--- title: CertificateSecurityService summary: API reference for CertificateSecurityService. status: draft owner: SAIF Doc Gen last_reviewed: 2026-09-24 library: SAIF.Services reference_type: package --- # CertificateSecurityService Implements per-request certificate authorization decisions for `CertificateService` and `CertificateEditor`-style callers by combining the current user's `IsAuthorized` grants (via `IUserProfileService`) with certificate-specific business rules (certificate type, creator identity, creation-date age) resolved through `ICertificateInformationService` for policy lookups on Other-States-policy access checks. Authorization outcomes are cached per current-user-ID for the lifetime of the service instance so repeated calls for the same user avoid re-evaluating `IsAuthorized`. ## Purpose - Decides whether the current user can view Other-States-Coverage (OSC) data, and, for a specific `OtherStatesPolicy`, whether an agent-restricted user is tied to that policy's agent or agency. - Decides whether the current user can add, edit, delete, renew, or resend a specific certificate, based on certificate type (standard/bid vs. Other-States), the user's maintain/renew authorization grants, and — for edit/delete — whether the current user created the certificate. - Decides whether the current user can add standard/bid certificates versus Other-States certificates, and whether other-coverages text can be maintained. - Enforces a time-boxed edit/delete window: certificates can only be edited or deleted within `SecurityResources.MaximumEditibleDays` of their creation date, and exposes the cutoff date used to filter editable certificates. ## Context - Namespace: `SAIF.Services.Policies.Certificates` - Assembly/package: `SAIF.Services` (packaged inside the `SAIF.SAIFCode.Core` NuGet package). ## Public members | Member | Signature | Purpose | | --- | --- | --- | | CertificateSecurityService (constructor) | `public CertificateSecurityService(IUserProfileService userProfileService, ICertificateInformationService certificateInformationService)` | Wires the user-profile service (current-user/authorization lookups) and the certificate-information service (policy lookups for Other-States-policy access checks). | | CanCurrentUserViewOsc | `public bool CanCurrentUserViewOsc()` | Returns `true` if the current user holds either the `ViewOsc` or `ViewOscExt` authorization resource; result is cached per user ID. | | CanCurrentUserAccess | `public bool CanCurrentUserAccess(OtherStatesPolicy policy)` | Returns `false` if the user cannot view OSC data at all; otherwise returns `true` for non-agent users, and for agent users returns `true` only if the user's external customer ID matches the policy's agent ID or agent agency ID. | | CanCurrentUserAdd | `public bool CanCurrentUserAdd()` | Returns whether the current user holds the standard "maintain own" certificate authorization. | | CanCurrentUserAddOsc | `public bool CanCurrentUserAddOsc()` | Returns whether the current user holds the "maintain own OSC" certificate authorization. | | CertificateOtherCoveragesCanBeMaintained | `public bool CertificateOtherCoveragesCanBeMaintained()` | Returns `true` if the current user holds either the `MaintainOtherCoverages` or `MaintainOtherCoveragesExt` authorization resource; result is cached per user ID. | | CanCurrentUserRenew | `public bool CanCurrentUserRenew()` | Returns whether the current user holds the standard certificate renew authorization (`Renew` or `RenewExternal`). | | CanCurrentUserRenewOsc | `public bool CanCurrentUserRenewOsc()` | Returns whether the current user holds the OSC certificate renew authorization (`RenewOsc` or `RenewOscExternal`). | | CertificateCanBeRenewed | `public bool CertificateCanBeRenewed(CertificateSecurityProperties certificate)` | Sets the certificate under evaluation and returns whether the current user can renew it, based on whether it is a standard or Other-States certificate. | | CertificateCanBeAdded | `public bool CertificateCanBeAdded(CertificateSecurityProperties certificate)` | Sets the certificate under evaluation and returns whether the current user is authorized to add a certificate of that type (standard/bid vs. Other-States). | | CertificateCanBeEdited | `public bool CertificateCanBeEdited(CertificateSecurityProperties certificate)` | Sets the certificate under evaluation and returns `true` only if the certificate is still within its editable time window and the current user is authorized to edit it (has "maintain all" rights, or "maintain own" rights and created the certificate). | | CertificateCanBeDeleted | `public bool CertificateCanBeDeleted(CertificateSecurityProperties certificate)` | Sets the certificate under evaluation and returns whether it can be deleted, using the same time-window and authorization rules as `CertificateCanBeEdited`. | | CertificateCanBeResent | `public bool CertificateCanBeResent(CertificateSecurityProperties certificate)` | Sets the certificate under evaluation and always returns `true` (resend is not currently gated by additional business rules beyond having reached this call). | | GetCertificateModificationCutoff | `public DateTime GetCertificateModificationCutoff()` | Returns today's date minus `SecurityResources.MaximumEditibleDays`, the earliest creation date a certificate can have and still be editable/deletable. | ## Behavioral notes - Most authorization checks (`CanCurrentUserViewOsc`, `CertificateOtherCoveragesCanBeMaintained`, and the private `CurrentUserCanMaintain*`/`CurrentUserCanRenew*`/`CurrentUserCanAdd*` properties) cache their boolean result in a `KeyValuePair` keyed by the current user's ID, re-evaluating `IsAuthorized` only when the cached user ID no longer matches.* - `CertificateCanBeEditedByCurrentUser`/`CertificateCanBeDeletedByCurrentUser` require either a "maintain all" authorization or both a "maintain own" authorization and the current user having created the certificate, compared case-insensitively via `String.Equals` on uppercased user IDs. - `CertificateCanBeEditedNow`/`CertificateCanBeDeletedNow` both delegate to `CertificateCanBeModifiedNow`, which requires `CurrentCertificate.CreateDate + SecurityResources.MaximumEditibleDays` to be after today. - `CanCurrentUserAccess` throws no exception on a null `policy` argument at the API boundary despite the method dereferencing it; the method carries a `CA1062:Validate arguments of public methods` suppression.* - A commented-out `PolicyHasCancelAttributes`/`CertificateCanBeMaintainedByCancelDateRules` block indicates a previously considered (and currently disabled) cancellation-date-based maintainability rule.* ## Constraints and usage notes - Both constructor parameters are null-checked via `Enforce.ArgumentNotNull`. - All `CertificateCanBe*` methods mutate the shared `CurrentCertificate` property as a side effect before evaluating the result, so this service is not safe for concurrent calls against different certificates on the same instance.* - Per-user authorization caches are stored as instance fields, so a `CertificateSecurityService` instance should not be reused across different users without expecting stale results if the user context changes mid-lifetime.* > **Note:** Statements marked with * were inferred from code structure, naming conventions, or > contextual evidence where direct confirmation was not available in source artifacts. Statements > marked with ** could not be confirmed; treat as unknown until verified. ## Sources - `Services/SAIF.Services/Policies/Certificates/CertificateSecurityService.cs`