New Website - Revision history

Ashley DeBon at 17:34, 28 July 2026

2026-07-28T17:34:28Z

Ashley DeBon: /* CallProof New Web — Application Overview */

2026-07-28T17:34:12Z

‎CallProof New Web — Application Overview

Ashley DeBon: /* Security mechanisms */

2026-07-28T14:50:03Z

‎Security mechanisms

Ashley DeBon: /* Security mechanisms */

2026-07-28T14:49:28Z

‎Security mechanisms

Ashley DeBon: /* Background processing */

2026-07-28T14:43:37Z

‎Background processing

Ashley DeBon: /* Menu system */

2026-07-28T14:43:29Z

‎Menu system

Ashley DeBon: /* Frontend */

2026-07-28T14:43:19Z

‎Frontend

Ashley DeBon at 13:40, 28 July 2026

2026-07-28T13:40:09Z

Ashley DeBon: /* Dashboard */

2026-07-28T13:26:32Z

‎Dashboard

Ashley DeBon: /* Architecture */

2026-07-28T13:25:52Z

‎Architecture

← Older revision		Revision as of 17:34, 28 July 2026
Line 2:		Line 2:


−	= CallProof New Web ~~— Application Overview~~ =	+	= CallProof New Web =

	'''CallProof New Web''' is a multi-tenant SaaS CRM for field sales teams. It combines account and contact management, Twilio calling and SMS, email, GPS and maps, appointments and tasks, sales opportunities, reporting, gamification, and admin tooling. The web app works alongside CallProof Android and iOS apps.		'''CallProof New Web''' is a multi-tenant SaaS CRM for field sales teams. It combines account and contact management, Twilio calling and SMS, email, GPS and maps, appointments and tasks, sales opportunities, reporting, gamification, and admin tooling. The web app works alongside CallProof Android and iOS apps.

← Older revision		Revision as of 17:34, 28 July 2026
Line 5:		Line 5:

	'''CallProof New Web''' is a multi-tenant SaaS CRM for field sales teams. It combines account and contact management, Twilio calling and SMS, email, GPS and maps, appointments and tasks, sales opportunities, reporting, gamification, and admin tooling. The web app works alongside CallProof Android and iOS apps.		'''CallProof New Web''' is a multi-tenant SaaS CRM for field sales teams. It combines account and contact management, Twilio calling and SMS, email, GPS and maps, appointments and tasks, sales opportunities, reporting, gamification, and admin tooling. The web app works alongside CallProof Android and iOS apps.
−
−	~~== Core stack ==~~
−	* Python '''3.12'''
−	* Django '''5.2.3'''
−	* PostgreSQL via <code>psycopg2-binary 2.9.10</code>
−	* Apache2 with <code>mod-wsgi 5.0.2</code>
−	* Static and media under <code>callproof-static</code>
−	* No <code>package.json</code> or Pipfile — frontend libraries are vendored under <code>callproof-static</code> or loaded from CDN
−
−	~~== Technology stack ==~~
−
−	~~=== Backend ===~~
−	* Django 5.2.3
−	* Python 3.12
−	* PostgreSQL
−	* mod-wsgi
−
−	~~== Security mechanisms ==~~
−	~~{\| class="wikitable"~~
−	~~! Security Area~~
−	~~! Mechanism~~
−	~~! Description~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| Django auth.User + UserProfile~~
−	~~\| Uses Django's built-in authentication system with an extended UserProfile model to manage user accounts, company associations, roles, and additional profile information.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| Complex Password Rules~~
−	~~\| Enforces password complexity requirements such as minimum length, uppercase and lowercase letters, numbers, and special characters where configured.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| <code>cp_login_required</code>~~
−	~~\| Ensures users are authenticated and belong to an active company before accessing protected pages.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| <code>manager_required</code> and Resource Decorators~~
−	~~\| Restricts access to manager-only features and validates user permissions for protected resources and administrative functions.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| Single Browser Login~~
−	~~\| Optionally restricts users to a single active browser session per company to improve account security.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| Company Two-Factor Authentication (2FA)~~
−	~~\| Supports optional company-wide two-factor authentication using the <code>pyotp</code> library for one-time password verification.~~
−	\|-
−	~~\| Authentication & Access~~
−	~~\| Permission-Based Feature Access~~
−	~~\| Controls access to features such as SMS, Call History, Phone Numbers, and other modules using menu permissions and feature flags.~~
−	\|-
−	~~\| Session & CSRF~~
−	~~\| Django Sessions~~
−	~~\| Maintains authenticated user sessions securely using Django's session framework.~~
−	\|-
−	~~\| Session & CSRF~~
−	~~\| CSRF Protection~~
−	~~\| Uses Django CSRF middleware with trusted origin validation to prevent Cross-Site Request Forgery attacks.~~
−	\|-
−	~~\| Session & CSRF~~
−	~~\| SameSite Cookie Handling~~
−	~~\| Configures SameSite cookie behaviour with additional handling for mobile (<code>/m/</code>) application paths where required.~~
−	\|-
−	~~\| Session & CSRF~~
−	~~\| X-Frame-Options~~
−	~~\| Prevents clickjacking attacks by controlling whether application pages can be embedded inside frames or iframes.~~
−	\|-
−	~~\| SSO & Social Login~~
−	~~\| SAML 2.0 with Duo IdP~~
−	~~\| Supports enterprise Single Sign-On (SSO) using SAML 2.0 with Duo Identity Provider, including Assertion Consumer Service (ACS), metadata exchange, and Single Logout (SLO).~~
−	\|-
−	~~\| SSO & Social Login~~
−	~~\| OAuth Authentication~~
−	~~\| Supports authentication through Google, Microsoft, and Apple OAuth providers.~~
−	\|-
−	~~\| Encryption & Secrets~~
−	~~\| AES Encryption~~
−	~~\| Encrypts sensitive email credentials and API-related secrets using AES encryption before storage.~~
−	\|-
−	~~\| Encryption & Secrets~~
−	~~\| CryptoJS~~
−	~~\| Encrypts selected client-side values stored in browser localStorage using CryptoJS.~~
−	\|-
−	~~\| Encryption & Secrets~~
−	~~\| AWS KMS~~
−	~~\| Uses AWS Key Management Service (KMS) to protect S3 objects when server-side encryption is enabled.~~
−	\|-
−	~~\| Encryption & Secrets~~
−	~~\| Environment-Based Secrets~~
−	~~\| Stores sensitive configuration such as API keys, passwords, and encryption keys in environment variables loaded through <code>dotenv</code>.~~
−	\|-
−	~~\| API Security~~
−	~~\| API Key Authentication~~
−	~~\| Authenticates API requests using API keys and shared secrets.~~
−	\|-
−	~~\| API Security~~
−	~~\| Role-Based API Access~~
−	~~\| Restricts API operations according to user roles and assigned permissions.~~
−	\|-
−	~~\| API Security~~
−	~~\| API Request Logging~~
−	~~\| Logs API requests while sanitising sensitive payload information to reduce exposure of confidential data.~~
−	\|-
−	~~\| Operational Security~~
−	~~\| Login Failure Throttling~~
−	~~\| Limits repeated failed login attempts using cache-based throttling to reduce brute-force attacks.~~
−	\|-
−	~~\| Operational Security~~
−	~~\| Account & Company Status Checks~~
−	~~\| Prevents access for disabled user accounts or suspended companies.~~
−	\|-
−	~~\| Operational Security~~
−	~~\| User Impersonation~~
−	~~\| Supports administrator or support impersonation using the <code>old_user_id</code> session value while preserving the original user identity.~~
−	\|-
−	~~\| Operational Security~~
−	~~\| Google reCAPTCHA~~
−	~~\| Supports Google reCAPTCHA on selected forms to reduce automated bot submissions where enabled.~~
−	\|}
−
−	~~== Performance optimizations ==~~
−	* Django cache used for login attempts, filter options, and selected lookups
−	* Default cache is LocMem unless production overrides it; shared Redis is not configured in checked-in settings
−	* <code>PaginationMixin</code> with configurable rows per page across list screens
−	* AJAX partial HTML and JSON responses to avoid full page reloads
−	* ORM use of <code>select_related</code>, <code>prefetch_related</code>, and <code>only</code> where implemented
−	* sorl-thumbnail for resized images such as logos and avatars
−	* Session-stored filter state for heavy list screens
−	* Specialized static routes for recordings, greetings, and user files
−
−	~~== Scalability ==~~
−	* Company-based multi-tenancy supports many isolated customers on one application
−	* Apache and mod-wsgi multi-process hosting
−	* AWS S3 for media, files, and email mailbox storage
−	* AWS SQS for asynchronous workers
−	* Twilio for telephony and SMS capacity
−	* Firebase for push delivery to mobile and web clients
−	* Background export and scheduled report pipelines so large jobs do not block the request thread
−	* Multiple deploy environments such as apptest, staging, UAT, and production via CodeDeploy
−
−	~~== Notable implementation details ==~~
−	* Thin views with service and utility layers in <code>helper</code>, <code>cplib</code>, and app services
−	* Mostly class-based views, with some function-based views and decorators still in use
−	* Soft deletes and hide flags on many domain models
−	* People Tab switches Contacts vs Accounts wording and enables personnel and Roles
−	* CallProof Voice section appears only when company Twilio is enabled
−	* System report mail under <code>/mail/</code> is separate from synced personal email under <code>/em/</code>
−	* Logging uses rotating app logs plus console and domain-specific loggers
−
−	~~== Deployment and operations ==~~
−	* Deployed with Apache and mod-wsgi
−	* Assets served from <code>callproof-static</code>
−	* Media and specialized recording paths under configured static or media URLs
−	* Environment variables drive database, Twilio, SendGrid, AWS, OAuth, SAML, maps, and billing configuration
−	* CodeDeploy supports multiple environments
−
−	~~== Summary ==~~
−	* CallProof New Web is a Django 5.2 and Python 3.12 multi-tenant field-sales CRM on PostgreSQL
−	* Integrates Twilio, SendGrid, Google and Microsoft services, AWS, Firebase, and Duo SAML
−	* Security centers on company-scoped access, CSRF, optional 2FA, encrypted secrets, and SSO
−	* Performance and scale rely on pagination, AJAX partials, caching, S3, SQS workers, and background exports

	== [[Login]] ==		== [[Login]] ==

@@ Line 124: / Line 124: @@
 | Supports Google reCAPTCHA on selected forms to reduce automated bot submissions where enabled.
 |}
 == Performance optimizations ==

@@ Line 23: / Line 23: @@
 == Security mechanisms ==
+{| class="wikitable"
 === Authentication and access ===
 * Django <code>auth.User</code> plus <code>UserProfile</code>

@@ Line 13: / Line 13: @@
 * Static and media under <code>callproof-static</code>
 * No <code>package.json</code> or Pipfile — frontend libraries are vendored under <code>callproof-static</code> or loaded from CDN
 == Technology stack ==

@@ Line 33: / Line 33: @@
 * PostgreSQL
 * mod-wsgi
 == Security mechanisms ==

@@ Line 140: / Line 140: @@
 More Info: [[Login]]
-[[File:LoginView.png|300px|thumb|Login]]
+[[File:LoginView.png|350px|thumb|Login]]
 <div style="clear:both;"></div>
@@ Line 157: / Line 157: @@
 More Info: [[Signup]]
-[[File:SignupView.png|300px|thumb|Signup]]
+[[File:SignupView.png|350px|thumb|Signup]]
 <div style="clear:both;"></div>
@@ Line 168: / Line 168: @@
 More Info: [[Dashboard (New Web)]]
-[[File:Dashboard.png|300px|thumb|Dashboard]]
+[[File:Dashboard.png|350px|thumb|Dashboard]]
 <div style="clear:both;"></div>

@@ Line 161: / Line 161: @@
-== [[Dashboard]] ==
+== [[Dashboard (New Web)]] ==
 Home screen after login. Shows sales activity at a glance: KPI counts, recent events, a map of rep locations, and an opportunity leaderboard.
 Navigation Sidebar CallProof / home icon → Dashboard. Route name: dash_index. Common landing page after login and a common redirect when access is denied elsewhere.
 Access Login required. Available to all logged-in company users. Not manager-only. If Terms of Service are not accepted, users are redirected to /tos/ first.
-More Info: [[Dashboard]]
+More Info: [[Dashboard (New Web)]]
 [[File:Dashboard.png|300px|thumb|Dashboard]]

@@ Line 14: / Line 14: @@
 * No <code>package.json</code> or Pipfile — frontend libraries are vendored under <code>callproof-static</code> or loaded from CDN
 === Menu system ===
 * Menus are database-driven