SAIF.Application security and authorization¶

This page documents authorization mechanisms implemented or consumed by SAIF.Application. Authentication is infrastructure-provided; this library focuses on programmatic authorization checks, role assignment, and reusable access caching.

Authorization architecture¶

SAIF.Application uses local programmatic checks that delegate resource authorization to clsSecurityPrincipal. UserAccess caches resource checks, while AppManagerBase exposes application-level accessibility flags derived from a single effective AppSecurityRole value.

flowchart TD
    Caller[Calling code] --> AppManager[AppManagerBase]
    Caller --> Access[UserAccess]
    AppManager --> Role[MarkUpdate / MarkViewOnly / MarkNoAccess]
    Access --> Principal[clsSecurityPrincipal]
    Principal --> Access
    Role --> Result[Accessibility flags]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
(none documented as literals)	Resource names are supplied by callers at runtime rather than defined in this library.	`UserAccess.HasAccess(...)`; `UserAccess.CheckAccess(...)`	`Application\SAIF.Application\UserAccess.vb`

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`UserAccess`	`HasAccess(inResourceName)`	Caller-supplied resource name	`IsAuthorized`	`Application\SAIF.Application\UserAccess.vb`
`UserAccess`	`CheckAccess(ParamArray inResourceName())`	Caller-supplied resource names	`HasAccess`	`Application\SAIF.Application\UserAccess.vb`
`AppManagerBase`	`SecurityRole`, `IsAccessible`, `IsUpdateable`, `IsViewOnly`, `IsRestricted`	`AppSecurityRole` (`ViewOnly`, `Update`, `NoAccess`)	Role state	`Application\SAIF.Application\AppManagerBase.vb`
`AppManagerBase`	`OnCheckSecurity()`	Role assignment through `MarkUpdate()`, `MarkViewOnly()`, `MarkNoAccess()`	Security hook	`Application\SAIF.Application\AppManagerBase.vb`

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Framework security principal used for authorization decisions.	`UserAccess`; `AppManagerBase`	`Application\SAIF.Application\UserAccess.vb`; `Application\SAIF.Application\AppManagerBase.vb`
`UserAccess`	Library-local authorization cache wrapper over `clsSecurityPrincipal`.	Application-manager implementations and other callers that need reusable resource checks.	`Application\SAIF.Application\UserAccess.vb`
`AppManagerBase`	Base class that translates security decisions into library-visible accessibility state.	Concrete application-manager implementations in consuming applications.	`Application\SAIF.Application\AppManagerBase.vb`

Notes¶

AD resource names listed here use runtime caller input rather than hard-coded string literals in this library.
Role-state behavior aligns with BR-001, and cached access behavior aligns with BR-003.

Sources¶

Application\SAIF.Application\AppManagerBase.vb
Application\SAIF.Application\Enums.vb
Application\SAIF.Application\UserAccess.vb