## 1. Project Overview & Quickstart (OWASP/01-Test_Business_Logic_Data_Validation)

# 01-Test_Business_Logic_Data_Validation

Open-source repository OWASP/01-Test_Business_Logic_Data_Validation

### Repository Details
- **Repository:** [OWASP/01-Test_Business_Logic_Data_Validation](https://github.com/OWASP/01-Test_Business_Logic_Data_Validation)
- **Primary Language:** Code

*Note: High-volume repository documentation is actively indexed and synchronized by YakaAI.*

## 2. Official Technical Reference & Guides (OWASP/docs)

## File: README.md

# OWASP Documentation Library

This is the official library of documentation for the OWASP Foundation,
including our handbooks.

Documentation for individual projects is _not_ hosted in this repository.

## Tech Stack

Documentation files are under `source/`, and are written primarily in
[Markedly Structured Text (MyST)](https://myst-parser.readthedocs.io/en/latest/index.html),
a variant of Markdown (`.md`). Some files may be in RestructuredText (`.rst`)
instead, although we recommend MyST for consistency.

The theme is the sphinx-rtd-theme, with some modifications via
`source/_static/theme.css`.

## Contributing

Contributions are welcome as Pull Requests. However, they must be approved
by a member of the OWASP Foundation staff before they can be merged.

---

## File: .readthedocs.yaml

version: "2"

build:
  os: "ubuntu-22.04"
  tools:
    python: "3.10"

python:
  install:
    - requirements: source/requirements.txt

sphinx:
  configuration: source/conf.py

---

## File: source/index.rst

.. OWASP Foundation documentation master file, created by
   sphinx-quickstart on Mon Apr 15 14:08:17 2024.
   You can adapt this file completely to your liking, but it should at least
   contain the root `toctree` directive.

OWASP Documentation Library
============================================

.. toctree::
   :maxdepth: 2

   handbooks/chapters
   handbooks/events
   handbooks/projects


Indices and tables
==================

* :ref:`genindex`
* :ref:`search`

---

## File: source/requirements.txt

sphinx==7.2.6
sphinx-rtd-theme==2.0.0
myst_parser==2.0.0

---

## File: source/handbooks/chapters.md

# Chapter Handbook

---

## File: source/handbooks/events.md

# Events Handbook

---

## File: source/handbooks/member-support.md

# Membership Billing Questions or Problems

**I need the invoice receipt**
* Navigate to stripe to find the customer
* Match the invoice number to the one the customer is requesting
* Click on the invoice and hit send receipt to the customer’s email address on file

**We signed up with an incorrect email address (or other information)**
* Navigate to stripe to find the customer
* Click the … on the right hand side of the screen and hit edit information
* Change the information that the customer is requesting
* Navigate to admin.google.com and find the same customer
* Click on Edit User
* Change the information that the customer is requesting
* Navigate to Copper and find the same customer
* Click on the user. Information should appear on the right hand side of the screen
* Change the information that the customer is requesting
* Navigate to Mailchimp and find the same customer
* Click on the same user and the information should appear.
* Change the information that the customer is requesting.

# Individual Membership Support

**I can’t login to my OWASP email account**
* Navigate to stripe to determine if their membership has expired or not
* If not, go to admin.google.com to see if the email is active
* If the email is active, hit reset password and send the instructions to the other email account on file
* If the email is not active, and there is no reason the account is suspended, reactivate the account and reset the password

**I cannot create an OWASP email account, can you assist me?**
* Check that the membership has been paid and everything is accurate
* Navigate to admin.google.com
* Navigate to “Home” in admin.google.com
* Under “Users” click “Add User”
* Input the information of their First and Last name, OWASP Email Address, and additional contact information.


**Is it possible to modify my owasp email to…**
* Check that the OWASP email address is in admin.google.com
* Click “Update User” and change the email address to the desired email address
* Locate the customer in Stripe with the old OWASP email address
* Under “Metadata” edit the old email address to the new email address
* Locate the customer in Copper with the old OWASP email address
* On the right hand side, change the email address to the modified email address
* Locate the customer in Mailchimp
* If there is an OWASP email address listed, change it to the new email address

# Membership Portal Support

**How do I access the OWASP membership portal?**
* Navigate to https://owasp.org/membership/
* Sign in to the membership portal using your OWASP email address and password


**What membership benefits do I receive?**
* Navigate to https://owasp.org/membership/
* On the page, scroll down until you see Membership Benefits
* All members receive all of the benefits that are listed on the page


**Can I receive an additional discount?**
* The only discounts offered are available on the ​​https://owasp.org/membership/ page.
* No other discounts or benefits are available at this time.

# New Project Requests 

**9/10 of the tickets I would receive that were New Project Requests did not have enough information or the information was insufficient.**
* In this case, respond to ticket “please provide additional information”
* Hit resolve ticket, then incomplete

# Member Lists for Events
1. Open original google sheet
2. Find previous google sheet with “import” information
3. Create “import” sheet on original google sheet
4. Copy row ‘A’ from “import” sheet from previous google sheet
5. Input information on “import” sheet on original google sheet from the attendees list on the original google sheet
6. Once all information is added, download the “import” google sheet as a .csv file
7. Go to https://admin.owasp.org/
8. Under “The following should only be used by the Membership Manager or appointed representative Membership upload file:” select “Choose file” and select the downloaded .csv file.
9. Click “upload” and wait for a message at the top of the page saying “Successful upload. An email will be sent to membership@owasp.com when processing is complete.”
10. Check membership@owasp.com for messages saying: Customer created in Stripe, Copper Opportunity created, Mailchimp information added or updated.

# Resources
* https://owasp.org/www-staff/member_workflow
* https://owasp.org/www-staff/member_pricing
* https://owasp.org/www-staff/procedures/refunding_membership
* https://owasp.org/www-staff/member_list

---

## File: source/handbooks/projects.md

# Project Handbook

---

## File: source/infrastructure/azure-backend.md

# Azure Environment
OWASP leverages a few Azure technologies in order to automate and support business processes.  This page will serve to document the backend jobs that exist today.

### Azure Subscription Details
**Subscription Name:** Microsoft Azure Sponsorship 

## Automation Account

The automation account hosts runbooks written in Python which are responsible for integrating and updating data amoungst the various systems supporting OWASP. These are all scheduled backend jobs that run nightly.

### Automation Account & Runbook Details
 **Azure Resource Group:** Staff-Administration
 **Automation Account Name:** OWASPAutomation
 **Github Repo:** https://github.com/OWASP-Foundation/Automations

## Automation Account

### Summary of Runbooks
| Runbook Name | Summary of Functionality |
|:---|:---|
| ChapterNightly |Updates the _data/chapters.json file for the website based on the info obtained from all the GitHub chapter repositories|
| CommunityEventsNightly |Updates the _data/communityevents.json file for the www-community repository website based on the info obtained from GitHub chapter repositories and Meetup|
| EventsAndCommitteeNightly |Updates the _data/committees.json and _data\revents.json file for the website based on the info obtained from GitHub revent and committee repositories|
| EventsAndCorpMembersNightly |Copies _data/corp_members.yml to assets/sitedata/corp_members.yml and _data/events.yml to assets/sitedata/events.yml|
| LeadersNightly |Updates the _data/leaders.json file for the website based on the info obtained from all the GitHub repositories|
| MemberEmailCleanupNightly |Suspends Google accounts based on info obtained from various systems|
| ProjectsNightly |Updates the _data/projects.json file for the website based on the info obtained from GitHub project repositories|
| RepositoryNightlyBuild |Gathers data for all Github repositories and updates the RepoEntries table in the owaspadmin941c Azure Storage Account  |
| UpdateGoogleLeaderGroups |Adds all the leaders into the proper Google leader groups|



## OWASP API

The OWASP API is implemented using Azure Functions written in Python.  This API supports a lot of the functionality on the OWASP website and in the OWASP Slack workspace.

