BusinessMgr-2019/docs/topics.md

Topic Tracker

<style> table th, table td { vertical-align: top; } </style>

Last updated: 2026-10-06

Prioritised Topics to Be Actioned

Priority	Topic	Date noted	Next step	Notes
P2	Externalise and rotate BusinessMgr encryption keys	2026-09-16	Move the retained in-code keys to protected configuration or a secret store and define coordinated key rotation.	The clean-break AES-GCM migration is complete. Existing key strings were retained by explicit decision; fixed/session IVs and legacy support were removed.
P3 deferred	Review legacy report rendering and printing	2026-09-10	Revisit only when report printing is required or cross-platform output is planned.	System.Drawing.Common is aligned at 10.0.12, but SbmReport remains Windows-only and currently has no implementations or external call sites. Later options are to isolate inactive source and remove the package; isolate active printing in a Windows-targeted project with rendering tests; or redesign reporting around SkiaSharp and generated image/PDF output. ImageSharp is not a direct replacement for printer integration.

.NET 10 Dependencies and Sequence

Work item	Depends on	Unblocks
Commit documentation and tracking changes	None	A clean pre-migration baseline and focused migration history
Capture BusinessMgr baseline	Documentation change separation; current Common-compatible targets; configured integration-test dependencies	Evidence for identifying migration regressions
Retarget BusinessMgr libraries	Common exposing validated .NET 10-compatible targets	Retargeting the web applications and tests
Retarget applications and tests	Migrated BusinessMgr libraries; compatible framework-specific packages	Full solution validation and removal of temporary Common .NET 8 targets
Complete BusinessMgr validation	Successful restore and build; available database and machine configuration	Approval to remove temporary compatibility targets from Common

In-Progress Topics

Priority	Topic	Date noted	Date started	Next step	Notes

Completed Topics

Topic	Date noted	Date started	Date completed	Outcome
Consume Common business object projects	2026-10-06	2026-10-06	2026-10-06	Added SacsBusinessBase references to BusinessMgr projects that consume Common Base objects and SacsBusinessDbas references to projects that consume Common database business objects. The Debug solution build passes with zero errors and existing compiler warnings. Control passes 15/15 tests and Portal passes 13/13.
Migrate encrypted cookies, links, session parameters, and service traffic to authenticated encryption	2026-09-16	2026-09-16	2026-09-16	Switched every listed consumer to purpose-bound SACSENC2. AES-GCM with a fresh nonce per value. Removed fixed and session IVs, legacy reads, and service plaintext fallback. Existing encrypted values are intentionally invalidated and service peers require coordinated deployment; see encryption-consumers.md.
Align System.Drawing.Common with .NET 10	2026-09-16	2026-09-16	2026-09-16	Updated System.Drawing.Common from 6.0.0 to 10.0.12 in SaBusMgrCoreProcs. The complete solution builds, Control passes 11 tests, Portal passes 13 tests, and the package audit reports no known vulnerabilities. Further architectural concern about the dormant Windows-only report code is deferred.
Align Razor runtime compilation with .NET 10	2026-09-16	2026-09-16	2026-09-16	Updated Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation from 6.0.36 to 10.0.12 in the shared web project and both web applications. The complete solution builds; Control passes 11 tests and Portal passes 13 tests. Automated validation now audits all three web package owners, and all report no known vulnerable packages.
Validate the Common Microsoft.Data.SqlClient 7 upgrade	2026-09-15	2026-09-15	2026-09-15	Common now supplies Microsoft.Data.SqlClient 7.0.3 transitively. BusinessMgr builds successfully and both NUnit suites pass without requiring consumer source or package changes.
Consume Common's .NET 10 ODBC dependency	2026-09-15	2026-09-15	2026-09-15	Removed six redundant direct System.Data.Odbc 6.0.2 references. BusinessMgr consumes System.Data.Odbc 10.0.12 transitively through the Common database project where the implementation and eight focused provider tests reside. The solution builds with zero errors; Control passes 11 tests and Portal passes 13 tests.
Migrate BusinessMgr tests from MSTest to NUnit	2026-09-14	2026-09-14	2026-09-15	Replaced MSTest with NUnit 4.6.1, NUnit3TestAdapter 6.3.0, and NUnit.Analyzers 4.15.0 in both test projects. Converted all eight fixtures and 24 tests to NUnit's constraint-style Assert.That model and brought every migrated fixture into line with the repository's section-comment convention. Removed unused Portal SSDT SQL unit-testing references and targets plus one unused transitive Application Insights namespace dependency. The Control base fixture now constructs representative session data instead of passing an uninitialised null value, removing its nullable warning and ensuring its console tests exercise a valid user session. The complete solution builds with the .NET CLI; Control passes 11 tests and Portal passes 13 tests, including coverage collection.
Capture the pre-migration BusinessMgr build and test baseline	2026-09-10	2026-09-10	2026-09-10	Using SDK 10.0.401, restore succeeded. Visual Studio 18 MSBuild built the complete Debug solution successfully, including the SSDT-dependent Portal test project. The .NET CLI built all production projects and the Control tests but reports MSB4278 for the Portal test project's Visual Studio SSDT import, so Visual Studio MSBuild remains required for that project. Common's MailKit 4.13.0 dependency reports NU1902; the CLI build otherwise recorded 20 compiler warnings. Control tests passed 8 of 8 and Portal tests passed 13 of 13.
Pin the BusinessMgr .NET 10 SDK	2026-09-10	2026-09-10	2026-09-10	Added global.json for SDK 10.0.401 with latestPatch roll-forward and prerelease SDKs disabled. Visual Studio MSBuild remains required for the SSDT-dependent Portal test project.
Migrate BusinessMgr to .NET 10 against compatible Common targets	2026-09-10	2026-09-10	2026-09-10	All eight BusinessMgr projects now target net10.0. Visual Studio 18 MSBuild restored and built the complete solution successfully with no compilation errors. Control tests passed 8 of 8 and Portal tests passed 13 of 13 on .NET 10. Package vulnerability and framework-specific package reviews are tracked separately.
Automate BusinessMgr validation	2026-09-12	2026-09-12	2026-09-12	Added eng/validate.ps1 to locate Visual Studio MSBuild, build the SSDT-dependent solution serially, run both test assemblies, and verify diffs and changed-file line endings. The script passes with 8 of 8 Control and 13 of 13 Portal tests.
Remove vulnerable transitive System.Security.Cryptography.Xml 8.0.2 dependency	2026-09-10	2026-09-13	2026-09-13	Replaced the broad legacy Microsoft.AspNetCore.Identity 2.3.1 reference with Microsoft.Extensions.Identity.Core 10.0.12, matching the only used API, PasswordHasher<TUser>. Three focused tests cover both password helpers, wrong-password rejection, current hash round trips, legacy Identity V3 verification, and rehash detection. Restore and build no longer report NU1903; 11 Control and 13 Portal tests pass, and the package audit reports no vulnerable packages for SaBusMgrStandardBase.
Update BusinessMgr test and coverage tooling	2026-09-14	2026-09-14	2026-09-14	Updated both test projects to Microsoft.NET.Test.Sdk 18.10.0, MSTest 4.4.0, and coverlet collector 10.0.1. Full validation passes without MSTest analyzer warnings, with 11 Control and 13 Portal tests. The optional -CollectCoverage validation mode verifies non-empty Cobertura reports for both suites; the SSDT-based Portal project is published with Visual Studio MSBuild before dotnet vstest.