# Technical documentation — quantivia-clean

Evidence date: 2026-10-05.

Source: `git@bitbucket.org:overdrive/quantivia-clean.git`, inspected at `master` `808df0f` ("Demo site backup"). Credential secrets present in committed PHP config are **not** repeated here.

## Summary

`quantivia-clean` is a frozen **Windows IIS demo backup** of an **eGroupWare 1.8.004** installation hosting the Procon8 **Quantivia** deliverable progress and performance application, plus standard EGW apps and several ATE custom trackers. Quantivia is intentionally **not** a registered eGroupWare application; it is a sibling PHP app that consumes EGW session cookies and account/group tables while storing project data in a second MySQL database.

Related Silicon Ark trees: `quantiviaLive/`, `quantivia-svn/`.

## Repository facts

| Item | Value |
|---|---|
| Remote | `bitbucket.org/overdrive/quantivia-clean` |
| Default branch | `master` (`origin/HEAD`) |
| Inspected tip | `808df0f` (2019-06-12) |
| Other branch | `development` @ `0a43174` (3 commits ahead; QA-oriented) |
| Commits on `master` | 2 |
| Root README | Title only |
| Approx. scale | Large PHP tree (thousands of files; eGroupWare + Quantivia + vendors) |

## Runtime stack

| Layer | Detail | Evidence |
|---|---|---|
| Language | PHP (EGW requires ≥ 5.2, recommends 5.3+) | `setup/inc/class.setup.inc.php` |
| Platform | eGroupWare / PHPGW API 1.8.004 | `phpgwapi/setup/setup.inc.php` |
| Quantivia UI | SmartAdmin + jQuery + charting | `quantivia/main.php`, `quantivia/smartadmin/` |
| Quantivia version strings | settings `1.2.000`; `bo_version` 276 | `quantivia_setings.php`, BO header |
| Web server (this backup) | IIS under `C:\inetpub\wwwroot\demo.quantivia.com` | `header.inc.php` |
| File temp path | `C:\inetpub\temp\demo.quantivia.com` | Quantivia settings |
| Database | MySQL localhost:3306 — EGW `demo`, Quantivia `demodppr` | config files |
| Session handler | `egw_session_files` (configured in header) | `header.inc.php` |
| Linux packaging refs | Apache alias/cron under `doc/rpm-build/` | Documented packaging only |
| Docker / nginx | Not present | Observed absence |
| CI | No root Bitbucket Pipelines file observed in this pass | Observed |

## Application structure

### Root entry points

| File | Role |
|---|---|
| `index.php` | eGroupWare front controller (includes a developer IP debug toggle) |
| `login.php` / `logout.php` | Platform auth |
| `auto_login.php` | Demo-oriented login / auto-session |
| `about.php` | Stock EGW about |
| `groupdav.php` / `webdav.php` | DAV endpoints |
| `json.php` / `rpc.php` / `soap.php` / `xmlrpc.php` / `xajax.php` | RPC transports |
| `header.inc.php` | Live EGW config (demo paths/DB) |
| `header.inc.php.template` | Setup template |
| `functions.php` | Organogram / LDAP helper utilities (not stock EGW core) |

### Quantivia (`quantivia/`)

```text
quantivia/
  main.php                 SmartAdmin shell
  index.php                Session check → main.php
  dashboard/               Dashboard UI
  forms/                   Configuration & wizard forms
  view/                    Progress filing views
  services/                AJAX/JSON/API endpoints (Menu, graphs, qvaapi, …)
  inc/
    class.quantivia_bo.inc.php   Business logic (~12k+ lines)
    class.quantivia_so.inc.php   Data access / SQL
    common_pageSetup.php         Role bootstrap + authz helpers
    worker.php                   Background worker entry
  setup/
    quantivia_setings.php        Runtime DB/path/version config
    sql_construct.php            Base schema constructs
  templates_*/               Client branding packs (18)
  smartadmin/, lib/, jpgraph/, quantiviasqladmin/, …
```

Quantivia self-description (`quantivia/index.php`):

```text
quantivia Module, writen for PROCON8 by Jean Thirion
It is intended to be executed from within the eGroupware foldes, but not as part of eGroupware.
```

