# Project plan — superbowl

Evidence date: 2026-10-02.

Source repository: `git@bitbucket.org:overdrive/superbowl.git`.

Inspected revision: `master` at `a6f4b8b` (2026-09-16, "Merged in feature/TASK-001-sc-admin (pull request #2)"). 36 commits, from `a841b63` (2020-04-14, "initial commit") through `a6f4b8b`. The scan-host path `~/projects/sonar_scan/repos/superbowl` was not on this machine. The tree was read from that git revision. Credential values are omitted.

This plan describes what the repository contains. It does not decide what the product should become.

## Product

The repository is an ASP.NET Web Forms application named **Superbowl** (`Superbowl/Superbowl.sln`, project `Superbowl/Superbowl/Superbowl.vbproj`, assembly title `Superbowl`, root namespace `Superbowl`). The master page sets the browser title to `RGBC Superbowl`.

It is the interactive master-data and operations console for the RGBC Superbowl SQL Server database: accounts, products, sales reps, export sales, logs, and a small set of admin utilities. Daily file loads and the `sysCronJob` worker live in other repositories (`superbowl_daily`, `superbowl_daily_2`, `superbowl_cronjob` in Silicon Ark). This web app inserts `ArchiveProduct` rows into `sysCronJob` and reads tables those batches fill (`dwfSales`, `dlyImportLog`, `dwfOnconPromo`, `dwfOffconPromo`, `dwfACLisp`).

There is no README in git. `Web.config` comments say database credentials are documented in a README. That file is not in the tree. In-repo product notes are `docs/index.md`, `docs/tasks/TASK-001.md`, and `docs/testsprite_run.md`, plus dated version comments at the top of `Superbowl/Superbowl/Admin.Master.vb` (v1.2.4 through v1.4.6, 2009–2016).

Assembly version in `My Project/AssemblyInfo.vb` is `1.4.3.0`. Assembly file version is `1.0.0.0`. Copyright text is `Copyright ©  2008`. **Discrepancy:** the master-page comments continue to v1.4.6 (2016-09-20) after the assembly version stopped at 1.4.3.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (checked out; matches `origin/master` at this revision) | `a6f4b8b` | 2026-09-16 | Pull request #2, SC Admin authorization |
| `feature/TASK-001-sc-admin` | merged | 2026-09-16 | Named in the merge commit and in `docs/index.md` |

`git log` on this clone shows a single line of history into `master`. Other remote branches were not enumerated. The onboarding issue recorded the same tip (`a6f4b8b`).

**Discrepancy:** the onboarding scan listed `sonar-project.properties`, `sonarqube_scan.bat`, and `Superbowl_20260403` at the repository root. None of those paths are in the git tree at `a6f4b8b`. Commit `e4b2c6d` is titled "Security Enhancements Item SonarQube", but the Sonar files themselves are not in the tree. Provenance: **Unknown** — they may have been untracked files on the scan host. `BuildProcessTemplates/` is in git (TFS 11.x XAML templates only).

**Discrepancy:** `docs/index.md` still lists TASK-001 as **In progress** on branch `feature/TASK-001-sc-admin` (updated 2026-09-15). Git `master` already contains the merge of that branch (pull requests #1 and #2, 2026-09-16). The task file's remaining acceptance items (database verification of Export Sales, production user assignment) are unchecked.

## Objectives (inferred from the implementation and from `docs/`, not from a written plan)

- Let an authenticated RGBC user maintain Superbowl master data: customers, products, brands, principals, companies, reps, and setup lists.
- Give a Supply Chain Administrator edit rights on the Product menu and Export Sales records, and keep Accounts, Sales Reps, Setup, and mutating utilities read-only for that role. Provenance: **Documented** in `docs/tasks/TASK-001.md`; **Implemented** in `UserPermissions.vb`.
- Capture export sales and, for a full administrator, post selected unprocessed rows into `dwfSales`.
- Queue a product-code archive (`F` / `S` suffix rename) for the cron job.
- Show sales-to-date, import logs, audit logs, usage logs, AdCheck mappings, and on-consumption / off-consumption promo extracts.

## Scope

In this repository:

- One VB.NET web application under `Superbowl/Superbowl/`.
- SQL scripts under `Superbowl/Superbowl/Scripts/` (country, customer group, competitor set, tags, liquor licence, SC Admin group, Non-RGBC migration, null-rep fix). These are scripts, not an automated migration runner.
- Project memory under `docs/`.
- Legacy TFS build-process XAML under `BuildProcessTemplates/`.

Out of this repository (named by code or by sibling Silicon Ark folders, not re-investigated here):

- The daily import executable (`superbowl_daily` / `superbowl_daily_2`).
- The cron worker that drains `sysCronJob` (`superbowl_cronjob`). Comment in `ProductArchiveDetails.aspx.vb`: "MOVED TO SUPERBOWL CRONJOB".
- Active Directory, which the login page says controls login.
- The SQL Server database itself. Schema is implied by SQL strings and scripts, not shipped as a full database project.

## System architecture

```text
Browser
  -> IIS / ASP.NET Web Forms (VB.NET, .NET Framework 4.8)
       -> Windows identity (Request.LogonUserIdentity.Name)
       -> mstUser + mstUserGroupSuperbowl (session ULEVEL)
       -> SQL Server catalog "Superbowl" (connection name csStockControl)
            master tables (mst*)
            warehouse copies (dwd*)
            facts written by other jobs (dwf*, dlyImportLog)
            sysCronJob / sysCronJobProducts (archive hand-off)
```

`Admin.Master` wraps authenticated pages. `index.aspx` is the default document. When `blnDebug` is false, a missing session user or a session level of 0 redirects to `Index.aspx`.

