# Technical documentation — theshoulderpractice (The Shoulder Practice, SHOU-1)

Evidence date: 2026-10-01. Source: `master` at `b805d89` (2025-06-20).

The scan-host checkout named in the onboarding task was not on this machine. This note is from a read-only clone of `origin/master`.

## What this repository is

A Git snapshot of the Evolution Software Palette / Unified Framework, with the web site configured as customer installation **SHOU-1** (The Shoulder Practice). Application code was imported on 2024-01-10. Behaviour last changed on 2024-01-24. Commits on 2025-06-20 added SonarQube only.

There is no README.

## Solutions

| File | Role |
|---|---|
| `SHOU-1.sln` | Practice solution. Includes `library`, `business`, website `service`, website `core` (URL `http://localhost:45935`), website `core-dev`, website `core_custom/SHOU-1`, and SSDT project `data`. |
| `EvolutionSoftwareUnifiedFramework.sln` | Framework solution name at the repository root. Not opened line by line. Treat `SHOU-1.sln` as the solution that names this installation. |

`tools/scheduler/scheduler.sln` is a separate scheduler solution.

## Runtime and language

- C# and ASP.NET Web Forms (`.aspx`, `.ascx`, `.master`, `.ashx`).
- WCF service (`.svc`) on .NET Framework.
- SQL Server scripts and an SSDT project (`data/data.sqlproj`).
- WinForms for `SchedulerTool`.
- `business` and the SHOU-1 site compilation target **.NET Framework 4.8**.
- `library/library.csproj` targets **.NET Framework 4.7.2**.
- `Web.config` `httpRuntime` still says `targetFramework="4.6"` while `compilation` says `4.8`.
- Roslyn compiler provider in `Web.config` requests C# language version 7.3 (`Microsoft.CodeDom.Providers.DotNetCompilerPlatform` 3.6.0.0).
- Web Forms code-behind uses `CodeFile` (dynamic compilation), not only precompiled `CodeBehind`.

## Repository map

```text
theshoulderpractice/
  SHOU-1.sln
  EvolutionSoftwareUnifiedFramework.sln
  bitbucket-pipelines.yml
  sonar-project.properties
  business/          framework_business class library
  library/           framework_library class library
  core/              framework website copy
  core-dev/          second website copy
  core_custom/SHOU-1/  practice website
  service/           WCF website
  data/              SSDT project and Scripts/
  components/        build output and third-party DLLs
  packages/          committed NuGet packages
  mobile/            class library stub
  tools/             importer, exporter, constructor, CAPI, CEP, scheduler
  SchedulerTool/     WinForms Google Sheet runner
  publish/SHOU-1/    precompiled site snapshot
  publish/service/   precompiled service snapshot
  release/1.0.0.1/   files.zip, scripts.zip
  release/1.0.5/     files.zip, scripts.zip
  BuildProcessTemplates/
```

`business` Debug and Release both set `OutputPath` to `..\components\`.

## Web application structure

`core_custom/SHOU-1` is the site whose configuration names the practice.

- `Core.master` — public shell. `Default.aspx`, `Canvas.aspx`, `Cart.aspx`, `Products.aspx`, `Media.aspx`, `Search.aspx`, `Reset.aspx`, `Error.aspx`.
- `Administration.master` — `Admin*.aspx` and `Medical_*.aspx`.
- `App_Code/` — `MediSwitch.cs`, `DataTables.cs`, `Loyalty.cs`, `jQueryHandler.cs`, `objects/oSurgicalNotes.cs`.
- `controls/admin/` — framework administration editors.
- `controls/medical/` — reference-data editors.
- `controls/module/` — feature modules loaded by the canvas.
- `controls/surface/` — generic surface form, grid, and view. Generated per-app markup was excluded in 2024 (see features).
- `controls/surface_custom/` — Surgical Notes form, grid, and view.
- `controls/composite/`, `controls/structure/`, `controls/sales/` — additional control sets. Not individually specified.
- `upload/` — runtime uploads. Surface drawing and task images are referenced as `~/upload/...`.
- `WebMethods.ashx`, `SessionHeartbeat.ashx`.

`Canvas.aspx.cs` chooses a control folder:

- `~/controls/`
- `~/controls/module/`
- `~/controls/surface/`
- `~/controls/surface_custom/`
- `~/controls/composite/`

`core` and `core-dev` repeat the same page names. They are parallel trees, not projects referenced as libraries. Diffing them against `core_custom/SHOU-1` was not completed file by file. **Requires Confirmation** before anyone treats `core` as deployable for this practice. The SHOU-1 connection string and practice name were read from `core_custom/SHOU-1/Web.config` and from `publish/SHOU-1/Web.config`.

