# Technical documentation — siliconreact

Evidence date: 2026-10-03. Source: `git@bitbucket.org:overdrive/siliconreact.git`, `master` at `96fd3b0` (2023-03-24, Hein Lie).

Secrets are not copied here. The credentials provider contains a hardcoded password; this document names the file and does not repeat the value.

## Repository

| Item | Value |
|---|---|
| Origin | `git@bitbucket.org:overdrive/siliconreact.git` |
| Default branch | `master` (`origin/HEAD`) |
| Tip | `96fd3b0` — 2023-03-24 09:02:19 +0200 — "fixed some routing" — Hein Lie (`hein@overdrive.co.za`) |
| Other branches | None on the remote |
| Tags | None found |
| First commits | `1de5eba`, `bb78735`, `5eef0d0` on 2023-03-08 by Jaco Brits (`jaco@overdrive.co.za`) |
| Application commits | `4018f2b` through `96fd3b0` by Hein Lie |
| README | `create-next-app` template. It does not describe Silicon React |
| Licence, changelog | None found |
| Tests | None found (no test script, no test directory) |
| Package name | `siliconreact`, version `0.1.0`, `"private": true` |

A scan that created the onboarding task listed `sonarqube_scan.bat` at the repository root. That file is not in git. **Unknown / Requires Confirmation**.

## Stack

| Area | Choice | Evidence |
|---|---|---|
| Language | TypeScript 4.9.5, `strict: true` | `package.json`, `tsconfig.json` |
| UI | React 18.2.0 | `package.json` |
| Framework | Next.js 13.2.3, pages router | `package.json`, `pages/` |
| Next config | `reactStrictMode: true` only | `next.config.js` |
| Component library | MUI Material 5.11.12, icons 5.11.11 | `package.json` |
| Styling | Emotion 11 (`@emotion/react`, `@emotion/styled`, `@emotion/server`) | `package.json`, `_app.tsx`, `_document.tsx` |
| Forms | Formik 2.2.9 | Login and signup |
| Auth | next-auth 4.20.1, credentials provider, JWT session | `pages/api/auth/[...nextauth].ts` |
| Lint | ESLint 8.35.0, `eslint-config-next` 13.2.3, extends `next/core-web-vitals` | `package.json`, `.eslintrc.json` |
| Path alias | `@/*` → repo root | `tsconfig.json` |

`@types/node`, `@types/react`, and `@types/react-dom` are listed under `dependencies`, not `devDependencies`. ESLint and TypeScript are also under `dependencies`.

`package-lock.json` is gitignored. No `yarn.lock` or `pnpm-lock.yaml` is in the tree. The lockfile that would reproduce an install is **not in git**.

Node and npm versions are not pinned (no `.nvmrc`, no `engines` field). **Unknown / Requires Confirmation**.

## Application structure

```text
pages/
  _app.tsx                 SessionProvider, Emotion cache, MUI theme, CssBaseline
  _document.tsx            lang=en, theme-color, favicon, Roboto stylesheet, Emotion style tags
  index.tsx                renders pages/auth/login
  auth/login.tsx           sign-in form
  home/index.tsx           authenticated welcome + sign out
  users/index.tsx          authenticated welcome placeholder
  signup/index.tsx         sign-up form (no persistence)
  forgotpassword/index.tsx reset form (logs a message)
  landing/index.tsx        welcome screen
  api/hello.ts             sample JSON handler
  api/auth/[...nextauth].ts
components/button/index.tsx
lib/validate.ts
src/theme.ts               createTheme with palette overrides commented out
src/createEmotionCache.ts  emotion cache key "css", prepend: true
src/Link.tsx               unused MUI/Next Link; imports clsx
styles/globals.css         not imported
styles/Home.module.css     not imported
public/assets/images/SiliconLogo.png
public/favicon.ico
public/next.svg public/thirteen.svg public/vercel.svg
```

`pages/_app.tsx` does not import `styles/globals.css`. The create-next-app global stylesheet and `Home.module.css` are unused.

`src/Link.tsx` is the MUI example that composes Next.js `Link`. No other file imports it. It imports `clsx`, and `clsx` is not listed in `package.json`. A bundler that compiles this file would need that module. `next build` was not run during this investigation, so whether the unused file is compiled is **Unknown**.

## Routing

Next.js maps each file under `pages/` to a route. There is no custom rewrite and no `middleware.ts`.

| Route | File | Notes |
|---|---|---|
| `/` | `pages/index.tsx` | Renders the login component. Landing import is commented out (`96fd3b0`) |
| `/auth/login` | `pages/auth/login.tsx` | Same login form. NextAuth `pages.signIn` is `/auth/login/` |
| `/home` | `pages/home/index.tsx` | Client session gate. Redirects to `/` |
| `/users` | `pages/users/index.tsx` | Client session gate. Redirects to `/` |
| `/signup` | `pages/signup/index.tsx` | |
| `/forgotpassword` | `pages/forgotpassword/index.tsx` | |
| `/landing` | `pages/landing/index.tsx` | Log In pushes `/auth/login` |
| `/api/hello` | `pages/api/hello.ts` | |
| `/api/auth/*` | `pages/api/auth/[...nextauth].ts` | NextAuth catch-all |

Removed route: `/login` (`pages/login/index.tsx`, deleted in `dc7d03c`).

`96fd3b0` also changed the favicon from `/static/favicon.ico` to `/favicon.ico`. The file in git is `public/favicon.ico`.

## Authentication

`SessionProvider` wraps the tree and receives `pageProps.session`. No page calls `getServerSideProps` or `getServerSession`, so that prop is unset unless NextAuth injects it by its own conventions. Pages that care about the session use the client hook `useSession`.

