---
title: Check whether a page is authorized
summary: Answers whether a requested page is authorized for the current user by testing membership in the resolved authorized-item set purely in memory — no database access.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-17
library: SAIF.Business.Menu
reference_type: package
operation_id: OP-MENU-02
trigger: "`clsControllerBase.RedirectUnauthorizedUsers` on every web request, via `NavigationContext.IsMenuItem`"
---

# Check whether a page is authorized

Answers whether a requested page is authorized for the current user by testing membership in the resolved authorized-item set purely in memory — no database access.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-MENU-02 |
| **Trigger** | `clsControllerBase.RedirectUnauthorizedUsers` on every web request, via `NavigationContext.IsMenuItem` |
| **Inputs** | Application code, requested page link |
| **Outputs** | The matching `clsMenuAuthorizedItem`, or `Nothing` (interpreted as "not authorized") |
| **Primary components** | `clsMenuAuthorizedItemCollection.FindPage(inAppCode, inPageLink)` |
| **Entry point** | `SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb` |

## Steps

1. Filter the in-memory collection with a predicate: `ApplicationCode` equals the supplied code (case-sensitive, exact) **and** `LinkOnly(PageLink.Trim.ToUpper) = LinkOnly(inPageLink.Trim.ToUpper)`. ([BR-MENU-008](../business-rules.md#br-menu-008-page-reachability-requires-an-authorized-entry), [BR-MENU-009](../business-rules.md#br-menu-009-page-link-normalization))
2. `LinkOnly` strips everything from the first `?` onward, so query-string variants of the same page resolve to the same grant. ([BR-MENU-009](../business-rules.md#br-menu-009-page-link-normalization))
3. Move matches into a new collection via `mdlUtilities.AddToList`.
4. Return the first match, or `Nothing` when none. ([BR-MENU-008](../business-rules.md#br-menu-008-page-reachability-requires-an-authorized-entry))
   - If no match: the caller treats `Nothing` as denial and redirects the request.
5. `FindPageExact` performs the same steps without `LinkOnly`, requiring the query string to match too.

## Process flow

```mermaid
flowchart TD
    Start([Web request received]) --> Filter[Filter authorized items: ApplicationCode + LinkOnly page match]
    Filter --> Found{Match found?}
    Found -->|Yes| Allow([Return matching item, allow request])
    Found -->|No| Deny([Return Nothing, redirect unauthorized user])
```

## Failure and edge-case behavior
- No match found: the caller receives `Nothing` and treats the request as unauthorized.
- `FindPageExact` requires the full page link (including query string) to match, so a parameterized request that does not exactly match the stored grant is denied even if `FindPage` would allow it.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [SQL catalog](../sql/index.md)
- [Database tables](../database-tables.md)

## Sources
- SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb