---
title: SAIF.Presentation.Web.MVC architecture
summary: Architectural responsibilities, boundaries, and interaction patterns.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-17
library: SAIF.Presentation.Web.MVC
reference_type: package
---

# SAIF.Presentation.Web.MVC architecture

`SAIF.Presentation.Web.MVC` is the SAIF in-house Model-View-Controller framework layered on ASP.NET WebForms. It supplies the abstract base types every SAIF WebForms screen derives from — `ViewPageBase`, `ViewControlBase`, `clsControllerBase`, `clsModelBase`, `clsFactoryBase` — plus `clsContext`/`clsOnlineContext` for cross-application context hand-off persisted in a SQL Server `Context` table, and `NavigationContext` for menu-driven page authorization backed by Oracle. It is the only library in this batch that reads configuration, performs data access, and enforces authorization.

## Responsibilities
- Orchestrate the per-request lifecycle for every SAIF WebForms screen: session-timeout handling, authentication/security establishment, per-page menu authorization, model initialization, query-string and cross-application context processing, control-value harvesting, navigation, and centralized error handling.
- Provide the abstract base contracts (`clsControllerBase`, `clsModelBase`, `clsFactoryBase`) that consuming applications implement per screen.
- Persist and retrieve cross-application context hand-off values in a SQL Server `Context` table so state can travel with a user navigating between SAIF web applications.
- Cache and evaluate a user's authorized menu items (via `SAIF.Business.Menu`, a project reference within this repository) to answer "may this user reach this app/page?" on every request.
- Restore client-side input focus and render diagnostic script markers as part of the WebForms page lifecycle.

## Component boundaries
- **View layer** — `ViewPageBase` (extends `System.Web.UI.Page`) / `ViewControlBase` (extends `System.Web.UI.UserControl`): own the ASP.NET lifecycle, view identity (`ViewID`), view-state persistence strategy, message display, and error surfacing. Contain no business logic.
- **Controller layer** — `clsControllerBase`: converts raw HTTP into framework actions (initialize → security → menu authorization → model init → query string → context → retrieve → uninitialize); owns navigation and error routing.
- **Model layer** — `clsModelBase`: holds screen state, user preferences, and the validate-then-write contract (`ValidateData`/`WriteData`). Concrete models live in consuming applications.
- **Construction** — `clsFactoryBase`: each screen supplies a factory returning its controller and model, decoupling the base page from concrete types.
- **Context layer** — `clsContext` (+ `clsOnlineContext`): a named key/value bag with well-known typed keys (`claimId`, `policyNum`, `SAIFClaimNum`, `ProviderLocationSeqNum`) and a private nested SQL Server repository (`clsContextRepository`) that transfers those values between applications within a session.
- **Authorization layer** — `NavigationContext`: caches the user's authorized menu items (loaded over Oracle through `SAIF.Business.Menu`) and answers page-authorization queries.

## Interaction model
- Every derived `.aspx` page's `Page_Init` obtains its controller from `clsFactoryBase` and calls `clsControllerBase.Initialize`, which runs the fixed sequence: session-timeout check → `SecurityCheck` (establish `clsSecurityPrincipal`, emit `STYPE` cookie, or 401/deny) → lazy `NavigationContext` construction into `Session("navdata")` → `RedirectUnauthorizedUsers` (menu authorization) → `Model.Pre_Init`/`Load` → query-string and cross-application context processing.
- Cross-application navigation (`clsControllerBase.Navigate`) persists context key/value rows to the SQL Server `Context` table before redirecting; the receiving application's `Initialize` → `CheckContext` retrieves and deletes those rows, making the hand-off single-use.*
- Page authorization is entirely menu-data-driven: `NavigationContext` loads the user's authorized `(applicationCode, pageLink)` set from Oracle via `SAIF.Business.Menu`, cached in session for the duration of the session.*
- Consuming applications derive concrete pages/controls/controllers/models from the five base types; there is no runtime plugin or reflection-based discovery — wiring is by inheritance and a per-screen factory.

## Architecture diagram
The following diagram shows the lifecycle a request follows through the MVC base classes and their downstream collaborators.

```mermaid
flowchart TD
	A["Browser request<br>derived .aspx"] --> B["ViewPageBase.Page_Init"]
	B --> C["clsFactoryBase.GetController"]
	C --> D["clsControllerBase.Initialize"]
	D --> E["SecurityCheck<br>clsSecurityPrincipal"]
	E --> F["NavigationContext<br>Session(navdata)"]
	F --> G["SAIF.Business.Menu<br>authorized menu items (Oracle)"]
	F --> H["RedirectUnauthorizedUsers"]
	H --> I["Model.Pre_Init + Load<br>clsModelBase"]
	I --> J["CheckContext<br>clsContext / SQL Server Context table"]
	J --> K["Derived Retrieve<br>control values"]
	K --> L["UnInitialize<br>persist model + viewdata"]
```

## Sequence diagram
The following diagram shows cross-application context hand-off, the primary inter-application interaction owned by this library.

```mermaid
sequenceDiagram
	participant A as App A controller
	participant DB as SQL Server Context table
	participant B as App B controller
	A->>A: Navigate(TargetApp, TargetView)
	A->>DB: SaveContext(SessionID) - delete then insert rows
	A->>B: Response.Redirect(/TargetApp/TargetView)
	B->>B: Initialize -> CheckContext(referrer path)
	B->>DB: RetrieveContext(SourceApp, CurrentApp, SessionID)
	DB-->>B: context rows
	B->>DB: Delete(SourceApp, SessionID)
	B->>B: HandleContext(values) - derived class applies them
```

## Design constraints
- No class in this library inherits from `clsBusinessBase`, `IBusinessCriteria`, or any other BOF business-object base type; this library is a screen/request-orchestration framework, not a business-object library.
- Menu-based authorization is session-cached: a revoked grant persists in `Session("navdata")` until the session ends or is explicitly cleared, so authorization changes are not immediately effective.*
- Two database engines are used directly by consumers of this library: SQL Server (`Context` hand-off table, database `APPM`, application tag `NETFRAMEWORK`) and Oracle (menu authorization data, schema/user `MENU`, delegated to `SAIF.Business.Menu`); both are hard-coded literals, not configuration-driven.
- Nine runtime configuration keys must be supplied by the hosting application's `web.config` — this library ships no defaults for any of them (see [Dependencies](dependencies.md) and [Configuration](configuration.md)).
- Environment/network-zone trust decisions (`IsInsideClient`, `clsEnvironment.InternalAddress`) hard-code IP address patterns (`10.*`, `131.131.*.*`, `127.0.0.1`), coupling error routing and session-timeout behavior to the current network addressing scheme.
- Behavior branches on Infragistics control-type names (`WEBCURRENCYEDIT`, `WEBDATETIMEEDIT`, `WEBMASKEDIT`, etc.) and SAIF control names using reflection and string matching, without a direct assembly reference to the Infragistics vendor library.*

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Configuration](configuration.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- SAIF.Presentation.Web.MVC/clsControllerBase.vb
- SAIF.Presentation.Web.MVC/clsModelBase.vb
- SAIF.Presentation.Web.MVC/clsFactoryBase.vb
- SAIF.Presentation.Web.MVC/clsContext.vb
- SAIF.Presentation.Web.MVC/clsOnlineContext.vb
- SAIF.Presentation.Web.MVC/NavigationContext.vb
- SAIF.Presentation.Web.MVC/ViewPageBase.aspx.vb
- SAIF.Presentation.Web.MVC/ViewControlBase.ascx.vb