---
title: BolMiddleware dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
---

# BolMiddleware dependencies

BolMiddleware consumes six internal SAIF NuGet packages and the `Microsoft.AspNetCore.App` shared framework, and has no project references. Four of the packages are HTTP API clients for the BOL Context, BOL Menu, Policy Core, and Policy Header APIs; the other two supply the SAIF startup base class, security and environment services, and common helpers. Client-side assets come from vendored libraries and CDNs.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| `BolContextApi.Client` 8.2026.310.3 | NuGet Package | Provides `IBolContextApiClient` and the `ContextHelper` and `ContextResult` types; used by `WebContextService` to save and load the web context. |
| `BolMenuApi.Client` 1.0.24025.2 | NuGet Package | Provides `IBolMenuApiClient` and `BusinessOnlineMenu`; used by `MenuService` to load the user menu. |
| `PolicyCoreApiClient` 1.0.24093.1 | NuGet Package | Provides `IPolicyCoreApiClient`; used by `SecurityService.IsValidPolicyForCurrentUser`. |
| `PolicyHeaderApi.Client` 1.0.25072.1-alpha | NuGet Package | Provides `IPolicyHeaderApiClient` and `PolicyHeader`; used by `PolicyHeaderService` to load the policy header and relationships. |
| `SAIF.NetCore.Common` 8.2023.319.2 | NuGet Package | Provides configuration, URI, and collection extension helpers such as `GetRequiredValue` and `Enforce.ArgumentNotNull`. |
| `SAIF.NetCore.ServiceExtensions` 8.2025.302.1 | NuGet Package | Provides `OidcRazorStartup`, the base of `BolRazorLayoutStartup`, and the security, environment, and logging contracts. |

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| `Microsoft.AspNetCore.App` (FrameworkReference) | net8.0 shared framework | Razor Pages, session, cookies, and `System.Web.HttpUtility` used by `NavigationOptions`. |
| bootstrap, jquery, jquery-validation | Vendored under `wwwroot/lib` | Client-side UI assets served from the RCL static web assets. |
| Bootstrap (CDN) | 5.3.2 | Loaded from jsdelivr with subresource integrity in the shared layouts. |
| Font Awesome (CDN) | 6.0.0-beta3 | Loaded from cdnjs without subresource integrity in the shared layouts. |
| Google Analytics gtag | Not versioned | Loaded in the core scripts header partial. |
| gulp, sass, minification tooling | Dev dependencies | Build-time compilation of styles and scripts; not packaged as runtime dependencies. |

## Transitive dependencies

Dependencies in this section are inherited from dependency framework libraries. They are not directly referenced by this library but are required at runtime through framework packages.

| Dependency | Source framework | Type | Usage |
| --- | --- | --- | --- |
| `SAIF.NetCore.AuthService` | `SAIF.NetCore.ServiceExtensions` | Transitive | Hosts `ISecurityClient`, which `SecurityService` resolves for authorization and external user lookup.* |
| `SAIF.NetCore.ServiceContracts` | `SAIF.NetCore.ServiceExtensions` | Transitive | Hosts `ExternalUser` and `ExternalUserType` used by the services and PageModels.* |
| `SAIF.NetCore.EnvironmentClient` | `SAIF.NetCore.ServiceExtensions` | Transitive | Hosts `IEnvironmentClient`, whose `GetSettingValue` is called for session cookie settings.* |
| `SAIF.NetCore.Logging` | `SAIF.NetCore.ServiceExtensions` | Transitive | Hosts `ISaifLogService`, whose `Error` overloads the services call.* |
| `Microsoft.AspNetCore.Mvc.NewtonsoftJson` | `SAIF.NetCore.ServiceExtensions` | Transitive | Likely supplies Newtonsoft.Json, used for session and cookie JSON serialization, since there is no direct reference.* |

## API dependencies

The source calls the following client interfaces directly. The Legends CLI index (repository Framework.NCore) covers `SAIF.NetCore.Common`, `SAIF.NetCore.ServiceExtensions`, and the sibling libraries `SAIF.NetCore.AuthService`, `SAIF.NetCore.EnvironmentClient`, `SAIF.NetCore.Logging`, and `SAIF.NetCore.ServiceContracts`, so `ISecurityClient` and `IEnvironmentClient` are traced. `BolContextApi.Client`, `BolMenuApi.Client`, `PolicyHeaderApi.Client`, and `PolicyCoreApiClient` were not found in the Framework.NCore index, the only repository checked; endpoint URLs, transport, and authentication inside those four packages remain unknown**.

For the traced clients: `ISecurityClient.GetExternalUser` goes through a remote service backed by EXT Oracle tables, while `IsAuthorized` is an authorization check. `IEnvironmentClient.GetSettingValue` string overloads return an empty string when a setting is missing, generic overloads throw `EnvironmentClientException`, and a blank section defaults to the track name.

| Client interface | Operation called | Consuming code |
| --- | --- | --- |
| `IBolContextApiClient` | `SaveContext(request)` | `WebContextService.SaveContext` |
| `IBolContextApiClient` | `GetContext(contextId)` and `GetContext(sessionId, applicationName)` | `WebContextService.GetContext` |
| `IBolMenuApiClient` | `GetBusinessOnlineMenu(userId)` | `MenuService.GetMenu` |
| `IPolicyHeaderApiClient` | `GetHeader(number, isExternal)` and `GetRelationships(policyNumber)` | `PolicyHeaderService.GetHeader` and `GetRelationships` |
| `IPolicyCoreApiClient` | `IsValidPolicyForUser(policyNumber, userId)` | `SecurityService.IsValidPolicyForCurrentUser` |
| `ISecurityClient` | `IsAuthorized(userId, role)` and `GetExternalUser(userId)` | `SecurityService.IsAuthorizedAsync` and `GetCurrentExternalUserAsync` |
| `IEnvironmentClient` | `GetSettingValue` for `UseSessionCookie` and `SessionCookieName` | `BolContextModel.GetSessionId` and `AddMiddlewareSessionCookie` |

Page models call these through the facade services, so the library depends on six remote-service contracts even though it implements none of them. See the risks below.

