-
-
-
-
+
+
+
+
diff --git a/SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml b/Workspace/SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml
similarity index 93%
rename from SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml
rename to Workspace/SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml
index 071d406..14214f8 100644
--- a/SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml
+++ b/Workspace/SaxoniteCoreWebAdmin/Views/Common/ContactMethods.cshtml
@@ -1,8 +1,8 @@
-@model SaxModel_Admin
+@model SaxModel_Admin
@inject SaxLocaliser Localiser
@{
// Ensure view is only included once in page.
- if (!Model.RegisterView("Views/Common/ContactMethods")) return;
+ if (!Model.RegisterView(ViewContext)) return;
// Scripts.
Model.AdditionalFiles_JS.Add("js/sax-cnt-mth.js");
}
diff --git a/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml b/Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml
similarity index 97%
rename from SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml
rename to Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml
index c107892..d9a1d54 100644
--- a/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml
+++ b/Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemAddress.cshtml
@@ -1,8 +1,8 @@
-@* Controls - Item Address *@
+@* Controls - Item Address *@
@model SaxModel_Admin
@inject SaxLocaliser Localiser
-@if (!Model.RegisterView("Views/Common/Controls-ItemAddress")) return;
+@if (!Model.RegisterView(ViewContext)) return;
@* Item address - Line 1 *@
diff --git a/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml b/Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml
similarity index 95%
rename from SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml
rename to Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml
index 1d7d84f..de7bebd 100644
--- a/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml
+++ b/Workspace/SaxoniteCoreWebAdmin/Views/Common/Controls-ItemContactMethods.cshtml
@@ -1,8 +1,8 @@
-@* Contact Methods controls *@
+@* Contact Methods controls *@
@model SaxModel_Admin
@inject SaxLocaliser Localiser
-@if (!Model.RegisterView("Views/Common/Controls-ItemContactMethods")) return;
+@if (!Model.RegisterView(ViewContext)) return;
+
+# Topic Tracker
+
+Last updated: 2026-10-16
+
+## Prioritised Topics to Be Actioned
+
+| Priority | Topic | Date noted | Next step | Notes |
+|---|---|---|---|---|
+| P1 | Reassess inherited package vulnerabilities after Common updates | 2026-10-16 | Reassess the Common dependency graph after its independent package update; no Common changes are in Saxonite scope. | Restore reports advisories for ImageSharp 3.1.12 and crypto packages 10.0.12/10.0.0 in Common's dependency graph. |
+| P2 | Complete and validate the .NET 10/Common upgrade | 2026-10-16 | Validate application flows with configured Saxonite machine/database settings. | Full solution test run passes: Admin 7, Online 7, Shared 37. Restore completed with inherited vulnerability warnings. Added purpose-isolation/tamper coverage and checks that serialized session data omits IV state. |
+| P3 | Review remaining Saxonite production package versions | 2026-10-16 | Assess the Swashbuckle 7-to-10 major upgrade separately. | Applied available non-major updates to HtmlAgilityPack, Razor runtime compilation, and unit test tooling. NUnit 5 and Swashbuckle 10 remain deferred major-version upgrades. |
+
+## Completed Topics
+
+| Priority | Topic | Date noted | Date started | PR | Version | Date ready | Outcome |
+|---|---|---|---|---|---|---|---|
+| P2 | Restructure Saxonite repository and upgrade to .NET 10 | 2026-10-16 | 2026-10-16 | [#1](http://viking:3000/andy/Saxonite/pulls/1) | 1.3.0 | 2026-10-16 | Moved application and library projects into `Workspace`; upgraded to .NET 10 and aligned Common integration; migrated to authenticated encryption. Version is 1.3.0.0. Debug build and all test suites pass: Admin 7, Online 7, Shared 37. Machine/database runtime validation remains tracked under the prioritized .NET 10/Common validation topic. |
+| P3 | Validate Admin, Online, and shared test project separation | 2026-10-16 | 2026-10-16 | — | — | — | Added `Workspace/SaxoniteUnitTestsShared`; Admin and Online test projects now reference their respective application projects. Added representative tests for shared bus rules and serialized data, Admin association and address models, and Online profile and address models. All three suites pass: Admin 7, Online 7, Shared 37. |
+| P3 | Align test tooling with Common | 2026-10-16 | 2026-10-16 | — | — | — | All three Saxonite test projects use NUnit 4.6.1, NUnit3TestAdapter 6.3.1, NUnit.Analyzers 4.15.0, Microsoft.NET.Test.Sdk 18.11.0, Moq 4.21.0, and coverlet.collector 10.1.0. Migrated MSTest fixtures/assertions, corrected tautological user-id assertions, and verified all suites pass after the package updates. Not yet marked PR-ready. |
diff --git a/docs/upgrade-and-encryption.md b/docs/upgrade-and-encryption.md
new file mode 100644
index 0000000..8f87ac3
--- /dev/null
+++ b/docs/upgrade-and-encryption.md
@@ -0,0 +1,23 @@
+# .NET and Authenticated Encryption Upgrade
+
+Date started: 2026-10-16
+
+## Framework and Common Alignment
+
+All Saxonite projects have been retargeted from .NET 6 to .NET 10. The solution's relative references now resolve to sibling `Common-VS/Workspace`; `SaxoniteStandardBase` references Common's `SacsBusinessBase` for the shared item option definition. Razor runtime compilation was moved to 10.0.12, and redundant legacy `System.Collections.Specialized` and ASP.NET Identity package references were removed where the framework/API now supplies the needed surface.
+
+Restore and Debug build completed. The build succeeds; restore reports inherited package vulnerability advisories detailed below. All three test projects pass (Admin: 7 tests; Online: 7 tests; Shared: 37 tests). Coverage includes purpose isolation, tamper rejection, omission of IV fields from serialized session data, representative shared bus rules and XML serialization, and Admin/Online model behavior.
+
+## Authenticated Encryption
+
+Saxonite callers now use Common's purpose-bound `SACSENC2.` AES-GCM wrappers with distinct purposes for Admin and Online parameters, keep-logged-in cookies, password-reset links, and Online ID obfuscation. Fixed and session IV state has been removed from application session data and reset-link encryption. Decryption remains fail-closed with no legacy CBC fallback.
+
+This is an intentional clean break. Existing encrypted keep-logged-in cookies, password-reset links, and encrypted session/query parameters will no longer decrypt and users may need to sign in again or request a new password-reset link. Admin and Online purposes are separated even where they share key material. Common's migration record is [`../../../Common-VS/Workspace/docs/authenticated-encryption-migration.md`](../../../Common-VS/Workspace/docs/authenticated-encryption-migration.md).
+
+## Remaining Validation and Package Work
+
+Saxonite's three test projects now use the aligned test stack: NUnit 4.6.1, NUnit3TestAdapter 6.3.1, NUnit.Analyzers 4.15.0, Microsoft.NET.Test.Sdk 18.11.0, Moq 4.21.0, and coverlet.collector 10.1.0. Existing test cases were migrated from MSTest attributes and assertions. The tests are a targeted baseline, not a full coverage measure.
+
+The restore reports moderate and high severity advisories for Common's `SixLabors.ImageSharp` 3.1.12 and `System.Security.Cryptography.Xml`/`Pkcs` 10.0.12 (with `Pkcs` 10.0.0 also in part of the graph). These package references belong to Common projects and are outside the Saxonite upgrade scope. Reassess after Common is updated independently.
+
+Runtime validation with machine-specific configuration and database access remains outstanding. The current tests are focused unit tests and do not verify deployment configuration or production flows.