SAIF.Application business rules¶

This page captures the library-level operational rules enforced by SAIF.Application.

BR-001: Single effective application security role¶

Field	Value
Statement	An application manager instance exposes exactly one effective security role at a time: `ViewOnly`, `Update`, or `NoAccess`.
Trigger	A consuming implementation assigns application access through `MarkUpdate()`, `MarkViewOnly()`, or `MarkNoAccess()`.
Enforcement	`AppManagerBase` stores a single `m_AppSecurityRole` value and derives `SecurityRole`, `IsAccessible`, `IsUpdateable`, `IsViewOnly`, and `IsRestricted` from that value.
Outcome	Callers receive a mutually exclusive role state for the current manager instance.
Confidence	Verified
Source	`Application\SAIF.Application\AppManagerBase.vb`

Field	Value
Statement	Duplicate message text is not appended more than once within the active message aggregation result.
Trigger	`AppendMessageLines(...)` or `MessageFormatting` helper methods process message content.
Enforcement	`AppManagerBase` and `MessageFormatting` test whether a candidate line is already present before appending it.
Outcome	The resulting message string avoids repeated identical message lines.
Confidence	Verified
Source	`Application\SAIF.Application\AppManagerBase.vb`; `Application\SAIF.Application\MessageFormatting.vb`

Field	Value
Statement	Authorization outcomes are cached by resource name for the lifetime of a `UserAccess` instance.
Trigger	Calling code invokes `HasAccess(resourceName)` for a resource name that is not already cached.
Enforcement	`UserAccess` stores the `clsSecurityPrincipal.IsAuthorized(...)` result in a lower-cased resource-name cache and reuses that stored value on later checks.
Outcome	Repeat checks for the same resource name do not require another authorization call through the security principal.
Confidence	Verified
Source	`Application\SAIF.Application\UserAccess.vb`

Field	Value
Statement	A keyed `IDataPortalInfo` entry is stored under the lower-cased form of its key, and a key that is already present is never overwritten by a later registration or injection.
Trigger	`ApplicationDataAccess.CreateSQLServerPortal(key)`, `CreateOraclePortal(key)`, or `AppManagerBase.InjectDPI(key, dpi)` sets the `DPI(key)` property for a key.
Enforcement	The `DPI` property setter lower-cases the key and only calls `m_DPILibrary.Add(...)` when `ContainsKey` is false for that lower-cased key; the getter also lower-cases the key before lookup.
Outcome	Callers can register or inject a portal under a given key at most once per `ApplicationDataAccess` instance; subsequent attempts with the same key (in any casing) are silently ignored rather than replacing the existing entry.
Confidence	Verified
Source	`Application\SAIF.Application\ApplicationDataAccess.vb`

Field	Value
Statement	When a non-blank `BatchID` is set on `ApplicationDataAccess`, the environment's `ClientID` used to build a new SQL Server or Oracle portal is the `BatchID` value instead of the underlying `clsDataAccess.ClientID`.
Trigger	`CreateSQLServerPortal(key)` or `CreateOraclePortal(key)` is called on an `ApplicationDataAccess` instance whose `BatchID` property has been set to a non-blank value.
Enforcement	Both portal-creation methods first set `m_Env.ClientID = m_DAL.ClientID`, then overwrite it with `m_Env.ClientID = BatchID` when `BatchID.Trim.Length > 0`, before constructing the `clsSQLDataPortal` or `clsMSOracleDataPortal`.
Outcome	Batch-hosted callers (constructed via `New ApplicationDataAccess(inBatchUserID)` or with `BatchID` set explicitly) get portals whose environment identifies the batch user rather than the ambient data-access client.
Confidence	Verified
Source	`Application\SAIF.Application\ApplicationDataAccess.vb`

These rules describe library infrastructure behavior rather than claim-domain validations or database rules.