SAIF.SAIFCode.Core security and authorization¶

This page documents authorization mechanisms declared by this library and consumed elsewhere. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity on the request context. SAIF.SAIFCode.Core declares 16 Active Directory resource-name constants and 9 security service contracts, but contains no enforcement code of its own: no IsAuthorized calls, no authorization attributes, no directory lookups. Of the 16 constants, 6 have a compiled enforcement point in SAIF.Services, 6 are referenced only by uncompiled NoteService.cs files (excluded from the build and therefore not enforced), and 4 (all ViewRole constants) have no reference anywhere in the repository; this page traces each one to its enforcement point, or records that it has none in compiled code, and cross-references ../saif-services/security-authorization.md for the implementations.

Authorization architecture¶

Authorization in this library follows a declare-here, enforce-elsewhere pattern: AD resource-name constants and security service interfaces/DTOs are declared here, and SAIF.Services implementations perform the programmatic IsAuthorized checks against them via the external IUserProfileService.GetCurrentUser().IsAuthorized(resource) call*. No WCF SecurityService integration, service reference, client class, endpoint URL, or configuration key was found in this library or its app.config (binding redirects only).

flowchart TD
    Caller[Calling code in SAIF.Services] --> Resource["AD resource-name constant<br>(declared in SAIF.SAIFCode.Core)"]
    Resource --> Profile["IUserProfileService.GetCurrentUser()<br>(external, SAIF.Framework.Core)"]
    Profile --> IsAuth["IsAuthorized(resource)"]
    IsAuth -->     AD[("Active Directory")]

AD resource catalog¶

Full catalog of all 16 AD resource-name constants declared in this library. All are public const string members of four SecurityRoles classes (all four files compiled). The environment suffix (Resource/TestResource) is not part of the literal and is appended at runtime by the external IUserProfileService implementation*. Summary: 6 of 16 have a compiled enforcement point in this repository, 6 are referenced only by uncompiled NoteService.cs files, and 4 (all ViewRole constants) are never referenced anywhere in the repository.

Resource name	Purpose	Enforcement point	Source
`AgencyImagingView`	View agency images*	None: no reference anywhere in the repository	`Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs`
`AgencyImagingEdit`	Edit agency image metadata	`SAIF.Services.Agencies.Imaging.ImageService.CanUserEditImages`, checked in `EditImage` (compiled) — see `../saif-services/security-authorization.md`	`Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs`
`AgencyImagingConfidential`	See confidential agency images	`SAIF.Services.Agencies.Imaging.ImageService.CanUserSeeConfidentialImages` (compiled) — see `../saif-services/security-authorization.md`	`Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs`
`AgencyImagingDeleted`	See soft-deleted agency images (constant named `DeleteRole`, but used as a view-deleted permission)	`SAIF.Services.Agencies.Imaging.ImageService.CanUserSeeDeletedImages` (compiled)	`Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs`
`AgencyNotePadView`	View agency notepad entries*	None: no reference anywhere in the repository	`Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs`
`AgencyNotePadEdit`	Edit agency notes*	`Services/SAIF.Services/Agencies/Notes/NoteService.cs` (not compiled — excluded from `SAIF.Services.csproj`)	`Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs`
`AgencyNotePadDelete`	Delete agency notes*	`Services/SAIF.Services/Agencies/Notes/NoteService.cs` (not compiled)	`Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs`
`AgencyNotePadConfidential`	See confidential agency notes*	`Services/SAIF.Services/Agencies/Notes/NoteService.cs` (not compiled)	`Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs`
`GroupImagingView`	View group images*	None: no reference anywhere in the repository	`Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs`
`GroupImagingEdit`	Edit group images	`SAIF.Services.Groups.Imaging.GroupImageSecurityProvider.CanUserEditImages` (compiled)	`Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs`
`GroupImagingConfidential`	See confidential group images	`GroupImageSecurityProvider.CanUserSeeConfidentialImages` (compiled), feeding `ImageFilterCriteria.CanUserSeeConfidentialImages` for SAIF.Data.NHibernate `GroupImageRepository.GetFilteredImageGroups`	`Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs`
`GroupImagingDeleted`	See soft-deleted group images (same `DeleteRole` naming mismatch as the agency constant)	`GroupImageSecurityProvider.CanUserSeeDeletedImages` (compiled), feeding `ImageFilterCriteria.CanUserSeeDeletedImages`	`Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs`
`GroupNotePadView`	View group notepad entries*	None: no reference anywhere in the repository	`Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs`
`GroupNotePadEdit`	Edit group notes*	`Services/SAIF.Services/Groups/Notes/NoteService.cs` (not compiled)	`Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs`
`GroupNotePadDelete`	Delete group notes*	`Services/SAIF.Services/Groups/Notes/NoteService.cs` (not compiled)	`Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs`
`GroupNotePadConfidential`	See confidential group notes*	`Services/SAIF.Services/Groups/Notes/NoteService.cs` (not compiled)	`Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs`

A repository-wide search for these literal values in *.cs, *.cshtml, *.vb, *.config, *.json, and *.xml returned only these definitions — no controller attribute or configuration entry uses them by value. Resource names used by the security service implementations themselves (for example ConflictClaim, SecureClaim, SAIFPolicyInfo, AgencyExternal) are defined in SAIF.Services, not in this library — see ../saif-services/security-authorization.md.

Authorization enforcement points¶

Attribute-based authorization¶

None. This library has no controllers or actions and declares no authorization attributes.

Programmatic authorization checks¶

None in this library. The contracts declared here are implemented and enforced entirely in SAIF.Services, traced below for cross-reference — enforcement itself belongs to ../saif-services/security-authorization.md.

Class	Method	Resource / Role	Check type	Source
`SAIF.Services.Security.ClaimSecurityService`	`GetClaimSecurity` / `LoadClaimSecurity`	`ConflictClaim`, `SecureClaim`	`IsAuthorized`	`Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs` (contract); implementation in SAIF.Services
`SAIF.Services.Policies.SecurityServices.PolicySecurityService`	`IsValidPolicyForCurrentUser` / `ValidatePoliciesForCurrentUser<T>` / specified-user overloads	Per-user-type domain and AD resource checks	`IsAuthorized` composite	`Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs` (contract)
`SAIF.Services.Policies.Certificates.CertificateSecurityService`	`CertificateCanBeEdited/Deleted/Added/Renewed/Resent`, `CanCurrentUserAdd/AddOsc/Renew/RenewOsc/ViewOsc/Access`	SAIF.Services `SecurityResources` class	`IsAuthorized`	`Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs` (contract)
`SAIF.Services.Groups.Imaging.GroupImageSecurityProvider`	`CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages`, `CanUserEditImages`	Groups imaging `SecurityRoles`	`IsAuthorized`	`Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs` (contract)
`SAIF.Services.Agencies.Imaging.ImageService`	`CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages`, `CanUserEditImages`	Agencies imaging `SecurityRoles`	`IsAuthorized`	`Core/SAIF.Core/Contracts/Agencies/Imaging/IAgencyImageService.cs` (contract)

Data-level authorization¶

This library declares, but does not implement, the following data-level authorization contracts. Enforcement logic is in SAIF.Services.

Entity type	Validation method	Mechanism	Source
Policy (`IPolicyNumber`)	`IPolicySecurityService.IsValidPolicyForCurrentUser(long)`, `ValidatePoliciesForCurrentUser<T>(IEnumerable<T>)`, specified-user overloads	Ownership check: does the policy belong to (or is it serviced by) the current or specified user, composed from `IsExternal`, domain, and AD resource checks per user type*	`Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs`
Claim (`IClaimSecurityAttributes`)	`IClaimSecurityService.GetClaimSecurity` / `LoadClaimSecurity`	Composite: claim-level flags (`IsConflictClaim`, `IsSecureClaim`) combined with the user's conflict/secure AD access, returned as `ClaimSecurityAccess`	`Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs`, `Core/SAIF.Core/Contracts/Claims/Information/IClaimSecurityAttributes.cs`
Certificate (`CertificateSecurityProperties`, `OtherStatesPolicy`)	`ICertificateSecurityService.CertificateCanBeEdited/Deleted/Added/Renewed/Resent`, `CanCurrentUserAccess(OtherStatesPolicy)`	Per-entity permission contract combining certificate state with the user's maintain-own/maintain-others resources	`Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs`

Segregation of duties¶

None found. No SOD classes or rules exist in this library. EmployeePaymentAuthority.AuthorizedBy/AuthorizedByEmployeeId, PaymentAuthorityLimitHistory.AuthorizedBy, and CaseCost.AuthorizedByEmployeeId carry approver identity, but no rule here compares approver and requester.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`IClaimSecurityService`	Computes a user's conflict/secure claim access	`SAIF.Services.Security.ClaimSecurityService`; consumed by `Web/SAIF.Web.Mvc/Controllers/ClaimControllerBase.cs`, `Web/SAIF.Web.Mvc5/Controllers/ClaimControllerBase.cs`, `Web/SAIF.Web.Mvc/Controllers/LegalControllerBase.cs`	`Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs`
`IPolicySecurityService`	Policy ownership check for current/specified user	`SAIF.Services.Policies.SecurityServices.PolicySecurityService`	`Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs`
`ICertificateSecurityService`	Per-entity certificate authorization	`SAIF.Services.Policies.Certificates.CertificateSecurityService`	`Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs`
`IGroupImageSecurityProvider`	Group-imaging authorization	`SAIF.Services.Groups.Imaging.GroupImageSecurityProvider`	`Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs`
`ILegalSecurityOverrideService`	Legal-case-keyed security override contract, same shape as `ISecurityOverrideService`	No implementation found anywhere in the repository; external implementer unknown**	`Core/SAIF.Core/Contracts/Legal/SecurityOverrides/ILegalSecurityOverrideService.cs`
`ClaimSecurityAccess`	Data carrier: `HasConflictAccess`, `HasSecureAccess`	Consumed by `IClaimSecurityService` implementations	`Core/SAIF.Core/Contracts/Security/ClaimSecurityAccess.cs`

Tech-debt and coverage findings¶

This section calls out the security tech-debt findings from the Stage 1c-security analysis that are specific to this library.

