clsPolicySecurity

clsPolicySecurity is the library's sole authorization boundary for policy access. It evaluates a caller's clsSecurityPrincipal against both Oracle-backed policy facts and a secondary SQL Server BDS data layer created in Initialize(), combining AD resource checks, per-user-type access rules, parent-policy fallback, and user-specific policy-list retrieval so callers do not implement authorization logic themselves.

Purpose

• Centralize policy-visibility decisions for employees, agents, policyholders, groups, auditors, and loss-control users instead of leaving each consumer to reconstruct the rules.
• Enforce secure-policy AD authorization, invalid-policy rejection, user-access-level mapping, auditor windows, loss-control identity matching, and parent-policy fallback (BR-VP-003 through BR-VP-009).
• Retrieve the caller's accessible policy list from the appropriate backend routine based on user type, using SQL Server BDS procedures for most external-user lists and Oracle text SQL for the fee-auditor path.

Context

• Namespace: SAIF.Business.View.Policy
• Assembly/package: SAIF.Business.View.Policy (embedded)

Public members

Member	Signature	Purpose
New	Public Sub New(ByVal inSecurityPrincipal As clsSecurityPrincipal, ByVal inDPI As IDataPortalInfo)	Captures the caller identity, stores the Oracle data portal, creates the BDS SQL Server data layer, and derives the normalized user type used by all later checks.
IsPolicyValidForUser	Public Function IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData) As Boolean	Evaluates a fully loaded policy view against the user-type matrix, including secure-policy AD checks, direct ownership/group/auditor/loss-control rules, and policyholder parent fallback (BR-VP-003 through BR-VP-009).
IsPolicyValidForUser	Public Function IsPolicyValidForUser(ByVal inPolicyNum As Decimal) As Boolean	Convenience overload that first retrieves clsPolicyData with the caller's access level, then runs the main authorization routine against that policy.
IsPolicyValidForParentPolicy	Public Function IsPolicyValidForParentPolicy(ByVal inPolicyNum As Decimal) As Boolean	Grants policyholder access through parent/child association membership when the requested policy is not the caller's exact policy number (BR-VP-009).
CanAuditorAccessPolicy	Private Function CanAuditorAccessPolicy(ByVal inPolicyNumber As Decimal, ByVal inVendorNumber As String) As Boolean*	Checks Oracle audit tables to determine whether an auditor still falls inside the 60-day cancellation/completion access window (BR-VP-006).*
IsInGroup	Private Function IsInGroup(ByVal inPolicyNumber As Decimal, ByVal inGroup As String, ByVal inChapter As String) As Boolean*	Uses SQL Server procedure cp_policy_in_group to decide whether a group user is authorized for the policy (BR-VP-005).*
PolicyList	Public ReadOnly Property PolicyList() As List(Of strPolicyList)	Dispatches to the user-type-specific list builder—group, safety consultant, agent, fee auditor, or policyholder affiliate list—so callers can enumerate only the policies visible to the signed-in user (BR-VP-005).
ConvertUserTypeToUserAccessLevel	Public Shared Function ConvertUserTypeToUserAccessLevel(ByVal inUserType As clsUserType) As clsPolicyData.UserAccessLevels	Normalizes application user types into the access-level enum that drives masking and authorization branches, including demo-user variants (BR-VP-005).
Initialize	Private Sub Initialize()*	Reads BDS_USER, bdsDatabase, and BDS_DATABASENAME configuration values, then creates the secondary SQL Server clsSQLDataLayer used by group, agent, and safety-consultant list paths.*
UserType	Public ReadOnly Property UserType() As clsUserType	Exposes the normalized caller classification that selects authorization branches and policy-list routines.
UserAccessLevel	Public ReadOnly Property UserAccessLevel() As clsPolicyData.UserAccessLevels	Exposes the mapped access level used when retrieving clsPolicyData and interpreting demo-user masking behavior.
SecurityPrincipal	Public ReadOnly Property SecurityPrincipal() As clsSecurityPrincipal	Exposes the underlying authenticated principal whose AD-resource authorizations and user number drive security checks.

Behavioral notes

• IsPolicyValidForUser(clsPolicyData) first blocks invalid or zero policy numbers (BR-VP-004).
• Secure policies require SecurityPrincipal.IsAuthorized("SAIFpolicyInfo"); otherwise access is denied immediately (BR-VP-003).
• The access matrix grants SAIF employees directly, checks agent ownership by agent number or agency sequence, calls IsInGroup for group users, uses team-assignment identity matching for loss control, and uses CanAuditorAccessPolicy for auditors (BR-VP-005, BR-VP-006, BR-VP-007).
• Demo loss-control users compare the policy team's hidden UserIdName instead of the masked display UserName when evaluating consultant access (BR-VP-008).
• If direct policyholder access fails, IsPolicyValidForParentPolicy re-evaluates the request through parent-policy associations (BR-VP-009).
• The class uses two backends: Oracle for clsPolicyData retrieval and CanAuditorAccessPolicy, and SQL Server BDS for IsInGroup, group policy lists, safety-consultant books, and agent policy lists.
• PolicyList is lazy and user-type specific; it is not preloaded during construction.

Constraints and usage notes

• This type should be treated as the only supported policy-authorization entry point in the library; other business objects expose data but do not authorize access themselves.
• Construction requires a valid Oracle IDataPortalInfo plus configuration for the secondary BDS connection.
• Policyholder list retrieval still depends on the obsolete affiliate collection rather than the newer associations API, so callers may see legacy semantics in that branch.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Business.View.Policy/clsPolicySecurity.vb