An external user record carries an IsAuthorizedUser flag persisted to EXT_USER.AUTHORIZED_USER_FLAG; the flag gates access decisions in calling application layers.*
Trigger
Insert or update of an EXT_USER record.
Enforcement
clsUser.InsertSQL (SQL-005) and clsUser.UpdateSQL (SQL-045) bind the :IsAuthorizedUser parameter to AUTHORIZED_USER_FLAG. Consumption of the flag for access-gating is not visible within this library — it is presumed to occur in a calling application layer.*
Outcome
The flag value is persisted to and retrieved from EXT_USER. Access enforcement based on the flag is deferred to the consuming application.*
A user matching a deny-self-registration block-list entry (by user-type code and customer-group ID) cannot self-register.**
Trigger
Self-registration request for a user-type/customer-group pair that exists in EXT_USER_DENY_SELF_REG.**
Enforcement
clsUserDenySelfRegistration and its collection represent the block-list; the exact matching/enforcement logic (e.g., which caller checks the list before allowing registration) was not traced in the analysis pass.**
Outcome
Presence of a matching row in EXT_USER_DENY_SELF_REG is expected to block self-registration for that user-type/customer-group pair.*
An active, non-deleted, non-test external user must not share an email address with another active user.*
Trigger
User registration or update that would produce a duplicate active email address.*
Enforcement
SQL-016 queries EXT_USER joining EMAIL_ADDRESS and EXT_USER_TYPE with filters test_user_flag = 'N' and status_code <> 'DEL'; the calling method uses the result to detect duplicates before persisting.*
Outcome
Duplicate detection prevents more than one active non-test user from sharing the same email address.*
All update operations on BOF-managed tables include an UPDATE_NUM optimistic-concurrency check; a mismatch indicates a concurrent modification and the update is rejected.*
Trigger
Any update call on clsUser, clsUserType, clsUserAccessGroup, clsUserDenySelfRegistration, or clsUserSecurityQuestion.*
Enforcement
UpdateSQL for each affected class appends AND update_num = :UpdateNum to the WHERE clause and increments the persisted value (UPDATE_NUM = :UpdateNum+1). BOF row-count checks after the update detect a mismatch and add an error message.*
Outcome
Concurrent modifications to the same row are detected and surfaced as an error to the caller, preventing silent data loss.*
BR-EU-06: Password composition and personal-data exclusion¶
Field
Value
Statement
A password must be 8-128 characters long, satisfy at least three enabled character classes, and must not contain the user ID, first name, or last name.
Trigger
Caller validates a password through clsPassword.IsValid.
Enforcement
clsPassword.IsValid checks minimum length, maximum length, class complexity, user-ID exclusion, and first-name/last-name exclusion, adding one validation message for each failed check.
Outcome
Invalid passwords return IsValid = False with the corresponding validation messages; only passwords that satisfy every check remain valid.
This library's business objects inherit from clsBusinessBase and clsBusinessCollectionBase in SAIF.BOF.Framework. The Legends CLI has no indexed content for BOF framework base classes in this run; inherited framework-level rules (such as standard BOF row-count concurrency checks and error-message patterns) cannot be enumerated from documentation. Consult SAIF.BOF.Framework source directly for authoritative inherited rule definitions.*
Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.