# Technical documentation — unity-lite

Evidence date: 2026-09-30. Revision: `master` `9b3a386` (2021-06-08, author `Jaco Brits`, subject merge after "import graph libs"). 95 tracked files. Default branch `master`. No other branches.

Credential values are omitted. The login form's initial email and password literals are omitted. Region, bucket name, endpoint name, and the attachment-size constant are taken from source because they are not secrets by themselves. Pool ids and the API Gateway host stay in `src/aws-config.js` only.

## What this repository is

A Create React App client. The README (`README.md`) titles it "Unity - Lite" and describes it as "Unity with out styling and redux components", using Amplify / lambda. `package.json` name is `role-based-access-control`, version `0.1.0`, `private: true`.

The browser title is UnityLite. The nav wordmark is UnityLite. The manifest name is still the CRA sample.

There is no Redux, no server, and no database in the tip tree. Domain calls go to an external API named `unity`. Earlier commits contained a `lambda/` directory with MySQL-backed handlers; that directory was deleted before tip.

## Repository layout

```text
unity-lite/
  package.json
  package-lock.json
  yarn.lock
  jsconfig.json                 baseUrl ./src
  .prettierrc.json              tabs, single quotes, always arrow parens
  .gitignore                    node_modules, dist, logs, IDE, media. Does not list .env
  README.md
  public/
    index.html                  title UnityLite, CDN Bootstrap, W3.CSS, Raleway
    manifest.json               CRA sample name
    favicon.ico
  src/
    index.js                    Amplify.configure, render, serviceWorker.unregister
    aws-config.js               region, bucket, API host, Cognito ids, MAX_ATTACHMENT_SIZE
    App.js                      fluid container around Routes
    App.test.js                 one smoke render
    serviceWorker.js            CRA helper, not registered
    routes/                     public/private split, MapAllowedRoutes
    config/                     Roles, PrivateRoutesConfig
    utils/                      isLoggedIn, getAllowedRoutes, history
    components/                 screens, unityRequests, vendored pivot files
    assets/                     images, nucleo fonts, faces/placeholder.png
```

No `Dockerfile`, `bitbucket-pipelines.yml`, `serverless.yml`, SAM template, `.env`, or `sonar-project.properties` is tracked.

The onboarding issue (captured 2026-09-28 from the scan host) listed `sonar-project.properties` and `sonarqube_scan.bat` beside `package.json`. `git ls-files` at `9b3a386` does not contain them. **Unknown / Requires Confirmation** whether the scan host has untracked copies.

## Runtime and toolchain

| Item | Value | Evidence |
|---|---|---|
| UI | React 16.8.6, React DOM 16.8.6 | `package.json` |
| Build | `react-scripts` 3.0.1 (`start`, `build`, `test`, `eject`) | `package.json` |
| Router | `react-router-dom` 5.2.0, history via `createBrowserHistory` from `history` | `src/routes/index.js`, `src/utils/history.js` |
| `history` package | Imported. Not a direct dependency | May resolve through `react-router-dom`. **Unknown** on a strict install |
| UI kit | `react-bootstrap` 1.0.0-beta.10, `bootstrap` 4.3.1, plus CDN CSS | `package.json`, `public/index.html` |
| Auth and API | `aws-amplify` 3.3.21 | `package.json`, `src/index.js` |
| Calendar | `@fullcalendar/react` 5.5.0, daygrid 5.5.0, timegrid 5.5.1, interaction 5.5.0 | `Calendar.js` |
| Charts | `chartist` 0.11.4, `react-chartist` 0.14.4 | `Dashboard.js` |
| Tables | `react-table` 7.6.3 | `Users.js` |
| Graphs / pivot | `plotly.js`, `react-plotly.js`, `react-pivottable` | Added under "import graph libs"; used by unmounted Pivot demo |
| Module paths | `jsconfig.json` `baseUrl` `./src` | Imports like `routes`, `config`, `utils`, `components` |
| Format | `yarn pretty` runs Prettier with tabs and single quotes on `src/**/*.js` | `package.json`, `.prettierrc.json` |
| Tests | `react-scripts test`. One file `src/App.test.js` renders and unmounts `App` | Not executed for this document |
| Storybook | Scripts on port 6006. Storybook 5.2.1 devDependencies. No `.storybook` config | Scripts would not start as committed |
| Lockfiles | Both `package-lock.json` and `yarn.lock` tracked. README says `yarn install` / `yarn start` | Which file is authoritative is **Unknown / Requires Confirmation** |

Node version is not pinned. No `.nvmrc`, `engines` field, or pipeline image.

`Tasklist.js` imports `react-icon-checkbox` and `react-icons/bs`, which are not dependencies. `Pivot.js` imports `react-dropzone` and `papaparse`, which are not dependencies. `Pivot.js` is not on a route. `Tasklist.js` is.

## Application structure

`src/index.js` calls `Amplify.configure` then `ReactDOM.render(<App />, #root)`.

`App` renders `routes/index.js` inside a fluid container and imports `Dashboard.css` globally.

`Routes` uses a custom browser history (`utils/history.js`) and a switch:

- `path="/app"` → `PrivateRoutes`
- `path=""` → `Auth` (matches everything else)

`Auth` (`src/routes/Auth.js`): `isLoggedIn()` ? `<Redirect to="/app" />` : `<PublicRoutes />`.

`PublicRoutes`: `/forgot-password`, `/register`, `/login`, else `LandingPage`.

`PrivateRoutes`: if not logged in, `<Redirect to="/" />`; else filter `PrivateRoutesConfig`, render `TopNav` + `MapAllowedRoutes` with `basePath="/app"` and `isAddNotFound`.

`MapAllowedRoutes` maps each route to `<Route path={match.path + path}>` and passes `children` into the component (used by `Configer`).

## Amplify configuration

From `src/index.js` + `src/aws-config.js` (ids omitted):

| Area | Setting |
|---|---|
| Auth | `mandatorySignIn: true`, region `eu-west-1`, user pool, app client, identity pool |
| Storage | region `eu-west-1`, bucket `unity-lite-files`, same identity pool |
| API | endpoint name `unity`, region `eu-west-1`, URL in `apiGateway.URL` |
| Other | `MAX_ATTACHMENT_SIZE: 5000000` |

## HTTP helper

`src/components/unityRequests.js`:

- Default action `"post"` → `API.post(apiName, path, { body: vars })`.
- Action `"get"` → `API.get(apiName, path, vars)`.
- Calls `Auth.currentSession()` but does not await it or attach the result to the request. Amplify still attaches Cognito auth when configured. **Inferred**.

Login uses `API.get` directly, not this helper.

## API paths used by the tip client

| Method (client) | Path | Caller |
|---|---|---|
| GET | `/unity/uuid/{cognitoUsername}` | `Login.js` |
| POST | `/unity/getcalendarevents/` | `Calendar.js` |
| POST | `/unity/addcalendarevent/` | `Calendar.js` |
| POST | `/unity/updatecalendarevent/` | `Calendar.js` |
| POST | `/unity/removecalendarevent/` | `Calendar.js` |
| POST | `/unity/getusers/1` | `Users.js`, `Quotes.js` (unmounted) |
| POST | `/unity/getdetails` | `User.js` |

Response shape expected by callers: often `{ body }` where `body` is a JSON string to `JSON.parse`. Calendar create assigns `addInfo.event.id = body.id` without parsing in that line — exact create response shape is **Unknown / Requires Confirmation**.

## Historical backend (removed)

Commits `3a6ecbd` and `b358947` deleted the in-repo `lambda/` tree. Inspected predecessors showed:

- `serverless-mysql` with env vars `databaseHost`, `databaseName`, `databaseUser`, `databasePass`.
- Tables referenced: `sysUser` (including `strCognitoUuid`), `crmCalendar`.
- Calendar get used **path parameters** in the deleted handler; the tip client posts a **JSON body**. Contract drift after removal is **Unknown / Requires Confirmation**.

Those handlers are not part of the tip deliverable. They are evidence only.

## Auth and session

| Concern | Behaviour |
|---|---|
| Sign-in | `Auth.signIn` then uuid GET |
| Session gate | `localStorage.roles` only |
| Roles parse | `JSON.parse(localStorage.roles)` |
| User details | `localStorage.userDetails` JSON |
| Logout | remove `roles`; no Cognito signOut |
| Token | JWT read in Login; unused |

## Frontend modules of note

| Path | Role |
|---|---|
| `components/Calendar.js` | FullCalendar + API |
| `components/Users.js` / `User.js` | User table / edit form |
| `components/Dashboard.js` | Static Chartist UI |
| `components/Tasklist.js` | Hardcoded tasks |
| `components/Configer.js` | Nested developer links |
| `components/unityRequests.js` | Amplify API wrapper |
| `components/Pivot*.jsx`, `Utilities.js` | Vendored pivot (unused route) |
| `components/Quotes.js`, `Timesheet.js` | Present; not in route config |
| `config/PrivateRoutesConfig.js` | Route table; unused `PivotTable` import |
| `assets/images/faces/placeholder.png` | User card image (present) |

## Infrastructure and deployment

Nothing in the repository defines hosting, CI, Terraform, CloudFormation, or Amplify CLI (`amplify/`). How builds are published is **Unknown / Requires Confirmation**.

Region consistently referenced: `eu-west-1`.

## Development and testing

```text
yarn install
yarn start          # CRA dev server
yarn build
yarn test           # react-scripts test (one smoke test)
yarn pretty         # prettier on src/**/*.js
yarn storybook      # expected to fail without .storybook
```

No TestSprite plan, no Cypress, no pipeline file. PHPUnit / Docker rules from other Multica projects do not apply to this React tree.

## Security observations (implementation facts, not a threat model)

- Cognito pool and API Gateway host are committed in `src/aws-config.js`.
- Login seeds credentials as component state literals.
- Role gate is client-only localStorage.
- Deleted historical Lambdas built SQL with string concatenation of path parameters (not present at tip; noted for anyone recovering that code).
- No rate limiting, captcha, or RLS exists in this client.

## Monitoring

No APM, analytics, or error-reporting SDK was found. Errors are `console.log`'d in several components.

## Relationship to Silicon Ark siblings

See `project-plan.md` § Relationship to other Unity clients. This tip (2021-06-08) precedes `unity-lite-v2`'s "Copy Unity Lite v1" tip (2022-05-26). Package name, Amplify shape, and route table align closely.

## Unknown / Requires Confirmation

- Live deployment URL and whether `aws-config.js` still matches production.
- Authoritative lockfile (`yarn` vs `npm`).
- Ownership of the API Gateway stage and current Lambda/source repo.
- Whether Sonar files on the scan host should be tracked.
- Node version used historically.
- Whether calendar POST body contract matches any surviving backend.