---
title: GroupImageSecurityProvider
summary: API reference for GroupImageSecurityProvider.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-24
library: SAIF.Services
reference_type: package
---

# GroupImageSecurityProvider

Implements `IGroupImageSecurityProvider`, centralizing the security checks and current-user identity used by the group imaging feature (`ImageService`, `ImageUpdater`, `ImageDeleter`, `ImageEditValidator`, `ImageDeleteValidator`). It depends solely on `IUserProfileService` to resolve the current user and evaluate role-based authorization via `IsAuthorized`.

## Purpose
- Determines whether the current user may view confidential group images (`SecurityRoles.ConfidentialRole`).
- Determines whether the current user may view deleted group images (`SecurityRoles.DeleteRole`).
- Determines whether the current user may edit group images (`SecurityRoles.EditRole`).
- Supplies the current user's ID for stamping create/update audit fields on image records.

## Context
- Namespace: `SAIF.Services.Groups.Imaging`
- Assembly/package: `SAIF.Services` (packaged inside the `SAIF.SAIFCode.Core` NuGet package)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| GroupImageSecurityProvider(userProfileService) | `public GroupImageSecurityProvider(IUserProfileService userProfileService)` | Stores the injected user-profile service used by all authorization checks. |
| CanUserSeeConfidentialImages | `public bool CanUserSeeConfidentialImages()` | Returns whether the current user holds the confidential-images role. |
| CanUserSeeDeletedImages | `public bool CanUserSeeDeletedImages()` | Returns whether the current user holds the delete role, permitting visibility of deleted images. |
| CanUserEditImages | `public bool CanUserEditImages()` | Returns whether the current user holds the edit role, permitting image edits. |
| UserId | `public string UserId()` | Returns the current user's user ID, used to stamp audit fields on image writes. |

## Behavioral notes
- Every check re-resolves the current user via `userProfileService.GetCurrentUser()` on each call rather than caching, so results reflect the latest session state at call time*.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- Services/SAIF.Services/Groups/Imaging/GroupImageSecurityProvider.cs