OBRetentionService tech debt¶
The proxy is a small, single-operation consumer with no resilience configuration at all. No credential is configured, so there is no secret-handling finding. Severities below are assigned by the documentation run from the analysis findings; the analysis recorded candidates without ratings.
CRITICAL¶
None recorded. No literal credential or secret exists for this proxy.
HIGH¶
| Finding | Component | Impact | Recommended action |
|---|---|---|---|
| No retry, timeout, or cancellation is configured; the binding sets no timeouts and the call is synchronous with no cancellation token | OnBaseService, binding in ProcessOB3PRetention/App.config |
A transient failure surfaces directly and ends the run at the first failing batch; a hung call is bounded only by the transport default | Set explicit binding timeouts and decide on a retry policy |
Every call sends a hard-coded placeholder document (text/plain, literal Base64 content) |
OnBaseService.ProcessRetention (ProcessOB3PRetention/Services/OnBaseService.cs:24) |
The archived document content is fixed test content rather than business data | Confirm with the OnBase owners that placeholder content is the intended contract |
| The generated client is never closed or aborted and a fault is not distinguished from other failures | OnBaseService |
A faulted channel is neither recovered nor released before process exit | Dispose the client with a close-or-abort pattern and handle communication faults explicitly |
throw ex; discards the original stack trace and only the message is logged |
ThirdPartyRetentionProcessor.Execute (ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs:64) |
Failures from the SOAP call lose their origin in logs | Rethrow with throw; and log the full exception |
The long result is logged but not validated or persisted, and the archive-then-mark sequence is not atomic |
ThirdPartyRetentionProcessor.Execute (ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs:52) |
A failure between the two steps leaves a batch sent but unmarked, so a later run could resend it* | Validate the result and make the sequence idempotent or recoverable |
The endpoint setting has no fallback, and the App.config endpoint address is a superseded QA value |
OnBaseService constructor, ProcessOB3PRetention/App.config |
A missing ProcessOB3PRetention.WSPEndPointUrl fails during container resolution outside the logged try; the App.config address can mislead a reader into believing QA is always targeted* |
Fail with a clear message on a missing setting and remove or annotate the unused address |
Also recorded below HIGH: the generation snapshots configuration.svcinfo and configuration91.svcinfo name the binding BasicHttpBinding_HylandOutBoundContract1 while ProcessOB3PRetention/App.config uses the unsuffixed name, so an Update Service Reference could re-insert a second binding and endpoint*. The captured WSDL also carries no capture date.
Related documentation¶
- Client index
- Overview
- Architecture
- Contract
- Operation map
- Client reference
- Consumption
- Dependencies
- Business rules
Note: Statements marked with
*were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.
Sources¶
- ProcessOB3PRetention/Services/OnBaseService.cs
- ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs
- ProcessOB3PRetention/Program.cs
- ProcessOB3PRetention/App.config
- ProcessOB3PRetention/Connected Services/OBRetentionService/configuration.svcinfo
- ProcessOB3PRetention/Connected Services/OBRetentionService/configuration91.svcinfo
- ProcessOB3PRetention/Connected Services/OBRetentionService/EISClientWithConfig.wsdl
- environmentSettings/settings.yml