# Technical documentation — rgbc_projects_net

Evidence date: 2026-10-05.

Source: `master` at `08268a8` (2021-03-08). Remote: `git@bitbucket.org:overdrive/rgbc_projects_net.git`. Only branch: `master`.

## What this repository is

Eight independent Visual Basic .NET solutions imported from Team Foundation Server on 2019-08-19 (`f641314`, "First Commit"). Two later commits touch Stock Control and the cron program. There is no root solution, no README, and no shared class library.

| Directory | Solution | Project | Output | Framework |
|---|---|---|---|---|
| `RGBC_Forecast_2018` | `RGBC Forecast.sln` | `RGBC Forecast.vbproj` | class library (web) | v4.6.2 |
| `RGBC_Promotions_2018` | `RGBC Promotions.sln` | `RGBC Promotions.vbproj` | class library (web) | v4.6.2 |
| `RGBC_ScoreCard_2018` | `RGBC_ScoreCard.sln` | `RGBC ScoreCard.vbproj` | class library (web) | v4.6.2 |
| `RGBC_Stock Control_2018` | `Stock_Control.sln` | `Stock_Control.vbproj` | class library (web) | v4.6.2 |
| `RGBC_Superbowl Web_2018` | `Superbowl.sln` | `Superbowl.vbproj` | class library (web) | v4.6.2 |
| `RGBC_Superbowl_Daily_2018` | `Superbowl Daily.sln` | `Superbowl Daily.vbproj` | WinExe | v4.6.2 |
| `RGBC_Superbowl Daily 2_2018` | `rgbc Superbowl Daily 2.sln` | `Superbowl Daily 2.vbproj` | WinExe | v4.6.2 |
| `RGBC_Superbowl_Cronjob_2018` | `Superbowl Cronjob.sln` | `Superbowl Cronjob.vbproj` | WinExe | v4.6.2 |

`OptionStrict` is `Off`. Web `RootNamespace` values: `RGBC_Forecast`, `RGBC_Promotions`, `RGBC_ScoreCard`, `Stock_Control`, `Superbowl`. Desktop: `Superbowl_Daily`, `Superbowl_Daily_2`, `Superbowl_Cronjob`.

`ProductVersion` `9.0.30729` or `9.0.21022` on several projects is the Visual Studio 2008 project marker. The target framework line is 4.6.2. Provenance: **Implemented** in the `.vbproj` files.

Each web folder also contains `BuildProcessTemplates` (TFS build templates). Forecast and Score Card also contain `$tf` version-control metadata from the TFS import. Those folders are not application code.

## Application structure

Web sites are ASP.NET Web Forms. Pages are `.aspx` with `.aspx.vb` code-behind. Shared helpers live in `App_Code/VB/` (`SystemFunctions.vb`, `ProjectFunctions.vb`, and a `db` module) for Forecast, Promotions, Score Card, and the cron program. Stock Control and Superbowl Web keep data access in `sqlDB.vb`.

Desktop programs are single-form:

- Daily: `Main.vb` plus `sqlDB_daily.vb`, `sqlDB_stockcontrol.vb`, `sqlDB_superbowl.vb`, `Duodecimal.vb`.
- Daily 2: `frmMain.vb` plus `Process` and `Export_Process` types.
- Cronjob: `frmCronjob.vb` (about 2,000 lines) plus `QFGen`.

Score Card ships RDLC reports and a `51Degrees.mobi.config`. Cronjob vendors Microsoft Report Viewer packages under `packages\`.

`bin` and `obj` outputs are committed for at least the cron program (Debug and Release manifests) and Score Card (`bin\Newtonsoft.Json.xml`). Provenance: **Implemented** tree contents.

## Runtime and hosting

**Unknown / Requires Confirmation** for the actual servers. What the code assumes:

- IIS for the five web applications. No `Dockerfile`, publish profile, or pipeline file was found.
- A Windows session for the three EXE programs. Daily calls `Run()` on startup when `blnDebug` is false. No Windows Service project is in the repo. Scheduler configuration is **Unknown**.
- SQL Server catalog `Superbowl`.

