# Project plan — legitimate

Evidence date: 2026-10-10.

Source repository: `git@bitbucket.org:overdrive/legitimate.git`.

Inspected revision: `main` at `0a9b1c8` (2026-02-11 11:12:35 +0200, "#17_LGKZN system unable to send emails", Renier van Rooyen). `origin/HEAD` is `main`.

No `silicon_ark/legitimate/` directory existed before these files.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The Bitbucket repository is named **legitimate**. The ASP.NET membership provider sets `applicationName` to **Neo Legitimate**. Recent commits are titled for **LGKZN** / **KZN**.

**Inferred** from application types, operating-licence issuing, gazettes, adjudication, and the source-system enums: staff of a KwaZulu-Natal transport authority use this system to receive, pay, verify, gazette, adjudicate, and issue public-transport operating licences, and to keep the related associations, members, vehicles, and routes.

Source applications named in `Neo.Legitimate.Common/Enums.cs`:

| Id | Name |
|---|---|
| 1 | NTLIS |
| 2 | LTPS |
| 3 | Legitimate |

There is no README, PRD, or product statement in this revision. A written expansion of NTLIS, LTPS, OLAS, and NLTA was not found. The e-hailing SQL script cites "section 62(c) NLTA" inside a document-type description.

This repository is not `legitimate_licences`. That sibling uses the `Neo.LegitimateLicences.*` namespace. This tree uses `Neo.Legitimate.*`.

## Where the tree was read

| Location | What it is |
|---|---|
| Issue path `~/projects/sonar_scan/repos/legitimate` | Recorded on OVER-184 at task creation (2026-09-28). That path is not on this machine |
| Clone of `origin/main` at `0a9b1c8` | The tree that was read |

The task-creation scan recorded last commit `7c6f17e` (2026-01-20). `main` has since moved to `0a9b1c8` (2026-02-11).

A folder `LegitimateLicences_QA` exists on the inspection machine. It belongs to the licences product line, not to this repository, and was not used as evidence.

One generated service-reference file under `AffectedApplicationDocumentScanner/Connected Services/` could not be written on Windows because the path is too long. It is a designer artifact. Product evidence below comes from projects that did check out.

## Branch reality

Reachable history on `main` in this clone is 13 commits. It starts with two import commits (`07c0334` "Initial commit" and `b4a6142` "initial commit") and then the KZN changes below. History before that import is not in this repository.

| Commit | Date | Subject |
|---|---|---|
| `0a9b1c8` | 2026-02-11 | #17_LGKZN system unable to send emails |
| `7c6f17e` | 2026-01-20 | #13_adjudication agendas when an agenda is finalized disabled "Remove Application" button |
| `6386dcd` | 2025-11-21 | #10_E_HAILING |
| `37765b1` | 2025-11-19 | #7_25,000+ list / pagination |
| `9e15893` | 2025-11-18 | #10_E_HAILING service type dropdown |
| `112a7b1`, `0ac4aef` | 2025-11 | #3 duplicate and convert Meter Taxi service to E-Hailing |
| `be5879f`, `8fa1d50` | — | Search updated to use a base URL instead of a hard-coded URL |
| `b1c576e` | — | #145 hearing agendas changed from 3 panel members to 2 |
| `c3ef5ef` | — | Vehicle registration number optional for unscheduled vehicles |

No release tags were inspected. Other remote branches were not compared. Whether a pipeline builds this repository is **Unknown / Requires Confirmation**. No `azure-pipelines.yml` or similar CI file was found at the repository root.

## Objectives (inferred from the application, not from a written plan)

No project plan exists in the repository. The following are **Inferred**:

- Capture operating-licence applications, including combined types (renewal plus transfer, COV, carrying-capacity change, and similar).
- Take payment, cash up, and print receipts.
- Verify applications, associations, members, routes, and vehicles, including a live verification queue.
- Publish gazettes and run adjudication hearings and in-committee meetings.
- Issue, extend, suspend, archive, and report on operating licences.
- Purify data that originated in NTLIS, LTPS, and OLAS.
- Support e-hailing as its own mode and service type, distinct from metered taxi and charter.
- Expose ASMX search services so another system can look up applications and association master data with a shared interface key.