### eGroupWare apps (directories present)

`actions`, `addressbook`, `admin`, `bookmarks`, `calendar`, `developer_tools`, `emailadmin`, `etemplate`, `felamimail`, `filemanager`, `home`, `importexport`, `infolog`, `manual`, `ncr`, `news_admin`, `notifications`, `organogram`, `permit`, `phpbrain`, `phpfreechat`, `phpgwapi`, `phpsysinfo`, `polls`, `preferences`, `projectmanager`, `registration`, `resources`, `risk`, `sambaadmin`, `setup`, `sitemgr`, `smt`, `syncml`, `timesheet`, `tracker`, `userfiles`, `wiki`, `womt`, plus `egw-pear`, `doc`, `custom`.

Runtime enablement of each app is stored in the EGW database (`egw_applications`), not in a static repo manifest. Which subset was live on the demo: **Unknown / Requires Confirmation**.

## Request / auth flow

```text
1. User authenticates via login.php or auto_login.php
2. EGW sets session cookies (sessionid, last_loginid)
3. Browser opens quantivia/main.php
4. PHP includes load quantivia_setings.php + BO/SO
5. common_pageSetup.php resolves uid and roles from EGW groups
6. services/Menu.php emits navigation for current p_id / roles
7. Forms/services enforce checkCurrentUserAutherization / requireFullLicence
```

Authorisation helper signature (four role booleans): `checkCurrentUserAutherization($allowSiteAdmin,$allowProjectAdmin,$allowProjectUser,$allowProjectProgressAdmin)`.

## Data architecture

### Two databases

| Database (demo config) | Owner | Contents |
|---|---|---|
| `demo` | eGroupWare | Accounts, ACL, preferences, app tables, sessions metadata |
| `demodppr` | Quantivia | Projects, control points, published values, per-project deliverable tables, logs, offload tasks |

Cross-link: Quantivia stores/uses EGW user ids and group membership (`P_{id}`, `P_{id}_admin`, `P_{id}_p_admin`, `Admins`).

### Quantivia base tables (from `sql_construct.php`)

Including but not limited to: `projects`, `elements`, `config`, `contol_point_defs` (spelling as in schema), `control_points`, `control_point_chains`, `budget_changes`, `published_values`, `offload_tasks`, `logs`, `logs_archive`, `session`, `standard_reports`, `project_calendar`, `view_users`.

### Dynamic tables

Deliverables (and related project-scoped structures) use names such as `p_{project_id}_deliverables`. Full column sets may have evolved beyond `sql_construct.php`; no SQL dump is in the repo.

### EGW core tables

Declared in `phpgwapi/setup/setup.inc.php` (`egw_accounts`, `egw_acl`, `egw_config`, `egw_applications`, …) plus per-app schemas.

## Key services / APIs

| Endpoint area | Path pattern | Notes |
|---|---|---|
| Menu JSON/HTML | `quantivia/services/Menu.php` | Role-aware navigation |
| Chart JSON | `*.json.php` under services | BullsEye, Trend, Pareto, FTE, … |
| Tables/reports | `Table.php`, `ReportTable.php`, … | Tabular data |
| Session | `SessionState.php`, `CurrentUser.php` | Client state |
| External API | `qvaapi.php` | Token validated |
| EGW RPC | `/json.php`, `/xmlrpc.php`, `/soap.php` | Platform |

## Integrations (technical)

| Integration | Mechanism | Config locus |
|---|---|---|
| EGW identity | Direct MySQL to EGW DB | `egw_db_*` in Quantivia settings |
| Mail | EGW FelamiMail + Quantivia HTML email templates | `felamimail/`, `templates_*/templates/` |
| GroupDAV | `groupdav.php` | EGW 1.8 GroupDAV |
| WebDAV | `webdav.php` | filemanager |
| LDAP/AD | Optional EGW auth; organogram helpers | setup templates; `organogram/` |
| CAS / NTLM / HTTP | Optional EGW auth | `login.php` / setup |
| Risk | PHP include of Quantivia BO | `risk/inc/class.risk_bo.inc.php` |
| Embedded SQL admin | phpMyAdmin forks | `quantivia/quantiviasqladmin/` |

Supported Quantivia PDO drivers per settings comment: mysql, mssql, oracle, sybase, sqlite. This backup uses **mysql**.

