on `webservicex.net`. `getCountriesFromWebService` = `0`.
- `App_Code/MediSwitch.cs` and `App_Code/Loyalty.cs` are present. `loyaltyEmail` = `0`.

## Background work

`tools/scheduler` and `SchedulerTool` are in the tree. A search of `tools/scheduler` found no `INDE-5` or `CPS` string. No queue, hangfire, or Windows service definition was identified for this site. **Unknown** whether a scheduler process is deployed with INDE-5.

## Storage

Surface uploads use `~/upload/data/` and `~/upload/temp/` (admin export and child import). Cluster and team document fields are string columns on the published objects (file metadata or paths stored by the generated control). The binary store for those controls was not opened. **Unknown** beyond the upload folders named above.

`httpRuntime maxRequestLength` is `10048` KB.

JSON max length for script services is `50000000`.

## Security notes (observation, not a remediation plan)

These are facts about the tree. Values are not repeated.

- Database, SMTP, SMS, and Rocket.Chat admin and moderator secrets are committed in `Web.config`.
- The password encryption passphrase is a source literal.
- WCF client security mode is `None`.
- `compilation debug="true"`.
- Several SQL statements concatenate emails, names, and telephone numbers.
- Rocket.Chat login logs the response body through `exception.HandleException`.
- Team and school filters for website users are application filters, not database row-level security policies in this repository.

## Environments and local run

`ReadME.txt` is the only setup document. It tells a developer to restore DLLs and reinstall the CodeDom package. It does not give a URL, a database publish order, or an INDE-5-specific step.

`.vs/.../applicationhost.config` defines a site named `INDE-5` whose physical path is `C:\DEV work\NEW_IEB\INDE-5\Evolution Software Unified Framework\Evolution Software Unified Framework\core_custom\INDE-5`. That is a machine path from the working copy that was committed. It is not a deployment manifest.

`WebAddy` `http://localhost:3083` is the address exam and template code will embed. It is not evidence of a shared environment.

No `appsettings` transform was read as selecting production. `Web.Debug.config` exists. Its effect was not compared line by line. **Unknown / Requires Confirmation** how release publish changes the connection string.

## Build, CI, and quality

`INDE-5/bitbucket-pipelines.yml`:

- Runs on branches `main` and `develop`, and on all pull requests.
- Single step, "SonarQube analysis", image `maven:3.8.3-jdk-11`, size `8x`.
- Pipe `sonarsource/sonarqube-scan:3.0.2`.
- Clone depth 50.
- Extra args force embedded Java, a 4 GB JVM, exclusions for `*.test.js`, `node_modules`, and `vendor`, sources `.`, and `sonar.projectKey=my-project`.

`INDE-5/sonar-project.properties` sets `sonar.projectKey=overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189` and nothing else. The pipeline extra arg overrides the key when both are passed. **Requires Confirmation** which key the SonarQube server expects.

There is no compile step, no test step, and no deploy step. No automated test attributes were found in the framework tree.

The root `.gitignore` is a generic template (Node, Java, Python, Maven, JetBrains, media). It does not ignore `.vs` or `Web.config`.

## Monitoring

No application-insights, health-check, or log-sink configuration was found for INDE-5. Failures in the custom surface methods call `exception.HandleException` and then `Response.Redirect("/error")`. The storage of those exceptions is the framework `exception` type. **Unknown** where that writes.

## Development and testing process

Not documented beyond the readme DLL steps and the SonarQube pipeline. No test project, no seed for `Framework_INDE-5`, and no INDE-5 migration folder.

## Discrepancies to review

| Topic | What the tree shows |
|---|---|
| Sonar project key | Pipeline says `my-project`. Properties file says `overdrive_ieb_8345eef9-efa7-4cfa-bc4a-5a046ec95189`. |
| Site title | `website` is set twice: `IEB (INDE-5 Local)` and `IEB CRM`. |
| JSON version | Package 11.0.1 versus binding redirect 13.0.0.0. |
| Chat username | Import and `GetUsername` prefix the team code. `UpdateGroupMembers` does not. |
| Power-user chat login | Comment says moderator account. Code uses the user's email. |
| SQL scripts | Other INDE codes have `data/Scripts` folders. INDE-5 does not. |
| Session timeout | 60 minutes on `core` and `core-dev`. Unset on the INDE-5 website config. |
| Discovery file | `sonarqube_scan.bat` was reported at task creation and is not in git. |
| Secrets in git | Connection string, SMTP, SMS, and Rocket.Chat secrets are committed. |