## Scope

### In this repository

- ASP.NET MVC web application `Neo.Legitimate.Web` (.NET Framework 4.6.2).
- Module and console projects for applications, associations, members, routes, vehicles, operating licences, gazette, adjudication, inspection, verification, integration, users, and admin.
- Workflow request projects: application, new route, new association, new member, new vehicle, licence issue, licence upliftment extension.
- ASMX web services: `Neo.Legitimate.NLTISWebService`, `Neo.Legitimate.LTPSWebService`, `Neo.Legitimate.LegitimateWebService`.
- Windows service `Neo.Legitimate.WinService` plus system-trigger and extension projects.
- SQL change scripts under `DbScripts/` and `_database schema changes/`.
- SSRS project `Neo.Legitimate.ServerReports`.
- Printing project and a printing test app.
- WinForms scanner `AffectedApplicationDocumentScanner`.
- InstallShield-style setup projects for a client and the Windows service.
- Checked-in Pilotfish Afx XML documentation and ActiveX `.reg` files. The Afx source is not in this repository.

### Out of this repository

- Pilotfish / Neo Afx framework source (`Pilotfish.Afx.*` assemblies).
- The Messages worker that sends SMTP. The Windows service comment names it and gives SendGrid as an example. Its implementation is in the Afx scheduler, not in this tree.
- Production IIS sites, production connection strings, and the live contents of workflow templates, roles, and lookup tables.
- The `legitimate_licences` product.

## System shape

```text
Browser (staff)
  -> Neo.Legitimate.Web  (MVC 4, forms auth, Knockout consoles)
       -> SQL Server catalogs named in config
       -> Pilotfish Afx services (workflow, documents, audit, correspondence, queries)
       -> SignalR MessageHub  (/signalr)

Neo.Legitimate.WinService
  -> Afx DatabaseServiceScheduler
  -> SystemTriggerHandler pushes new verification tasks to MessageHub
  -> SMTP from the Afx Messages worker (TLS 1.2 forced in this repo)

ASMX
  NLTISInterface / LTPSInterface / LegitimateInterface
  -> stored procedures, interface key

WinForms scanner -> AffectedApplicationService
```

Workflow step definitions are loaded from the database (`WorkflowsDatabase.GetActiveWorkflowTemplates`). They are not defined as XAML in this tree.

## Major components

| Area | Projects | Role |
|---|---|---|
| Web host | `Neo.Legitimate.Web` | Login, home, reports, error, Afx `.svc` endpoints, SignalR, the views staff open |
| Applications | `Neo.Legitimate.Applications`, `Neo.Legitimate.ApplicationRequest` | Application lists, receipts, cash-up, purification, gazette and adjudication entry points, the application form |
| Operating licences | `Neo.Legitimate.OperatingLicences`, `OperatingLicenseConsole`, `LicenceIssueRequest`, `LicenceUpliftmentExtensionRequest` | Status, issue, inspection, expiry, extension, purification |
| Parties and network | Associations, Members, Routes, Vehicles and their consoles, plus the four "new * request" projects | Master data and verification requests |
| Hearings and notices | `GazetteConsole`, `AdjudicationConsole`, `InspectionConsole`, `VerificationConsole`, `BulkVehicleVerificationConsole` | Gazette, panel, inspection, verification queue |
| Integration | `NLTISWebService`, `LTPSWebService`, `LegitimateWebService`, `IntegrationConsole` | Outbound XML search |
| Platform | `Neo.Legitimate.Common`, `Neo.Legitimate.Data`, `Neo.Legitimate.Admin`, `UserConsole` | Enums, helpers, EF models, users |
| Operations | `WinService`, `SystemTriggers`, `WinService.Extensions`, `Printing`, `ServerReports`, setup projects, document scanner | Background work, print, reports, install, scan |

Solution folders in `Neo.Legitimate.sln` are Web, Projects, Workflows, Modules, Consoles, Common, Database, and Reports. Two other solution files exist: `Neo.Legitimate.LegitimateWebService.sln` and `Neo.Legitimate.WinService.sln`.

