---
title: SAIF.Services.Web architecture
summary: Architectural responsibilities, boundaries, and interaction patterns.
status: draft
owner: <owner>
last_reviewed: 2026-07-24
library: SAIF.Services.Web
reference_type: package
---

# SAIF.Services.Web architecture

SAIF.Services.Web is a minimal utility class library consisting of a single hand-written class, `RemotePost`, that performs a server-side HTTP POST redirect (auto-submitting HTML form) from an ASP.NET web application to a target URL. It is not a BOF business object library, contains no `IBusinessCriteria` or data access, and enforces no business rules.

## Responsibilities
- Accumulate name/value pairs (`AddInput`) to be rendered as hidden form fields.
- Emit a minimal auto-submitting HTML `<form>` (`Post`) that POSTs the accumulated fields to a configured target `URL`, then terminate the current ASP.NET response.
- Provide a browser-redirect-via-auto-submitting-form bridge for forwarding a user with POST-body parameters to another application/site (e.g., a payment gateway or another SAIF web application) where a plain HTTP redirect (GET-only) would not carry the required data.

## Component boundaries
- **`RemotePost`**: the library's sole substantive type. Implicit base `System.Object`; not a BOF business object (no `clsBusinessBase`/`clsBusinessCollectionBase` inheritance, no `IBusinessCriteria`).
- **VB "My Project" scaffolding** (`Application.Designer.vb`/`.myapp`, `Resources.Designer.vb`/`.resx`, `Settings.Designer.vb`/`.settings`): auto-generated, no custom logic, no defined settings or resources.

## Interaction model
- `RemotePost.Post()` operates directly against the ASP.NET pipeline via `HttpContext.Current`: it clears the current response (`Response.Clear()`), writes an HTML document containing a hidden `<form>` (name defaults to `"form1"`, overridable via `FormName`) with one hidden `<input>` per name/value pair added via `AddInput`, and a `<body onload="document.<FormName>.submit()">` handler that auto-submits the form on page load in the browser, then calls `Response.End()`.
- Because it depends on `HttpContext.Current`, `RemotePost` can only be used from within an active ASP.NET web request context — it is not usable from a console/service host without one.
- Despite the project declaring an extensive NuGet dependency graph (`SAIF.BOF.Framework`, `SAIF.Web.API.Clients`, `Oracle.ManagedDataAccess`, `RestSharp`, `Newtonsoft.Json`), none of these are referenced by `RemotePost.vb` — the declared dependency footprint significantly exceeds the library's actual code surface.*

The following diagram shows the high-level interaction between a calling web application and `RemotePost`.

```mermaid
flowchart TD
	A[Calling ASP.NET page/handler] -->|AddInput name,value| B[RemotePost]
	B -->|Post| C[HttpContext.Current.Response]
	C -->|auto-submitting HTML form| D[Browser]
	D -->|HTTP POST| E[Target URL<br>e.g. payment gateway]
```

The following diagram shows the primary request/response sequence for a remote POST redirect.

```mermaid
sequenceDiagram
	participant Caller
	participant RemotePost
	participant Response as HttpContext.Current.Response
	participant Browser
	participant Target as Target URL
	Caller->>RemotePost: New RemotePost(); AddInput(name, value) (repeated)
	Caller->>RemotePost: URL = targetUrl
	Caller->>RemotePost: Post()
	RemotePost->>Response: Clear()
	RemotePost->>Response: Write(auto-submit HTML form)
	RemotePost->>Response: End()
	Response-->>Browser: HTML with hidden form
	Browser->>Target: HTTP POST (form fields)
```

## Design constraints
- `RemotePost.Post()` writes caller-supplied `Name`/`Value` pairs directly into HTML `<input>` attribute values via `String.Format` with no HTML-encoding — a potential output-encoding/HTML-injection concern for callers that pass untrusted values.*
- The library targets `.NET Framework 4.6.2` and is packaged/consumed exclusively as a NuGet package (`SAIF.BOF.Services.Web`), not via local project references.
- `Web.config`/`App.config` register only the Oracle `DbProviderFactories` provider factory; no application-specific `<appSettings>` are read by this library's code.
- No cached inherited framework context is required or referenced for this library — `RemotePost` does not inherit any SAIF framework base class.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `Services\SAIF.Services.Web\RemotePost.vb`
- `Services\SAIF.Services.Web\SAIF.BOF.Services.Web.vbproj`
- `Services\SAIF.Services.Web\Web.config`
- `Services\SAIF.Services.Web\App.config`