BolMenuModel¶

Abstract page model that adds the BOL menu to the context handling of BolContextModel. It loads the menu for the current user, classifies posted context values, and handles the menu item click post. It disables anti-forgery validation for every derived page.

Purpose¶

Load the menu from session or the BOL Menu API (BR-BOLMIDDLEWARE-007).
Classify the posted context value into policy, claim, or other (BR-BOLMIDDLEWARE-008).
Show an error view when the menu cannot be loaded (BR-BOLMIDDLEWARE-016).
Expose the change-context flag that the layouts use to show or hide the context textbox; it is not an authorization control (BR-BOLMIDDLEWARE-019).

Context¶

Namespace: BolMiddleware.Models
Assembly/package: BolMiddleware

Public members¶

Member	Signature	Purpose
`MenuData`	`BusinessOnlineMenu? MenuData`	Menu loaded for the current user, passed to the menu view components.
`ChangeContextPrivilege`	`bool ChangeContextPrivilege`	Whether the layouts render the context textbox as visible; presentation only, since the server reads the posted `contextvalue` regardless. Set by the consuming application.
`IsAuthorizedAsync`	`async Task<bool> IsAuthorizedAsync(string role)`	Checks whether the current user holds the caller-supplied role through the security service.
`CurrentUserId`	`string? CurrentUserId`	Identity name of the current user.
`IsUserExternal`	`bool IsUserExternal`	True when the user is not an internal SAIF domain user (BR-BOLMIDDLEWARE-005).
`OnPostMenuItemClick`	`IActionResult OnPostMenuItemClick(string targetApp, string targetPage)`	Handles the menu click post and redirects to the target through `OnNavigate`.
`OnNavigate`	`virtual IActionResult OnNavigate(NavigationOptions options)`	Hook that derived pages override to change how navigation proceeds; the default calls `Navigate`.
`OnPageHandlerExecuting`	`override void OnPageHandlerExecuting(PageHandlerExecutingContext context)`	Runs the base resolution, then loads the menu and applies a posted context value.

Behavioral notes¶

Carries [IgnoreAntiforgeryToken], so derived pages and the click post skip token validation.
The redirect target comes from posted values with no allow-list.

Constraints and usage notes¶

Derived pages must add their own anti-forgery protection if required; see Security and authorization.

Sources¶

src/BolMiddleware/Models/BolMenuModel.cs