## Implementation record

There is no milestone plan in the repository. The commits after the import are the only dated implementation record:

1. Import of the Neo Legitimate tree.
2. Unscheduled vehicle registration no longer required by the pre-check that used to demand it (`c3ef5ef`; the check is commented out in `Default-Events.cshtml`).
3. Adjudication hearing quorum reduced to two panel members (`b1c576e`, still visible in `AdjudicationConsole/Panel.cshtml`).
4. Search URLs taken from `BaseUrl` instead of a hard-coded host.
5. E-hailing mode and service type, documents, and questions (`DbScripts/01` through `07`, enum `Mode.EHailing` and `ServiceType.EHailing`).
6. Pagination for large lists (`37765b1`).
7. Remove Application hidden once an adjudication agenda is no longer in "awaiting finalisation" or "awaiting quorum" (`Applications.cshtml`).
8. Windows service forces TLS 1.2 before the scheduler starts, with a comment that the Messages worker uses SMTP (`0a9b1c8`).

## Dependencies known from the tree

- .NET Framework 4.6.2, ASP.NET MVC 4.0, Razor 2, Entity Framework 6.1.3, SQL Server.
- Pilotfish Afx (`Pilotfish.Afx.Core`, `Pilotfish.Afx.Security`, `Pilotfish.Afx.Services.*`).
- SignalR 2.2.1, OWIN, jQuery 1.6.4, Newtonsoft.Json 6.0.8, DocX 1.1.0, Sentry 1.2.0.
- ActiveX registration scripts for printing, a fingerprint reader, and a document scanner.
- A PDF component key is present in `Web.config` and is not copied here.

## Current status

**Implemented** and changed through 2026-02-11 on `main`. The checked-in web `BaseUrl` is `http://localhost:8100`. Whether that is only a developer default is **Unknown / Requires Confirmation**.

Checked-in database names do not match each other:

| File | Catalog named |
|---|---|
| `Neo.Legitimate.Web/Web.config` | `LegitimateKZN_QA`, and `Legitimate_LTPS` for `LtpsEntities` |
| `Neo.Legitimate.LegitimateWebService/Web.config` | `LegitimateKZN` and `Legitimate_OLAS` |
| `DbScripts/*.sql` and the e-hailing script | `LegitimateKZN_QA_SO` |

Which catalog production uses is **Unknown / Requires Confirmation**.

## Human confirmation

- Confirm this repository is the KZN Provincial Regulatory Entity system, and how it should be named beside `legitimate_licences`.
- Confirm which SQL catalog is production, QA, and the Softline / SO copy (`LegitimateKZN`, `LegitimateKZN_QA`, `LegitimateKZN_QA_SO`).
- Confirm whether metered-taxi "Is Uber application?" should remain now that e-hailing is its own mode.
- Confirm application request type ids 30 and 31. SQL references them. `ApplicationRequestType` in `Enums.cs` stops at 28.
- Confirm the e-hailing document script was meant to attach documents to application types 1, 2, 3, 4, 5, 6, 7, 8, 9, 13, and 30 for workflow 1, with `IsMandatory = 0`, rather than only to e-hailing mode.
- Confirm duplicate securable ids in `Enums.cs` (`1023` used twice, `2012` used for both licence print and route purification).
- Confirm the client-side mode/service-type lists in `ModeDetails.cshtml` against `App.Fn_AllowedServiceTypesForMode`. They do not match for midibus, and the script has no e-hailing mode list.
- Rotate credentials, the ASMX interface key, the Sentry DSN, and the PDF key that are stored in committed config. Values are omitted from Silicon Ark on purpose.
- Confirm whether workflow templates, notice periods, and fees in the database are still the approved business rules. This repository does not contain those rows.