ClaimSecurity

ClaimSecurity computes the four per-claim, per-user access flags — conflict, exposure, secure/hostile, and health-issue — by combining a specific claim's characteristic flags (IsWorkerConflict, IsExposure, IsHealthIssue, IsHostileWorker) with the current user's AD-resource membership token (ClaimUserAccess). It is the rule-evaluation logic consumed by ClaimAppManager.OnCheckSecurity() (see Security enforcement) but is not itself an enforcement point — it produces flags, it does not call MarkNoAccess/MarkViewOnly.

Purpose

• Evaluate BR-CLM-001 through BR-CLM-004 for a given claim and user.
• Expose the resulting access flags as public read-only properties for ClaimAppManager and external callers (e.g., screen-level field/section visibility logic) to consult.

Context

• Namespace: SAIF.Application.Claim
• Assembly/package: SAIF.Application.Claim

Public members

Member	Signature	Purpose
New(inUserAccess)	Public Sub New(inUserAccess As ClaimUserAccess)	Constructs the security evaluator from an existing per-user AD-resource access token.
New(inPrincipal)	Public Sub New(inPrincipal As clsSecurityPrincipal)	Constructs the security evaluator from an authenticated principal, internally building a ClaimUserAccess token.
ConflictAccess	Public ReadOnly Property ConflictAccess As Boolean	False when the claim is a worker-conflict claim the user lacks access to; drives the hard MarkNoAccess() gate in BR-CLM-001.
UserAccess	Public ReadOnly Property UserAccess As ClaimUserAccess	Exposes the underlying per-user AD-resource access token used for all four flag computations.
ExposureAccess	Public ReadOnly Property ExposureAccess As Boolean	False when the claim is an exposure claim the user lacks access to, per BR-CLM-002.
SecureClaimAccess	Public ReadOnly Property SecureClaimAccess As Boolean	False when the claim involves a hostile worker the user lacks secure-claim access to, per BR-CLM-004.
HealthIssueAccess	Public ReadOnly Property HealthIssueAccess As Boolean	False only when the claim is both a health-issue and exposure claim and the user lacks exposure access, per BR-CLM-003. Gated by ExposureAccess, not ClaimUserAccess.HealthIssueAccess — see the tech-debt note on that rule*.
CheckClaim(inClaim)	Public Sub CheckClaim(inClaim As clsClaimData)	Recomputes all four access flags from scratch against the passed-in claim's characteristic flags and the current ClaimUserAccess token; the underlying rule-evaluation logic for Security enforcement.

Behavioral notes

• Serializable (<Serializable> attribute).
• Only ConflictAccess is directly consumed by ClaimAppManager's own enforcement code; ExposureAccess, HealthIssueAccess, and SecureClaimAccess are exposed for external callers to enforce themselves*.
• Tech debt: HealthIssueAccess gates on UserAccess.ExposureAccess, not UserAccess.HealthIssueAccess (backed by the CollateralHealthClaim AD resource), making the CollateralHealthClaim resource key effectively dead from this library's perspective — see BR-CLM-003**.

Constraints and usage notes

• Constructing via New(inPrincipal) builds a ClaimUserAccess token internally; constructing via New(inUserAccess) allows callers to supply a pre-built token.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Application.Claim\ClaimSecurity.vb