# Project plan — legitimate_licences

Evidence date: 2026-10-10.

Source repository: `git@bitbucket.org:overdrive/legitimate_licences.git`.

Inspected revision: `main` at `707aa72` (2024-11-24 08:29:50 +0200, "first commit"). After a depth-1 clone, that commit is the only commit on `main`. `origin/HEAD` points at `main`. No other remote branches were present.

No `silicon_ark/legitimate_licences/` directory existed before these files.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The Bitbucket repository is named **legitimate_licences**. The membership, role, and profile providers in `Neo.LegitimateLicences.Web/Web.config` set `applicationName` to **Neo Legitimate**. The user-administration screen title is **Legitimate Licences Administration** (`Views/UserConsole/Console.cshtml`).

**Documented** in the embedded script `Neo.LegitimateLicences.Web/DBUp/Scripts/2023/2205-EmailSenderUpdate-Legitimate.sql`:

- Division type 1 is **Provincial Regulatory Entity** (PRE).
- Division type 2 is **National Public Transport Regulator** (NPTR).
- Division type 3 is left as the literal **TAT**. What TAT expands to is **Unknown / Requires Confirmation**.

The same script, print templates, and payment-advice drawing refer to the KwaZulu-Natal Provincial Regulatory Entity and to the National Public Transport Regulator. **Inferred** from application types, operating-licence printing, gazettes, and adjudication: the product records public-transport operating-licence and accreditation work for those authorities, including applications that originated in earlier systems named in code as NTLIS, LTPS, OLAS, and Legitimate.

There is no README, PRD, or product statement in this revision.

## Where the tree was read

| Location | What it is |
|---|---|
| Issue path `~/projects/sonar_scan/repos/legitimate_licences` | Recorded on OVER-185 at task creation (2026-09-28). That path is not on this machine |
| Fresh clone of `origin/main` at `707aa72` | The tree that was read |

A separate folder named `LegitimateLicences_QA` was found on the inspection machine. It is not a Git checkout. It contains a README, an environment checklist, `docs/EhailingProviders.md`, a `ProvidersRegistry` project, and references to 2025 and 2026 database scripts. None of that e-hailing material is in `707aa72`. Whether that folder is later uncommitted work, a different branch, or a different product line is **Unknown / Requires Confirmation**. It is not treated as the source of truth for this onboarding.

## Branch reality

One commit. Subject is "first commit". There is no longer history in this clone. Whether the tree was exported from a larger Neo Africa codebase is **Inferred** from `RefreshAssembliesFromNeoAfxMaster.bat`, which copies assemblies from `C:\Development\NeoAfrica\Neo.Afx` into a `LegitimateLicences` tree. That path is a developer machine path, not a repository remote.

`azure-pipelines.yml` triggers on branch `master`. The only branch in the clone is `main`. Whether an Azure DevOps pipeline still runs is **Unknown / Requires Confirmation**.

## Scope in this repository

In scope of what is present on `main`:

- ASP.NET MVC 5 web application `Neo.LegitimateLicences.Web` on .NET Framework 4.6.2, hosting many class-library modules.
- Web API `Neo.LegitimateLicences.Api` for verified-data XML, scanning, and printing.
- Windows service `Neo.LegitimateLicences.WinService` that starts an AFX `DatabaseServiceScheduler`.
- Desktop WinForms helper `Neo.LegitimateLicences.Desktop` launched by the custom protocol `legitimatedesktop` for print and scan.
- ActiveX / WinForms print controls for receipts, operating licences, accreditation certificates and decals, payment advice, and temporary replacement licences (target framework 4.0).
- Static content site `Neo.LegitimateLicences.Cdn`.
- Shared framework projects under `Neo.Afx.*` (core, services data, services web, Windows-service workflow/message libraries).
- Entity Framework 6 models against SQL Server database catalog `LegitimateNATIONAL`.
- DbUp runner invoked from `Global.asax.cs` on web startup, with three embedded scripts dated 2023.
- DevExpress 19.1 report handlers.
- Sentry initialisation when `SentryDsn` is set.
- Azure Pipelines YAML that restores NuGet, builds every `*.sln`, web-packages, and runs VSTest.

Out of scope of this revision, or present only outside the Git tree:

- E-hailing app-provider registration, certificate types 60/61/62, and `ProvidersRegistry`. Those exist in the local non-Git folder described above, not in `707aa72`.
- A product README or environment runbook inside the Git revision.
- Automated test projects. No `[Test]`, NUnit, or xUnit attributes were found.

## Major components

| Component | Role |
|---|---|
| `Neo.LegitimateLicences.Web` | Authenticated MVC shell, views, `Web.config`, DbUp, Sentry |
| Module libraries (`Applications`, `OperatingLicences`, `Accreditations`, `Associations`, `Members`, `Routes`, `Vehicles`, `Admin`, `Stationery`, `Dashboards`, `InterDepartment`, `Purifaction`, and others) | Feature controllers and models compiled into the web app |
| Console libraries (`*Console`) | Detail screens for one record (application, gazette, adjudication, licence, member, and so on) |
| Workflow request libraries (`ApplicationRequest`, `LicenceIssueRequest`, `NewRouteRequest`, `MDApprovalRequest`, cancel requests, `BusinessRuleBypassRequest`) | Capture forms tied to AFX workflows |
| `Neo.LegitimateLicences.Data` | EF models and stored-procedure wrappers. Schemas seen in `LegitimateDataModel.edmx`: `App`, `Audit`, `Crm`, `Doc`, `Md`, `Purification`, `System`, `Verified` |
| `Neo.Afx.Services.*` and `Neo.Afx.Core` | Workflow, documents, comments, correspondence, audit, security, queries, forms |
| `Neo.Afx.Services.Web` plus `Deploy/NeoAfxSharedAssemblies/AfxServices/*.svc` | WCF-style AFX service endpoints (workflow, query, notifications, integration, correspondence, document, comment, audit) |
| `Neo.LegitimateLicences.Api` | HTTP API used by the desktop client |
| `Neo.LegitimateLicences.WinService` and `SystemTriggers` | Background scheduler; dequeued triggers push verification tasks to SignalR |
| `Neo.LegitimateLicences.Desktop` and `ActiveX.Printing` | Local printing and scanning |
| `Neo.LegitimateLicences.Cdn` | Static CSS/JS, including a vendored SweetAlert2 tree |
| `Neo.LegitimateLicences.Reports` | DevExpress reports (.NET Framework 4.5.2) |
| `Assemblies` and `RefreshAssembliesFromNeoAfxMaster.bat` | Prebuilt AFX binaries and a machine-local refresh script |

Solution files at the repository root:

- `Neo.LegitimateLicences.Web.sln` — web shell, modules, consoles, workflows, AFX libraries.
- `Neo.LegitimateLicences.Api.sln`
- `Neo.LegitimateLicences.WinService.sln`
- `Neo.LegitimateLicences.ActiveX.sln`

Nested solution files also exist under `Cdn`, `Desktop`, and `Verifier`.

## Implementation plan as visible in the tree

There is no milestone document. The only dated implementation evidence inside the repo is:

| Evidence | Date | What it shows |
|---|---|---|
| Git commit `707aa72` | 2024-11-24 | Entire tree committed once, message "first commit" |
| `DBUp/Scripts/2023/` | Folder name 2023 | Three SQL scripts: office-location view, workflow task action, and a large email/SMS sender update whose resource name contains "Legitimate" |
| `azure-pipelines.yml` | Undated | Build-and-test pipeline aimed at branch `master` |

**Inferred** status: the product is a long-lived line-of-business system snapshotted into Bitbucket, not a greenfield project with a forward plan in this repository.

## Known dependencies

- .NET Framework 4.6.2 for most projects; 4.5.2 for Reports; 4.0 for ActiveX printing and some AFX Windows-service libraries.
- SQL Server database `LegitimateNATIONAL` (catalog name in connection strings).
- Entity Framework 6.2.0, ASP.NET MVC 5.2.7, SignalR 2.2.1, OWIN 2.1, DbUp 5.0.8, Sentry 3.33.1, Newtonsoft.Json 11 (binding redirect).
- DevExpress Web 19.1 report designer/viewer handlers.
- WebSupergoo PDF key setting name `WebsupergooPdfKey_DisabledOnTest` (value not reproduced here).
- DigitalPersona fingerprint library `DPUruNet`, used only when `FingerprintAuthenticationEnabled` is true. The committed value is `false`.
- AFX assemblies expected from `Assemblies` and from the developer path in the refresh batch file.
- IIS is **Inferred** as the host because the web and API projects are ASP.NET Framework applications with `Web.config`. No IIS site definition is in the repo.
- Windows Service install artefacts live under `WIndowServiceInstall` (spelling as in the tree). `install.bat` registers the exe with `installutil` from `C:\Installs\LegitimateLicense\`. The same folder contains `Interop.Clickatell.dll`.

Connection strings commit a SQL login and password. Those secrets are not copied into Silicon Ark.

## Current project status

**Implemented** in `707aa72`: a multi-module operating-licence case system covering applications, payment and cash-up, verification, gazetting, adjudication, inspections and referrals, issuing, accreditations, associations, members, routes, vehicles, stationery, purification, business-rule bypass, MD approval, licence and accreditation cancellation, inter-department release of pending TAT applications, dashboards, and reports.

**Not in this revision:** e-hailing provider registration and any documentation that exists only in the local non-Git folder.

**Unknown / Requires Confirmation:**

- Whether `main` is still the production codebase or a Sonar snapshot that stopped at the first commit.
- The legal customer (department versus a specific province) and whether KZN-hardcoded print text is the only production board.
- What TAT means.
- Whether Azure Pipelines, Sentry, fingerprint login, and the desktop protocol are used in production.
- The numeric values of system settings such as `GazettePeriodDays`, `RenewalGracePeriod`, and `UpliftmentNotificationDays`. The code reads them from `System.Settings`. The values are not in this repository.