## Major components

| Area | Role | Evidence |
|---|---|---|
| Login | Windows logon name looked up in `mstUser` for system `Superbowl` | `index.aspx.vb`, `sql_get_Users` |
| Permissions | Levels 2 viewer, 4 SC Admin, 5 full admin | `UserPermissions.vb` |
| Accounts | Customers, key accounts, key groups, Snell areas and super groups, AdCheck customers, countries, customer groups | `Admin.Master` |
| Product | Brands, companies, principals, products, data and dimensions, AdCheck products, archive, competitor sets | `Admin.Master` |
| Sales reps | Reps and rep managers. Menu item `[Sales QF]` has an empty URL | `Admin.Master` |
| Setup | Branches, channel segments, rep segments, users | `Admin.Master` |
| Data capturing | Export sales list and detail; Process is full-admin only | `ExportsList.aspx.vb` |
| Utilities | Audit, daily import log, integrity sync, month-end BFBE file, usage log, promo extracts, second Product Archive link | `Admin.Master` |
| Data access | String-built SQL in `sqlDB.vb`; audit snapshots via `AuditEntity.vb` | those files |
| Secrets | `RGBC_SUPERBOWL_CONNECTION_STRING` from environment or `.env` | `SecureConfig.vb`, `.env.example` |

## Milestones visible in git

- 2008 — assembly copyright and the start of the Web Forms application (comments, not a 2008 commit; history in git begins 2020).
- 2009–2016 — version comments in `Admin.Master.vb`: AdCheck audit, home dashboard, Non-RGBC channel segment, product archive handed to the cron job, price group on key accounts, .NET 4, VS2012, category on products, session-based logged-in user.
- 2020-04-14 — `initial commit`.
- 2020-04-20 — Oncon and Offcon promo export fix.
- 2021–2026 — regions, product data and dimensions, barcodes as strings, contact details, competitor sets, product tags, customer tags, Non-RGBC key account, security/env connection string, Sonar-titled commit, country selection, customer groups, Cognos column and promotions fixes, product archive fix.
- 2026-09-15 to 2026-09-16 — TASK-001 SC Admin: permission module, server-side demands, group script, merge of master, pull requests #1 and #2.

There is no dated roadmap beyond the open items in `docs/tasks/TASK-001.md`.

## Implementation plan (as written in the repo)

`docs/tasks/TASK-001.md` next steps, still unchecked at the bottom of that file:

1. Configure `Superbowl/.env` against a complete database and provide Admin, SC Admin, and Viewer identities.
2. Build Debug and Release with Visual Studio or MSBuild Web Application targets (`Microsoft.WebApplication.targets`).
3. Finish the role matrix, Export Sales, hostile-postback, and concurrent-session tests.
4. The "commit and merge PR 1" step is superseded: pull requests #1 and #2 are already merge commits on `master`.
5. Supply the production username, run `Scripts/Add_SC_Admin_Superbowl_Group.sql`, deploy, and complete client UAT.

No other task file exists under `docs/tasks/`.

## Known dependencies

- .NET Framework 4.8 Web Application (`TargetFrameworkVersion` v4.8). Solution format is Visual Studio 15.
- IIS or IIS Express. `Web.config` sets Windows authentication, default document `index.aspx`, `executionTimeout` 36000, `customErrors` Off, `directoryBrowse` enabled, `compilation debug` true.
- SQL Server database whose logical connection name is `csStockControl`. `.env.example` shows `Initial Catalog=Superbowl`.
- Environment variable `RGBC_SUPERBOWL_CONNECTION_STRING`, or a `.env` file one directory above the web application physical path. `.env` is gitignored.
- Active Directory / Windows logon for `Request.LogonUserIdentity.Name`. The lookup string is upper-cased and matched to `mstUser.strDomainLogin`.
- `sysQuery` row `bfbe-Sales_Month_to_Date` for Month End file generation.
- Sibling worker that consumes `sysCronJob` type `ArchiveProduct`. The worker is not in this repo.
- TFS was the historical source-control binding (`http://tfs01:8080/tfs/vs_projects_2018` in the solution file). Current remote is Bitbucket.

## Current project status

**Implemented and merged:** SC Admin level 4, session-based permission checks, Product and Export Sales edit for levels 4 and 5, full-admin demands on Accounts, Sales Reps, Setup, Month End process, and Integrity mutations. Non-RGBC list redirects to `CustomerList.aspx`.

**Documented as not finished:** Export Sales has not been verified against a database that contains `mstExports`. The production user for the SC Admin group has not been named. Command-line MSBuild on the machine that wrote `docs/testsprite_run.md` could not find `Microsoft.WebApplication.targets`. `docs/index.md` blockers repeat those three points.

**Unknown / Requires Confirmation:** production URL; which SQL Server instance is live (commit `cd59214` is titled "point to live"; `Web.config` no longer holds the connection string; a password-bearing string remains in the tracked `bin/Superbowl.dll.config` and is not repeated in these documents); whether the SC Admin script has been applied in production; and whether the scan-host folders `Superbowl_20260403` and the Sonar files are required for anything.