## Domain libraries

Namespace `framework_business`:

- `enums/pNums.cs` — user types, modules, field types, clinical enums, sales statuses.
- `objects/o*.cs` — one class per table-shaped record. Medical types are `oMedical*.cs` (24 files).
- `objects/ov*.cs` — view or report shapes, including MediSwitch claim history.
- `classes/xData.cs`, `xDataAlt.cs` — generic persistence (`GetTypedByCriteriaSpecific`, `SaveTyped`, `UpdateTyped`, `GetSurfaceDataAll`).
- `classes/xSurfaceCustomMethod.cs`, `xSurfaceCustomAction.cs` — custom surface behaviour.
- `classes/xCalendar.cs`, `xSales.cs`, `xPurchases.cs`, `xDebtors.cs`, `xSendEasy.cs`, `xGoogleSheetData.cs`, `xBodyMap.cs`.

Namespace `framework_library` is referenced by the site for utilities (`utils`, `encryption`, `exception`, `handler`). The encryption and session helpers live there. File-level map of `library/classes` was not listed in the product docs beyond the project file.

Table prefix passed into data calls reviewed in sign-in is `pal_`.

## Database

- Engine: SQL Server. Evidence: SSDT `data.sqlproj` and T-SQL scripts.
- Dev catalog in config: `Framework_SHOU-1_Dev` on server `NB-DEWALD`, Integrated Security.
- Script `SHOU-1_insert_new_open_surgery_type_11022020.sql` uses `USE [Framework_SHOU-1]`.
- Objects referenced by name include `pal_Template`, `pal_SurfaceLookup`, `pal_PlaceOfService`, `pal_MSClaimDoctor`, `pal_Account`, `pal_MedicalSymptom`.
- Script tree mixes SHOU-1 with many other customer codes and with archives going back through framework versions 1.0.9 to 1.6.1. There is no single create-database script identified as "the SHOU-1 baseline" in this pass.

**Unknown / Requires Confirmation:** which script set has actually been applied, and whether production is `Framework_SHOU-1` or another catalog.

## Configuration

File: `core_custom/SHOU-1/Web.config`.

| Key or section | Value found | Note |
|---|---|---|
| `conn` | `Framework_SHOU-1_Dev` on `NB-DEWALD` | Comment says to rename keys to point at live. No separate `connLive` entry is active. |
| `subject` | `The Shoulder Practice SHOU-1 DEV - {content}` | |
| `website` | Defined twice | Later value `Evolution Software Framework` wins in .NET `appSettings`. |
| `WebAddy` | `http://localhost:17901` | |
| `defaultCulture` | `en-ZA` (duplicated) | `globalization` is `en` / `en-US`. |
| `DateFormat` | `yyyy-MM-dd hh:mm tt` | |
| `Mediswitch.Gateway` and twins | QA host names | Live hosts commented out. |
| `MediSwitchResponses` | `0` | |
| `getCountriesFromWebService` | `0` | Country ASMX URLs are still listed. |
| `loyaltyEmail` | `0` | |
| `smsU`, `smsP` | Present | Credentials. Not copied here. |
| SMTP | `smtp.evolutionsoftware.co.za:25` | Credentials in `network`. Not copied here. |
| WCF client | `http://localhost:58913/framework_service.svc` | Security mode `None`. PaletteOne URL commented out. |
| SMS client | `http://sms.netgen.co.za/SMS_V2.asmx` | |
| Session | 60 minutes | Anonymous identification enabled. |
| `maxRequestLength` | 10048 | Kilobytes. |
| `maxJsonLength` | 50000000 | |
| `compilation debug` | `true` | Debug compilation is on in the checked-in config. |

`publish/SHOU-1/Web.config` repeats the dev catalog, the practice subject, and the practice website name. It was not diffed setting by setting against the source Web.config.

## Authentication

1. Forms are not ASP.NET Membership. The site stores `oUser` in `Session["user"]`.
2. Database passwords are compared after encryption with a hardcoded passphrase (`Admin_SignIn.aspx.cs`).
3. A second hardcoded passphrase decrypts reset links (`Reset.aspx.cs`).
4. A vendor email and password are compared in clear text in source and mint a session that is not a database row (`recId` -1, `customerCode` EVOL-1).
5. Google login attaches to an existing user only.
6. WCF binding security mode is `None`.

These are implementation facts. They need a human security review. Secret values are intentionally omitted from Silicon Ark.

`SchedulerTool/GoogleSheetAPISecretes.json` is committed (the filename spells "Secretes"). It was not opened. Treat it as a credential file until someone confirms it is a dummy.

## Service

`service/App_Code/Iframework_service.cs`:

- `byte[] ProcessInteraction(byte[] interactionData, string connectionKey, bool isTransactional, string tablePrefix, bool isCollection)`
- `byte[] GetVersion(string customerCode, string licenceKey, string versionNo, string file)`
- `bool SaveVersion(byte[] versionData, string versionNo, string file)`

The web site is a WCF client of this service. Timeouts on the binding are 5 minutes open/receive/close and 10 minutes send. Maximum received message size is `int.MaxValue`.