Provider configuration (`pages/api/auth/[...nextauth].ts`):

- `session.strategy`: `'jwt'`.
- One provider: `CredentialsProvider` with `credentials: {}` (fields are not declared to NextAuth; the login form posts `email` and `password`).
- `authorize` reads `email` and `password` from the credentials object.
- Comparison is a plain inequality against two string literals.
- Success returns a fixed user. Failure throws `Error('Invalid Credentials')`.
- `pages.signIn`: `/auth/login/`.

The login page calls `signIn("credentials", { redirect: false, email, password, callbackUrl: "/home" })` and, on `res.ok`, `router.push(res.url)`.

No `NEXTAUTH_SECRET` or `NEXTAUTH_URL` reference exists in the source. NextAuth requires a secret outside development. How that is supplied, if the app is run, is **Unknown / Requires Confirmation**.

## APIs

Only two route handlers exist.

| Method | Path | Behaviour |
|---|---|---|
| Any | `/api/hello` | `200` and `{ name: "John Doe" }`. No method filter, no auth |
| NextAuth methods | `/api/auth/*` | Handled by `NextAuth(authOptions)` |

There is no REST API for users, signup, or password reset.

## Data

No database client, schema, migration, or ORM is in the repository. The only identity record is the object returned from `authorize`. Session state is a JWT held by NextAuth, not a table in this repo.

Form state is in-memory Formik state. Signup does not bind inputs to that state.

## External integrations

| Integration | Where | What is exchanged |
|---|---|---|
| Google Fonts | `pages/_document.tsx` | Browser loads `https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap` |
| SonarQube | `bitbucket-pipelines.yml` | Pipe `sonarsource/sonarqube-scan:1.0.0` with `SONAR_HOST_URL` and `SONAR_TOKEN` |
| overdrive.co.za | Copyright anchors | User navigation only |

No email, SMS, storage bucket, queue, or analytics snippet is in the source. The README mentions Vercel deployment as generic Next.js guidance. No Vercel config is committed.

## Infrastructure and deployment

`bitbucket-pipelines.yml`:

- Image: `maven:3.3.9`.
- Clone depth: `full`.
- Cache: `sonar` at `~/.sonar`.
- The only pipeline is branch pattern `{master}`.
- The only step is "SonarQube analysis". It does not run `npm install`, `npm run lint`, or `npm run build`.

`sonar-project.properties` sets one property:

```text
sonar.projectKey=overdrive_siliconreact_AYbC8sOS_7nCiPvwlqwc
```

No Dockerfile, `docker-compose`, server config, or hosting manifest is in the tree. Deployment target and whether the pipeline still runs are **Unknown / Requires Confirmation**.

The Maven image is what the generated Sonar pipe file uses. The application itself is Node, not Java. **Inferred:** the image was kept from Bitbucket's SonarQube onboarding (`5eef0d0`, message "Initial Bitbucket Pipelines configuration") and was not replaced when the Next.js app was added.

## Environment configuration

`.gitignore` ignores `.env*.local`. No `.env`, `.env.example`, or `process.env` read exists in the TypeScript sources.

Local development, as the README template states: `npm run dev` (or yarn or pnpm) and open `http://localhost:3000`. Scripts in `package.json`:

| Script | Command |
|---|---|
| `dev` | `next dev` |
| `build` | `next build` |
| `start` | `next start` |
| `lint` | `next lint` |

## Background work

No workers, cron, queues, or scheduled jobs are defined.

## Security notes (from the code, not a pentest)

- The accepted password is a string literal in `pages/api/auth/[...nextauth].ts`, compared in plain text. It has been in git since `30f78f5` and was changed in `96fd3b0`.
- The accepted email is also a literal (`johndoe@gmail.com`). The session email is a different literal (`test@gmail.com`).
- There is no server middleware. `/home` and `/users` hide their content only after `useSession` reports unauthenticated.
- `/api/hello` is public.
- Signup and forgot-password do not send the typed values anywhere except, on signup, a `console.log` of Formik state that is not bound to the inputs.
- Login logs the full `signIn` result with `console.log(res)`.
- Home and users log `status` and session `data` with `console.log`.
- `src/theme.ts` does not set a custom palette. The theme-color meta uses `theme.palette.primary.main`, which is MUI's default primary.

## Development and testing

No test runner is configured. No PHPUnit, Jest, Cypress, or Playwright config is in the tree. CI does not execute the app.

`next lint` is the only quality script, and the pipeline does not call it.

This documentation pass did not install dependencies or start the dev server.

## Assets and styling notes

- Login, signup, and landing load the logo with `require("../../public/assets/images/SiliconLogo.png")` and `next/image`.
- `_document.tsx` still carries the MUI example comment "PWA primary color". No manifest or service worker was found.
- `components/button` wraps MUI and adds an optional `evtId` argument to `onClick`. Call sites in this repo do not pass `evtId`.

## Discrepancies worth keeping next to the code

| Item | Detail |
|---|---|
| README vs pages | README describes the create-next-app starter, `next/font`, and Inter. The app is a login shell using a Roboto stylesheet link |
| CSS vs MUI | `styles/globals.css` and `styles/Home.module.css` are the starter files and are not imported. Visual styling comes from MUI |
| `clsx` | Imported by unused `src/Link.tsx`, not declared in `package.json` |
| Pipeline image | `maven:3.3.9` for a Node application, scan step only |
| `sonarqube_scan.bat` | Named when the onboarding task was created. Absent from git |
| Lockfile | `package-lock.json` is ignored, so install reproducibility is not in the repository |