# Technical documentation — scoringApp

Evidence date: 2026-10-04. Source: `git@bitbucket.org:overdrive/scoringapp.git`, `master` at `04b1a38` (2022-12-22).

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

## Architecture

Single-process WPF desktop application (`OutputType` WinExe) on .NET Framework 4.8. UI pages are swapped inside a `Frame` on `MainWindow`. Persistence is a SQLite file. The only network peers in active code are the Footprint QA host and an unused Google connectivity URL.

```text
MainWindow
  Login  --POST-->  qa.footprintapp.net/api/login/login
  Listfixturs
    DetailFixture  --SQL-->  local Footprint.db
    Scoring
       Webservices.GetNewData  --GET-->  .../api/fixtures/getdetails/UserID/{id}
       Webservices.PostComment --POST--> .../api/fixtures/uploadcommentary/fid/{fid}
```

`FP LiveScoring V1` is a second WPF project in the folder. It is not referenced by `Live_Scoring_V1.sln`. Its handlers are empty. `Live Scoring\Live Scoring.vdproj` is an older installer and is also outside the solution.

There are no background services, queues, or scheduled jobs. Match clocks are `DispatcherTimer` plus `Stopwatch` on the scoring page.

## Application structure

Solution `Live_Scoring_V1.sln` (Visual Studio 17 format):

| Project | Kind |
|---|---|
| `Live_Scoring_V1\Live_Scoring_V1.csproj` | C# WPF, startup object `Live_Scoring_V1.App` |
| `SidelineApp-Setup\SidelineApp-Setup.vdproj` | Visual Studio setup project |

Compiled pages: `Login`, `MainWindow`, `Listfixturs`, `DetailFixture`, `Scoring`, `Test`, `Window1`.

Class library folder `Live_Scoring_V1\Classes`:

| File | Responsibility |
|---|---|
| `Loginn.cs` | Login API, local logged-in flag, unused MD5 helpers |
| `Webservices.cs` | Fixture download, commentary upload, connectivity helper |
| `SqlDatabase.cs` | Open, execute, create schema |
| `Fixtures.cs` | Read fixtures; `SetOfflineFixture` |
| `Teams.cs` | Squad queries, yellow/red location queries |
| `Events.cs` | Event catalogue queries |
| `Comments.cs` | Commentary CRUD used by the page, yellow-card count |
| `Score.cs` | Rebuild `Scores` from commentary |
| `Cards.cs` | In-memory card widget identity (`Identfier`) |
| `Players.cs` | Empty class |

`Scoring.xaml.cs` is about 4,800 lines and holds the match workflow, timers, and most SQL for commentary. `Master.xaml` is on disk and is not included in the csproj.

Namespaces: `Live_Scoring_V1` and `Live_Scoring_V1.Classes`.

## Frameworks and languages

- C# (`LangVersion` 7.3 on the x64, x86, and ARM64 property groups).
- WPF, .NET Framework 4.8 (`App.config` `supportedRuntime` sku `.NETFramework,Version=v4.8`).
- JSON: Newtonsoft.Json 6.0.0.0.
- SQLite: Finisar `SQLite.NET` 0.21.1869.3794. The csproj hint path is `..\..\Accredit\Accredit\bin\Debug\SQLite.NET.dll`, outside this repo. The project also copies `bin\Debug\SQLite.dll`, `SQLite.NET.dll`, and `SQLite3.dll` as content. A native `sqlite3.dll` is stored at `Windows_System32\sqlite3.dll`.

## Database

Runtime path, **Implemented** in `SqlDatabase`, `Webservices`, `Fixtures`, `Teams`, `Events`, and `Comments`:

```text
%AppData%\Sideline Manager\Footprint.db
```

`CreateDataBase` runs when opening that file throws (login check or `SqlDatabase.OpenCon`). It uses `New=True`.

Tables created there:

| Table | Purpose |
|---|---|
| `Users` | `UserID` unique, names, `UnionID`, `UserName`, `Password`, `LoggedIn` |
| `Events` | Catalogue: `CEID` unique, `CommName`, `position`, `type`, `Game_Status`, `Subs`, `SubsRequired`, `Card`, `Color`, `Session`, `Groups` |
| `Fixture` | One row per `FID`, plus clocks, officials, point values, timers, `Current`, `Game_status`, `Game_Paused` |
| `Teams` | Players per `FID` and `SID`, shirt, positions, `Location`, `Front`, `Started`, `Returned`, `Time` |
| `Scores` | One row per `FID` for both sides: tries, conversions, penalties, drop goals, penalty tries, subs, cards, `PorTry`, half and full points |
| `Commentary` | Event rows. Primary lookup used by edit/delete is string `ID` (a GUID string). Not declared UNIQUE |
| `Tournaments` | Created. No insert or select against it was found in the C# sources |
| View `Commentary_view` | `Commentary` left join `Events` on `CEID = EventID`, `GROUP BY ID` |

`CREATE TABLE YellowCards` is commented out. Yellow state is `Teams.Location = 3` plus commentary.

