SAIF.Application.Claim.Legal security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. The code relies on an injected clsSecurityPrincipal and inherited claim-security services rather than direct LDAP or attribute-based authorization.

Authorization architecture¶

The library exposes programmatic IsAuthorized checks on managers, then applies claim-level gating in LegalManagerBase.OnRetrieve and search-parameter scoping in clsCaseSearchManager.GetSearchResults.

flowchart TD
  Caller[UI caller] --> Manager[Legal manager]
  Manager --> Principal[clsSecurityPrincipal]
  Principal --> AD["Active Directory resource<br>check"]
  Manager --> Claim[ClaimData / ClaimSecurity]
  Claim --> Gate[Claim or search gating]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`LNAdmin`	LegalNet administrator. Grants unconditional claim-view access, bypassing the conflict and exposure confidentiality gates	`LegalManagerBase.IsInAdminGroup (property); consumed by LegalManagerBase.OnRetrieve`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb:240-248, consumed at :329`
`LNCaseUpdate`	Permission to update legal case data	`LegalManagerBase.IsInCaseUpdateGroup (property)`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb:249-257`
`LNView`	View-only access to LegalNet	`LegalManagerBase.IsInViewOnly (property)`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb:258-266`
`LNConflict`	Access to claims flagged as worker conflict (confidential)	`LegalManagerBase.HasLegalConflictAccess (Protected Friend property, constant LEGALCONFLICTSECURITYKEY); consumed by LegalManagerBase.OnRetrieve`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb:9, :34-38, consumed at :338`
`LNExposure`	Access to claims flagged as exposure (confidential health-issue claims)	`LegalManagerBase.HasLegalExposureAccess (Protected Friend property, constant LEGALEXPOSURESECURITYKEY); consumed by LegalManagerBase.OnRetrieve`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb:10, :39-43, consumed at :341`
`LNNoteView`	Permission to view legal case notes	`clsCaseNotesManager.IsInNoteView (property)`	`SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb:34-42`
`LNUpdate`	Permission to update bill notes on a legal case	`clsCaseNotesManager.CanUpdateBillNotes (property)`	`SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb:43-51`
`LNLCEUpdate`	Permission to update Legal Case Evaluation (LCE) records	`clsScheduleManager.IsInLCEUpdateGroup (property)`	`SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb:38-46`
`LNDueDateUpdate`	Permission to update the LCE due date	`clsScheduleManager.IsInLCEDueDateGroup (property)`	`SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb:47-55`

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`LegalManagerBase`	`HasLegalConflictAccess`	`LNConflict`	`IsAuthorized`	`LegalManagerBase.vb:36`
`LegalManagerBase`	`HasLegalExposureAccess`	`LNExposure`	`IsAuthorized`	`LegalManagerBase.vb:41`
`LegalManagerBase`	`IsInAdminGroup`	`LNAdmin`	`IsAuthorized`	`LegalManagerBase.vb:242`
`LegalManagerBase`	`IsInCaseUpdateGroup`	`LNCaseUpdate`	`IsAuthorized`	`LegalManagerBase.vb:251`
`LegalManagerBase`	`IsInViewOnly`	`LNView`	`IsAuthorized`	`LegalManagerBase.vb:260`
`clsCaseNotesManager`	`IsInNoteView`	`LNNoteView`	`IsAuthorized`	`clsCaseNotesManager.vb:36`
`clsCaseNotesManager`	`CanUpdateBillNotes`	`LNUpdate`	`IsAuthorized`	`clsCaseNotesManager.vb:45`
`clsScheduleManager`	`IsInLCEUpdateGroup`	`LNLCEUpdate`	`IsAuthorized`	`clsScheduleManager.vb:40`
`clsScheduleManager`	`IsInLCEDueDateGroup`	`LNDueDateUpdate`	`IsAuthorized`	`clsScheduleManager.vb:49`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Claim	`LegalManagerBase.OnRetrieve`	Conflict/exposure gating plus override path	`SAIF.Application.Claim.Legal\LegalManagerBase.vb`
Legal case search result	`clsCaseSearchManager.GetSearchResults`	`ExposureCode` and `ConflictAccess` scoping before search execution	`SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb`

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Authorization principal used by every `LN*` check.	All managers via `LegalManagerBase.New(inDatabase, inSecurityPrincipal)`	`SAIF.Application.Claim.Legal\LegalManagerBase.vb`
`ClaimSecurity`	Inherited claim-domain security helper used during retrieve and search gating.	`LegalManagerBase`, `clsCaseSearchManager`	`SAIF.Application.Claim\ClaimAppManager.vb`; `SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb`

Sources¶

SAIF.Application.Claim.Legal\LegalManagerBase.vb
SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb
SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb
SAIF.Application.Claim\ClaimAppManager.vb