SAIF.Business.Menu security and authorization

This page documents authorization mechanisms implemented by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is out of scope here. SAIF.Business.Menu is the authorization model for the SAIF web applications in this repository: it contains no Active Directory code and no WCF SecurityService client. Instead, authorization is expressed as Oracle data — menu items are linked to security groups (MENU_SECURITY), users are linked to those same groups by name (MENU_SECURITY_USER), and clsMenuAuthorizedItemCollection.GetMenuAuthorizedItems(dpi, menuUser) resolves the effective, per-user set of reachable pages with a three-branch UNION. Every downstream authorization decision in this repository — the enforceable page check in SAIF.Presentation.Web.MVC and all menu/toolbar trimming in the presentation libraries — reads from this one projection.

Authorization architecture

Authorization is data-driven and resolved entirely in Oracle, not through AD group membership checks, a WCF security service, or attribute-based authorization. The library performs authorization resolution (producing the set of items a user may reach), not denial — enforcement (redirect/deny) is the responsibility of the consuming presentation layer, which tests membership in the resolved set via FindPage.

flowchart LR
    U[":MenuUser"] --> B1["Branch 1 — granted<br>MENU_SECURITY_USER join MENU_SECURITY<br>on SECURITY_GROUP_TXT (case-insensitive)"]
    U --> B3["Branch 3 — favorites<br>MENU_FAVORITE where MENU_USER = :MenuUser<br>and ITEM_INACTIVE_DATE is null"]
    B2["Branch 2 — unsecured<br>MENU_ITEM with no MENU_SECURITY row"] --> UN
    B1 --> UN["UNION to clsMenuAuthorizedItemCollection"]
    B3 --> UN
    UN --> C["MENU_PAGE join: page link, application code,<br>visibility flag, toolbar capability flags"]
    C --> D["Consumers: MVC page check,<br>menu and toolbar rendering"]

AD resource catalog

No AD resource names, LDAP paths, System.DirectoryServices/AccountManagement usage, or authorization attributes exist in this library. The resource model is database security-group names, not AD resource names.

Resource name	Purpose	Enforcement point	Source
(none)	No Active Directory resource name is referenced anywhere in this library	—	—

Database security-group model (the actual resource catalog)

Group names are free-text values held in the database; no group name is hard-coded in source, so the concrete catalog of group values can only be enumerated from the MENU_SECURITY / MENU_SECURITY_USER tables in each environment.**

Element	Table / column	Type surface	Meaning
Security group grant on a menu item	MENU_SECURITY.SECURITY_GROUP_TXT	clsMenuSecurity.SecurityGroup	Names a group that is permitted to reach the menu item identified by MENU_ITEM_SEQ_NUM
Security group membership	MENU_SECURITY_USER.SECURITY_GROUP_TXT	clsMenuSecurityUser.SecurityGroupTxt	Names the group the user belongs to
Menu user (subject)	MENU_SECURITY_USER.MENU_USER	clsMenuSecurityUser.MenuUser	The account name (upper-cased by callers) whose authorization is being resolved
Employee identifier	MENU_SECURITY_USER.MENU_USER_EMPLID	clsMenuSecurityUser.MenuUserID / clsMenuAuthorizedItem.MenuUserEmplid	Employee ID carried alongside the membership; surfaced on the authorized item but not used in any authorization predicate
Protected object	MENU_ITEM.MENU_ITEM_SEQ_NUM	clsMenuItem, clsMenuAuthorizedItem.MenuItemSeqNum	The unit of authorization — a page placed in a category
Protected resource identity	MENU_PAGE.APPLICATION_CODE + MENU_PAGE.PAGE_LINK_TXT	clsMenuAuthorizedItem.ApplicationCode / .PageLink	The (application, page) pair matched against the request URL by consumers

