Skip to content

User access and external-user reporting

This operation combines current-user classification helpers with the reporting queries used for external customers. The library distinguishes internal and external user types from the current principal, derives PMS group keys when needed, and exposes customer-scoped last-logon and user-list queries.

Field Value
Operation ID OP-SB-12
Trigger Caller invokes user-type, resource-access, or external-user-reporting helpers.
Inputs Security principal, resource name, customer or customer-group ID, external-user type code
Outputs User type, group IDs, booleans, last-logon rows, user collections, or summary message
Primary components clsUserType.Initialize, clsUserType.GetGroupKeyFromPMSId, ObjectServices.IsAuthorized, ExternalUserServices.GetLastLogonsByCustomer, ExternalUserServices.GetUsersByCustomer
Entry point Business\SAIF.Business\clsUserType.vb

Steps

  1. clsUserType.Initialize evaluates the current security principal in priority order and assigns the first matching category such as SAIF employee, agent, policyholder, group, MCO, medical provider, bookkeeper, loss control, auditor, or unknown.
  2. Group-user accessors defer PMS group-key derivation until GroupID or GroupChapterID is requested.
  3. SetGroupKey parses chapter markers such as %, bracketed values, and the special [^E] case from the user number before deciding whether the raw key already contains a PMS number.
  4. When the key is a PMS-style numeric group, GetGroupKeyFromPMSId calls cp_get_group_key_4_pms_info and stores the returned group key and chapter identifier for later access checks (SQL-034).
  5. ObjectServices.IsAuthorized and related wrappers expose resource-authorization checks against the current principal without adding local SQL.
  6. External-user reporting expands the incoming user-type code when needed, builds the customer-group or customer-specific query, and joins EXT_USER to EXT_USER_TYPE to return last-logon rows or current-user rows (SQL-036, EXT_USER, EXT_USER_TYPE).
  7. Production-mode reporting excludes test users from the external-user result sets before the results are returned (BR-SB-007, SQL-036, EXT_USER, EXT_USER_TYPE).
  8. Message helpers reduce the returned rows to a single summary string when callers need only the latest external-user logon narrative.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([User or reporting request]) --> Kind{Current principal or external-user query?}
    Kind -->|Principal| Principal[Classify user and derive group data]
    Kind -->|External query| Query[Build customer-scoped external-user query]
    Principal --> Return1([Return user type or access result])
    Query --> Prod{Production environment?}
    Prod -->|Yes| Filter[Exclude test users]
    Prod -->|No| Return2([Return query rows])
    Filter --> Return3([Return filtered rows or message])

Failure and edge-case behavior

  • Users who do not match any configured authorization group are classified as Unknown.
  • Group-key derivation only runs for group users and returns empty chapter data when the user number does not contain chapter information.
  • Production reporting intentionally suppresses test users from the external-user result sets (BR-SB-007).

Sources

  • Business\SAIF.Business\clsUserType.vb
  • Business\SAIF.Business\ObjectServices.vb
  • Business\SAIF.Business\Services\ExternalUserServices.vb