## Background jobs

`SchedulerTool` is a WinForms executable that hides its window, reads the first command-line argument, and exits.

- Argument containing `googlesheetimport` constructs `GoogleSheetImports` and calls `ExecuteGoogleSheetImportMethods`.
- Known argument fragments: `googlesheetimport-fabrictrimzip`, `googlesheetimportcolours`, `googlesheetimportdetails`.
- Exceptions are written through `LogWriter`. The process then closes.

No Windows Service project, hangfire, or queue was found. Scheduling is external (Task Scheduler or similar). **Unknown** whether any job is installed for SHOU-1. The import names do not describe shoulder-practice data.

`tools/scheduler/` is a second scheduler codebase and includes `MediSwitch.cs`. Relationship to `SchedulerTool` was not fully mapped. Both exist.

## UI libraries

Checked-in binaries and handlers:

- Telerik.Web.UI (dialog, web resource, spell check, RadUpload, RadMediaPlayer types in code).
- AjaxControlToolkit.
- jQuery / Bootstrap-style markup (`carousel`, `col-md-12`, glyphicon classes) inside Web Forms pages.
- EPPlus, Spire.Pdf, Spire.XLS, PdfMetamorphosis, NReco.VideoConverter for documents and video.

Theme enum values in `pNums.Theme`: `palette`, `evolution`, `hawkeye`, `aquaman`. Which skin SHOU-1 uses is data or CSS, not pinned in the files read here.

## Integrations

See the integration table in `prd.md`. Short technical list:

- SQL Server via the `conn` app setting.
- MediSwitch SOAP/HTTP gateways.
- Netgen SendEasy SOAP.
- Evolution Software SMTP.
- Google OAuth profile fields on sign-in, and Google Sheets in the scheduler.
- SonarQube through Bitbucket Pipes.
- Optional webservicex.net country service, disabled.

## Build, release, and deployment

- Visual Studio solution build. Business and library output lands in `components/`.
- `publish/SHOU-1` contains a precompiled Web Forms app (`PrecompiledApp.config`, `bin/App_Code.dll`, page markup).
- `release/1.0.0.1` and `release/1.0.5` each contain `files.zip` and `scripts.zip`. No notes file says what the version numbers mean.
- `core_custom/SHOU-1/website.publishproj` and `service/website.publishproj` are Visual Studio publish profiles. A profile path `Evolution Software Framework.pubxml` was touched in the page-exclusion commit.
- Bitbucket Pipeline (`bitbucket-pipelines.yml`):
  - clone depth full
  - step "SonarQube analysis", size 2x
  - pipe `sonarsource/sonarqube-scan:3.0.2`
  - `EXTRA_ARGS=-Dsonar.scanner.forceEmbeddedJava=true`
  - runs for branch `master` and for all pull requests
  - does not build, test, or deploy
- `sonar-project.properties` sets only `sonar.projectKey`. No exclusions for `packages/`, `publish/`, or `components/` are declared. A scan of this tree will see generated and third-party files unless the Sonar server adds exclusions. **Requires Confirmation.**

No Dockerfile, no Terraform, no `appspec.yml`.

## Testing

No unit-test project, no `*Tests*.csproj` at the solution level that is part of SHOU-1, and no CI test step.

`tools/CEP/CEP.ConsoleTests` is a console project with a readme. It belongs to the CEP toolset, not to an automated suite for the practice site.

`Test.aspx` is a page in the site. It is not a test harness that was executed.

## Security notes for reviewers

Recorded so they are not lost. Do not treat this list as a penetration test.

- Vendor password and two encryption passphrases are in source.
- SMTP and SMS passwords are in `Web.config`.
- `compilation debug="true"` is checked in.
- WCF security mode is `None` on the localhost client binding.
- A Google credential JSON filename is in `SchedulerTool`.
- Patient lookup loads all `PatientProfile` surface rows and compares them in memory (`GetSurfaceDataAll`). That is a privacy and performance characteristic, not only a style issue.
- Sign-in failure does not distinguish unknown user from bad password (the result panel is generic). The vendor path is separate.
- SQL scripts contain a personal email address used as a referring-doctor number.

## Development process visible in Git

- 12 commits, one branch (`master`), no tags.
- Authors: Dewald Stander (initial import, gitignore, page exclusion, division-by-zero removal) and Jaco Brits (pipeline and Sonar files, edited in the Bitbucket UI).
- `.gitignore` is a generic template (Node, Java, Python, IDE files). It does not ignore `publish/`, `packages/`, `bin/`, or `components/`. Those trees are in Git, which is why the clone is large (about 265 MB, 6831 files).

## Related documents

- `project-plan.md` — purpose, scope, architecture, status.
- `prd.md` — workflows and functional requirements.
- `features.md` — current, excluded, dormant, and leftover features.
- `business-rules.md` — rules enforced by code and SQL.