Skip to content

Authorize a request against SAIF roles

Decide whether the current user is authorized for any of the roles declared on the filter. Trigger: MVC authorization filter stage on any controller/action decorated with SaifAuthorizeAttribute (applied as [SaifAuthorize]).

Field Value
Operation ID OP-09
Trigger MVC authorization filter stage on any controller/action decorated with SaifAuthorizeAttribute (applied as [SaifAuthorize])
Inputs HttpContextBase; Roles (comma-joined from the constructor); _ForceProductionRole; injected IUserProfileService and IEnvironmentService
Outputs bool authorization decision
Primary components SaifAuthorizeAttribute.AuthorizeCore(HttpContextBase)
Entry point src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs

Steps

  1. Enforce.ArgumentNotNull on httpContext, UserProfileService, and EnvironmentService — missing property injection fails fast (BR-01, BR-15).
  2. If Roles is empty, return true — an attribute constructed with no roles authorizes everyone (BR-16).
  3. Resolve the current user with UserProfileService.GetSystemUser(EnvironmentService.UserId()) and cache user.UserId into _userId for later logging.
  4. If the user is null or its UserId is empty, return false (BR-17).
  5. Strip spaces from Roles, split on ,, and return true when any role satisfies user.IsAuthorized(role, _ForceProductionRole) — OR semantics across roles (BR-18).

    Origin: Step 5's role check delegates to IApplicationUserProfile.IsAuthorized, owned by SAIF.Framework.Core† (retrieved via the Legends CLI RAG service) and executed on behalf of this operation; the underlying AD group membership evaluation itself is not visible in this repository.**

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Authorization filter stage])
    Guard[Guard httpContext/services]
    Empty{Roles empty?}
    AllowAll([Return true])
    Resolve[Resolve system user]
    NoUser{User resolvable?}
    Deny([Return false])
    AnyRole{Any role authorized?}
    Allow([Return true])
    DenyRole([Return false])
    Start --> Guard
    Guard --> Empty
    Empty -->|Yes| AllowAll
    Empty -->|No| Resolve
    Resolve --> NoUser
    NoUser -->|No| Deny
    NoUser -->|Yes| AnyRole
    AnyRole -->|Yes| Allow
    AnyRole -->|No| DenyRole

Failure and edge-case behavior

  • No unexpected failure paths beyond argument-guard exceptions and delegated dependency behavior were identified for this operation.

Note: Statements marked with † are derived from dependency library documentation via the Legends CLI. Statements marked with * were inferred from code structure or contextual evidence. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs