# Technical documentation — unity-frontend

Evidence date: 2026-09-30. Source: `https://bitbucket.org/overdrive/unity-frontend.git`, `master` `0de9d02` (2019-08-14). Other remotes: `banele` `7a0569f`, `trev` `e1d8ebb`, `sergei` `c2e721f`. `origin/HEAD` is `master`.

The scan-host path `~/projects/sonar_scan/repos/unity-frontend` was not on the machine that produced this file. Statements come from the git tree.

The Google Maps key committed in `frontend/.env` is omitted.

## What this repository is

Two Create React App projects and a SmartAdmin static dump, plus a root README that describes a Laravel API that is not in the tree.

| Path | Package | What it is |
|---|---|---|
| `frontend/` | `fuse-react-app` `3.0.0` | Fuse React admin template (Withinpixels). HTML title **Unity WebSystem**. ThemeForest regular license URL in `frontend/LICENSE` |
| `public/` | `public` `0.1.0` | Small login and dashboard CRA. HTML title **Unity** |
| `public/src/components/assets/` | none (no package of its own) | SmartAdmin 1.5–1.7 assets, copyright MyOrange in `app.config.js` |
| `react-frontend/` | `react-frontend` `0.1.0` | Third CRA. **Only on branch `sergei`** |

Not this repository: the Unity game engine, and Bitbucket `unityfrontend` (Silicon Ark `unityFrontend/`).

## Repository layout (`master`)

```text
.htaccess                 Apache CORS header
README.md                 Laravel + React notes (incomplete)
frontend/                 Fuse CRA
  .babelrc                @babel/preset-env
  .env                    REACT_APP_MAP_KEY (value omitted)
  .gitignore
  .htaccess               same CORS header
  .yarnrc                 network-timeout 600000
  jsconfig.json           baseUrl src
  package.json
  public/                 CRA public (index.html, manifest, Fuse assets)
  src/
    @fuse/                Fuse framework
    @lodash/
    app/                  application, auth, configs, fuse-layouts, services
    styles/
    index.js              entry
public/                   second CRA (directory name collides with CRA's public/ convention)
  package.json
  public/index.html       document title Unity
  src/index.js            real entry
  src/App.js              imported by index.js, not rendered
  src/components/         LoginForm, Dashboard, Notfound
  src/components/assets/  SmartAdmin
```

`frontend/` contains about 842 `.js` / `.jsx` files, mostly Fuse. `public/src/components/assets/` contains about 1565 files.

`trev` relocates `public/src` to `/src`, `public/public` to `/public`, and copies `public/package.json` to the repo root. `frontend/` stays. The commit messages say CRA could not find `index.js` while the app lived under `public/`.

## Frameworks and languages

### Fuse app (`frontend/`)

From `frontend/package.json`:

- React 16.8.6 and React DOM 16.8.6 (also pinned under `resolutions`)
- react-scripts 3.0.1
- react-router-dom 5.0.0, react-router-config 5.0.0
- redux 4.0.1, react-redux 7.1.0-rc.1, redux-thunk 2.3.0
- Material UI 4.0.1 (`core`, `icons`, `styles`) and `@material-ui/pickers` 3.0.0
- axios 0.19.0, axios-mock-adapter 1.16.0 (declared; no `MockAdapter` construction under `frontend/src`)
- formsy-react 1.1.5, notistack, chart.js 2.8.0, react-chartjs-2
- firebase 6.1.0, auth0-lock 11.16.0, jsonwebtoken 8.5.1, jwt-decode 2.2.0
- Tailwind CSS 1.0.2 and PurgeCSS 1.3.0 as dev dependencies
- Node-style Babel preset only in `.babelrc` (`@babel/preset-env`). CRA still compiles the app

Scripts:

| Script | What it runs |
|---|---|
| `start` | `yarn run tailwind` then `react-scripts start` |
| `build` | tailwind, then `node ./purge-tailwindcss.js`, then `cross-env GENERATE_SOURCEMAP=false react-scripts build` |
| `tailwind` | `tailwind build ./src/styles/tailwind.base.css -c ./tailwind.js -o ./src/styles/tailwind.css` |
| `test` | `react-scripts test --env=node` |
| `build-docs` | deletes `*.ts` / `*.tsx` under the Material UI docs folder and runs `babel-node` on `build.js` |

`frontend/.gitignore` ignores generated `src/styles/tailwind.css`. That file is not required to read the source; `start` and `build` regenerate it.

`jsconfig.json` sets `baseUrl` to `src`, which is how imports such as `app/...` and `@fuse` resolve.

### `public/` app

React 16.8.6, react-scripts 3.0.1, react-router-dom 5.0.1, Formik 1.5.8, Yup 0.27.0, axios 0.19.0, email-validator 2.0.4. `LoginForm.js` does not import `email-validator`. Scripts are the stock `start`, `build`, `test`, `eject`. No Tailwind step.

### `sergei` / `react-frontend`

React 16.9.0, react-scripts 3.1.1, react-router-dom 5.0.1, `history` 4.10.0. No Formik, no axios. Title in `public/index.html` is **React App**.

## Application structure (Fuse)

Entry: `frontend/src/index.js` renders `app/App` and unregisters the service worker. IE11 polyfills are commented out. `browserslist` still lists `ie 11` for development.

`App.js` wraps, from the outside: `AppContext` (route table), JSS + `jss-extend`, Redux `Provider`, `Auth`, `react-router` `Router` with `@history`, `FuseAuthorization`, `FuseTheme`, `FuseLayout`.

`Auth.js` leaves `jwtCheck`, `auth0Check`, and `firebaseCheck` commented out. The class still contains those methods.

Route assembly is `frontend/src/app/configs/routesConfig.js`:

1. Spread `appsConfigs`, `pagesConfigs`, `authRoleExamplesConfigs`.
2. Add user-interface, documentation, `LoginConfig`, `RegisterConfig`, `LogoutConfig`, `CallbackConfig`.
3. `FuseUtils.generateRoutesFromConfigs`.
4. Exact `/` → `<Redirect to="/login"/>`.

There is no `path: '*'` redirect to the 404 page. Unmatched paths are treated as allowed by `FuseAuthorization` (`matched ? hasPermission(...) : true`).

`ExampleConfig` (`/example`) is not in that list. The nav config's only item points at `/example`.

Layouts live under `frontend/src/app/fuse-layouts/` (`layout1`, `layout2`, `layout3`). Login and login-2 force a full-width layout with navbar, toolbar, and footer hidden.

## Authentication

| Mechanism | Where | Runs on `master`? |
|---|---|---|
| Custom axios POST | `frontend/src/app/main/login/Login.js` | Yes, on submit. Does not store a token |
| Custom axios POST | `Login2Page.js` | Yes, on submit. URL has `/loginlogin`. Does not store a token |
| `jwtService` | `frontend/src/app/services/jwtService/jwtService.js` | Code is present. `Auth.jwtCheck` is not called, so `init()` does not run at startup. `signInWithEmailAndPassword` uses `GET /api/auth` with the password in the axios `data` body. `createUser` uses `POST /api/auth/register`. 401 interceptor emits `onAutoLogout` with `Invalid access_token` |
| Firebase | `firebaseService` + commented config | No |
| Auth0 | `auth0Service` + commented config | No |
| Formik form | `public/src/components/LoginForm.js` | Validates locally. Does not call an API |
| In-memory flag | `sergei` `react-frontend/src/App.js` `userAuth` | That branch only. Lost on refresh |

Redux user shape is `{ role, data: { displayName, photoURL, email, shortcuts } }` in `user.reducer.js`. The action types that replace it are `SET_USER_DATA`, `REMOVE_USER_DATA`, and `USER_LOGGED_OUT` from `app/auth/store/actions`, not the local `SET_USER_DATA` constant in `Login.js`.

Role names and the permission function are documented in `business-rules.md`.

## APIs and data

No database, ORM, or API implementation is in this repository. The README names HeidiSQL / phpMyAdmin and Passport. Those tools are not configured here.

Calls the frontends make:

| Caller | Method and URL | Body |
|---|---|---|
| `Login.js` | `POST http://local.unity/api/public/api/v1/login` | `{ email, password }` |
| `Login2Page.js` | `POST http://localhost/coreUnit/api/public/api/v1/loginlogin` | `{ email, password }` |
| `Dashboard.js` (`public/`) | `GET http://localhost/coreUnit/api/public/api/client/list` | none |
| `LoginForm.js` | none. Constant `https://localhost/api/public/api` is unused | — |
| Fuse demo stores and `jwtService` | relative `/api/...` on the page origin | template payloads |

Demo `/api` paths include `/api/auth`, `/api/auth/register`, `/api/auth/access-token`, `/api/auth/user/update`, `/api/todo-app/*`, `/api/mail-app/*`, `/api/contacts-app/*`, `/api/calendar-app/*`, `/api/chat/*`, `/api/notes-app/*`, `/api/scrumboard-app/*`, `/api/e-commerce-app/*`, `/api/academy-app/*`, `/api/file-manager-app/files`, `/api/project-dashboard-app/*`, `/api/analytics-dashboard-app/widgets`, `/api/quick-panel/data`, `/api/profile/*`, `/api/search`, `/api/faq`, `/api/knowledge-base`, `/api/invoices/get-invoice`, `/api/icons`.

`@fake-db` is documented inside `jwtAuthDoc.js` and is not in the tree. Those relative calls have nowhere to go unless some other process on the same origin serves them.

`Dashboard.js` initial rows are hard-coded in the component. They are not loaded from a fixture file.

## External services

- **Google Maps.** `process.env.REACT_APP_MAP_KEY` in `frontend/src/app/main/apps/e-commerce/order/Order.js`, `frontend/src/app/main/apps/dashboards/analytics/widgets/Widget6.js`, and a documentation example under `google-map-react`. The value is committed in `frontend/.env`. It is omitted here.
- **Firebase and Auth0.** Placeholder comments only.
- **Google and Facebook buttons** on the login cards have no SDK wiring.

## Environment and build

| Item | Evidence |
|---|---|
| Fuse dev URL | `frontend/README.md`: `yarn start` → `http://localhost:3000` |
| `public/` dev URL | Stock CRA README in that app also says port 3000. **Inferred:** one of the two must move if both run |
| Production build | `yarn build` / `npm run build` per app. Fuse build disables source maps |
| Env files | Only `frontend/.env` is committed. Gitignore covers `.env.local`, `.env.development.local`, `.env.test.local`, `.env.production.local` |
| Package manager | Fuse scripts call `yarn`. `frontend/.yarnrc` sets `network-timeout 600000`. `public/package-lock.json` is also committed, so that app was installed with npm at least once |
| Tailwind output | Generated, not committed |

No `.env` for the `public/` app. Its API URLs are string literals.

## Deployment and infrastructure

- Two `.htaccess` files set `Access-Control-Allow-Origin: *` when `mod_headers` is loaded. There is no rewrite-to-`index.html` rule for the SPA, no HTTPS redirect, and no other Apache config.
- No Dockerfile, `docker-compose`, Bitbucket Pipelines file, serverless manifest, or CI config.
- No background worker, queue, or cron.
- `trev` commit messages mention `C:\wamp64\www\unity_frontend` as a developer working copy. That path is not a deployment descriptor.

How a production host was supposed to choose between `frontend/build` and `public/build` is **Unknown / Requires Confirmation**.

## SonarQube

A discovery inventory on 2026-09-28 listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither file is on `master`, `banele`, `sergei`, or `trev`. **Unknown / Requires Confirmation** whether they were untracked files on the scan host.

## Security notes (as implemented)

- API passwords travel in JSON POST bodies on the two Fuse login screens, over `http://` URLs, not `https://`. The unused `public/` constant is `https://localhost/...`.
- `LoginForm.js` logs the email and password to the console.
- `frontend/.env` contains a live-looking Maps key and is tracked by git.
- CORS is `*` at the Apache snippet, and `Login.js` also sets `Access-Control-Allow-Origin` as a **request** header, which does not grant CORS.
- No CSRF token, no rate limit, and no auth guard on `/dashboard` in the `public/` app.
- Firebase and Auth0 secrets are not present (configs are comments). `jwtService` still contains the Fuse client's token handling; the secret used to **sign** tokens would have lived in `@fake-db`, which is absent, so this repo does not contain a JWT signing secret.
- SmartAdmin's own license text says the template may not be redistributed. That is the vendor file's claim, not a rule this app enforces.

## Development and testing

Root README tools list: WAMP (PHP Laravel and browser JavaScript), Visual Studio Code, HeidiSQL or phpMyAdmin, Postman, Chrome React tools. The Laravel half of that list has no matching code.

No `*.test.js` or `*.spec.js` on `master`. `frontend` `test` uses `--env=node`. `sergei` adds the default CRA `App.test.js`, which looks for a "learn react" link the `sergei` `App.js` does not render.

There is no lint script beyond CRA's `eslintConfig.extends: react-app`. No Cypress, no PHPUnit, no Docker-based test run.

`serviceWorker.unregister()` means no offline cache.

## Monitoring

No monitoring, logging service, or error reporter is configured. Login failures use `console.log` and, on some status codes, `alert`.

## Branch details worth keeping

| Branch | Technical delta from `master` |
|---|---|
| `banele` | One line: `.idea` in `public/.gitignore` |
| `trev` | Moves the small CRA to the repo root so `react-scripts` can see `src/index.js`. Adds root `package-lock.json`. Does not change login or dashboard logic |
| `sergei` | Adds `react-frontend/` (nested `BrowserRouter` in `App.js` and again in `routes.js`; `/` redirects to `/login` or `/dashboard` from a module flag; a route also renders `App`, which renders `router` again). Comments out Yup in `public/.../LoginForm.js`. Imports `ProfilePage` in `routesConfig.js` and adds `/pages/profile` a second time. Ignores Eclipse `.project` and `.settings/*` in `frontend/.gitignore` |