---
title: SAIF.Application dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-08-21
library: SAIF.Application
reference_type: embedded
---

# SAIF.Application dependencies

## Internal dependencies

`SAIF.Application` declares **no** same-repo `<ProjectReference>` elements. It is the lowest application-layer project in the solution and depends on no other project in this repository — *verified*. Its internal dependencies are the organizational SAIF NuGet packages below.

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| `SAIF.BOF.Framework` (`.Core`, `.Connection`, `.Security`, `.Security.EnvironmentApi`, `.Bindable`, `.Logging`, `.Mail`, `.DNS`) | NuGet Package | Internal SAIF framework package supplying `clsBusinessBase`, `clsSecurityPrincipal`, `clsDataAccess`, `IDataAccess`, `IDataPortal`, `IDataPortalInfo`, `clsSQLDataPortal`, `clsMSOracleDataPortal` |
| `SAIF.Framework.Common` | NuGet Package | Referenced by the project; no direct type usage found in the scanned source* |
| `SAIF.HashUtil` | NuGet Package | Referenced by the project; no direct type usage found in the scanned source* |
| `SAIF.Web.API.Clients` (`SAIF.Web.API.Clients`, `SAIF.Web.API.Core`) | NuGet Package | Referenced by the project; no direct type usage found in the scanned source* |

## External dependencies
| Dependency | Version | Usage |
| --- | --- | --- |
| `Oracle.ManagedDataAccess` | 21.5.0 | ODP.NET managed driver registered in `app.config` / `Web.config` for Oracle data portals |
| `RestSharp` | 106.12.0 | Referenced by the project; no direct usage found in the scanned source* |
| `Newtonsoft.Json` | 8.0.3 | Referenced by the project; binding redirect present |
| `Microsoft.Bcl.AsyncInterfaces`, `System.Buffers`, `System.Memory`, `System.Numerics.Vectors`, `System.Runtime.CompilerServices.Unsafe`, `System.Text.Encodings.Web`, `System.Text.Json`, `System.Threading.Tasks.Extensions`, `System.ValueTuple` | various | Transitive BCL/compatibility packages (framework-standard, excluded from further analysis) |

## Dependency risks and notes
- **Zero internal (same-repository) dependencies.** `SAIF.Application` is consumed by, but does not itself depend on, `SAIF.Application.Claim`, `SAIF.Application.Claim.Legal`, and `LegalMaintenance` — it is the foundation project of the application layer, so any change here has wide downstream blast radius across those three consumers.
- **Opaque authorization implementation.** `clsSecurityPrincipal.IsAuthorized` (from `SAIF.BOF.Framework.Security`) is the sole authorization decision source used via `UserAccess`. Whether it performs a WCF `SecurityService` call, a direct AD lookup, or an internally cached lookup, and how the environment suffix (`Resource` / `TestResource`) is appended, cannot be confirmed from this repository — the package is not available locally.**
- **Several referenced packages show no call site in the scanned source**: `SAIF.Framework.Common`, `SAIF.HashUtil`, `SAIF.Web.API.Clients` / `SAIF.Web.API.Core`, and `RestSharp` are declared in `packages.config` and the project file but no corresponding type usage was found; they may be residual references or required only transitively at runtime.*
- **`SAIF.BOF.Framework.Security.EnvironmentApi` is an unused reference.** The DLL is referenced but no `IEnvironmentService` member (`GetConfigSetting`, `GetSecureConfigSetting`, `.ApplicationId`, `.MachineName`) is called from any source file in this library.
- **No packaging pipeline exists for this library.** The repository builds and deploys an IIS web application (`deploy-stages-web-iis.yml`); no NuGet pack/publish template is referenced, so `SAIF.Application` is consumed exclusively as an embedded (source/ProjectReference) library within this solution, not as a published NuGet package.
- **Data-portal provisioning risk is transitive.** `ApplicationDataAccess` builds `clsSQLDataPortal` / `clsMSOracleDataPortal` instances from `SAIF.BOF.Framework.Connection`; any behavior change in that package (connection handling, transaction semantics) propagates to every derived manager without this library issuing any SQL itself.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

## Sources
- `SAIF.Application/SAIF.Application.vbproj`
- `SAIF.Application/packages.config`
- `SAIF.Application/AppManagerBase.vb`
- `SAIF.Application/UserAccess.vb`
- `SAIF.Application/ApplicationDataAccess.vb`
- `Pipelines/build-vars.yml`, `Pipelines/build.yml`, `Pipelines/release.yml`
- `SAIF.BOF.Framework.Security.EnvironmentApi` (referenced package, no local call site)