Skip to content

Resolve and authorize the policy context

This operation is the main application-layer gate for policy access. It validates the requested policy number, loads the underlying policy data, delegates policy-level authorization when applicable, and updates the manager's context and message state.

Field Value
Operation ID OP-02
Trigger Caller invokes Retrieve() or changes the active policy context
Inputs Policy number, security principal, user access level
Outputs Boolean success plus updated context, no-access flag, and user-facing message
Primary components PolicyAppManager.OnRetrieve, PolicyAppManager.UserCanAccessPolicy, PolicyAppManager.GetPolicyData
Entry point Application\SAIF.Application.Policy\PolicyAppManager.vb

Steps

  1. Check whether PolicyNumber is zero.
  2. If so, mark the context not set, set the message to PolicyNotEntered, and return False (BR-103).
  3. Load PolicyData; reuse the cached instance only when the cached policy number still matches the current context (BR-104).
  4. Build the delegated read through clsPolicyData.GetPolicyData(DPI, PolicyNumber, UserAccessLevel).

  5. Origin: The underlying retrieval steps are implemented in Retrieve policy header and executed on behalf of this operation.

  6. If PolicyData.IsValid is false, mark the context not set, set the message to PolicyNotFound, and return False (BR-105).
  7. Evaluate UserCanAccessPolicy.
  8. If HttpContext.Current Is Nothing, return True immediately (BR-106).
  9. Otherwise delegate to SAIF.Business.View.Policy.clsPolicySecurity.IsPolicyValidForUser(PolicyData).

  10. Origin: The delegated authorization sequence is implemented in Authorize a policy for the current user.

  11. If access is denied, mark the context set, mark no access, set the message to PolicyNotAuthorized, and return False (BR-107).
  12. If access is allowed, mark the context set, mark update, clear the message, and return True.

Process flow

The following diagram visualizes the retrieval and access-decision flow.

flowchart TD
    Start([Retrieve request]) --> Missing{Policy number is 0?}
    Missing -->|Yes| NotEntered([PolicyNotEntered])
    Missing -->|No| Load[Load PolicyData]
    Load --> Valid{PolicyData.IsValid?}
    Valid -->|No| NotFound([PolicyNotFound])
    Valid -->|Yes| Web{HttpContext exists?}
    Web -->|No| Allow[Allow access]
    Web -->|Yes| Auth[Delegate policy authorization]
    Auth --> Access{Authorized?}
    Access -->|No| Deny([Set context + no access])
    Access -->|Yes| Success([Mark context set])

Failure and edge-case behavior

  • The missing-policy-number branch runs before authorization so callers never see an access-denied message for missing input (BR-103).
  • Non-web hosts bypass delegated policy authorization entirely (BR-106).

Sources

  • Application\SAIF.Application.Policy\PolicyAppManager.vb
  • Business\SAIF.Business.View.Policy\clsPolicyData.vb
  • Business\SAIF.Business.View.Policy\clsPolicySecurity.vb