# Technical documentation — quantivia-svn

Evidence date: 2026-10-05.

Source: `git@bitbucket.org:overdrive/quantivia-svn.git`, `master` at `ca64fae` (2019-06-12, message "svn update"). Only branch observed: `master`. `origin/HEAD` → `master`.

The scan-host path `~/projects/sonar_scan/repos/quantivia-svn` was not on the machine that produced this document. Facts below come from that git revision. Secret values are omitted. Configuration files that contain credentials are named as risks only.

## Architecture

PHP multi-application tree: **eGroupware 1.8** platform + commercial **Quantivia** module + **QFD** license/worker helpers + ATE custom apps.

```text
Browser
  │
  ├─ login.php / loginextra.php / auto_login.php
  │
  ├─ index.php  ──► eGroupware apps (menuaction = app.class.method)
  │
  ├─ quantivia/main.php  ──► SmartAdmin shell
  │       ├─ forms/*.php
  │       ├─ services/*.php
  │       ├─ dashboard/*.php
  │       └─ templates_*/
  │
  ├─ QFD/*  ──► license bootstrap / ULM
  │
  └─ groupdav.php | webdav.php | json.php | soap.php | xmlrpc.php | xajax.php

MySQL (typical)
  ├─ egw_*          eGroupware
  └─ quantivia DB   projects + p_{id}_* (+ global CP defs/chains)
```

Quantivia business logic is concentrated in:

- `quantivia/inc/class.quantivia_so.inc.php` — PDO data access (extends PDO)
- `quantivia/inc/class.quantivia_bo.inc.php` — business object (`bo_version` 276)
- Supporting: `quantivia_notifier`, change/calendar/operarius classes, crypt/common helpers

## Repository layout (top level)

| Path | What it is |
|---|---|
| `phpgwapi/` | eGroupware API 1.8.004 |
| `quantivia/` | Quantivia product (SmartAdmin UI, BO/SO, templates, workers, bundled libs) |
| `QFD/` | Quantivia Framework Daemon / license installer |
| `setup/` | eGroupware setup UI |
| `admin/`, `preferences/`, `home/`, … | Standard EGW apps |
| `ncr/`, `permit/`, `risk/`, `smt/`, `womt/`, `actions/` | ATE custom trackers |
| `organogram/`, `lab/` | Ancillary utilities |
| `header.inc.php` | Live-style server bootstrap (**contains secrets**) |
| `header.inc.php.template` | Safe template for setup-generated config |
| `Procedures.sql` | Sample/test MySQL procedures |
| `login.php`, `loginextra.php`, `auto_login.php`, `logout.php` | Auth |
| `index.php`, `about.php`, `redirect.php`, … | EGW entry points |
| `groupdav.php`, `webdav.php` | DAV |
| `custom/` | Untangle captive-portal sample (unrelated) |

Not present at root: `Dockerfile`, `composer.json` (root), `package.json`, `bitbucket-pipelines.yml`, PHPUnit suite for Quantivia, product README.

## Languages and frameworks

| Layer | Technology | Evidence |
|---|---|---|
| Server | PHP (legacy; `mbstring.func_overload` still set in `index.php`) | Entry PHP files |
| Platform | eGroupware / phpGroupWare API lineage | `phpgwapi`, headers |
| Quantivia UI | SmartAdmin (Bootstrap/jQuery) | `quantivia/smartadmin/` |
| Charts | JPGraph | `quantivia/jpgraph/` |
| Spreadsheets | PHPExcel | `quantivia/lib/PHPExcel/` |
| Mail | PHPMailer via notifier | `class.quantivia_notifier.inc.php` |
| DB access | PDO | `quantivia_so` |
| EGW DB abstraction | ADOdb (bundled) | `phpgwapi/inc/adodb/` |
| Auth extras | RFC 6238 TOTP | `loginextra.php`, `lib/rfc6238/` |
| Admin UIs | phpMyAdmin fork + phpLiteAdmin | `quantiviasqladmin/`, `quantiviasqliteadmin/` |

## Application versions (as labelled in tree)

| Component | Version string | Source |
|---|---|---|
| phpgwapi | 1.8.004 | `phpgwapi/setup/setup.inc.php` |
| Quantivia setup app | 1.3.000 | `quantivia/setup/setup.inc.php` |
| Quantivia settings | 2.0.000 | `quantivia_setings.php` |
| Quantivia BO | 276 | `$GLOBALS['quantivia']['default']['bo_version']` |
| Header format | 1.29 | template / setup |

These labels **disagree**. Authoritative release identity is **Unknown / Requires Confirmation**.

## Data stores

### eGroupware database

Configured in `header.inc.php` / domain array (`db_host`, `db_name`, `db_user`, `db_pass`, `db_type`). Default type in inspected file: MySQL. Core tables include `egw_accounts`, `egw_acl`, `egw_applications`, `egw_config`, addressbook, sqlfs, async, etc. (see `phpgwapi` setup).

### Quantivia database

Configured in `quantivia/setup/quantivia_setings.php` (and host-specific copies). Dual connection: Quantivia `db_*` and `egw_db_*`. `PDO_type` comment lists mysql, mssql, oracle, sybase, sqlite.

Schema construction helpers: `quantivia/setup/sql_construct.php`, `sqlite_construct.php`.

### Per-project tables

Created/verified by `confirm_project_tables($p_id)` — deliverables, chains (+ archive), resources, commitments (+ archive), profiles, published partitions keyed by datadate.

### Procedures.sql

Root SQL file with example procedures (`p2` selecting control points by element, `interpolate_deliverable`, generic loops). No PHP caller confirmed. Treat as **Unknown** for production.

## Configuration and environments

| File | Role |
|---|---|
| `header.inc.php` | EGW server root, domain DB, session handler, mcrypt flags |
| `header.inc.php.template` | Setup-generated template |
| `quantivia/setup/quantivia_setings.php` | Primary Quantivia runtime settings |
| `quantivia_setings_CENTOS.php`, `dppr_setings-*.php` | Alternate host settings copies |

Notable settings keys (values omitted): DB endpoints, `worker_url` / `worker_port`, `file_storage`, `file_retention`, `excel_password`, `cpu_cores`, `report_period`, `debug_ip`.

Inspected defaults point at Windows path `C:\Code_1_2` and worker host `sdev.quantivia.com` — **Inferred** as a development workstation snapshot.

## Authentication and sessions

| Mechanism | Path | Notes |
|---|---|---|
| Password login | `login.php` | EGW session create; CAS/HTTP auth branches exist in EGW login |
| TOTP login | `loginextra.php` | Password then OTP |
| Demo auto-login | `auto_login.php` | `webdemo*` password reset path |
| Session cookie | EGW `sessionid` | Required by Quantivia |
| Setup ACL | `setup_acl` in header | IP/domain restriction for setup |
| License file | `license.lic` pattern via `sg_*` helpers | MAC + domain |

Session handler configurable (`egw_session_files` default in template; memcache option commented).

## APIs and integrations

| Interface | Entry | Role |
|---|---|---|
| Quantivia JSON/services | `quantivia/services/*.php` | Charts, filters, menu, session state, template selection |
| EGW JSON | `json.php` | Platform JSON |
| SOAP / XML-RPC | `soap.php`, `xmlrpc.php` | Platform RPC |
| xajax | `xajax.php` | Platform AJAX |
| GroupDAV / WebDAV | `groupdav.php`, `webdav.php` | CalDAV/CardDAV/file DAV |
| License HTTP | QFD → `online.quantivia.com` | License operations; SSL peer verify disabled in QFD clients |
| Email | notifier + FelamiMail | SMTP |
| P6 | `forms/p6import.php` | Schedule import |
| Excel | PHPExcel wizards | Import/export |
| QR / barcode | `lab/`, `services/Barcode.php`, `qr.php` | Utilities / services |

## Background workers / jobs

| Component | Path | Behaviour |
|---|---|---|
| Worker | `quantivia/inc/worker.php` | Consumes `offload_tasks` |
| TaskMaster | `quantivia/inc/TaskMaster.php` | Spawns N workers |
| Batch loop | `TaskMasterLoop.bat` | Windows infinite php loop |
| QFD VBS | `QFD/worker.vbs`, `union*.bat` | HTTP poll worker.php |
| EGW async | `egw_async` table / phpgwapi | Platform async jobs |

## Storage

- Quantivia temp/file storage path from settings (`file_storage`).
- eGroupware VFS / sqlfs for EGW filemanager.
- JPGraph cache artefacts committed under `projectmanager/$SERVER_TEMP/` (operational noise in VCS).

## Security observations (no secrets reproduced)

| Finding | Location | Notes |
|---|---|---|
| Committed DB and related credentials | `header.inc.php`, `quantivia_setings*.php` | High risk if repo shared |
| Demo auto-login password=username | `auto_login.php` | High if exposed |
| IP-conditional `display_errors` | `index.php` (hard-coded LAN IP) | Medium |
| Dev license bypass hosts | `common_functions.inc.php` | Medium |
| QFD `CURLOPT_SSL_VERIFYPEER false` | `QFD/ULM.php`, `running.php` | Medium |
| SQL admin UIs in tree | `quantiviasqladmin/`, `quantiviasqliteadmin/` | Auth wrapper **Unknown** |
| Quantivia setup hooks point at `risk_hooks` | `quantivia/setup/setup.inc.php` | Likely defect |

## Development and testing

- No project-level automated test suite for Quantivia was found.
- `test.php` exists at repository root (EGW-era utility).
- `developer_tools/` EGW app present.
- Eclipse/PDT metadata: `.project`, `.buildpath`, `.settings/`.
- Debugging: `debug_ip` in Quantivia settings; REMOTE_ADDR gate in `index.php`.

## Deployment / infrastructure

**Unknown / Requires Confirmation** for production topology. Evidence of intended environments:

- Windows paths and `.bat`/`.vbs` workers suggest historical Windows PHP hosting.
- Alternate `*_CENTOS.php` settings suggest Linux deployments existed.
- No Docker, Ansible, or pipeline definition committed at repository root.
- QFD appears to be the installer/license companion rather than a full PaaS deploy.

## Git / VCS notes

- Single commit import from SVN (`ca64fae`).
- Windows clones may need `git config core.longpaths true` because of extreme filenames under `projectmanager/$SERVER_TEMP/jpgraph_cache/`.

## Dependency inventory (bundled, not Composer-root)

Major vendors embedded under Quantivia / phpgwapi include JPGraph, PHPExcel, SmartAdmin/CKEditor plugins, TCPDF fonts, HTMLPurifier, ADOdb, phpFreeChat (app), phpSysInfo (app), egw-pear.

Exact license obligations for each vendor tree were not exhaustively audited in this pass — **Unknown** for compliance packaging beyond Quantivia commercial + EGW GPL notices in headers.

## Related Silicon Ark guidance

Document Quantivia as the primary product for this repository. If ATE apps (`ncr`, `smt`, `womt`, …) need independent lifecycle tracking, split them into separate Silicon Ark project directories in a future pass — not done here because they share this install tree and were not separate Bitbucket repos in the onboarding brief.