Only 6 of 16 AD resource-name constants have a compiled enforcement point in the repository — the imaging Edit, Confidential, and Deleted roles for both Agencies and Groups. The other 10 have no enforcement anywhere in the compiled SAIF.Services build.
6 NotePad constants (Agency and Group Edit/Delete/Confidential) are referenced only by NoteService.cs files that are excluded from SAIF.Services.csproj — dead/unreachable code. Any consumer implementing notes against these contracts outside this repository must re-implement the checks; otherwise note confidentiality and delete restrictions are unenforced**.
All 4 ViewRole constants (AgencyImagingView, AgencyNotePadView, GroupImagingView, GroupNotePadView) are never referenced anywhere in the repository. View access to agency and group images and notes is therefore not gated by these resources anywhere in the repository; it is controlled by the host application or not at all**.
The DeleteRole constants carry an inconsistent meaning between imaging and notes. For imaging (AgencyImagingDeleted, GroupImagingDeleted), the constant is used as "can see deleted images" (a view permission on soft-deleted records). For notes (AgencyNotePadDelete, GroupNotePadDelete), the constant is used as "can delete" (a destructive permission). The shared member name (DeleteRole) across four otherwise-parallel SecurityRoles classes hides this difference in meaning and invites misuse by a future consumer who assumes symmetric semantics.
ILegalSecurityOverrideService has no implementation anywhere in the repository. It declares the same override CRUD shape as ISecurityOverrideService (which SAIF.Services does implement), but no SAIF.Services class, nor any other repository file, implements it. Any consumer relying on legal security overrides must supply an external implementer.
The four SecurityRoles classes share the identical simple class name (SecurityRoles) across four different namespaces; the correct class is selected only by the consumer's using directive (verified correct in all compiled consumers, but a fragile pattern for future maintainers)*.
Additional enforcement gaps in the consumers of these constants (documented for the SAIF.Services library) are out of scope for this page — see ../saif-services/security-authorization.md.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

Core/SAIF.Core/SAIF.SAIFCode.Core.csproj
Core/SAIF.Core/packages.config
Core/SAIF.Core/app.config
Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs
Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs
Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs
Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs
Core/SAIF.Core/Contracts/Security/ClaimSecurityAccess.cs
Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs
Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs
Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs
Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs
Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageService.cs
Core/SAIF.Core/Contracts/Agencies/Imaging/IAgencyImageService.cs
Core/SAIF.Core/Contracts/Claims/SecurityOverrides/ISecurityOverrideService.cs
Core/SAIF.Core/Contracts/Legal/SecurityOverrides/ILegalSecurityOverrideService.cs
Core/SAIF.Core/Contracts/Claims/Information/IClaimSecurityAttributes.cs
Core/SAIF.Core/Contracts/Claims/Information/ClaimUserAccess.cs
Core/SAIF.Core/Contracts/Claims/Information/ClaimForOnBase.cs
Core/SAIF.Core/Contracts/OnlineMessages/IOnlineMessagesApiService.cs
Core/SAIF.Core/Contracts/Policies/PolicyDocumentsApi/PolicyDocumentsReturnCodeList.cs
Core/SAIF.Core/Contracts/Policies/PolicyDocumentsApi/ReturnCodeMessages.cs
Core/SAIF.Core/Contracts/Claims/Authority/EmployeePaymentAuthority.cs
Core/SAIF.Core/Contracts/Claims/Authority/PaymentAuthorityLimitHistory.cs
Core/SAIF.Core/Contracts/Legal/CaseCost.cs
Services/SAIF.Services/SAIF.Services.csproj
Services/SAIF.Services/Agencies/Imaging/ImageService.cs
Services/SAIF.Services/Agencies/Notes/NoteService.cs
Services/SAIF.Services/Groups/Imaging/GroupImageSecurityProvider.cs
Services/SAIF.Services/Groups/Imaging/ImageService.cs
Services/SAIF.Services/Groups/Notes/NoteService.cs
Services/SAIF.Services/Security/ClaimSecurityService.cs
Services/SAIF.Services/Security/ClaimSecurityRoles.cs
Services/SAIF.Services/Policies/SecurityServices/PolicySecurityService.cs
Services/SAIF.Services/Policies/Certificates/CertificateSecurityService.cs
Services/SAIF.Services/Claims/SecurityOverride/SecurityOverrideService.cs
Services/SAIF.Services/OnlineMessages/OnlineMessagesApiService.cs
Web/SAIF.Web.Mvc/Controllers/ClaimControllerBase.cs
Web/SAIF.Web.Mvc5/Controllers/ClaimControllerBase.cs
Web/SAIF.Web.Mvc/Controllers/LegalControllerBase.cs