Skip to content

Retrieve the accessible policy list for a user

Builds the list of policies a given user is permitted to select from, dispatching to a different data source per user type: group/chapter book, safety-consultant book, agent/agency online list, or fee-auditor list. Policyholder users instead derive their list from their own affiliated-policy collection.

Field Value
Operation ID op-08-retrieve-accessible-policy-list
Trigger Caller reads clsPolicySecurity.PolicyList
Inputs Current UserType/SecurityPrincipal
Outputs List(Of strPolicyList) — each entry has PolicyNum, PolicyName, PolicyNameAndNumber
Primary components PolicyList property, GetPolicyListForAgent, GetPolicyListforGroup, GetPolicyListForSafetyConsultant, GetPolicyListForFeeAuditor
Entry point SAIF.Business.View.Policy/clsPolicySecurity.vb

Steps

  1. The PolicyList property is lazily populated (m_PolicyList Is Nothing guard) on first read, and dispatches on UserType.UserType (BR-VP-005):
  2. Agent → GetPolicyListForAgent(UserType.UserNumber, Not UserType.IsProducer()).
  3. PolicyHolder → builds the list directly in-memory from PolicyDataForUser.AffiliatedPolicyCollection, without an additional list-specific query (see Retrieve affiliated policies (legacy)).
  4. LossControl → GetPolicyListForSafetyConsultant(UserType.UserNumber.ToString).
  5. Group → GetPolicyListforGroup().
  6. Auditor → GetPolicyListForFeeAuditor(UserType.UserNumber.ToString).
  7. Any other user type leaves m_PolicyList unset; the getter then returns an empty List(Of strPolicyList).
  8. GetPolicyListForAgent guards on IsNumeric(inAgentNum) before querying; executes cp_get_agent_online_policy_list (SQL-027) on the SQL Server (BDS) portal, binding @AgentNum and @ForAgency (derived from "not a producer").
  9. GetPolicyListforGroup executes cp_claimprofile_get_group_policy_list (SQL-025) on the BDS portal, binding @GroupKeyCode, @SpecificChapterCode, and @rptDate = Now; a code comment documents a special-case group whose chapter code is a regex-like bracketed exclusion pattern (HBA[^E]) rather than a literal chapter letter.
  10. GetPolicyListForSafetyConsultant executes cp_claimprofile_get_sc_book (SQL-026) on the BDS portal, binding @losscontrol to the user number.
  11. GetPolicyListForFeeAuditor executes an inline-built SQL string from GetAuditorPolicyListSQL() (SQL-028) on the primary (Oracle) portal as RequestType.ResultSet/CommandType.Text, binding VendorNum; the SQL joins pa_audit, pa_auditor, and policy, filtering out cancelled/completed audits older than a rolling 60-day-forward window (sysdate + 60).
  12. Each of the four query methods maps result rows into strPolicyList structures via the same New strPolicyList(policyNum, policyName) pattern, though the exact column names queried differ per source (policy_number/policy_name for the group/SC-book/agent queries vs. POLICY_NUM/POLICY_NAME for the auditor query).

Process flow

flowchart TD
    Start(["Caller reads<br>PolicySecurity.PolicyList"]) --> A{m_PolicyList<br>already populated?}
    A -->|Yes| Return(["Return cached list"])
    A -->|No| B{User type?}
    B -->|Agent| C["cp_get_agent_online_policy_list<br>(BDS)"]
    B -->|PolicyHolder| D["Build in-memory from<br>AffiliatedPolicyCollection"]
    B -->|LossControl| E["cp_claimprofile_get_sc_book<br>(BDS)"]
    B -->|Group| F["cp_claimprofile_get_group_policy_list<br>(BDS)"]
    B -->|Auditor| G["Inline fee-auditor query<br>(Oracle)"]
    B -->|Other| H["m_PolicyList left unset"]
    C --> I["Map rows to strPolicyList"]
    D --> I
    E --> I
    F --> I
    G --> I
    I --> Return
    H --> J(["Return empty list"])

Failure and edge-case behavior

  • GetPolicyListForAgent silently produces no list (leaves m_PolicyList unset, so the getter returns an empty list) if inAgentNum is not numeric — no exception is raised.*
  • A user type not covered by the Select Case (e.g. SaifEmployee, MCO, MedProv, Bookkeeper) receives an empty policy list from this property even though IsPolicyValidForUser grants those types unconditional per-policy access — the two operations are not symmetric.*
  • The fee-auditor query's 60-day window uses sysdate + 60 on both cancel_date and completed_date bounds, which reads as a forward-looking window rather than the -60-day lookback used in CanAuditorAccessPolicy for the single-policy authorization check — the two auditor-access queries do not use an identical time window.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Business.View.Policy/clsPolicySecurity.vb