### Azure Function Details
**Azure Resource Group:** Staff-Administration
**Function Name:** owaspadmin
**Github Repo:** https://github.com/OWASP-Foundation/owaspadmin-azurefunctions


### Summary of API Endpoints & Supporting Components
| Functional Area | Function | Type | URLs/Slack command | Notes |
|:---|:---|:---|:---|:---|
| **Membership** |||||
|| BillingManagement | HTTP | owasp.org/manage-membership/ | Returns basic info indicating that an email with link will be sent to the email address on file |
|| CreateCheckoutSession | HTTP | owasp.org/membership/ owasp.org/manage-membership/ owasp.org/membership/force_majeure/ (not really used here) owasp.org/donate/ | Handles membership -> Stripe -> Back to Azure function StripeWebhookProcessor Shows member information for managing subs and provisioning email (etc) Handles donations -> Stripe -> Back to Azure function StripeWebhookProcessor |
|| CreateLeaderMembership | HTTP | owasp.org/membership/ owasp.org/membership/force_majeure/ (not really used here) | Handles creating the free leader memberships |
|| CreateForceMajeureMembership | HTTP | owasp.org/membership/force_majeure/ | Handles creating the free 'Force Majeure' memberships |
|| CancelSubscription | HTTP | owasp.org/manage-membership/ | Cancels membership subscription |
|| get-member-info | HTTP | members.owasp.org/ | Gets the membership info displayed on index.md in the Member Portal |
|| HandleAddMembers | HTTP | admin.owasp.org | Used when adding members from a CSV file from conferences |
|| process-handle-add-members | Queue || Processes the queue item created from HandleAddMembers |
|| IsLeaderByEmail | HTTP | owasp.org/membership/ owasp.org/membership/force_majeure/ (not really used here) | Used to determine if the person trying to get Leader complimentary membership is a leader |
|| update-member-info | HTTP | members.owasp.org | Updates the PII if a member edits their info in the Member Portal |
|| IsMember | HTTP || Meant to allow third parties to verify membership provided they have an 'api key' - not currently in use |
|| member-report | HTTP || Not currently in use - see member-report-go in the azure-afgo functions |
| **Slack** |||||
|| BillingSlackBot | HTTP | /contact-lookup, /contact-details, /stripe-details | processes the given commands in stripe under staff-general |
| **Chapter** |||||
|| chapter-create | HTTP | /chapter-create | displays the chapter creation dialog in Slack which will trigger the SlackActionTrigger which puts a chapter item in the chapter queue |
|| chapter-process | Queue || takes an item from the chapter queue and processes it, producing a chapter repo, updating copper, etc |
|| chapter-report | HTTP || creates a chapter report under the staff drive in google and provides a link to it -> can time out |
|| chapter-lookup | HTTP || Originally listed as disabled; pending review of functionality |
| **Committee** |||||
|| committee-create | HTTP | /committee-create | displays the committee creation dialog in Slack which will trigger the SlackActionTrigger which puts a committee item in the committee queue |
|| committee-process | Queue | /committee-create | takes an item from the committee queue and processes it, producing a committee repo, updating copper, etc |
| **Project** |||||
|| project_create_jira | HTTP | /project-create-jira | takes the JIRA ticket ID as argument. JIRA leader names, leader emails, and leader github usernames must all be filled and having matching amount of entries. Puts a project item on the project queue |
|| project_create_jira_process | HTTP || takes an item from the project queue and processes it, producing a project repo, updating copper, etc. and responds to the JIRA ticket |
|| project-create | HTTP || Not currently used |
|| project-process | Queue || Not currently used |
|| project-report | HTTP | /project-report | creates a project report under the staff drive in google and provides a link to it -> can time out |
| **Event** |||||
|| event-create | HTTP | /event-create | displays the event creation dialog in Slack which will trigger the SlackActionTrigger which puts an event item in the event queue |
|| event-process | Queue || takes an item from the event queue and processes it, producing a event repo, updating copper, etc |
|| EventBotQueueWorker | Queue || Processes all the commands under /events |
|| EventsCheckout | HTTP || Foundation of Stripe checkout in events - not currently in use |
|| EventsSlackbot | HTTP | /events | Not currently used by staff but can produce an integrated event experience from website to checkout |
| **Miscellaneous** |||||
|| get-repo-file | HTTP || Gets a file from a repo but not currently used for anything |
|| GetMeetupEvents | HTTP || Gets events from Meetup for a group but not currently used |
|| leader-report | HTTP | /leader-report | Puts a report in the staff drive under chapters but also gives link in Slack |
|| owasp_slack_add_user | HTTP | owasp.org/slack/invite | Handles adding users to Slack |
|| report-process | Queue || processes the items created by /chapter-report and /project-report |
|| provision-zoom-email | HTTP | /provision-zoom-email | Adds the leaders in the repo given to a zoom leaders email, a zoom group, and emails them all telling them how to access |
|| provision-zoom-process | Queue | /provision-zoom-email | Does the actual work for the /provision-zoom-email command |
|| ProvisionEmail | HTTP | owasp.org/manage-membership /members.owasp.org/ | Provisions email address for OWASP members |
|| rebuild_milestones | HTTP | /rbsp | Rebuild www-staff milestones but this is no longer used |
|| rebuild-site | HTTP | /rebuild-site | Does a 'full' rebuild of all www- OWASP pages (github is flaky and may skip them). Only use overnight is suggested. |
|| RunCurrentTests | HTTP | /rebuild-site | Not used at this time |
|| SlackActionTrigger | HTTP || Processes items for chapter-create, project-create, committee-create, event-create, and various /events items |
|| stripe-customer-cleanup | Timer | Nightly | Runs nightly to clean up spam customers in Stripe. Does not always complete as there are alot of spam customers. They are customers created with 0 metadata, 0 dollars spent, etc. |
|| StripeQueueWorker | Queue | nightly | Does all the actual work for handling things that go through stripe including membership, donation, subscriptions |
|| StripeWebhookProcessor | HTTP || Handles the webhooks from Stripe for checkout.session.completed, product.created, sku.created, sku.updated, order.created, charge.refunded, invoice.paid Many of these things (product, sku based) were used in the /events flow |
|| validate-otp-user | HTTP || Cloudflare validater for logging into members.owasp.org, for instance. |
|| contact-lookup | HTTP || originally listed as disabled, but it's enabled.  Code review pending. |
|| ccontact-lookup-process | Queue || originally listed as disabled, but it's enabled.  Code review pending. |
| **Disabled** |||||
||BuildRepositoriesEntry||||
||BuildSiteFiles||||
||BuildSiteFilesOrchestrator||||
||BuildSiteFilesStart||||
||BuildStaticWebsiteFiles||||
||BuildStaticWebsiteFilesTwo||||
||disable-owasp-emails||||
||DisableEmail1DayNotice||||
||DisableEmail7DayNotice||||
||DisableEmail15DayNotice||||
||DisableEmailVerify||||
||DisableOWASPEmail||||
||StudentMemberQueueWatcher||||
||StudentMemberWebHook||||


### API Endpoints - Website Details


### API Endpoints - Slack Details

---

## File: source/infrastructure/OWASPAzureFunctionsEval.md

# OWASP Azure Functions Evaluation

### BillingManagement
- Used in the currently redirected manage-membership page on owasp.org
- Enabled: Yes
- Invocations (30 days): 0
- Evaluation: Can be removed

### BillingSlackBot
- Slack commands: /stripe-details, /contact-details, /contact-lookup
- Enabled: Yes
- Invocations (30 days): 2
- Evaluation: Can be removed; not used for GlueUp memberships

### BuildRepositoriesEntry
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### BuildSiteFiles
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### BuildSiteFilesOrchestrator
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### BuildSiteFilesStart
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### BuildStaticWebsiteFiles
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### BuildStaticWebsiteFilesTwo
- Originally built site JSON; replaced by OWASPAutomation
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### CancelSubscription
- Used to cancel subscriptions in manage-membership
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed; not used in GlueUp

### chapter-create
- Slack command to create a chapter
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed with new website

### chapter-process
- Processes chapter creation dialog
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed with new website

### chapter-lookup
- Slack command to give chapter details from Salesforce
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed with new website

### chapter-report
- Slack command to launch chapter report
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed with new website

### committee-create
- Slack command to create a committee
- Enabled: Yes
- Invocations: 0
- Evaluation: Keep while committees remain in GitHub

### committee-process
- Processes committee creation dialog
- Enabled: Yes
- Invocations: 0
- Evaluation: Keep; update to use Monday.com instead of Copper CRM

