BolMiddleware dependencies

BolMiddleware consumes six internal SAIF NuGet packages and the Microsoft.AspNetCore.App shared framework, and has no project references. Four of the packages are HTTP API clients for the BOL Context, BOL Menu, Policy Core, and Policy Header APIs; the other two supply the SAIF startup base class, security and environment services, and common helpers. Client-side assets come from vendored libraries and CDNs.

Internal dependencies

Dependency	Reference Type	Usage
BolContextApi.Client 8.2026.310.3	NuGet Package	Provides IBolContextApiClient and the ContextHelper and ContextResult types; used by WebContextService to save and load the web context.
BolMenuApi.Client 1.0.24025.2	NuGet Package	Provides IBolMenuApiClient and BusinessOnlineMenu; used by MenuService to load the user menu.
PolicyCoreApiClient 1.0.24093.1	NuGet Package	Provides IPolicyCoreApiClient; used by SecurityService.IsValidPolicyForCurrentUser.
PolicyHeaderApi.Client 1.0.25072.1-alpha	NuGet Package	Provides IPolicyHeaderApiClient and PolicyHeader; used by PolicyHeaderService to load the policy header and relationships.
SAIF.NetCore.Common 8.2023.319.2	NuGet Package	Provides configuration, URI, and collection extension helpers such as GetRequiredValue and Enforce.ArgumentNotNull.
SAIF.NetCore.ServiceExtensions 8.2025.302.1	NuGet Package	Provides OidcRazorStartup, the base of BolRazorLayoutStartup, and the security, environment, and logging contracts.

External dependencies

Dependency	Version	Usage
Microsoft.AspNetCore.App (FrameworkReference)	net8.0 shared framework	Razor Pages, session, cookies, and System.Web.HttpUtility used by NavigationOptions.
bootstrap, jquery, jquery-validation	Vendored under wwwroot/lib	Client-side UI assets served from the RCL static web assets.
Bootstrap (CDN)	5.3.2	Loaded from jsdelivr with subresource integrity in the shared layouts.
Font Awesome (CDN)	6.0.0-beta3	Loaded from cdnjs without subresource integrity in the shared layouts.
Google Analytics gtag	Not versioned	Loaded in the core scripts header partial.
gulp, sass, minification tooling	Dev dependencies	Build-time compilation of styles and scripts; not packaged as runtime dependencies.

Transitive dependencies

Dependencies in this section are inherited from dependency framework libraries. They are not directly referenced by this library but are required at runtime through framework packages.

Dependency	Source framework	Type	Usage
SAIF.NetCore.AuthService	SAIF.NetCore.ServiceExtensions	Transitive	Hosts ISecurityClient, which SecurityService resolves for authorization and external user lookup.*
SAIF.NetCore.ServiceContracts	SAIF.NetCore.ServiceExtensions	Transitive	Hosts ExternalUser and ExternalUserType used by the services and PageModels.*
SAIF.NetCore.EnvironmentClient	SAIF.NetCore.ServiceExtensions	Transitive	Hosts IEnvironmentClient, whose GetSettingValue is called for session cookie settings.*
SAIF.NetCore.Logging	SAIF.NetCore.ServiceExtensions	Transitive	Hosts ISaifLogService, whose Error overloads the services call.*
Microsoft.AspNetCore.Mvc.NewtonsoftJson	SAIF.NetCore.ServiceExtensions	Transitive	Likely supplies Newtonsoft.Json, used for session and cookie JSON serialization, since there is no direct reference.*

API dependencies

The source calls the following client interfaces directly. The Legends CLI index (repository Framework.NCore) covers SAIF.NetCore.Common, SAIF.NetCore.ServiceExtensions, and the sibling libraries SAIF.NetCore.AuthService, SAIF.NetCore.EnvironmentClient, SAIF.NetCore.Logging, and SAIF.NetCore.ServiceContracts, so ISecurityClient and IEnvironmentClient are traced. BolContextApi.Client, BolMenuApi.Client, PolicyHeaderApi.Client, and PolicyCoreApiClient were not found in the Framework.NCore index, the only repository checked; endpoint URLs, transport, and authentication inside those four packages remain unknown**.

For the traced clients: ISecurityClient.GetExternalUser goes through a remote service backed by EXT Oracle tables, while IsAuthorized is an authorization check. IEnvironmentClient.GetSettingValue string overloads return an empty string when a setting is missing, generic overloads throw EnvironmentClientException, and a blank section defaults to the track name.

Client interface	Operation called	Consuming code
IBolContextApiClient	SaveContext(request)	WebContextService.SaveContext
IBolContextApiClient	GetContext(contextId) and GetContext(sessionId, applicationName)	WebContextService.GetContext
IBolMenuApiClient	GetBusinessOnlineMenu(userId)	MenuService.GetMenu
IPolicyHeaderApiClient	GetHeader(number, isExternal) and GetRelationships(policyNumber)	PolicyHeaderService.GetHeader and GetRelationships
IPolicyCoreApiClient	IsValidPolicyForUser(policyNumber, userId)	SecurityService.IsValidPolicyForCurrentUser
ISecurityClient	IsAuthorized(userId, role) and GetExternalUser(userId)	SecurityService.IsAuthorizedAsync and GetCurrentExternalUserAsync
IEnvironmentClient	GetSettingValue for UseSessionCookie and SessionCookieName	BolContextModel.GetSessionId and AddMiddlewareSessionCookie

Page models call these through the facade services, so the library depends on six remote-service contracts even though it implements none of them. See the risks below.

Dependency risks and notes

• Indexed and traced packages: SAIF.NetCore.Common and SAIF.NetCore.ServiceExtensions are in the Legends CLI index (repository Framework.NCore), as are the sibling libraries SAIF.NetCore.AuthService, SAIF.NetCore.EnvironmentClient, SAIF.NetCore.Logging, and SAIF.NetCore.ServiceContracts. The Common helpers BolMiddleware uses (Enforce.ArgumentNotNull, which throws ArgumentNullException, plus the URI, string, collection, and dictionary extensions) make no remote calls. GetRequiredValue<T> is a fail-fast configuration read supplied by SAIF.NetCore.ServiceExtensions (IConfigurationExtensions), although it is called through the Common entry in the resolution data.
• Not found in the Framework.NCore index: BolContextApi.Client, BolMenuApi.Client, PolicyHeaderApi.Client, and PolicyCoreApiClient were not found in the Framework.NCore index, the only repository checked, so the endpoints and transport used inside them remain unknown**. Members called by BolMiddleware, by package:
• BolContextApi.Client: RegisterBolContextApiClient, IBolContextApiClient.SaveContext, IBolContextApiClient.GetContext (by context id and by session id plus application), ContextHelper, ContextResult, ContextSaveRequest.
• BolMenuApi.Client: RegisterBolMenuApiClient, IBolMenuApiClient.GetBusinessOnlineMenu, BusinessOnlineMenu, BusinessOnlineMenuItem.
• PolicyHeaderApi.Client: RegisterPolicyHeaderApiClient, IPolicyHeaderApiClient.GetHeader, IPolicyHeaderApiClient.GetRelationships, PolicyHeader, PolicyAssociation, AssociationTypes.
• PolicyCoreApiClient: RegisterPolicyCoreApiClient, IPolicyCoreApiClient used by SecurityService.IsValidPolicyForCurrentUser.
• SAIF.NetCore.ServiceExtensions (indexed): OidcRazorStartup, AppStartup.EnableLegacyBolAuthMiddleware, GetRequiredValue.
• SAIF.NetCore.AuthService (indexed): ISecurityClient.IsAuthorized, ISecurityClient.GetExternalUser.
• SAIF.NetCore.EnvironmentClient (indexed): IEnvironmentClient.GetSettingValue.
• SAIF.NetCore.Logging (indexed): ISaifLogService.Error.
• SAIF.NetCore.ServiceContracts (indexed): ExternalUser, ExternalUserType.
• SAIF.NetCore.Common (indexed): Enforce.ArgumentNotNull, URI, string, collection, and dictionary extensions.
• Stale packages: four internal packages are behind the feed. BolMenuApi.Client is 1.0.24025.2 against 8.2026.630.2, PolicyCoreApiClient is 1.0.24093.1 against 6.2026.223.1, SAIF.NetCore.Common is 8.2023.319.2 against 10.2026.26267.1, and SAIF.NetCore.ServiceExtensions is 8.2025.302.1 against 10.2026.26279.1. BolContextApi.Client is current.
• Prerelease: PolicyHeaderApi.Client 1.0.25072.1-alpha is a prerelease and also behind the feed version 6.2026.225.1.
• Conflicting packaging pipelines: the primary pipeline in .azdo/BolMiddleware-nuget produces major version 8, while the legacy pipelines/client.build.yml produces major version 2 from pipelines/build-vars.yml.
• Duplicate registration: IBolContextApiClient is registered by RegisterBolContextApiClient() and again by an explicit singleton registration in RegisterBolServices.
• ISecurityClient is defined in SAIF.NetCore.AuthService, not in SAIF.NetCore.ServiceExtensions; BolMiddleware reaches it only through the SAIF.NetCore.ServiceExtensions package chain.*
• Newtonsoft.Json is used without a direct package reference, so its version depends on the transitive chain.*
• The CDN assets Font Awesome (no subresource integrity) and Google Analytics are loaded at runtime from third-party hosts.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Related documentation

• Index
• Overview
• Architecture
• Configuration
• Operations and processes
• Business rules
• Security and authorization
• Service registration
• API reference

Sources

• src/BolMiddleware/BolMiddleware.csproj
• src/BolMiddleware/GlobalUsings.cs
• src/BolMiddleware/BolRazorLayoutStartup.cs
• src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs
• src/BolMiddleware/Services/Security/SecurityService.cs
• src/BolMiddleware/Pages/Shared/_BolCoreScriptsHeaderPartial.cshtml
• src/BolMiddleware/package.json
• .azdo/BolMiddleware-nuget/azure-pipelines.yml
• .azdo/BolMiddleware-nuget/variables/vars.yml
• pipelines/client.build.yml
• pipelines/build-vars.yml