clsProviderCollection

clsProviderCollection retrieves a set of clsProvider objects either by an array of tax IDs or by an arbitrary caller-supplied WHERE clause (OP-13). It builds its query by string concatenation rather than bind variables, which makes both retrieval paths a potential SQL-injection vector if fed untrusted input (BR-PRV-003).

Purpose

• Loads multiple providers in one round trip when a caller has a known list of tax IDs, avoiding per-provider GetProvider calls.
• Exposes an escape hatch (GetProvidersUsingWhere) that lets a caller inject a raw WHERE clause, which the criteria layer inserts verbatim into the SQL text with no parameterization or sanitization (BR-PRV-003).
• Never allows creation, update, or deletion of provider records; the collection is a strict read path (BR-DATA-001).

Context

• Namespace: SAIF.Business.View.Provider
• Assembly/package: SAIF.Business.View.Provider (embedded/project-compiled); also distributed as the NuGet package SAIF.BOF.Business.View.Provider.

Public members

Member	Signature	Purpose
GetProviderCollection	Shared Function GetProviderCollection(dpi As IDataPortalInfo, taxIDs As String()) As clsProviderCollection	Retrieves providers whose primary tax ID is in the supplied array, built as an unparameterized IN (...) clause (OP-13, BR-PRV-003).
GetProvidersUsingWhere	Shared Function GetProvidersUsingWhere(dpi As IDataPortalInfo, whereClause As String) As clsProviderCollection	Retrieves providers matching a caller-supplied WHERE clause appended verbatim to the base SQL (OP-13, BR-PRV-003).
Item	Default ReadOnly Property Item(index As Integer) As clsProvider (from clsBusinessCollection(Of clsProvider))	Returns the provider at the given position in the loaded collection.
Count	ReadOnly Property Count As Integer (from clsBusinessCollection(Of clsProvider))	Number of providers returned by the retrieval query.
IsValid	ReadOnly Property IsValid As Boolean (overridden from clsBusinessBase/collection base)	Reflects aggregate rule-check state of the member providers; not used to gate any write since none exist.
IsDirty	ReadOnly Property IsDirty As Boolean (overridden from clsBusinessBase/collection base)	Indicates in-memory changes to member providers; has no effect on persistence since no write SQL is defined (BR-DATA-001).
Save	Function Save() As clsProviderCollection (overridden from collection base)	Calls ApplyEdit()/MyBase.Save() but cannot persist any change because the criteria's insert/update/delete SQL properties throw (BR-DATA-001).*

Behavioral notes

• OP-13: Criteria.BuildSQLWhere() either emits the caller's WHERE clause unchanged or concatenates a where prv.primary_tax_id in ('…','…') clause from the tax-ID array; BeforeRetrieve binds no parameters for either path, and AfterRetrieve loads one clsProvider per returned row.
• Because neither retrieval path uses bind variables, a caller passing untrusted input (e.g., from a UI field) into GetProvidersUsingWhere or the tax-ID array could allow arbitrary SQL execution (BR-PRV-003).*

Constraints and usage notes

• Callers must only pass trusted, application-controlled values to GetProvidersUsingWhere; there is no sanitization layer in this library.*
• The collection cannot persist any change made to its member clsProvider instances; all SQL beyond retrieval throws ApplicationException (BR-DATA-001).

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Business.View.Provider/clsProviderCollection.vb