BusinessMgr-2019/docs/component-reviews.md

Component Review Register

<style> table th, table td { vertical-align: top; } </style>

Last updated: 2026-09-16

Component	Scope	Status	Date reviewed	Next steps	Notes
BusinessMgr encrypted cookies, links, session parameters, and service traffic	Authenticated-encryption migration	Clean-break migration implemented	2026-09-16	Smoke-test cookies, emailed links, session URLs, and end-to-end service traffic; later externalise and rotate retained in-code keys.	All consumers use Common's purpose-bound SACSENC2. AES-GCM envelope with fresh nonces. Fixed/session IVs, CBC, legacy reads, and plaintext fallback are removed. Existing encrypted values are intentionally invalidated; coordinated service deployment is required. See encryption-consumers.md.
BusinessMgr.sln	.NET 10 restore, Debug build, and tests	Migrated; passing with warnings	2026-09-16	Perform application smoke tests, then release-validate.	All eight projects target net10.0. Razor runtime compilation 10.0.12, System.Drawing.Common 10.0.12, and the tested Common database dependencies are aligned with .NET 10. Control tests pass 15 of 15 and Portal tests pass 13 of 13.
SaBusMgrCoreWeb and web applications	Razor runtime compilation	Dependency aligned with .NET 10	2026-09-16	Retain the package-owner audits and cover runtime view compilation in application smoke testing.	Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation 10.0.12 is referenced by the shared web project and both applications. The solution build and both test suites pass, and all three package audits report no known vulnerabilities.
SaBusMgrCoreProcs/Procs/Reports	System.Drawing.Common and legacy report printing	Dependency aligned; Windows-only architecture review deferred	2026-09-16	Revisit only when report printing is required or cross-platform report output is planned.	System.Drawing.Common 10.0.12 builds and audits cleanly. The Windows-only subsystem uses Graphics, printing, fonts, brushes, text measurement, and footer rendering, but the abstract SbmReport currently has no implementations or call sites. Future options remain isolation/removal, a dedicated Windows-targeted project with rendering tests, or replacement with SkiaSharp-based image/PDF reporting.
SaBusMgrStandardBase/Base/Helpers/SbmPasswordHelper.cs and SaBusinessMgrCoreWebControl/Control/Helpers/SbmcPasswordHelper.cs	Password hashing	Dependency upgrade complete; legacy hashes compatible	2026-09-13	Preserve the compatibility tests when password-hashing defaults or account migration behavior changes.	Both helpers use PasswordHasher<TUser> from Microsoft.Extensions.Identity.Core 10.0.12. Current hashes round-trip, wrong passwords fail, and legacy Identity V3 hashes remain valid while being identified for rehash.
eng/validate.ps1	Repository validation	Complete; passing	2026-09-16	Use as the standard validation entry point and extend it when repository-wide checks change.	Restores and builds serially with the .NET CLI, runs 11 Control and 13 Portal NUnit tests, audits the Identity, process, and three web package owners, and verifies changed-file line endings and diffs.
SaBusMgrTest_Control and SaBusMgrTest_Portal	Test framework, SDK, and coverage tooling	Migrated to NUnit; coverage verified	2026-09-15	Use NUnit constraint assertions with Assert.That wherever possible.	Both projects use Microsoft.NET.Test.Sdk 18.10.0, NUnit 4.6.1, NUnit3TestAdapter 6.3.0, NUnit.Analyzers 4.15.0, and coverlet collector 10.0.1. All tests use NUnit's constraint assertion model; Control passes 11 tests and Portal passes 13 tests. The Control base fixture constructs valid session data from the configured test account, avoiding a null session in console tests. The optional validation coverage mode verifies a non-empty Cobertura report from each suite without an SSDT-specific publish step.