## Dependency risks and notes
- Indexed and traced packages: `SAIF.NetCore.Common` and `SAIF.NetCore.ServiceExtensions` are in the Legends CLI index (repository Framework.NCore), as are the sibling libraries `SAIF.NetCore.AuthService`, `SAIF.NetCore.EnvironmentClient`, `SAIF.NetCore.Logging`, and `SAIF.NetCore.ServiceContracts`. The Common helpers BolMiddleware uses (`Enforce.ArgumentNotNull`, which throws `ArgumentNullException`, plus the URI, string, collection, and dictionary extensions) make no remote calls. `GetRequiredValue<T>` is a fail-fast configuration read supplied by `SAIF.NetCore.ServiceExtensions` (`IConfigurationExtensions`), although it is called through the Common entry in the resolution data.
- Not found in the Framework.NCore index: `BolContextApi.Client`, `BolMenuApi.Client`, `PolicyHeaderApi.Client`, and `PolicyCoreApiClient` were not found in the Framework.NCore index, the only repository checked, so the endpoints and transport used inside them remain unknown**. Members called by BolMiddleware, by package:
  - `BolContextApi.Client`: `RegisterBolContextApiClient`, `IBolContextApiClient.SaveContext`, `IBolContextApiClient.GetContext` (by context id and by session id plus application), `ContextHelper`, `ContextResult`, `ContextSaveRequest`.
  - `BolMenuApi.Client`: `RegisterBolMenuApiClient`, `IBolMenuApiClient.GetBusinessOnlineMenu`, `BusinessOnlineMenu`, `BusinessOnlineMenuItem`.
  - `PolicyHeaderApi.Client`: `RegisterPolicyHeaderApiClient`, `IPolicyHeaderApiClient.GetHeader`, `IPolicyHeaderApiClient.GetRelationships`, `PolicyHeader`, `PolicyAssociation`, `AssociationTypes`.
  - `PolicyCoreApiClient`: `RegisterPolicyCoreApiClient`, `IPolicyCoreApiClient` used by `SecurityService.IsValidPolicyForCurrentUser`.
  - `SAIF.NetCore.ServiceExtensions` (indexed): `OidcRazorStartup`, `AppStartup.EnableLegacyBolAuthMiddleware`, `GetRequiredValue`.
  - `SAIF.NetCore.AuthService` (indexed): `ISecurityClient.IsAuthorized`, `ISecurityClient.GetExternalUser`.
  - `SAIF.NetCore.EnvironmentClient` (indexed): `IEnvironmentClient.GetSettingValue`.
  - `SAIF.NetCore.Logging` (indexed): `ISaifLogService.Error`.
  - `SAIF.NetCore.ServiceContracts` (indexed): `ExternalUser`, `ExternalUserType`.
  - `SAIF.NetCore.Common` (indexed): `Enforce.ArgumentNotNull`, URI, string, collection, and dictionary extensions.
- Stale packages: four internal packages are behind the feed. `BolMenuApi.Client` is 1.0.24025.2 against 8.2026.630.2, `PolicyCoreApiClient` is 1.0.24093.1 against 6.2026.223.1, `SAIF.NetCore.Common` is 8.2023.319.2 against 10.2026.26267.1, and `SAIF.NetCore.ServiceExtensions` is 8.2025.302.1 against 10.2026.26279.1. `BolContextApi.Client` is current.
- Prerelease: `PolicyHeaderApi.Client` 1.0.25072.1-alpha is a prerelease and also behind the feed version 6.2026.225.1.
- Conflicting packaging pipelines: the primary pipeline in `.azdo/BolMiddleware-nuget` produces major version 8, while the legacy `pipelines/client.build.yml` produces major version 2 from `pipelines/build-vars.yml`.
- Duplicate registration: `IBolContextApiClient` is registered by `RegisterBolContextApiClient()` and again by an explicit singleton registration in `RegisterBolServices`.
- `ISecurityClient` is defined in `SAIF.NetCore.AuthService`, not in `SAIF.NetCore.ServiceExtensions`; BolMiddleware reaches it only through the `SAIF.NetCore.ServiceExtensions` package chain.*
- Newtonsoft.Json is used without a direct package reference, so its version depends on the transitive chain.*
- The CDN assets Font Awesome (no subresource integrity) and Google Analytics are loaded at runtime from third-party hosts.

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

## Sources
- src/BolMiddleware/BolMiddleware.csproj
- src/BolMiddleware/GlobalUsings.cs
- src/BolMiddleware/BolRazorLayoutStartup.cs
- src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs
- src/BolMiddleware/Services/Security/SecurityService.cs
- src/BolMiddleware/Pages/Shared/_BolCoreScriptsHeaderPartial.cshtml
- src/BolMiddleware/package.json
- .azdo/BolMiddleware-nuget/azure-pipelines.yml
- .azdo/BolMiddleware-nuget/variables/vars.yml
- pipelines/client.build.yml
- pipelines/build-vars.yml