---
title: Tech debt
summary: Known gaps, risks, and follow-up work for this proxy.
status: draft
owner: SAIF.Core documentation
last_reviewed: 2026-09-24
---

# Tech debt

| ID | Severity | Finding | Evidence | Suggested remediation |
| --- | --- | --- | --- | --- |
| TD-CR-01 | Medium | Dead generated proxy: ~900 KB of generated code (`Reference.cs`), 8 metadata files, and 35 `.datasource` files are compiled and shipped in `SAIF.Services.Web.Proxies.dll` with no in-repo consumer | `Services/SAIF.Services.Web.Proxies/Service References/CallRex/` | Remove the service reference if no consumer is planned, or document the intended external consumer that justifies keeping it |
| TD-CR-02 | Low | Unused vendor assembly references: `CallRex.Utilities.dll` and `CallrexAPIUtilities.dll` are referenced by the project but not imported by any source file | `SAIF.Services.Web.Proxies.csproj:57-62`; `Libs/ThirdParty/CallRex/` | Remove the references if unused, or confirm a runtime need (e.g., reflection-based use) |
| TD-CR-03 | Medium | Ambiguous configuration: two endpoints (`CustomBinding_IClientService`, `CustomBinding_IClientService1`) share the same contract with no endpoint name distinction a caller must supply; `IClientAccessPolicy` has no endpoint at all | `app.config:61-70`; `service.wsdl:1753,3315-3330` | Consolidate to one endpoint per intended use case, or document why two coexist; add an `IClientAccessPolicy` endpoint if that contract is ever needed |
| TD-CR-04 | Low | No timeouts configured on `CustomBinding_IClientService`; framework defaults (1 min send/open/close, 10 min receive) would silently apply if the proxy were ever used | `app.config:34-37` | Set explicit timeouts before any caller is introduced |
| TD-CR-05 | Low | Stale test namespace: `AudioVideoTests` is namespaced `SAIF.Services.Tests.CallRex` but depends on an undefined `CallRecordingSystem` type and is permanently skipped | `Tests/SAIF.Services.Tests/AudioVideo/AudioVideoTests.cs:13,21,35,83,132,161` | Delete or rewrite the test; the namespace is misleading since it does not exercise this proxy |
| SEC-CR-01 | High | Transport is plain HTTP (`http://callrexprod:8002/ClientService`, `http://callrexprod:8002/ClientServiceBasic`); NTLM authenticates the caller, but message bodies are not encrypted in transit | `app.config:61,66` | Require HTTPS/TLS transport before any caller is introduced, given the sensitive operations below |
| SEC-CR-02 | High | Sensitive operations are present on the contract but unused: `Login(username, password)`, `ChangePassword(oldPassword, newPassword)`, `SetNewEncryptionKey(username1, password1, username2, password2, revokeExistingKeys, enableEncryption)`, `UpdateUser(user, passwordChanged)` carry credentials in message bodies over HTTP | `service.xsd` element definitions for these operations | If a caller is ever introduced, ensure TLS transport and avoid logging these message bodies |

## Config applicability gap

The `app.config` of a class library that ships only DLL/PDB is not loaded by package consumers*, so any external `SAIF.SAIFCode.Core` consumer that constructs these clients would need to supply its own `<client>` configuration — the two endpoints documented here would not apply automatically.

## Related documentation
- [Client index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Contract](contract.md)
- [Operation map](operation-map.md)
- [Client reference](reference.md)
- [Consumption](consumption.md)
- [Dependencies](dependencies.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `Services/SAIF.Services.Web.Proxies/app.config`
- `Services/SAIF.Services.Web.Proxies/SAIF.Services.Web.Proxies.csproj`
- `Services/SAIF.Services.Web.Proxies/Service References/CallRex/service.wsdl`
- `Services/SAIF.Services.Web.Proxies/Service References/CallRex/service.xsd`
- `Tests/SAIF.Services.Tests/AudioVideo/AudioVideoTests.cs`
- `Libs/ThirdParty/CallRex/CallRex.Utilities.dll`
- `Libs/ThirdParty/CallRex/CallrexAPIUtilities.dll`