# Technical documentation — reactFrontend

Evidence date: 2026-10-05. Source: `git@bitbucket.org:overdrive/reactfrontend.git`, `master` `25c9bd8e70a876560a68952635d9e5a34a9530d6` (2020-07-17, Alex Kedian, "Updated Base API URL and Amplify URL").

No technical document existed in the repository or in `silicon_ark/reactFrontend/` before this file. `README.md` is the Create React App readme (scripts `npm start`, `npm test`, `npm react-scripts build` — the last heading does not match the script name `build`).

The scan-host path `~/projects/sonar_scan/repos/reactFrontend` was not on this machine. `git ls-remote` returned `25c9bd8e70a876560a68952635d9e5a34a9530d6` as `HEAD`, which matches the onboarding issue.

## Repository

| Item | Value |
|---|---|
| Workspace / slug | `overdrive` / `reactfrontend` |
| Package name | `footprintreboot` `4.2.8`, private |
| Default branch inspected | `master` |
| Other remote branch | `origin/development` at `94af90a` (2020-04-28), 44 commits, behind `master` |
| Commit count on `master` | 229, from 2020-03-10 to 2020-07-17 |
| First commit | `3acfab4` Lori Horn, "README.md Bitbucket" |

`PowerPoint/Blindside Software Hierarchy.pptx` is tracked. Slides were not extracted.

The onboarding issue listed `sonar-project.properties` and `sonarqube_scan.bat` beside the repo root. They are not in the git tree at `25c9bd8`. `footprint.jpg` is tracked.

## Application structure

Create React App (`react-scripts` `^3.4.0`), not ejected. Entry:

1. `src/index.js` picks a theme name, writes `__theme_color` in `localStorage`, imports `assets/css/sass/themes/gogo.{color}.scss`, then loads `AppRenderer`.
2. `src/App.js` imports `src/helpers/Amplify.js` (side effect: `Amplify.configure`), then lazy-loads views.
3. Redux (`react-redux`, `redux`, `redux-saga`) holds auth and the Gogo menu/settings/chat/survey/todo slices. Sagas are wired from `src/redux/sagas.js`. The auth saga is the one product saga. Chat, survey, and todo sagas belong to the template.

Top-level tree:

```text
footprint.jpg
package.json
package-lock.json
PowerPoint/Blindside Software Hierarchy.pptx
public/                 index.html, manifest.json, assets
README.md
src/
  App.js
  index.js
  components/           cards, forms, tables, AccessControl, modals
  constants/            menu.js, defaultValues.js
  containers/           navs, dashboards (template)
  customData/           dropdown and table option modules
  helpers/              Amplify.js, footprintAPI.js
  lang/
  layout/
  redux/
  views/
    user/               login and password screens
    app/                shell: dashboards, pages, ui, applications, menu
tsconfig.json
.vscode/launch.json
```

`tsconfig.json` is present. Product screens inspected are `.js` and `.jsx`, plus `src/views/app/pages/test/dynamicForm.tsx`. The test route mounts `src/views/app/pages/test` and is not in the main menu.

Code splitting: route modules use `React.lazy` and `Suspense` with a loading div. That is the CRA / React.lazy pattern already in the Gogo shell.

## Routing

| Path | Module | Guard |
|---|---|---|
| `/` | Redirect to `/user/login` | Public |
| `/user/login`, `/register`, `/forgot-password`, `/reset-password`, `/new-password`, `/confirm-code` | `src/views/user` | Public |
| `/error` | `src/views/error` | Public |
| `/app` | Redirect to `/app/dashboards` | `AuthRoute` |
| `/app/pages/user`, `/insight`, `/medical`, `/organisation`, `/squad`, `/tournament`, `/settings`, `/test` | `src/views/app/pages` | `AuthRoute` |
| `/app/ui`, `/app/applications`, `/app/menu`, `/app/blank-page` | Template areas | `AuthRoute` |
| anything else | Redirect to `/error` | — |

`AuthRoute` checks Redux `loginUser`, not `Auth.currentAuthenticatedUser()`.

Child redirects:

- `/app/pages` → `/app/pages/product` (template product pack).
- `/app/pages/user` → `/app/pages/user/users`.
- `/app/pages/squad` → `/app/pages/squad/squads`.
- `/app/pages/tournament` → `/app/pages/tournament/tournaments`.
- `/app/pages/organisation` → `/app/pages/organisation/dashboard`.
- `/app/pages/settings` → `/app/pages/settings/groups`.

User detail is `exact` `/app/pages/user/:userID`. It is registered after `/users`, `/transfers`, `/new`, `/reports`, and `/pivot-report`, so those literals win.

