Skip to content

Determine visible association types

This operation evaluates the full association-type list and returns only the types the current principal is allowed to see.

Field Value
Operation ID OP-05
Trigger ValidatedAssociationTypes is read by the header settings or header provider
Inputs DPI, security principal
Outputs Authorized set of IPolicyAssociationType values
Primary components clsPolicyHeaderSecurityManager.GetValidAssociationTypes
Entry point Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb

Steps

  1. Load and cache the complete association-type set through clsAssociationTypeFactory.GetAssociationTypes(DPI).
  2. Classify the caller as internal or external based on clsUserType(inSecurityPrincipal).IsSAIFEmployee.
  3. Evaluate each association type.
  4. Unsecured types are always accessible.
  5. Secured types require the principal to hold either <SecurityGroupName> for internal users or <SecurityGroupName>Ext for external users (BR-112).
  6. Return only the accessible types.

Process flow

The following diagram visualizes association-type authorization.

flowchart TD
    Start([Validated types requested]) --> Load[Load all association types]
    Load --> Kind{Internal or external user?}
    Kind --> Eval[Evaluate each type]
    Eval --> Secured{Type secured?}
    Secured -->|No| Keep[Keep type]
    Secured -->|Yes| Check[Check matching resource]
    Check -->|Authorized| Keep
    Check -->|Unauthorized| Drop[Drop type]
    Keep --> Done([Return accessible set])
    Drop --> Done

Failure and edge-case behavior

  • The full association-type set is cached process-wide and does not show an invalidation path in the findings.*
  • Concrete SECURITY_GROUP_NAME values come from data, not source, so the full dynamic resource inventory cannot be confirmed here.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb