# Technical documentation — wiki (SO Wiki System)

Evidence date: 2026-09-28.

Source: `git@bitbucket.org:overdrive/wiki.git`, `master` at `bb3c49b` (2019-05-02, author jacobrits, "first commit"). Only branch: `master`. `origin/HEAD` points at `master`.

The scan-host path `~/projects/sonar_scan/repos/wiki` was not on the machine that produced this document. Facts below come from that git revision. Secret values are omitted. `SOawsCodeDeploy.pem` is described only as a file type and a risk.

## Architecture

Static files served by `httpd`. There is no application runtime, no database, and no API process.

```text
index.html
views/dashboard/index.html     shell; includes controller/core.js
views/dashboard/dashboard_*.html
views/dashboard/index_org.html
views/wiki/blog.html           fragment, not linked
views/template/*.html          INSPINIA demo catalogue
controller/core.js             does not parse
unity.py                       unused by the pages
assets/                        theme static files
appspec.yml + scripts/         CodeDeploy on the host
codedeploy_deploy*.py          run from a pipeline image, not from the browser
```

Page flow that works without JavaScript, by ordinary links and the login form action:

1. `/index.html`
2. `/views/dashboard/index.html`
3. `/views/template/blog.html` when Wiki is chosen
4. Other `/views/template/` and `/views/dashboard/dashboard_*.html` pages by their own links

`controller/core.js` does not participate in that flow. See "Page loader".

## Repository layout

| Path | What it is |
|---|---|
| `README.md` | Title "SO Wiki System", line "Basic Wiki system", then Bitbucket's default README tutorial |
| `index.html` | Root login |
| `controller/core.js` | jQuery page loader |
| `views/dashboard/` | Shell, five dashboard variants, `index_org.html` |
| `views/wiki/blog.html` | Article-card fragment |
| `views/template/` | Theme demo HTML, plus `.DS_Store` and `favicon.ico` |
| `assets/` | About 1,519 files: css, js, font-awesome, fonts, img, locales, email_templates, pdf |
| `scripts/install_dependencies`, `start_server`, `stop_server` | CodeDeploy hooks. No `.sh` suffix. Shebang `bash` |
| `appspec.yml` | CodeDeploy appspec, version 0.0, `os: linux` |
| `codedeploy_deploy.py`, `codedeploy_deploy_develop.py` | Amazon's Bitbucket Builds CodeDeploy sample (header copyright 2016, narshiva@amazon.com, v1.0.0) |
| `bitbucket-pipelines_org.yml` | Pipeline definition under a non-default filename |
| `unity.py` | CLI stub |
| `SOawsCodeDeploy.pem` | PEM-encoded RSA private key. Not referenced by the Python scripts |

Not present: `package.json`, `composer.json`, `requirements.txt`, `Dockerfile`, test directory, `.gitignore` in the wiki repository, `bitbucket-pipelines.yml`, `sonar-project.properties`, `sonarqube_scan.bat`.

The task-creation scan listed the two Sonar filenames at the root. They are not in `bb3c49b`.

File types in the tree are dominated by `.png`, `.js`, `.html`, and `.css`. There are no `.php`, `.sql`, or `.env` files.

## Languages and frameworks

| Piece | Version evidence |
|---|---|
| HTML / CSS | Static documents |
| JavaScript in the browser | jQuery 3.1.1 (`assets/js/jquery-3.1.1.min.js`). Bootstrap 4.1.0 (`assets/js/bootstrap.js`). INSPINIA 2.8 (`assets/css/style.css`, `assets/js/inspinia.js`). Popper via `assets/js/popper.min.js`. MetisMenu, SlimScroll, and Pace are included by the shell |
| i18next | 1.11.1, loaded only by `views/template/i18support.html` |
| Locale JSON | `assets/locales/en.json`, `es.json`. `app.name` is "INSPINIA 2.4" |
| Python deploy scripts | `from __future__ import print_function`, boto3. Image in the pipeline file: `python:3.5.7`. Dependency pin in that file: `boto3==1.3.0` |
| Python CLI | `unity.py` shebang `#!/usr/bin/python`. `print` statements without parentheses (Python 2). Uses `sys` and `getopt` only |
| Shell hooks | bash, `yum`, `service` |

`assets/css/style.css` imports Open Sans and Roboto from `https://fonts.googleapis.com`.

Template login footer text says the framework is based on Bootstrap 3 (2014). The shipped `bootstrap.js` header is Bootstrap 4.1.0. Provenance: both strings are in the tree.

## Page loader

File: `controller/core.js`. Copyright comment "2019 silicon overide" (spelling as in the file).