### contact-lookup
- Slack command to look up a contact from Salesforce
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### contact-lookup-process
- Processes contact lookup
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### CreateCheckoutSession
- Used in donate.md and previously membership pages
- Enabled: Yes
- Invocations: 101
- Evaluation: Processes donations; errors likely misuse

### CreateForceMajeureMembership
- Previously used for Force Majeure memberships
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### CreateLeaderMembership
- Previously used for complimentary leader memberships
- Enabled: Yes
- Invocations: 11
- Evaluation: Can be removed; successes not valid

### disable-owasp-emails
- Ran nightly to disable unused emails; now does nothing
- Enabled: Yes
- Invocations: 30
- Evaluation: Can be removed

### DisableEmail15DayNotice
- Sent notices 15 days before email disable
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### DisableEmail1DayNotice
- Sent notices 1 day before email disable
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### DisableEmail7DayNotice
- Sent notices 7 days before email disable
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### DisableEmailVerify
- Added users to notification queues
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### DisableOWASPEmail
- Disables OWASP email
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### event-create
- Slack command to create regional event info
- Enabled: Yes
- Invocations: 0
- Evaluation: Keep while regional events remain in GitHub

### event-process
- Processes regional event creation
- Enabled: Yes
- Invocations: 0
- Evaluation: Keep; update to use Monday.com

### EventBotQueueWorker
- Processes Slack event creation queue
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### EventsCheckout
- Handled ordering tickets for Slack-created events
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### EventsSlackbot
- Slack commands for creating events/sites
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### get-member-info
- Used in www-members site
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### get-repo-file
- Pulls a file from GitHub
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### GetMeetupEvents
- Displays chapter Meetup events
- Enabled: Yes
- Invocations: 47,504
- Errors: 815
- Evaluation: Can be removed when moved to owasp.community

### HandleAddMembers
- Queues add-members requests
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### IsLeaderByEmail
- Looks up leader email
- Enabled: Yes
- Invocations: 1
- Evaluation: Can be removed

### IsMember
- Looks up membership in Copper CRM
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### leader-report
- Requests a leader report
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### member-report
- Requests a member report
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### owasp-slack-add-user
- Adds a user to the OWASP Slack instance
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### process-handle-add-members
- Processes the HandleAddMembers command
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### project-create
- Slack command to create a www-project- page
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### project-process
- Processes the project-create command
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### project-report
- Slack command to launch a project report
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### project_create_jira
- Slack command to create a project page from JIRA
- Enabled: Yes
- Invocations: 0
- Evaluation: Useful until projects move

### project_create_jira_process
- Processes the JIRA-based project creation
- Enabled: Yes
- Invocations: 0
- Evaluation: Useful; needs update

### provision-zoom-email
- Adds leaders to a shared Zoom account
- Enabled: Yes
- Invocations: 1
- Evaluation: In use; Zoom accounts need updates

### provision-zoom-process
- Processes Zoom provisioning
- Enabled: Yes
- Invocations: 1
- Evaluation: Same as above

### ProvisionEmail
- Self-provisioning of OWASP email
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### rebuild-site
- Rebuilds all GitHub pages sites
- Enabled: Yes
- Invocations: 0
- Evaluation: Use sparingly

### rebuild_milestones
- Rebuilds staff milestones
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### report-process
- Processes report commands
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### RunCurrentTests
- Used to run and test functionality
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### SlackActionTrigger
- Pre-processes Slack commands
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### stripe-customer-cleanup
- Cleans unused Stripe customers
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### StripeQueueWorker
- Processes Stripe payments, invoices, donations
- Enabled: Yes
- Invocations: 22
- Evaluation: Keep while Stripe donations remain

### StripeWebhookProcessor
- Adds queue messages from Stripe webhooks
- Enabled: Yes
- Invocations: 23
- Evaluation: Keep while Stripe donations remain

### StudentMemberQueueWatcher
- Created student memberships in Salesforce
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### StudentMemberWebhook
- Added queue messages for student memberships
- Enabled: No
- Invocations: 0
- Evaluation: Can be removed

### update-member-info
- Allows self-updates to member information
- Enabled: Yes
- Invocations: 0
- Evaluation: Can be removed

### validate-otp-user
- Cloudflare validator for old members site
- Enabled: Yes
- Invocations: 4
- Evaluation: Can be removed