admin-studio
WinForms desktop application used by Head Office staff to manage bookings, supplier setups, financials, receipts and much of the back-office estate, distributed via ClickOnce.
Health score
0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.
Facts
| Languages | csharp, powershell |
| Frameworks | WinForms, WCF clients, MSTest |
| Runtimes | .NET Framework 4.7.2 |
| Tests / CI | some / CI in place |
| Last commit | 2026-07-24 |
| Owner | Owner unknown (mapping to be curated) |
| Domain | Payments and finance (system generated; curate in repo-owners.json to override) |
| Product area | Phenix |
| Hosted | On-prem Deployed to our own machines
|
| Releases | 1 release pipeline(s): \finance\admin-studio\admin-studio CI |
| Integration | wcf, rest, soap |
| Source | Open in Azure DevOps |
Risk flags
Each flag links to its glossary definition.
Dependencies in context
Entanglement
loosely attached Bound into the core by 1 mechanism(s).
- Speaks WCF (client)
Detaches when its WCF surface gains a modern interface or its WCF calls move to one.
Depends on / used by
Migration playbooks
Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.
ZDD adoption
No chance (frozen core)The deliberately frozen legacy core. Policy, not tooling: minimal change flows through these systems, on a slow scheduled cadence with coordinated maintenance windows. Named in the two-speed strategy as frozen legacy core: protect the core, release the rest. Changes here go through the slow scheduled cadence and coordinated maintenance windows.
- Consumes WCF contract packages: never take a breaking client bump mid-feature, and treat obsolete warnings as migration debt
SQL Server exit
Blocked by a shared databasesqlserver:MediaServer, sqlserver:DataWarehouse are shared, so this system cannot change engine on its own: every sharer moves in convoy. Either agree the move with all sharers as one programme, or first split this system's data out behind an owned API, then follow the steps below.
- sqlserver:MediaServer is shared with 4 other system(s)
- sqlserver:DataWarehouse is shared with 3 other system(s)
- Inventory the schema and query surface of sqlserver:MediaServer, sqlserver:DataWarehouse: tables, stored procedures, triggers, cross-database joins and anything else engine-specific.
- Confirm the target: PostgreSQL (relational model; keep transactions and joins, swap the engine).
- Replatform to modern .NET first (see the recommended actions): current PostgreSQL and MongoDB drivers and EF Core providers target modern .NET, and doing one risky change at a time is cheaper than doing two.
- Data access is not through an ORM, so port the SQL by hand: translate T-SQL constructs, replace stored procedures with application code or target-native equivalents, and add integration tests around the queries that matter first.
- Stand up the target alongside SQL Server, backfill with an ETL pass (pgloader or an export/import job), then dual-write or replicate until parity is proven.
- Move reads to the target, watch correctness and latency, then cut writes over and keep SQL Server read-only until confidence is earned.
- Decommission the SQL Server database and remove the connection strings and firewall paths that pointed at it.
Containerisation
Not appropriateThis is a desktop application distributed to user machines; containers do not apply. Its modernisation path is replacement by a web application, not containerisation.
Recommended actions
Rotate the credentials committed to admin-studio
Risk flags indicate credentials or keys in source (plaintext-credentials, secrets-in-repo). Rotate now and enable secret scanning in CI; this is independent of all other work.
Impact: Closes a live security exposure at near-zero cost
proposedReplatform admin-studio to modern .NET
Runs on .NET Framework 4.7.2, out of mainstream support. No pinning dependency blocks it; sequence by fan-in (providers before consumers).
Impact: Reduces the end-of-life runtime count
proposedAssessment notes
admin-studio
Purpose
The primary Head Office thick client for Travel Counsellors' Phenix back office: bookings, supplier configuration, financials (receipts, ledgers, supplier payments, commissions), virtual credit cards, refunds, quotes and more. Distributed as a ClickOnce application (Live and Beta channels) from an internal web server.
Tech stack
C# WinForms on .NET Framework 4.7.2, old-style csproj with packages.config. Four projects (controller layer, common views, Live and Beta executables) plus PowerShell build/deploy scripts and a deployment-scripts git submodule. Consumes dozens of internal TC NuGet client packages (CardPayments, Commission, ContactCentre, BookingDownload, DestinationManagement, ConnectionBroker, CreditCheck, etc.).
Deployment
Included as a prod application with 1 release; build pipeline admin-studio CI, release pipeline \finance\admin-studio\admin-studio CI. azure-pipelines.yml builds on a self-hosted VS agent, imports a ClickOnce signing certificate (PFX committed to the repo with a hard-coded password), and CI/CD publishes to internal shares and the ClickOnce server per README.
Dependencies
Calls admin-studio-api (REST) — the only dependency matching an included repo name. Also consumes many WCF/SOAP services hosted across the estate (ContactCentre, UserAccount, ExchangeRate, AddressLookup, AlertManagement, PhenixFeature, Cruise) and REST APIs (payments router, ledger, destinations, teams, Dynamics 365) whose hosting repos are not confidently mappable to included.json names.
Data stores
Direct SQL Server connections to MediaServer and DataWarehouse databases, alongside SSRS report server access. Most data access is via services rather than direct SQL.
Integration points
WCF (basicHttp/netTcp) service clients, legacy ASMX/SOAP (ContactCentre, SSRS), and REST/HTTP API clients via internal client packages.
Code health
Actively maintained (last commit 2026-07-24). Four MSTest test projects exist but with only ~28 test files for a very large codebase — coverage is thin. CI builds and runs vstest on a self-hosted agent.
Modernisation risks
Large legacy WinForms/.NET Framework 4.7.2 thick client with ClickOnce distribution and an odd Beta-to-Live csproj/config transform scheme. Signing certificate and plaintext DB credentials committed to source. High fan-in on many WCF/SOAP services makes replatforming complex; it is the natural centre of gravity for a back-office web replacement, hence high priority.