Skip to content

Resolve policy header

This operation avoids repeated header calls by reusing the header stored in the session when it belongs to the requested policy. It also gates the header behind the policy access check.

Field Value
Operation ID OP-11
Trigger TryGetPolicyHeader during policy page handling
Inputs Policy number, session, current user
Outputs Header stored in the session, AccessAllowed, ErrorMessage
Primary components BolPolicyModel.TryGetPolicyHeader, BolPolicyModel.GetPolicyHeader, SecurityService.IsValidPolicyForCurrentUser
Entry point src/BolMiddleware/Models/BolPolicyModel.cs

Steps

  1. Read the policy header from the session.
  2. If its policy number equals the context policy number, use it and stop (BR-BOLMIDDLEWARE-014).
  3. Otherwise validate that the current user may see the policy (BR-BOLMIDDLEWARE-009); see Authorization helpers.
  4. If access is denied: set AccessAllowed false and ErrorMessage, and stop.
  5. Request the header through Get policy header with the policy number, customer id, and user type code.
  6. Save the header to the session and set AccessAllowed true.
  7. On exception: capture ex.Message into ErrorMessage.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([TryGetPolicyHeader]) --> D1{Session header matches policy?}
    D1 -->|Yes| EndOk([Use session header])
    D1 -->|No| D2{Access valid for user?}
    D2 -->|No| EndErr([Set error message])
    D2 -->|Yes| S1[Get policy header]
    S1 --> S2[Save to session]
    S2 --> EndOk

Failure and edge-case behavior

  • Reuse of a session header means a revoked association remains visible until the session ends.
  • The access check result comes from a blocking Task.Result call.

Sources

  • src/BolMiddleware/Models/BolPolicyModel.cs
  • src/BolMiddleware/Services/Security/SecurityService.cs
  • src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs