---
title: Enforce menu-based page authorization
summary: Denies access to any application/page combination not present in the current user's authorized menu set.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-17
library: SAIF.Presentation.Web.MVC
reference_type: package
operation_id: OP-MVC-03
trigger: Step 6 of Initialize a request, every request
---

# Enforce menu-based page authorization

The one enforceable, data-driven authorization decision in this library. It answers "may this user reach this application/page?" by consulting the cached `NavigationContext` rather than any AD group or role check, and denies by redirecting to the login screen rather than returning a 403.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-MVC-03 |
| **Trigger** | Step 6 of [Initialize a request](initialize-request.md), every request |
| **Inputs** | `Request.Url.LocalPath`, `Session("navdata")` (`NavigationContext`) |
| **Outputs** | Continue, or clear `navdata` and redirect to the login screen; a trace line at Info/Warning level |
| **Primary components** | `clsControllerBase.RedirectUnauthorizedUsers` (private) |
| **Entry point** | SAIF.Presentation.Web.MVC/clsControllerBase.vb |

## Steps

1. Split the local path: the first segment is the application, the remainder (rejoined with `/`) is the page item ([BR-MVC-007](../business-rules.md#br-mvc-007-page-access-requires-menu-authorization)).
2. Read the cached `NavigationContext` from `Session("navdata")`.
3. Call `navData.IsMenuItem(currentApp, currentItem)`.
   - Delegated logic (`NavigationContext.IsMenuItem`, implemented in this library): resolve the application code from `ApplicationCodes.ItemByAppPath(app)`, then return whether `MenuAuthorizedItems.FindPage(appCode, item)` is non-`Nothing` — i.e. the page appears in the user's authorized menu set loaded from Oracle ([BR-MVC-007](../business-rules.md#br-mvc-007-page-access-requires-menu-authorization), [BR-MVC-015](../business-rules.md#br-mvc-015-menu-authorization-data-is-read-from-oracle-as-user-menu)).

> **Origin**: The authorized-item lookup itself (`MenuAuthorizedItems.FindPage`) resolves against menu data loaded from Oracle by `SAIF.Business.Menu` — see [Load the user's authorized menu](load-authorized-menu.md) for how that set is populated.
4. When `SAIFTracingSwitch` is at `Info`, write an informational trace line containing the current thread user, app, page, and result.
5. If the result is false, clear `Session("navdata")` and `Response.Redirect("/OnlineLogin/LoginScreen.aspx")` ([BR-MVC-007](../business-rules.md#br-mvc-007-page-access-requires-menu-authorization)).
   - On failure: none observed — this is the terminal deny action.
6. When the switch is at `Warning`, write a "Menu denied access" trace line.
   - If redirect is buffered and terminating (the default ASP.NET behavior), this statement is placed after the redirect call and is not reached in practice.*

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([RedirectUnauthorizedUsers]) --> S1[Split LocalPath into app + item]
	S1 --> S2[Read NavigationContext from Session navdata]
	S2 --> S3[IsMenuItem app item]
	S3 --> D{Authorized?}
	D -->|Yes| EndOk([Continue request])
	D -->|No| S4[Clear navdata]
	S4 --> EndDeny([Redirect /OnlineLogin/LoginScreen.aspx])
```

## Failure and edge-case behavior
- A page not present in the user's authorized menu is treated identically whether the application code is unknown or the page link is simply missing — both resolve to "not a menu item."
- Because the deny redirect clears `navdata`, the next request reloads the menu set from Oracle even if the underlying denial reason has not changed.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- SAIF.Presentation.Web.MVC/clsControllerBase.vb
- SAIF.Presentation.Web.MVC/NavigationContext.vb