Included from:

| Page | Script URL | Resolves to the controller file |
|---|---|---|
| `views/dashboard/index.html` | `../../controller/core.js` | Yes |
| `views/dashboard/index_org.html` | `../controller/core.js` | No. That would be `views/controller/core.js` |

Functions:

- `pageSetup()` — body is comments. Would have loaded `../../template/nav/topnav_<role>.html`, `sidenav_<role>.html`, `topsearch_<role>.html`, and `../../template/footer/footer.html`. The `views/template/nav` and `views/template/footer` directories do not exist. The comment's relative path is `../../template/...`, which from a page in `views/dashboard/` would not be `views/template/` either.
- `pageContent(view, page)` — `$('.pageContents').load('../../views/' + view + '/' + page + '.html')`.
- Document ready calls `pageSetup()` and `pageContent('blog')`. The second argument is omitted, so the URL string would be `../../views/blog/undefined.html`.
- A delegated click on `.button` switches on the `action` attribute: empty `updateProfile`, `logout` calling `logOut()` (undefined), default `pageContent('dashboard', 'index')`.

The click callback is closed with `)};`. That is not a valid end to `$(document).ready(function () { ... $('body').on('click', '.button', function () { ... }); });`. The script fails to parse, so the ready handler does not run. This was determined by reading the source. A browser was not used.

No other application JavaScript file defines routes. Theme files under `assets/js/plugins/` are vendor demos (CodeMirror modes, charts, editors).

## Shell versus template dashboards

`views/dashboard/index.html` is a reduced page (about 12 KB) with three side-menu groups: Dashboards, Wiki, Logout.

`views/dashboard/dashboard_2.html`, `dashboard_3.html`, `dashboard_4_1.html`, and `dashboard_5.html` differ from the matching files in `views/template/` mainly in the dashboard submenu labels: Dashboard Software, Dashboard Technical, Dashboard Support, Dashboard HR, Dashboard Finance. `dashboard_2.html` also drops a space in the title ("SO.2 | Dashboard v.2" versus " SO.2 | Dashboard v.2").

`views/dashboard/dashboard_4.html` is the theme's alternate top-navigation dashboard. It is not in the shell's submenu.

`views/template/index.html` remains the full theme home (graphs, mailbox, and the rest of the catalogue in the side menu).

## Wiki fragment

`views/wiki/blog.html` starts with a `<div class="wrapper wrapper-content ... blog">`. It is not a complete HTML document. Card copy matches the blog body inside `views/template/blog.html` (first heading "One morning, when Gregor Samsa"). Card links go to `../template/article.html`.

The shell's Wiki item does not point here. It points at `views/template/blog.html`.

## CLI

`unity.py` parses `-h`, `-i`/`--ifile`, and `-o`/`--ofile`. `-h` prints `test.py -i <inputfile> -o <outputfile>` and exits. Other options print the input and output strings. The header's eight-item Unity menu is not implemented. No `unity.bat` or `unity.sh` is in the tree.

## Data

No database, schema, migration, or model directory.

Persisted product data: none. Article text is HTML. The profile name is HTML.

Sample JSON:

- `assets/js/api/typehead_collection.json` — theme typeahead sample. Not read by the shell.
- `assets/locales/en.json`, `es.json` — theme i18n strings.

`assets/pdf/example.pdf` and `assets/email_templates/` are samples. No mailer is configured.

## External integrations

### Google Fonts

`assets/css/style.css` lines 1–2 import Open Sans and Roboto. No key.

### AWS CodeDeploy and S3

`codedeploy_deploy.py` (branch intent: `master`):

1. Build `VERSION_LABEL` with `strftime("%Y%m%d%H%M%S")`.
2. S3 key: `APPLICATION_NAME + '/' + VERSION_LABEL + '-bitbucket_builds.zip'`.
3. `boto3.client('s3').put_object` of `/tmp/artifact.zip` into `S3_BUCKET`.
4. `boto3.client('codedeploy').create_deployment` for `APPLICATION_NAME` and `DEPLOYMENT_GROUP_NAME`, revision type S3, `bundleType` zip, `deploymentConfigName` from `DEPLOYMENT_CONFIG`, description "New deployment from BitBucket", `ignoreApplicationStopFailures=True`.
5. Poll `get_deployment` until status is `Succeeded` (exit 0), `Failed` or `Stopped` (exit 1), or the call throws.

`codedeploy_deploy_develop.py` is the same with `APPLICATION_NAME_DEV` and `DEPLOYMENT_GROUP_NAME_DEV`.

Region, keys, and bucket name are not in the repository. boto3's default credential chain is assumed. Provenance: **Inferred** from the absence of a profile or key argument in the client constructors.

`sleep` is imported in both files and not used.

### Pipeline

`bitbucket-pipelines_org.yml`:

- Image `python:3.5.7`.
- Branch `master`: `apt-get update`, `apt-get install -y zip`, `pip install boto3==1.3.0`, `zip -r /tmp/artifact.zip *`, `python codedeploy_deploy.py`.
- Branch `develop`: the same, then `python codedeploy_deploy_develop.py`.

Bitbucket Pipelines loads `bitbucket-pipelines.yml` from the repository root. This file has a different name, so it is not the active pipeline definition unless an operator renamed it outside git. **Unknown / Requires Confirmation.**

The zip glob `*` does not include dotfiles. The repository has no `.gitignore`. It does contain `views/template/.DS_Store`, which `*` will include.

### CodeDeploy on the host

`appspec.yml`:

- `files.source` is `/`, `files.destination` is `/var/www/html/`.
- `BeforeInstall` runs `scripts/install_dependencies` (`yum install -y httpd`) and `scripts/start_server` (`service httpd start`).
- `ApplicationStop` runs `scripts/stop_server`.
- Each hook: `timeout: 300`, `runas: root`.
- No `AfterInstall`, `ApplicationStart`, or `ValidateService`.

CodeDeploy's usual order is ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService. With this file, `httpd` is stopped only if `stop_server` succeeds, then started in BeforeInstall, then the files are copied. `stop_server` does not succeed at stopping the process: the line `isExistApp = \`pgrep httpd\`` is not a bash assignment because of the spaces around `=`, so the variable tested afterwards is empty and `service httpd stop` is skipped.

`install_dependencies` does not enable `httpd` on boot, open a firewall, or write a vhost. TLS is not configured in this repository.

OS assumption of the hooks: a `yum`-based Linux (Amazon Linux or RHEL family) with `service` and `pgrep`. The appspec `os` is `linux`. The exact AMI is **Unknown**.

## Authentication

No application authentication.

The login form is HTML5 constraint validation only (`required`, `type="email"`).

AWS authentication for deploy is outside the repo.

`SOawsCodeDeploy.pem` is an RSA private key committed at the root. The deploy scripts do not open it. **Unknown / Requires Confirmation:** whether a host, a CodeDeploy agent install, or a person was meant to use it. It should be treated as compromised. This document does not contain the key.

## Background work, queues, storage

No queue, cron, or worker.

The deploy script's status loop is the only poll. It runs in the pipeline step, not on the web server.

Browser storage is not used by `controller/core.js`. Theme pages may use plugin demos; they are not the shell.

File storage for articles: the HTML files themselves. The footer quota is not connected to a disk check.

## Monitoring and security

No application log, metrics exporter, or health URL is defined. `ValidateService` is absent. CodeDeploy reports deployment status to the pipeline script's stdout.

`views/template/404.html` and `500.html` exist as theme pages. `httpd` is not configured here to use them.

Security observations from the tree:

- Unauthenticated static admin pages, including the shell.
- Private key in the repository and, via `source: /`, in the deployed document root.
- Deploy scripts run with whatever AWS rights the pipeline environment has. Those rights are **Unknown**.
- Hooks run as root.
- `ignoreApplicationStopFailures: true` lets a deployment continue when ApplicationStop fails.
- Vendor JavaScript under `assets/js/plugins/` is historical theme code (2014–2018 era libraries, including a password-strength word list). It is not an application password policy.
- No dependency lock file other than the `boto3==1.3.0` pin in the pipeline YAML. Python 3.5.7 and boto3 1.3.0 are long out of support. That is a statement about the pins in the file, not a recommendation invented for this product.

No rate limit, captcha, or row-level security exists, because there is no API and no database.

## Development and testing

No test runner, lint config, or CI file under the standard pipeline name.

`unity.py` comments describe a generator for projects and MVC files. It does not generate files.

Sonar configuration was not in git at inspection. The scan-host listing named `sonar-project.properties` and `sonarqube_scan.bat`. Whether those files were local-only is **Unknown / Requires Confirmation**.

How a developer was expected to preview the site: open `index.html` in a browser, or deploy and use `httpd`. No README run instruction says either. The README's numbered steps are Bitbucket's source-editor tutorial.

## Configuration

| Name | Where read | In repo |
|---|---|---|
| `APPLICATION_NAME` | `codedeploy_deploy.py` | Name only |
| `APPLICATION_NAME_DEV` | `codedeploy_deploy_develop.py` | Name only |
| `DEPLOYMENT_GROUP_NAME` | `codedeploy_deploy.py` | Name only |
| `DEPLOYMENT_GROUP_NAME_DEV` | `codedeploy_deploy_develop.py` | Name only |
| `S3_BUCKET` | Both deploy scripts | Name only |
| `DEPLOYMENT_CONFIG` | Both deploy scripts | Name only |
| AWS credentials | boto3 default chain | Not in repo |
| Web server port, server name, TLS | Not set | **Unknown**. `httpd` package defaults apply if the hooks run unchanged |

## Known defects in the current tree

These are descriptions of the source, for people maintaining the knowledge base. They are not a change request.

1. `controller/core.js` is syntactically invalid, and the one `pageContent` call would request `views/blog/undefined.html` even if it ran.
2. `index_org.html` points the controller script at the wrong relative path.
3. Root "Create an account", shell search, shell side-menu logout, and the profile menu's page links target files that are not at those paths.
4. Wiki menu and `views/wiki/blog.html` are not connected.
5. `scripts/stop_server` does not assign `isExistApp`.
6. `start_server` runs at BeforeInstall, before the revision is copied, and nothing starts `httpd` after the copy.
7. `bitbucket-pipelines_org.yml` is not the filename Bitbucket runs by default.
8. An RSA private key is committed and is inside the CodeDeploy file mapping.