## Configuration and data stores

Connection strings name the catalog `Superbowl` unless noted. User names and passwords are stored in git (`Web.config`, `app.config`, `My Project\Settings.settings`). They are not repeated here. They should be treated as exposed and rotated. **Requires confirmation** of which entry is production.

| Project | Names seen | Data source | Security |
|---|---|---|---|
| Forecast `Web.config` | `SuperbowlConnectionString` | `SQL-SERVER` | SQL authentication |
| Forecast settings | default and live-style | `SQL-SERVER` and `SAPPHIRE` | SQL auth and integrated security |
| Promotions `Web.config` | `SuperbowlConnectionString` | `SQL-SERVER` | SQL authentication |
| Promotions `Web.config` | `SuperbowlConnectionStringLIVE` | `SAPPHIRE` | integrated security |
| Promotions `Web.config` | `ApplicationServices` | `.\SQLEXPRESS` attach `aspnetdb.mdf` | integrated, user instance |
| Score Card `Web.config` | `SuperbowlConnectionString` | `Benriach` | SQL authentication |
| Score Card `Web.config` | `SuperbowlConnectionStringLIVE` | `Benriach` | integrated security |
| Score Card `Web.config` | `SuperbowlConnectionStringDEV` | `sqlsrv02` | SQL authentication |
| Stock Control `Web.config` | `csStockControl` | `sqlsrv02` | SQL authentication |
| Stock Control settings | release-style | `SAPPHIRE` | integrated security |
| Stock Control settings | other | `WSBS2003\SQLEXPRESS` | SQL authentication, user `pj` |
| Superbowl Web `Web.config` | `csStockControl` | `SQL-SERVER` | SQL authentication |
| Daily `app.config` | settings | `Benriach` integrated; `sqlsrv02` SQL auth | |
| Daily 2 `App.config` | three strings | `sqlsrv02` / `Superbowl`; `SAPPHIRE` / `Superbowl`; `BenriachE` / `TRGBC` | SQL auth, integrated, integrated |
| Cronjob `app.config` | settings | `sqlsrv02` SQL auth; `Benriach` and `SAPPHIRE` integrated | |

`TRGBC` is a second catalog used by Daily 2. Its role is **Unknown / Requires Confirmation**.

Web `appSettings` on Stock Control and Superbowl Web hold the signed-in user (`UNAME`, `UDOMAIN`, `UID`, `UGROUP`, `UGROUPID`, and `ULEVEL` on Superbowl). `blnDebug` is `true` in the committed `Web.config` for both. Those settings are process-wide `WebConfigurationManager.AppSettings` values, not only session state. **Implemented.** Concurrent users on one worker process would overwrite each other's group. **Inferred** risk from the API used. Superbowl Web also stores the display name in `Session("User")`.

SMTP:

| Program | Release host in config |
|---|---|
| Cronjob | `10.0.0.17` (`SMTPHost`) |
| Daily 2 | `10.0.0.17` |
| Daily | `tullamore.rgbc.local` |

DEBUG compiles of `frmCronjob.vb` use `smtp.office365.com:587` and a mailbox credential in source. Release compiles use `SMTPHost` and from-address `administrator@rgbc.co.za`.

File locations compiled into Daily 2 (release): `\\Benriach\Sales\ADM\` and `\\Benriach\Sales\2WaySystem\`. Daily writes exports to `\\Benriach\Sales\eSalesCharter\NewFiles\`. Each desktop program also uses `Imports`, `Imported`, and (Daily 2) `Exports` under its own base directory.

## Authentication

See BR-001 through BR-006 in [business-rules.md](business-rules.md).

`Web.config` `authentication mode`:

- Windows: Forecast, Promotions, Score Card.
- Forms: Stock Control, Superbowl Web.

All five login pages call `FormsAuthentication.SignOut()` and then trust `Request.LogonUserIdentity`. The Forms-mode sites therefore still depend on IIS providing a Windows identity. **Requires confirmation** of the IIS authentication settings (Windows authentication enabled, anonymous disabled or not).

Score Card `OVERRIDE_USERNAME` bypasses the Windows name. See BR-003.

No ASP.NET Membership provider is wired to the RGBC user tables. The Promotions `ApplicationServices` connection points at a local SQL Express membership database and is not used by `Index.aspx.vb`.

## Authorisation

Not a central policy. Each site checks different fields:

- Forecast: `blnView`, `blnEdit`, `blnSpecial`, and group name `Dev`.
- Promotions: `blnView`, `blnSpecial` on My Brands, group `Dev` for the sandbox menu item.
- Score Card: `blnView` and group names `RSM`, `User`, `Admin`, `Dev`.
- Stock Control: substring of the group name (`admin`, `brand`, `shipping`, `order`).
- Superbowl Web: non-zero `intLevel` plus a non-empty group. Finer menu rules are commented out.

Details: [business-rules.md](business-rules.md).

## Database access

There is no ORM and no `.sql` project. Queries are VB strings executed through `SqlClient` helpers (`doQuery`, `doQueryDS`, `getRow`).

Dates stored by the applications are often strings `yyyyMMdd` or `yyyyMMddHHmmss`, not SQL `datetime` parameters. Period keys are `yyyyMM` strings on `mstPeriod.strPeriod`.

Tables named from the code that was read (not a full schema):

`mstUser`, `mstUserGroup`, `mstUserGroupForecast`, `mstUserGroupPromotion`, `mstUserGroupScoreCard`, `mstUserGroupSuperbowl`, `mstUsageLog`, `mstCompany`, `mstPeriod`, `mstBrand`, `mstProduct`, `mstPrincipal`, `mstVendor`, `stkProductPeriod`, `dwfSales`, `sysCronJob`, `sysQuery`, `porRequisition`, `porDocument`, `mstNot_RGBC_Customer`, `dwdCustomer`.

Views named by Daily 2: `vwAPVendors`, `vwGLAccounts`.

## Background processing

| Program | Mechanism |
|---|---|
| Superbowl Cronjob | WinForms `Run()` polls `sysCronJob` status `New`. Not a service |
| Superbowl Daily | WinForms `Run()` on load when not debugging. Imports files then posts |
| Superbowl Daily 2 | WinForms. Operator clicks Run. Also has email-log and requisition-email buttons |
| Forecast planning | Does not generate QF in-process. Inserts a `BrandQF` cron row |

Job type list: [prd.md](prd.md) FR-010.

`PreProcess` on the cron form handles work that is not only a queue row (comments name FSR and POR file import and reminder mail). It is part of `frmCronjob.vb`.

## Integrations

- Windows identity / Active Directory as a name string only.
- SQL Server.
- SMTP.
- SMB paths on host `Benriach`.
- Flat files attributed in comments to Cognos (`cognos09.txt`, `cognos12.txt`, `cognos14.txt`), AdCheck, SALBA, and Advantex-style PDA extracts (`pda_crm.csv`, `pda_prod.csv`, `OffPremiseSurvey.csv`, and others). The producing systems are not in this repo.

## Security observations

These are facts about the tree, not a pentest.

- SQL text is built by concatenation. Some paths call `CleanString`. Forecast `sql_get_Users` does not. A domain login containing a quote would change the query.
- Database passwords and a DEBUG SMTP password are in git history. Rotate them. Do not copy the values into new config samples.
- Stock Control login catch block writes `sqlDB.conn.ConnectionString` into the HTML response.
- `WebConfigurationManager.AppSettings` stores the current user on Stock Control and Superbowl Web.
- Score Card `OVERRIDE_USERNAME` is an unauthenticated identity switch if the query string reaches `LogginUser`.
- DEBUG master pages sign in as a fixed domain account when session is empty.
- User-group checks for Stock Control are substring matches.
- `sql_update_Users_refManagerID` omits `SET`.

## Logging and monitoring

- `mstUsageLog` on web login.
- `stgSuperbowlLog` is mentioned in a cron comment when an approved PO has no manager. The insert site was not quoted here.
- Daily `WriteLog` writes process messages and can flag a row for email (`blnEmail`).
- Cron stores status and result on `sysCronJob`.
- Superbowl Web has Daily Log, Audit Log, and Usage Log pages.

No application performance monitor, health endpoint, or Sonar project file is in git. OVER-258's discovery listing included `sonar-project.properties` and `sonarqube_scan.bat`. They are not on `08268a8`.

## Development and testing

- Language: Visual Basic .NET, Web Forms and WinForms, Visual Studio solution format.
- No test project, no `TestMethod`, no pipeline YAML, no `bitbucket-pipelines.yml`.
- `#If DEBUG` changes login bypasses, SMTP, and file paths. Shipping a DEBUG build would not match release behaviour.
- `bin` and `obj` committed beside source make a clean build harder to review.

How a developer was expected to publish (IIS site per solution, ClickOnce, or file copy) is **Unknown / Requires Confirmation**. No publish profile was found in the search.

## Deployment

**Unknown / Requires Confirmation.** Evidence stops at: five IIS applications, three Windows executables, SQL Server `Superbowl`, SMTP, and the Benriach file shares.

## Related documentation

`silicon_ark/RGBC_ScoreCard/` describes repository `rgbc_scorecard` at a 2026 revision. Overlapping Score Card comments (version 1.2.0, 1 September 2018) are noted in [project-plan.md](project-plan.md). Do not treat that PRD as a description of this archive's other seven programs.