# Technical documentation — unityFrontend

Evidence date: 2026-09-30. Source: `git@bitbucket.org:overdrive/unityfrontend.git`, `master` `9742198` (2020-04-14).

Values omitted on purpose: seeded passwords in `src/@fake-db/db/auth-db.js`, the JWT HMAC secret in that same file, and `REACT_APP_MAP_KEY` in `.env`.

## What this repository is

A Create React App (react-scripts 3.0.1) on the Fuse React 3.2.0 admin template. Package name `fuse-react-app`. Page title "Unity - Work Management". Custom screens live under `src/app/main/apps/ticketing`, `src/app/main/apps/Unity`, and `src/app/main/apps/user-management`. Persistence for those screens is an axios mock adapter, not a database.

`README.md` is the upstream CRA readme (`yarn start`, `yarn test`, `yarn run build`, `yarn run eject`). It does not describe Unity.

## Repository facts

| Item | Value |
|---|---|
| Remote | `git@bitbucket.org:overdrive/unityfrontend.git` |
| Default branch | `master` |
| HEAD | `9742198` (2020-04-14, Alex Kedian) |
| First commit | `5c5fc68` (2019-10-02, Jaco Brits) |
| Commit count | 22 |
| Other branches | none on this clone after a full history fetch |

Commits `5c5fc68` through `d8d8752` are an earlier app (`package.json` name `unityfronend2`, Bootstrap, React Router 4). From `4371db7` (2020-01-13) the tree is Fuse. History after that date is Alex Kedian, except the 2019 author `siliconoverdrive` on the earlier line.

The task's scan listing included `sonar-project.properties` and `sonarqube_scan.bat`. They are not in the git tree at HEAD.

## Application structure

```text
public/                 index.html, manifest, Fuse assets
src/index.js            mounts <App>, unregisters the service worker
src/app/App.js          imports @fake-db, renders Auth + layout
src/app/auth/           role constants, login/user reducers
src/app/services/       jwtService (used), firebaseService, auth0Service
src/app/fuse-configs/   navigation, routes, settings, themes
src/app/fuse-layouts/   layout1 (active), layout2, layout3
src/app/main/apps/      Fuse demos + ticketing, Unity, user-management
src/app/main/pages/     Fuse page demos (auth pages, errors, invoices, …)
src/app/main/documentation/   Fuse docs, still routed
src/@fuse/              template UI, FuseUtils.hasPermission, FuseAuthorization
src/@fake-db/           axios-mock-adapter handlers
```

Path alias: `jsconfig.json` baseUrl `src` (imports such as `app/...`, `@fuse/...`, `@fake-db`).

Lazy route components use `React.lazy`. The ticket detail route and the Unity homes are lazy. Login and register are eager imports in their config files.

## Stack

| Layer | Choice | Evidence |
|---|---|---|
| UI | React 16.8.6, Material UI 4.3, JSS | `package.json` |
| State | Redux 4, redux-thunk, react-redux 7 | `package.json`, `src/app/store` |
| Routing | react-router-dom 5.0.1, react-router-config | `routesConfig.js` |
| HTTP | axios 0.19 | services and `store/actions` |
| Forms | formsy-react 1.1.5 on login and register | `JWTLoginTab.js`, `JWTRegisterTab.js` |
| Tables | react-table 6 on the ticket list | `TicketsTable.js` |
| Charts | chart.js 2.8, react-chartjs-2 | `DoughnutChartComponent.js` |
| Dates | moment 2.24 on new tickets; date-fns is also a dependency | `ticket.actions.js` |
| CSS | Tailwind 1.0.5 generated into `src/styles/tailwind.css`, plus Fuse CSS | `package.json` scripts, `tailwind.js` |
| Auth libraries present | jsonwebtoken 8.5.1 (mock signer), jwt-decode 2.2.0 (client), firebase 6.3.3, auth0-lock 11.17.1 | `package.json` |

Node version is not pinned. Yarn is implied by `yarn.lock`, `package.json` scripts, and `.yarnrc`.

## Scripts

| Script | What it runs |
|---|---|
| `start` | `yarn run tailwind` then `react-scripts start` |
| `build` | Tailwind, then `node ./purge-tailwindcss.js`, then `cross-env GENERATE_SOURCEMAP=false react-scripts build` |
| `tailwind` | Tailwind 1 build from `src/styles/tailwind.base.css` using `tailwind.js` into `src/styles/tailwind.css` |
| `test` | `react-scripts test --env=node` |
| `eject` | CRA eject |
| `build-docs` | Regenerates Material UI component docs under `src/app/main/documentation/material-ui-components` |
| `build-stats` / `bundle-report` | Production build plus webpack-bundle-analyzer |

No test files (`*.test.js`, `*.spec.js`) were found. The test script exists and has nothing project-specific to run.

## Runtime configuration

`settingsConfig.js`: layout style `layout1`, navbar folded, footer false, toolbar false, custom scrollbars, dark navbar/toolbar/footer theme.

`Auth.js` waits on `jwtCheck()` only.

`src/index.js` leaves the IE 11 polyfill commented out. Development browserslist includes IE 11. Production browserslist is the CRA default (`>0.2%`, not dead, not Opera Mini).

Service worker: `unregister()` at startup. The file header says switching to `register()` is a manual change. The app is not an offline PWA at HEAD.

## Authentication

Flow:

1. `jwtService.init` reads `localStorage.jwt_access_token`.
2. Missing token → `onNoAccessToken`.
3. Expired `exp` → clear storage, `onAutoLogout` with `access_token expired`.
4. Otherwise set `Authorization` and `GET /api/auth/access-token` with the token in the axios body. The mock verifies the signature, re-signs, and returns the user.
5. Login is `GET /api/auth` with `{ email, password }` in the body. The service logs both values to the console.
6. 401 responses call `onAutoLogout` with `Invalid access_token` and then `this.props.history.push('/')`. `jwtService` has no `props`. That line throws if it is reached.

The mock secret and the two-day expiry live in `src/@fake-db/db/auth-db.js`. Signature verification happens only in the mock, not in the browser.

Firebase and Auth0 service classes and register tabs remain. They are not initialised from `Auth.js`. Their config objects are commented placeholders (`firebaseServiceConfig.js`, `auth0ServiceConfig.js`).

## API surface the Unity screens call

All paths are relative. No `axios.defaults.baseURL` and no `proxy` field in `package.json`. In development, CRA serves the app and the mock intercepts these URLs in the browser.

`src/@fake-db/index.js` loads the handlers and ends with `mock.onAny().passThrough()`.

### Auth mock (`auth-db.js`)

| Method | Path | Behaviour |
|---|---|---|
| GET | `/api/auth` | Email/password check. 200 with user + token, or 200 with `{ error }` |
| GET | `/api/auth/access-token` | Verify token. 200 with user + new token, or 401 |
| POST | `/api/auth/register` | Create `unassigned` user, or 200 with field errors |
| POST | `/api/auth/user/update` | Map users by a condition `user.uuid === user.id` (both sides are the request user). **Inferred:** the id comparison does not use the stored user id |
| GET | `/api/auth/users` | All login users |
| GET | `/api/auth/user` | Find by `params.userId` as `uuid` |
| GET | `/api/auth/user-groups` | Groups ordered by name |
| GET | `/api/auth/user-group` | Find by `params.userGroupId` |
| POST | `/api/auth/user-group/module/capabilities/save` | Returns the body. Later lines are unreachable |
| POST | `/api/auth/user-group/save` | Called from `user-group.actions.js`. No handler in `auth-db.js`, so the mock passes it through |

### Ticket mock (`ticketing-db.js`)

| Method | Path | Behaviour |
|---|---|---|
| GET | `/api/ticketing/tickets` | Full array |
| GET | `/api/ticketing/ticket` | Find by `params.ticketId` |
| POST | `/api/ticketing/ticket/save` | Replace by `id` or append |
| POST | `/api/ticketing/ticket/close` | Same replace-or-append. Does not itself set status |
| GET | `/api/ticketing/dashboard/metrics` | Counts Open, Closed, In Progress. No UI caller |
| GET | `/api/ticketing/widgets/month-metrics` | `{ rows: [{ title, clicks, conversion }, ...] }` travel sample |
| GET | `/api/ticketing/priorities` | Handler returns `ticketingDB.priorities`. The array on the object is named `priority` (line 1141), so this property is missing. No Unity screen caller was found |
| POST | `/api/test` | Returns the string `blah` |

### User-management mock (`user-management-db.js`)

| Method | Path | Behaviour |
|---|---|---|
| GET | `api/user-management/users` | No leading slash. The list action that called this is commented out |
| GET | `/api/user-management/user` | Find in `userManagementDB` |
| POST | `/api/user-management/user/save` | Replace or append in `userManagementDB` |

Login users and this second user list are different arrays. See business rule BR-018.

## Routing notes that affect behaviour

`UnityAppConfig` paths:

- `/apps/unity/AdminHome`
- `/apps/unity/TechnicianHome`
- `/apps/unity/landing`
- `/apps/unity` → redirect to landing

Nav paths are lowercase `adminhome` and `technicianhome`. The technician seed redirect is `technicianHome`. These are different strings.

`/` exact → `/login`. Unmatched → `/pages/errors/error-404`.

Ticketing layout is forced to `layout1`. Login and register hide navbar, toolbar, footer, and side panels.

`FuseAuthorization` recomputes access from the matched route's `auth` and the user role on location or role changes.

## Data

There is no database, ORM, or migration in this repository. Mock arrays reset on full reload. The JWT string is the only Unity client state written to `localStorage`.

Ticket object fields used by the list and the new-ticket action: `id`, `number`, `name`, `description`, `status`, `type`, `active`, `age`, `priority`, `department`, `note`, `company`, `assignedTo`, `correspondence`, `tasks`, `products`, `resolved`, `creator`, `createdAt`, `owner`.

## Build, deployment, infrastructure

Not in the repository at HEAD:

- Dockerfile, compose file, or hosting config
- CI pipeline (no `bitbucket-pipelines.yml`, no GitHub workflow)
- Environment-specific API host
- Backend process, queue, or worker

`yarn start` serves the dev app at `http://localhost:3000` (CRA readme). `yarn run build` writes a static `build/` folder. Where that folder was hosted is **Unknown / Requires Confirmation**.

`.env` contains `REACT_APP_MAP_KEY`. CRA exposes any `REACT_APP_` variable to the client bundle. The value is a Google API key and is omitted here. Ticket screens do not read it. Fuse map examples do (`Order.js`, `Widget6.js`, google-map-react docs).

## Security observations (from the code, not a pentest)

- Mock passwords are plaintext in source.
- The mock JWT secret is a short literal in source.
- Login logs the password to the browser console.
- The client accepts a JWT after decoding `exp` and does not verify the signature.
- `jsonwebtoken` is a frontend dependency used by the mock. It is not a backend.
- Group capability flags do not protect routes.
- Many routes have no `auth` array, including user management and the Unity homes.
- A third-party map key is committed in `.env`.

## Monitoring and quality

No application logging service, error tracker, or analytics call was found in the Unity screens. `console.log` is used in the JWT service, admin home, and several actions.

Sonar properties were not in git. The scan-host listing is the only mention of Sonar for this repo, and those files were not available to read.

## Related Silicon Ark projects

Other directories use the Unity name (`unityNodejsApi`, `unity-lambda-api`, `unity-lite`, `unity-lite-v2`, `unity-soft-ui`, `unity-skeleton`, `unity-salestracker`). This frontend's HTTP calls stay on relative `/api/*` and do not reference those repositories. A shared product is **Unknown / Requires Confirmation**.