# GB4.7MFE Project Memory

## Project Overview
- Angular 20 MFE monorepo, Native Federation, 39 micro-frontends, 67 shared features
- ~830 components, ~863 services — ongoing active development
- Stack: Angular 20, NGXS, TailwindCSS, TypeScript 5.8 strict, Keycloak, Firebase
- Branch: GBDEV4.x

## Key Paths
- Host: `projects/gbhost/`
- Core HTTP service (1499 lines): `libs/common/src/lib/gbservice/gbhttpservice/`
- Shared signals: `libs/common/src/datapassing.ts`
- Auth service: `features/login/service/login.service.ts`
- Layout shell: `features/gblayout/gblayout.component.ts`
- Form JSONs (440+): `projects/gbhost/public/formjson/`
- State: `features/gbngxsstore/`
- i18n config: `transloco.config.ts` | files: `projects/public/i18n/`
- Path alias: `@gbcommon/common` → `libs/common/src/public-api.ts`

## P0 Security Issues (must fix before production)
See `security.md` for full details.
1. Hardcoded Jasper creds: `budget.component.ts`, `visitorpass.component.ts`
2. Hardcoded AES-256 key `'12345678901234567890123456789012'`: `login.service.ts:176,521`
3. `bypassSecurityTrustHtml`: `gbrichtexteditor.component.ts:101`, `gbdynamichtml.component.ts:20`
4. SSO token in `localStorage`: `login.service.ts:639` → use httpOnly cookie
5. ClientSecret in URL query param: `login.service.ts:319` → move to POST body

## Known Memory Leaks
See `memory-leaks.md` for full details.
- `gblayout.component.ts:53,60` — unclean subscribe + window resize listener leak
- `gbusersetting.component.ts:93` — subscribe with no cleanup
- `login.service.ts:145-652` — nested subscribes, no takeUntil (singleton = permanent leak)
- `gbqrscanner.component.ts:122` — setInterval not cleared on destroy

## Mandatory Patterns for All New Code
```typescript
// Every component MUST have:
changeDetection: ChangeDetectionStrategy.OnPush
private destroy$ = new Subject<void>();
ngOnDestroy() { this.destroy$.next(); this.destroy$.complete(); }
// Every subscribe MUST use:
.pipe(takeUntil(this.destroy$)).subscribe(...)
// No any types — define interfaces
// No console.log — use GbConsoleService
// No bypassSecurityTrust* — use DOMPurify
// No hardcoded display strings — use Transloco keys
// Dialog widths: min(600px, 95vw) not fixed px
```

## i18n Rules (see `i18n.md`)
- Use `@jsverse/transloco` only — remove `@ngx-translate/core`
- All display strings: Transloco keys, not hardcoded English
- Arabic supported but RTL CSS missing — add for all layout components
- Config missing: `fallbackLang: 'en'`, `missingHandler.useFallbackTranslation: true`

## Architecture Notes (see `architecture.md`)
- Layer: Component → Service → DBService → GbHttpService → Backend
- State: Signals (local), NGXS (global persistent only), no new BehaviorSubjects
- `GbHttpService` needs splitting into focused services
- No ESLint/Prettier/Husky — add before next major module
- Both Karma+Jest configured — neither actively used; pick one
- New module checklist in `architecture.md`

## Responsive Notes (see `responsive.md`)
- `gblayout.component.ts:46` — hardcoded 160px offset for screenheight
- All MatDialog uses fixed `width: '600px'` — change to `min(Xpx, 95vw)`
- No RTL CSS despite Arabic language support

## Analyzed Modules (see docs/analysis/)
- `leave-analysis.md` — ESS Leave (leaverequest 2226L + leaverequestlist 1222L), 13 P0 issues, 4 redundant API call chains, duplicate PicklistValue handlers break employee selection in list view

## User Preferences
- Ongoing development: new modules and subprojects planned
- Wants all analysis and standards persisted across sessions
- Prefers concise responses with file:line references