---
title: Request pipeline and composition
summary: The application composes its dependencies once at start, then authenticates and routes each request; only non-AJAX requests on controllers derived from BaseController receive web context and render the layout.
status: draft
owner: Claims
last_reviewed: 2026-09-30
operation_id: request-pipeline-and-composition
trigger: Application start (composition) and each HTTP request to the application
---

# Request pipeline and composition

The application composes its dependencies once at start. Each request is then authenticated and routed to a controller; only non-AJAX requests on controllers derived from `BaseController` are given the web context, and only full-view responses render the `_Bootstrap3` layout.

## Trigger and screens

| Item | Detail |
| --- | --- |
| Trigger | Application start (composition) and each HTTP request to the application |
| Screens | [Bill entry](../../screens/entry.md), [Inbox](../../screens/inbox.md), [Search](../../screens/search.md) |
| Tables | Not traced** |

## Steps

Application start (once per application domain, not per request)

1. `Application_Start` registers areas, Web API routes, global filters (`HandleErrorAttribute`), MVC routes, AutoMapper maps, bundles and FluentValidation, and replaces the view engines with the Razor engine. It also binds the JSON date binder for `DateTime` and `DateTime?`.
2. `Application_Start` calls `DependencyMap.Configure` to build the Autofac container (see [Architecture](../architecture.md#start-up-pipeline)).

Each request

3. IIS authenticates the caller with Windows authentication; anonymous access is off.
4. The default route `{controller}/{action}/{id}` selects the controller and action.
5. Authorization depends on the controller.
   1. `SaifAuthorize` requires `CBPEnterBill` on the Entry, Inbox and Search controllers, for full-view and AJAX requests alike.
   2. The other hosted controllers require only an authenticated user.
   3. `HomeController` derives from `WebContextControllerBase`, not from `BaseController`; `Home.Index` redirects to `Entry/Index` and `Home.Navigate` handles the web-context change.
6. For the controllers derived from `BaseController`, `OnActionExecuting` runs its logic only when `Request.IsAjaxRequest()` is false.
   1. For a non-AJAX request it calls the inherited `OnActionExecuting` and then `SetDefaultCurrentValue` so the web context defaults to the claim number. `CheckSecurity` returns `HasConflictAccess` for the web-context claim.
   2. For an AJAX request the override does nothing, so neither the inherited call nor the web-context default runs.
7. The action runs and the response takes one of three paths.
   1. A full view, such as `Entry.Index`, `Inbox.Index` and `Search.Index`, renders the `_Bootstrap3` layout with the web-context control, top menu and side menu.
   2. A JSON or grid response, such as `GetBill`, `GetInboxBills` and the grid read actions, returns data and does not render the layout.
   3. A redirect, such as `Home.Index`, returns a redirect response and does not render the layout.

   > **Origin**: Steps 5.1 and 6.1 rely on `SaifAuthorizeAttribute` and the web-context extensions (`WebContextExtensions`, `TempDataExtensions`) in `SAIF.Framework.Web.Mvc`†. Per the Legends CLI RAG service, `SaifAuthorizeAttribute` is a sealed authorization filter that grants access when the current user satisfies any one of its declared roles, otherwise logging a `SecurityException` and redirecting to a fixed error URL, using property-injected `IUserProfileService`, `ILogService` and `IEnvironmentService`; `WebContextExtensions`/`TempDataExtensions` render and persist the `WebContextId` handoff value between requests. `ClaimControllerBase` in `SAIF.SAIFCode.Web.Mvc` could not be located in the available Legends CLI documentation corpus, so its inherited `OnActionExecuting` behavior was not traced**.

## Process flow

The diagram separates application start from the per-request paths.

```mermaid
flowchart TD
    A["Application_Start"] --> B["Register routes, filters, maps,<br>bundles and validation"]
    B --> C["DependencyMap.Configure<br>(Autofac container)"]
    R["HTTP request"] --> D["Windows authentication"]
    D --> E["Route to controller"]
    E --> F{"Controller has<br>SaifAuthorize?"}
    F -->|"Yes"| G{"Has CBPEnterBill?"}
    G -->|"No"| X["Access denied"]
    G -->|"Yes"| H{"Derives from<br>BaseController?"}
    F -->|"No"| H
    H -->|"No (Home)"| K["Action runs"]
    H -->|"Yes"| I{"AJAX request?"}
    I -->|"No"| J["OnActionExecuting sets<br>web context default"]
    I -->|"Yes"| K
    J --> K
    K --> L{"Response type"}
    L -->|"Full view"| M["_Bootstrap3 layout renders<br>web context and menus"]
    L -->|"JSON or grid data"| N["Data returned, no layout"]
    L -->|"Redirect"| O["Redirect, no layout"]
```

## Failure and edge-case behavior

- A caller without the `CBPEnterBill` role is refused by the framework filter on the Entry, Inbox and Search controllers.
- The inherited behavior of `ClaimControllerBase` was not traced**.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Hosted endpoints](../hosted-endpoints.md)
- [Data model](../data-model.md)
- [Architecture](../architecture.md)
- [Tech debt](../tech-debt.md)
- [Screen catalog](../../screens/index.md)

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Sources
- ClaimBillEntry/Global.asax.cs
- ClaimBillEntry/App_Start/RouteConfig.cs
- ClaimBillEntry/App_Start/FilterConfig.cs
- ClaimBillEntry/Controllers/BaseController.cs
- ClaimBillEntry/Controllers/HomeController.cs
- ClaimBillEntry/Views/Shared/_Bootstrap3.cshtml
- SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs