clsPolicySecurity¶
clsPolicySecurity is the library's only authorization class. Constructed with a security principal and a data portal, it answers two questions: whether a given policy is visible to that principal, and which policies the principal may see at all. Both answers are fail-closed — the decision starts at refuse and the list starts empty — and both branch on the principal's user type. Its checks reach two different data stores: the Oracle policy store for agent, policyholder, and auditor questions, and a separate SQL Server store, configured from the BDS_* settings, for group membership.
Purpose¶
- Refuses a secure SAIF policy to any principal lacking the
SAIFpolicyInfoActive Directory resource (BR-001). - Applies the per-user-type access decision for agents, policyholders, groups, loss-control consultants, and auditors (Authorize a policy for the current user).
- Builds the permitted policy list for the principal, using a different scope query per user type (Build the permitted policy list).
- Translates a framework user type into the ranked access level the rest of the library consumes (BR-013).
Context¶
- Namespace:
SAIF.Business.View.Policy - Assembly/package:
SAIF.BOF.Business.View.Policy - Declared in:
Business/SAIF.Business.View.Policy/clsPolicySecurity.vb
Public members¶
| Member | Signature | Purpose |
|---|---|---|
| UserType | Public ReadOnly Property UserType() As clsUserType |
The framework classification of the current principal, on which every access branch turns. |
| UserAccessLevel | Public ReadOnly Property UserAccessLevel() As clsPolicyData.UserAccessLevels |
The ranked visibility level derived from the principal's user type (BR-013). |
| SecurityPrincipal | Public ReadOnly Property SecurityPrincipal() As clsSecurityPrincipal |
The principal whose access this instance evaluates. |
| PolicyList | Public ReadOnly Property PolicyList() As List(Of strPolicyList) |
The policies this principal may see, built by the scope query matching the principal's user type and empty when none matches (Build the permitted policy list). |
| New | Public Sub New(ByVal inSecurityPrincipal As clsSecurityPrincipal, ByVal inDPI As IDataPortalInfo) |
Binds the evaluator to a principal and an Oracle data portal; the SQL Server portal is initialised separately from configuration.* |
| IsPolicyValidForParentPolicy | Public Function IsPolicyValidForParentPolicy(ByVal inPolicyNum As Decimal) As Boolean |
Decides whether a policyholder may see a policy by ownership or by a shared parent association (BR-005). |
| IsPolicyValidForUser | Public Function IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData) As Boolean |
Decides whether the principal may see an already loaded policy, refusing secure policies without the Active Directory resource and unmatched user types (BR-001, BR-019). |
| IsPolicyValidForUser | Public Function IsPolicyValidForUser(ByVal inPolicyNum As Decimal) As Boolean |
Loads the policy by number and then decides whether the principal may see it (Authorize a policy for the current user). |
| ConvertUserTypeToUserAccessLevel | Public Shared Function ConvertUserTypeToUserAccessLevel(ByVal inUserType As clsUserType) As clsPolicyData.UserAccessLevels |
Maps a framework user type onto the ranked access level the rest of the library consumes, doubling every external type into a demonstration variant (BR-013). |
Behavioral notes¶
- The class initialises its second data portal lazily on first use, reading the three
BDS_*settings described on the Configuration page.* - The loss-control check truncates the assignment name at a
%wildcard before comparing, so a stored wildcard pattern behaves as a prefix (BR-007).
Constraints and usage notes¶
- Every decision path that finds no matching user type refuses access or returns an empty list (BR-019).
- A misconfigured BDS connection cannot be distinguished from a negative group-membership answer; both refuse access.*
Note: Statements marked with
†are derived from dependency library documentation via the Legends CLI. Statements marked with*were inferred from code structure or contextual evidence. Statements marked with**could not be confirmed; treat as unknown until verified.
Sources¶
Business/SAIF.Business.View.Policy/clsPolicySecurity.vb