Authorization enforcement points

Programmatic authorization checks

Class	Method	Resource / Role	Check type	Source
clsMenuAuthorizedItemCollection	GetMenuAuthorizedItems(inDataportal, inMenuUser)	Menu user vs. security groups	Resolution (SQL-015)	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	Criteria.RetrieveSQL branch 1 (group-granted)	MENU_SECURITY / MENU_SECURITY_USER	Data-level predicate	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	Criteria.RetrieveSQL branch 2 (unsecured)	MENU_ITEM with no MENU_SECURITY row	Data-level predicate (fail-open)	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	Criteria.RetrieveSQL branch 3 (favorites)	MENU_FAVORITE	Data-level predicate	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	GetAllMenuAuthorizedItems / Criteria.RetrieveAllSQL	All users (administrative read)	Programmatic (unfiltered, 'UNSECURED' substituted as user)	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	Item / ItemExact / ItemByCategory	In-memory filter of the authorized set	Lookup filter	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	FindPage / FindPageExact	ApplicationCode + page link	Page-level lookup (the predicate behind the enforceable page check in SAIF.Presentation.Web.MVC)	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItemCollection	SecuredAppItems	Non-favorite, non-unsecured items	Projection	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuAuthorizedItem	IsUnsecured / IsVisible / IsFavorite	UnsecuredFlag, VISIBLE_FLAG, FavoriteFlag	Per-item classification	SAIF.Business.Menu/clsMenuAuthorizedItem.vb
clsMenuAuthorizedItem	IsDisplayInsert / IsDisplaySave / IsDisplayDelete / IsDisplayPrint / IsDisplayDownload / IsDisplaySavePreferences / IsDisplayHelp	MENU_PAGE *_FLAG columns	Capability model (toolbar gating)	SAIF.Business.Menu/clsMenuAuthorizedItem.vb

This library performs resolution, not denial — the authorization predicate lives in the retrieval SQL WHERE clauses. There are no Throw-based access denials anywhere in this code.

Authorization administration surface

These operations mutate the authorization model itself and therefore constitute privileged functionality. Nothing in this library authorizes the administrative operations themselves; the protection of these operations depends entirely on which application hosts them.*

Operation	Statement	Bound values	Source
Grant a group access to a menu item	INSERT INTO MENU_SECURITY (SQL-010)	:MenuSecuritySeqNum, :MenuItemSeqNum, :SecurityGroup, SYSDATE, :UserId	SAIF.Business.Menu/clsMenuSecurity.vb
Re-point or rename a grant	UPDATE MENU_SECURITY (SQL-036)	:MenuItemSeqNum, :SecurityGroup, SYSDATE, :UserId keyed by :MenuSecuritySeqNum	SAIF.Business.Menu/clsMenuSecurity.vb
Revoke a grant	DELETE MENU_SECURITY (SQL-043)	keyed by :MenuSecuritySeqNum	SAIF.Business.Menu/clsMenuSecurity.vb
Add a user to a group	INSERT INTO MENU_SECURITY_USER (SQL-011)	MENU_SECURITY_USER_SEQ.NEXTVAL, :SecurityGroupTxt, :MenuUser, :MenuUserID	SAIF.Business.Menu/clsMenuSecurityUser.vb
Change a membership	UPDATE MENU_SECURITY_USER (SQL-037)	:SecurityGroupTxt, :MenuUser, :MenuUserID keyed by :MenuSecurityUserSeq	SAIF.Business.Menu/clsMenuSecurityUser.vb
Remove a membership	DELETE MENU_SECURITY_USER (SQL-044)	keyed by :MenuSecurityUserSeq	SAIF.Business.Menu/clsMenuSecurityUser.vb
List a user's memberships	SELECT ... FROM MENU_SECURITY_USER WHERE MENU_USER = :MenuUser (SQL-030)	:MenuUser	SAIF.Business.Menu/clsMenuSecurityUserCollection.vb
List the groups granted on an item	SELECT ... FROM MENU_SECURITY WHERE MENU_ITEM_SEQ_NUM = :MenuItemSeqNum (SQL-028)	:MenuItemSeqNum	SAIF.Business.Menu/clsMenuSecurityCollection.vb

MENU_SECURITY writes stamp UPDATE_DATE = SYSDATE and UPDATE_USER = :UserId, giving an audit trail on grants. MENU_SECURITY_USER writes carry no update-date or update-user columns, so membership changes are not attributable from the row itself.