The installer places `Database\Footprint.db` into the AppData folder `Sideline Manager` (`SidelineApp-Setup.vdproj` folder name `Sideline Manager` under `AppDataFolder`). **Unknown** whether that seed file's schema matches `CreateDataBase`. It was not opened. If the AppData file already exists, `CreateDataBase` does not migrate it. There are no `ALTER TABLE` statements in the C# sources.

`SetOfflineFixture` inserts columns that this `CREATE TABLE` does not include (`Sanction_Time`, `BloodBin_Time`, `HalfTimeLength`, `Extra_Time`, `ExtraTimeHalfLength`, `Referee`, `AssistantReferee1`, `AssistantReferee2`, `TMO`, `Timekeeper`) and the column list is missing a comma after `Timekeeper`. Provenance: **Implemented** mismatch.

SQL is concatenated. `SqlDatabase.Execute` returns true only when `ExecuteNonQuery` reports exactly one row. A statement that changes zero rows, or more than one, returns false. Callers often treat false as "did not save".

`GetData` closes the connection inside a `using` on the reader and returns that reader. Callers of `GetData` were not found on the match path; screens open their own connections.

## APIs

All active URLs are hardcoded. No `appSettings` keys exist. `App.config` only sets the runtime.

| Call | Method and URL | Body | Notes |
|---|---|---|---|
| Login | POST `https://qa.footprintapp.net/api/login/login` | `application/x-www-form-urlencoded`: `UserName`, `Password` | Production URL commented in `Loginn.cs` |
| Fixtures | GET `https://qa.footprintapp.net/api/fixtures/getdetails/UserID/{USERID}` | none | `WebClient.DownloadStringAsync`. Production URL commented |
| Commentary | POST `https://qa.footprintapp.net/api/fixtures/uploadcommentary/fid/{FID}` | form field `comment` = JSON from `JsonConvert.SerializeObject` of `Comments.GetCommentary` | Result string is discarded. Production URL commented |

No API version header, token, or cookie handling is in the client. TLS behaviour is whatever `WebClient` on .NET Framework 4.8 does. **Unknown** whether the QA host still accepts these routes.

Download JSON fields read by name include `FID`, `FixtureDate`, `StartTime`, `Location`, `HomeTeam`, `AwayTeam`, `FixtureNumber`, `StageName`, `RoundNumber`, `HomeName`, `AwayName`, `HomeAbbr`, `AwayAbbr`, `Allow22MeterTry`, `Tries_Points`, `Conversion_Points`, `Penalties_Points`, `Dropgoal_Points`, `PenaltyTry_Points`, `Portry_Points`, `Code`, `TID`, `YELLOWCARDCOUNTER`, `YELLOWCARDTIMER`, `BLOODTIMER`, `HIATIMER`, `HtimeMin`, `TournName`, `MATCHOFFICIALS`, `TeamH`, `TeamA`, `HOME_LINEUP`, `AWAY_LINEUP`, `EVENTS`, `SESSIONS`. Player fields: `UserID`, `FirstName`, `LastName`, `NickName`, `FullName`, `Pos`, `Vice`, `Cap`, `Jersey`. Official fields: `PosDescription`, `FullName`. Event fields: `CEID`, `CommName`, `position`, `type`, `Subs`, `SubsRequired`, `Card`, `Color`, `Group`, `Session`.

## External integrations

| System | Role |
|---|---|
| Footprint QA (`qa.footprintapp.net`) | Login, fixture sync, commentary upload. **Implemented** |
| Footprint production (`footprintapp.net`) | Commented URLs only |
| Google `http://clients3.google.com/generate_204` | Connectivity helper. Not wired to the running window |
| Bitbucket `overdrive/scoringapp` | Git host. `origin` is `git@bitbucket.org:overdrive/scoringapp.git` |
| Accredit bin path | Compile-time hint for `SQLite.NET.dll`. Not an integration at runtime |

## Infrastructure and deployment

**Implemented** installer `SidelineApp-Setup`:

- Product name Sideline Manager, manufacturer Evolve, version 1.0.3.
- `InstallAllUsers` true, `RemovePreviousVersions` true, `DetectNewerInstalledVersion` true.
- Default install directory `[ProgramFiles64Folder]Evolve\Sideline Manager`.
- Output MSI names: `Debug\SidelineManager-Setup.msi` and `Release\SidelineApp-Setup.msi`.
- `Database\Footprint.db` is a setup file aimed at AppData `Sideline Manager`.
- `Windows_System32\sqlite3.dll` is a setup file aimed at a folder named `System32` under `WindowsFolder`.
- Debug bootstrapper prerequisite is .NET Framework 4.8. Release prerequisite in the same vdproj is .NET Framework 4.7.2. The application `TargetFrameworkVersion` is 4.8.
- `RequiresElevation` on the MSI bootstrapper block is false.

ClickOnce properties in the csproj point `PublishUrl` at `C:\Users\ReniervanRooyen\Documents\Git\Evolve\Publish\`, with updates disabled and `ApplicationRevision` 19. That path is a developer machine path, not a configured update server.

Assembly version is `1.0.0.0`. Assembly copyright says 2017. The installer and the latest commit say 1.0.3. **Conflict** of version metadata.

Temporary ClickOnce key files are in the project: `Live_Scoring_V1_TemporaryKey.pfx` and `Live_Scoring_V1_1_TemporaryKey.pfx`. The csproj sets `SignManifests` to false and still records a `ManifestKeyFile` and thumbprint. Do not copy those files into documentation.

No Dockerfile, pipeline YAML, or cloud deploy script is in the tree.

`sonar-project.properties` and `sonarqube_scan.bat` were listed by the onboarding issue against a scan-host working copy. They are not in `master` at `04b1a38`.

## Environment configuration

There is no `.env` and no environment-variable switch between QA and production. The active host is the uncommented QA URL in source. Changing environment means editing `Loginn.cs` and `Webservices.cs`.

Local data location is the Windows user AppData folder, not a setting.

## Auth

- Login is a form POST of the raw password.
- The password is stored in `Users.Password` in the local SQLite file.
- MD5 helpers on `Loginn` are unused.
- Subsequent API calls do not send the password or a token.
- Logout is a local flag.
- No captcha, lockout, or certificate pinning is present.
- SQL identifiers and values are concatenated, including commentary text and names from the API.

## Storage

SQLite file as above. Images are WPF resources under `Live_Scoring_V1\Images` plus `logo-lr.ico` and the SL app icons. No object storage, no user file export besides the upload POST.

## Monitoring

None. Failures use `MessageBox` ("Did not save!") or empty `catch` blocks. `Console.WriteLine` is used for some SQL and lineup debug. No log file, telemetry, or health endpoint.

## Security notes (as implemented)

- Clear-text password in AppData SQLite.
- API calls without an auth header after login.
- Installer definition copies `sqlite3.dll` into a Windows `System32` folder.
- PFX files are committed in the application project.
- String-built SQL.

These are observations from the tree, not a pentest.

## Development and testing

- Open `Live_Scoring_V1.sln` in Visual Studio with the .NET Framework 4.8 targeting pack and the setup-project workload if the MSI is required.
- The SQLite managed DLL hint path expects a sibling `Accredit` checkout. **Unknown** whether a build on a clean machine succeeds without copying `SQLite.NET.dll` into the hint path or `bin\Debug`.
- No test project, no PHPUnit/NUnit/xUnit reference, and no CI definition.
- `Test.xaml.cs` is a UI experiment for a yellow-card grid, not an automated test. `MainWindow` does not show it.

## Git

| Item | Value |
|---|---|
| Remote | `git@bitbucket.org:overdrive/scoringapp.git` |
| Default branch inspected | `master` at `04b1a38` |
| Commits on `master` | 63 |
| First commit | `4482327`, 2019-09-05, maanie, "Initial working version" |
| Latest commit | `04b1a38`, 2022-12-22, heinrichoverdrive, "Deploy V1.0.3 BEta" |

Other remote branches exist (`Dev`, `qa`, `Code_Rework`, and others). They were not used as the source for this document.

## Human confirmation

1. Schema of the packaged `Database\Footprint.db` versus `CreateDataBase`.
2. Whether the QA host is still correct.
3. Whether installing `sqlite3.dll` into Windows `System32` is intentional.
4. Whether event ids 33 and 53 match the live Footprint event catalogue.
5. Build instructions for machines that do not have the Accredit `SQLite.NET.dll` hint path.