## Background processing

- `quantivia/inc/worker.php` present.
- `offload_tasks` table in Quantivia schema.
- Linux cron example exists for EGW async jobs: `doc/rpm-build/egroupware.cron`.
- No `QFD/` daemon tree in this repository (unlike some sibling Quantivia repos).
- Actual scheduling on the IIS demo host: **Unknown / Requires Confirmation**.

## Client template packs (present)

`templates_aurecon_01`, `templates_bacs_01`, `templates_bechtel_01`, `templates_bombardier_01`, `templates_ccc_01`, `templates_crrc_01`, `templates_CRTG_EEB_01`, `templates_downer_01`, `templates_echarris_01`, `templates_elevo_01`, `templates_hyder_01`, `templates_mashroat_01`, `templates_mcd_01`, `templates_mmhkt_01`, `templates_parsons_01`, `templates_procon8_01`, `templates_sungard_01`, `templates_wpa_01`.

Which pack is default for a given deployment is configuration/session dependent; demo branding references Procon8/Quantivia in places.

## Security observations (factual)

| Observation | Implication |
|---|---|
| Live demo DB users/passwords committed in `header.inc.php` and `quantivia_setings.php` | Treat as compromised/demo-only; rotate if still valid |
| Header setup admin password hash committed | Same |
| Excel export password in settings | Same |
| `phpinfo.php` / SQL admin tools present in tree | High risk if publicly reachable |
| Demo auto-login can reset demo account passwords | Expected for demo; dangerous if exposed beyond demo |
| Legacy PHP / mcrypt-era patterns | Not suitable for modern hardening expectations without remediation |

No claim is made that these credentials are currently valid.

## Development and testing

| Topic | Finding |
|---|---|
| Automated Quantivia tests | Not found |
| EGW API tests | Some platform tests may exist under EGW trees; not product-grade Quantivia coverage |
| Coding standards | `phpgwapi/doc/coding_standard.txt` (EGW) |
| Local docs | `quantivia/templates_*/user_guide.php`, `setup/doc/`, `doc/` |
| Dependency management | No Composer/npm app manifest for Quantivia core; vendors vendored in-tree |

## Deployment notes

**This backup:**

- OS: Windows
- Web root: `C:\inetpub\wwwroot\demo.quantivia.com`
- Temp: `C:\inetpub\temp\demo.quantivia.com`
- DB: local MySQL

**Alternate packaging (docs only):**

- `doc/rpm-build/apache.conf` — Apache Alias `/egroupware`, PHP settings, GroupDAV redirects
- Debian/RPM packaging metadata under `doc/rpm-build/`

No Dockerfile. No Infrastructure-as-Code for the demo host in-repo.

## Configuration files checklist

| File | Purpose |
|---|---|
| `header.inc.php` | EGW paths, domain DB, session, setup admin |
| `header.inc.php.template` | Regenerable template |
| `quantivia/setup/quantivia_setings.php` | Quantivia PDO + EGW cross-DB + paths + version |
| `setup/` | Installer UI and logic |

There is no `.env` pattern; configuration is PHP arrays/constants.

## Differences vs sibling Quantivia repos (high level)

| Aspect | quantivia-clean (this) | quantiviaLive / quantivia-svn (sibling docs) |
|---|---|---|
| Host config | `demo.quantivia.com` IIS | e.g. `online.quantivia.com` / other paths |
| EGW / Quantivia DB names | `demo` / `demodppr` | Different names in those trees |
| `QFD/` | Absent | Present in sibling docs |
| Git history | Explicit "Demo site backup" | Other import messages |
| Quantivia settings version | `1.2.000` | Differing version strings in sibling docs |

Exact file-level diffs across repos were not computed in this onboarding pass.

## Unknowns requiring confirmation

1. Whether IIS demo host and MySQL instances still exist.
2. Which branch (`master` vs `development`) was last deployed.
3. Enabled EGW application set in the live DB.
4. Licence file / hostname exception mechanism for this tree (no `QFD/`).
5. Production relationship between `quantivia-clean`, `quantiviaLive`, and `quantivia-svn`.
6. Whether Untangle samples under `custom/` should be deleted from knowledge scope.
7. PHP version actually used in 2019 on the demo server.
8. Presence/location of database backups outside git.