Data-level authorization

Entity type	Validation method	Mechanism	Source
clsMenuAuthorizedItem	Criteria.RetrieveSQL branches 1 and 3	Subject-scoped retrieval — the authorization set is filtered in the database on the bind variable :MenuUser, never assembled client-side from a broader read	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuItem / clsMenuAuthorizedItem	NOT EXISTS branch, flagged UnsecuredFlag = 'Y'	Fail-open default for unconfigured items — a menu item with no MENU_SECURITY row is returned to every user rather than being denied	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuFavorite	Branch 3 join to MENU_ITEM with no reference to MENU_SECURITY	Favorites grant reachability independently of group membership — an active favorite row for the user adds the item to the authorized set even when no group grant exists*	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
clsMenuFavorite	FAV.ITEM_INACTIVE_DATE IS NULL	Soft-delete respected on favorites	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
MENU_SECURITY / MENU_SECURITY_USER	upper(USR.SECURITY_GROUP_TXT) = upper(SEC.SECURITY_GROUP_TXT)	Case-insensitive group matching — group names differing only in case are treated as the same group	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
All	Named bind variables throughout	Parameterized binding — every user-supplied value enters SQL as a named bind variable (:MenuUser, :MenuItemSeqNum, :SecurityGroup, …); no string concatenation of caller input into SQL was found	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb, SAIF.Business.Menu/clsMenuSecurity.vb, SAIF.Business.Menu/clsMenuSecurityUser.vb
clsApplicationCode	Join to BUSONLINE_APPS_CODE	Referential scoping to active applications — item resolution joins the application table; consumers resolve the application via GetActiveApplicationCodes	SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb, SAIF.Business.Menu/clsApplicationCodeCollection.vb

Segregation of duties

No segregation-of-duties rules are checked anywhere in this library — no mutually exclusive privilege combination is validated in code.

Security interfaces and contracts

No security-specific interfaces or base classes (e.g. ISecurityManager) are defined or consumed by this library. Authorization is expressed entirely through data (security-group tables) and the clsMenuAuthorizedItemCollection projection described above.

Notes

• Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
• Concrete security-group names cannot be enumerated from source — they are data-only values in MENU_SECURITY / MENU_SECURITY_USER.**
• No BUSINESS RULES region in any of the menu business objects is populated, so there is no code-level validation preventing, for example, a membership row that names a group no menu item grants, or a favorite pointing at an item the user has no grant for.
• The relationship between MENU_SECURITY_USER.SECURITY_GROUP_TXT values and Windows/AD groups is not expressed in code; whether these strings mirror AD group names or are an independent naming scheme is not determinable from this repository.**

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Database tables
• SQL catalog
• API reference

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Business.Menu/clsMenuAuthorizedItemCollection.vb
• SAIF.Business.Menu/clsMenuAuthorizedItem.vb
• SAIF.Business.Menu/clsMenuSecurity.vb
• SAIF.Business.Menu/clsMenuSecurityCollection.vb
• SAIF.Business.Menu/clsMenuSecurityUser.vb
• SAIF.Business.Menu/clsMenuSecurityUserCollection.vb
• SAIF.Business.Menu/clsMenuFavorite.vb
• SAIF.Business.Menu/clsMenuItem.vb
• SAIF.Business.Menu/clsMenuPage.vb
• SAIF.Business.Menu/clsApplicationCodeCollection.vb
• SAIF.Business.Menu/SAIF.Business.Menu.vbproj