SAIF.Business.Menu security and authorization

This page documents the authorization model implemented by SAIF.Business.Menu. The library does not use AD resource groups or a centralized security service; it authorizes menu visibility from Oracle data stored in MENU_SECURITY, MENU_SECURITY_USER, and MENU_FAVORITE. The library trusts the caller-supplied MenuUser identifier and expects upstream callers to render only the rows returned by the authorized-menu collection.*

Authorization architecture

Authorization is entirely data-level and query-driven. clsMenuAuthorizedItemCollection executes the authoritative menu SQL, joins item-to-group rows to user-to-group rows, includes items with no security rows, and optionally unions the user's active favorites. Whether any SECURITY_GROUP_TXT values also correspond to AD groups elsewhere in the platform cannot be confirmed from this library alone.**

flowchart TD
    Caller[Calling layer] --> Menu[clsMenuAuthorizedItemCollection]
    Menu --> Sec[(MENU_SECURITY)]
    Menu --> User[(MENU_SECURITY_USER)]
    Menu --> Fav[(MENU_FAVORITE)]
    Menu --> Items[(MENU_ITEM / MENU_PAGE / lookups)]

AD resource catalog

This library has no AD-resource catalog. Instead, it uses business-defined SECURITY_GROUP_TXT values stored in database tables.

Resource name	Purpose	Enforcement point	Source
N/A	Authorization uses data-level security groups in MENU_SECURITY and MENU_SECURITY_USER rather than AD group names.	clsMenuAuthorizedItemCollection.Criteria.RetrieveSQL	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb

Authorization enforcement points

No attribute-based authorization checks were identified in this library.

Programmatic authorization checks

Class	Method	Resource / Role	Check type	Source
clsMenuAuthorizedItemCollection.Criteria	RetrieveSQL	Per-user menu visibility	Data-level SQL membership and favorite/public union	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection.Criteria	RetrieveAllSQL	All-users menu snapshot	Data-level SQL membership and public union	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	GetMenuAuthorizedItems	Authorized menu entry point	Programmatic retrieval gate	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItem	IsUnsecured	Public-item flag	Flag-based authorization indicator	SAIF.Business.Menu\clsMenuAuthorizedItem.vb
clsMenuAuthorizedItemCollection	SecuredAppItems	Secured-only in-memory view	Programmatic in-memory filter	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
clsMenuItem	SecurityGroups	Per-item security-group assignments	Programmatic retrieval of authoritative item groups	SAIF.Business.Menu\clsMenuItem.vb
clsMenuItem	IsValid	Child security-group validity	Programmatic validation gate	SAIF.Business.Menu\clsMenuItem.vb
clsMenuSecurityUserCollection	GetMenuSecurityUserForUser	User group memberships	Programmatic retrieval intended to be authoritative, but the underlying retrieveForUserSQL statement's :MenuUser bind variable is never supplied by BeforeRetrieve — see SQL-MENU-035; this retrieval fails rather than authoritatively return the user's groups.	SAIF.Business.Menu\clsMenuSecurityUserCollection.vb
clsMenuSecurityCollection	contains(inSecurityGroup)	Duplicate group assignment check	Programmatic in-memory duplicate check	SAIF.Business.Menu\clsMenuSecurityCollection.vb

Data-level authorization

Entity type	Validation method	Mechanism	Source
Menu-item security assignment	clsMenuSecurity	Stores group assignments in MENU_SECURITY. Related rule: BR-MENU-003.	SAIF.Business.Menu\clsMenuSecurity.vb
Menu-item security collection	clsMenuSecurityCollection.GetMenuSecuritiesForItem	Retrieves item-to-group rows from MENU_SECURITY for maintenance and save cascades. Related rule: BR-MENU-005.	SAIF.Business.Menu\clsMenuSecurityCollection.vb
User security membership	clsMenuSecurityUser	Stores user-to-group rows in MENU_SECURITY_USER. Related rule: BR-MENU-003.	SAIF.Business.Menu\clsMenuSecurityUser.vb
User security collection	clsMenuSecurityUserCollection.GetMenuSecurityUserForUser	Intended to retrieve a user's memberships from MENU_SECURITY_USER, but the :MenuUser bind variable in the underlying SQL-MENU-035 statement is not supplied by the code, so this retrieval path fails rather than authorize on the intended per-user data. Related rule: BR-MENU-003.	SAIF.Business.Menu\clsMenuSecurityUserCollection.vb
Effective authorization join	clsMenuAuthorizedItemCollection.Criteria.RetrieveSQL	Joins MENU_SECURITY and MENU_SECURITY_USER, returns public items under BR-MENU-002, and unions favorites under BR-MENU-004.	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
All-users public snapshot	clsMenuAuthorizedItemCollection.Criteria.RetrieveAllSQL	Emits the UNSECURED sentinel used by BR-MENU-006.	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb

Segregation of duties

SoD is not a feature of this library. The CRUD factories for clsMenuSecurity and clsMenuSecurityUser do not embed a separate administrator-role gate, so any restriction on who may administer menu security must exist in calling layers or database grants outside this library.*

Security interfaces and contracts

Interface / Class	Role	Consumers	Source
clsMenuAuthorizedItemCollection	Executes the authoritative menu-authorization query and materializes projection rows.	Calling layers that need authorized navigation.	SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
clsMenuSecurityCollection	Persists and retrieves item-to-group assignments.	clsMenuItem maintenance flows.	SAIF.Business.Menu\clsMenuSecurityCollection.vb
clsMenuSecurityUserCollection	Persists and retrieves user-to-group memberships.	Administrative maintenance flows.	SAIF.Business.Menu\clsMenuSecurityUserCollection.vb

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Database tables
• SQL catalog
• API reference

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Business.Menu\clsMenuAuthorizedItem.vb
• SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb
• SAIF.Business.Menu\clsMenuItem.vb
• SAIF.Business.Menu\clsMenuSecurity.vb
• SAIF.Business.Menu\clsMenuSecurityCollection.vb
• SAIF.Business.Menu\clsMenuSecurityUser.vb
• SAIF.Business.Menu\clsMenuSecurityUserCollection.vb
• SAIF.Business.Menu\mdlUtilities.vb