---
title: SecurityService
summary: API reference for SecurityService.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
---

# SecurityService

Implementation of `ISecurityService`. It reads the identity from the current `HttpContext`, delegates role checks and external user lookups to the platform `ISecurityClient`, and delegates policy access checks to the Policy Core API client (`IPolicyCoreApiClient`).

## Purpose
- Derive the user id and the external flag from the identity name ([BR-BOLMIDDLEWARE-005](../../business-rules.md#br-bolmiddleware-005-external-user-detection)).
- Check policy access through the Policy Core API ([BR-BOLMIDDLEWARE-009](../../business-rules.md#br-bolmiddleware-009-policy-access-validation)).

## Context
- Namespace: `BolMiddleware.Services.Security`
- Assembly/package: `BolMiddleware`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| Constructor | `SecurityService(IHttpContextAccessor httpContextAccessor, ISecurityClient securityClient, other clients, IPolicyCoreApiClient policyCoreApiClient)` | Receives the accessor and clients. |
| `GetCurrentUserId` | `string? GetCurrentUserId()` | Returns the identity name of the current user. |
| `IsAuthorizedAsync` | `Task<bool> IsAuthorizedAsync(string role)` | Calls `ISecurityClient` to test the role. |
| `IsUserExternal` | `bool IsUserExternal()` | Treats any identity outside the `SAIF` domain as external. |
| `GetCurrentExternalUserAsync` | `Task<ExternalUser> GetCurrentExternalUserAsync()` | Looks up the external user through `ISecurityClient.GetExternalUser`. |
| `IsValidPolicyForCurrentUser` | `Task<bool> IsValidPolicyForCurrentUser(long policyNumber)` | Asks the Policy Core API (`IPolicyCoreApiClient.IsValidPolicyForUser`) whether the user may view the policy. |

## Behavioral notes
- Protected fields `_httpContextAccessor`, `_policyCoreApiClient`, and `_securityClient` are available to subclasses.

## Constraints and usage notes
- Depends on `ISecurityClient`, which this library does not register.

## Sources
- src/BolMiddleware/Services/Security/SecurityService.cs