## Frameworks and libraries

From `package.json` dependencies that the product screens import, and the template ones that ship with them:

| Concern | Library | Version range in package.json |
|---|---|---|
| UI | `react`, `react-dom`, `reactstrap` | React `^16.13.1`, reactstrap `^8.0.1` |
| Routing | `react-router-dom` | `^5.1.2` |
| Forms | `formik`, `yup` | formik `^1.5.1`, yup `^0.27.0` |
| HTTP | `axios`, `aws-amplify` | axios `^0.18.1`, amplify `^3.0.10` |
| Auth SDK | `@aws-amplify/auth`, `aws-amplify-react` | auth `^3.2.6` |
| State | `redux`, `react-redux`, `redux-saga` | saga `^1.0.2` |
| i18n | `react-intl` | `2.4.0` |
| Dates | `moment` | `2.22.2` |
| Tables | `react-table` `6.10.3`, `react-bootstrap-table-next` | — |
| Calendar | `@fullcalendar/react` `^4.4.0`, `react-big-calendar` | — |
| Charts | `chart.js` `2.7.2`, `apexcharts`, `echarts` | Template and demo pages |
| CSS | `node-sass` devDependency `^4.14.1`, Bootstrap CSS checked in under `src/assets` | — |

Also listed and not traced into the member flow: `firebase` `^7.14.3`, `jquery`, `lodash`, `video.js`, `react-google-maps`, `react-yandex-maps`, `react-quill`, `react-pivottable`. Firebase is unused at startup (`App.js` comments the helper import). A Firebase config object remains in `src/constants/defaultValues.js` (values omitted).

`browserslist`: `>0.2%`, `not dead`, `not ie <= 11`, `not op_mini all`.

## Auth

Both configure blocks set:

| Key | Value |
|---|---|
| Region | `eu-west-1` |
| User pool | `eu-west-1_16nNqbqeS` |
| Identity pool | `eu-west-1:43f59f4f-b414-4926-ac62-da5c27674e77` |
| App client | `54akdkecv9neibv7fapo9r3p80` |
| Flow | `USER_PASSWORD_AUTH` |
| `mandatorySignIn` | `true` |
| S3 bucket (Storage) | `footprint-reboot-app` |

`src/views/user/index.js` comments an older pool `eu-west-1_E6NTixDJM`, identity pool `eu-west-1:f5399a14-1ad8-4145-9bfa-f61a46738e58`, client `q615ifm3cs2c3cj1c9kkde167`, and `clientMetadata: { myCustomKey: 'footprintReboot' }`. Those lines are not active.

Calls:

| Action | API |
|---|---|
| Login | `auth.signIn(email, password)` |
| Logout | `auth.signOut()` |
| Forgot password | `Auth.forgotPassword(email)` |
| Reset | `auth.forgotPasswordSubmit(email, code, newPassword)` |
| Confirm sign-up | `Auth.confirmSignUp(email, code)` then `Auth.forgotPassword` |
| Activation | `Auth.signUp(email, <literal password>)` |
| Top bar | `Auth.currentAuthenticatedUser()`, then reads `attributes['custom:memberid']` |

Session persistence for the route guard is `localStorage.user_id` = Cognito `username`. Amplify also stores its own `CognitoIdentityServiceProvider.*` keys. `footprintAPI.getToken` is commented out and does not attach `Authorization`.

Register saga: `auth.createUserWithEmailAndPassword`. That method name is not part of Amplify Auth. See the PRD.

## API clients and the host split

Three clients:

1. `aws-amplify` `API`, name `"footprint"`, configured in `src/helpers/Amplify.js` and again in `src/views/user/index.js`.
2. `footprintAPI` in `src/helpers/footprintAPI.js`, an axios instance with `baseURL`.
3. One direct `axios.get` on the organisation dashboard.

HEAD `25c9bd8` updates (2) and the endpoint inside (the user-route copy of) (1). It does not update `src/helpers/Amplify.js`.

| Client | Base at `25c9bd8` | When it applies |
|---|---|---|
| `src/helpers/Amplify.js` `API.endpoints[0].endpoint` | `https://dev.reboot.footprintapp.net/api` | App startup. Stays in effect on a refresh of `/app` if the user-route module has not been evaluated |
| `src/views/user/index.js` `Amplify.configure` | `https://dev-api.reboot.footprintapp.net` | Evaluated when `/user` is lazy-loaded. Replaces the previous Amplify config for the rest of the page session |
| `footprintAPI` `BASE_URL` | `https://dev-api.reboot.footprintapp.net` | Every `footprintAPI.apiGet` / `apiPost`, independent of Amplify |

Commented endpoints still in those files:

- `https://i70xkud5f9.execute-api.eu-west-1.amazonaws.com/prod`
- `https://196gw49oa0.execute-api.eu-west-1.amazonaws.com/dev`

Organisation dashboard (not Amplify):

- `GET https://afsxv57muc.execute-api.eu-west-1.amazonaws.com/dev/footprint`

`defaultValues.servicePath` is `https://api.coloredstrategies.com` (Gogo demo). `defaultValues.databaseURL` in the Firebase object points at `gogo-react-login`. Neither is the Footprint API.

Amplify calls use paths that start with `/footprint/...` and pass a `{ body }` object. Axios calls use paths such as `/members/{id}/verbose` and `/footprint/userpermissions` against `dev-api` with no extra `/api` prefix. The two styles are not the same URL even when the host matches.

### Amplify `API` paths

| Call | File |
|---|---|
| `POST /footprint/members` | `user-list.js` |
| `GET /footprint/types/13` | `user-list.js` |
| `GET /footprint/groups` | `user-list.js`, `groupsAndRoles.js` |
| `GET /footprint/roles/{groupID}` | `user-list.js` |
| `POST /footprint/updateemail` | `profile-settings-content.js` |
| `POST /footprint/updatememberactive` | `account-management-content.js` |
| `POST /footprint/updateuuid` | `account-management-content.js` |
| `GET /footprint/getpermissionmodules/{groupID}` | `groupsAndRoles.js` |
| `POST /footprint/getmoduledetails` | `groupsAndRoles.js` |
| `GET /footprint/getallcardpermissions` | `groupsAndRoles.js`, `UserAccessPermissionsSection.js` |
| `POST /footprint/savepermissions` | `groupsAndRoles.js` |
| `POST /footprint/updatepermissions` | `groupsAndRoles.js` |
| `POST /footprint/updatecustompermissions` | `UserAccessPermissionsSection.js` |
| `POST /footprint/updateusergeneral` | `GeneralForm.js` |
| `POST /footprint/updateuseridentity` | `IdentityForm.js` |
| `POST /footprint/updateuserother` | `OtherForm.js` |
| `POST /footprint/updateusernextofkin` | `NextOfKinForm.js` |
| `POST /footprint/updateuseraddress` | `AddressForm.js` |

### Axios `footprintAPI` paths

| Call | File |
|---|---|
| `GET /members/{userID}/verbose` | `user-detail.js` |
| `POST /footprint/userpermissions` | `user-detail.js` |
| `GET /members/{userUuid}` | `Topnav.js` (`userUuid` is `custom:memberid`) |

Response handling differs. Amplify callers `JSON.parse(response.body)`. `footprintAPI` callers read `response.data`. That matches each library's usual return shape. It was not executed against the hosts.

## Storage, jobs, monitoring

- No database client, cache, queue, or background worker is in the repo.
- S3 is named only in the Amplify Storage config. No `Storage.put` / `Storage.get` call was found in the product pages read for this document.
- No logging SDK. Failures use `console.log`. Login failures use `react-notifications` (`NotificationManager.warning`).
- No Dockerfile, no `bitbucket-pipelines.yml`, no GitHub Actions, no serverless template, no `.env` (and `.gitignore` ignores `.env`).
- `public/manifest.json` name is still "Create React App Sample". `display` is `standalone`.
- `.vscode/launch.json` is present. It was not treated as a deployment description.

## Security notes from the tree

These are observations, not a penetration test.

- Cognito ids, the S3 bucket name, and API hosts are hardcoded in client source. That is normal for a public SPA client id, and it also means the dev hosts cannot be changed without a code change.
- `footprintAPI` sends no bearer token. Whether the API is open or relies on something else (cookies, a gateway authorizer that is not configured here) is **Unknown**.
- Account activation signs a user up with a password literal in source.
- The commented token snippet in `footprintAPI.js` contains an email address inside a `localStorage` key. It is not executed.
- `canRender` does not enforce PRIVATE or VIEW.
- Firebase config remains in `defaultValues.js` while Firebase is not initialised.
- CORS fixes appear only as commit subjects (`9dacd13`, `c8df195`). No CORS headers are set in this repo because it is the browser client.

## Development and testing

| Command | Script |
|---|---|
| Dev server | `npm start` → `react-scripts start` (CRA default port 3000; the readme states that) |
| Production bundle | `npm run build` → `react-scripts build` into `build/` (gitignored) |
| Tests | `npm test` → `react-scripts test`. No test files are in the tree |
| Eject | `npm run eject` |

`homepage` is `http://localhost/`, so a production build's asset paths are rooted at `/`.

There is no seed data script. Static UI data is JavaScript modules under `src/customData` and JSON under `src/data`.

## Related Silicon Ark directories

A Markdown search found Footprint mentions in `tournaments.footprintapp.net`, `track.mypass.zone`, and `unity-lambda-api` (bucket name `footprint-reboot-qa-zaf` in an example file). None of those documents name the slug `reactfrontend`, and this repository does not name them. Relationship: **Unknown / Requires Confirmation**.

The S3 bucket in this repo is `footprint-reboot-app`. The bucket string in `unity-lambda-api` docs is `footprint-reboot-qa-zaf`. They are not the same name.

## Requires confirmation

- Which API base operators intend, given the split left by `25c9bd8`.
- Whether `custom:memberid` is set on every Cognito user.
- Whether `development` was abandoned on 2020-04-28 on purpose.
- Runtime Node version. `package.json` has no `engines` field. `node-sass` 4 and `react-scripts` 3 imply an old Node 10–13 line. That is **Inferred** from those packages' historical support, not from a file in the repo.
- Whether the sonar files from the scan host were local untracked tools or a different checkout.