---
title: Authorization helpers
summary: Answers user type, role, external user, and policy access questions through ISecurityClient and the Policy Core API.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
operation_id: OP-15
trigger: Calls from page models
---

# Authorization helpers

`SecurityService` gives the page model chain one place to ask who the current user is, whether the user is external, whether a caller-supplied role is held, and whether a policy may be viewed.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-15 |
| **Trigger** | Calls from page models |
| **Inputs** | Role name, policy number, current HTTP identity |
| **Outputs** | Booleans, user id, `ExternalUser` |
| **Primary components** | `SecurityService.GetCurrentUserId`, `IsUserExternal`, `IsAuthorizedAsync`, `GetCurrentExternalUserAsync`, `IsValidPolicyForCurrentUser` |
| **Entry point** | `src/BolMiddleware/Services/Security/SecurityService.cs` |

## Steps

1. `GetCurrentUserId` returns the authenticated identity name from `IHttpContextAccessor`, or null.
2. `IsUserExternal` compares the domain portion of the identity name with `SAIF` ([BR-BOLMIDDLEWARE-005](../business-rules.md#br-bolmiddleware-005-external-user-detection)).
3. `IsAuthorizedAsync(role)` calls `ISecurityClient.IsAuthorized` for the caller-supplied role; the library defines no role names.
4. `GetCurrentExternalUserAsync` calls `ISecurityClient.GetExternalUser` for the external user record.
5. `IsValidPolicyForCurrentUser(policyNumber)` asks the Policy Core API whether the user may see the policy and returns the answer ([BR-BOLMIDDLEWARE-009](../business-rules.md#br-bolmiddleware-009-policy-access-validation)).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Page model call]) --> D1{Which question?}
	D1 -->|User id| S1[Read identity name]
	D1 -->|External?| S2[Compare domain with SAIF]
	D1 -->|Role| S3[ISecurityClient IsAuthorized]
	D1 -->|External user| S4[ISecurityClient GetExternalUser]
	D1 -->|Policy access| S5[IPolicyCoreApiClient IsValidPolicyForUser]
	S1 --> EndOk([Return answer])
	S2 --> EndOk
	S3 --> EndOk
	S4 --> EndOk
	S5 --> EndOk
```

## Failure and edge-case behavior

- The internal or external decision rests on the identity name text, not on a claim or role.
- Callers must pass role names; no default roles are defined in this library.

## Related documentation
- [Index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Dependencies](../dependencies.md)
- [Configuration](../configuration.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Service registration](../service-registration.md)
- [API reference](../api/index.md)

## Sources
- src/BolMiddleware/Services/Security/SecurityService.cs
- src/BolMiddleware/Services/Security/ISecurityService.cs
- src/BolMiddleware/Models/BolMenuModel.cs