Skip to content

Load policy header and validate access

Pages that derive from BolPolicyModel show the policy header above their content. This operation runs around the consumer handler to resolve the header for the context policy and to expose the result flags the layout and consumer page use.

Field Value
Operation ID OP-10
Trigger Handler execution on a BolPolicyModel page
Inputs Context policy number, current user
Outputs Header, AccessAllowed, ErrorMessage, ParentAccount, ShowPolicyDropdown
Primary components BolPolicyModel.OnPageHandlerExecuting, BolPolicyModel.OnPageHandlerExecuted, BolPolicyModel.CanViewPolicyDropdown
Entry point src/BolMiddleware/Models/BolPolicyModel.cs

Steps

  1. If the posted contextvalue is non-empty, reset ParentAccount to zero and store 0 as the ParentAccount context value; otherwise leave it (BR-BOLMIDDLEWARE-010). A stored ParentAccount greater than zero is then restored from the context value.
  2. If the context has a policy number, run Resolve policy header (BR-BOLMIDDLEWARE-014, BR-BOLMIDDLEWARE-009).
  3. When a new header is loaded and ParentAccount is zero, derive ParentAccount from the relationship policy, or from the rate account when no relationship policy exists (BR-BOLMIDDLEWARE-011).
  4. Set ShowPolicyDropdown through CanViewPolicyDropdown, which requires at least one association plus an external or internal predicate: an external user needs a CustomerId equal to the relationship policy or rate account (or a ManualAffiliation association with CustomerId equal to ParentAccount); an internal user needs the policy or parent account to equal the relationship policy or rate account (BR-BOLMIDDLEWARE-012).
  5. Validate access, then call the virtual OnRequestStart hook. After the handler completes, OnPageHandlerExecuted calls the virtual OnRequestEnd hook.
  6. On a failed access check: ErrorMessage is set and the view components show the error view.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Handler executing]) --> D0{contextvalue posted?}
    D0 -->|Yes| S1[Reset ParentAccount to zero]
    D0 -->|No| S1b[Keep stored ParentAccount]
    S1 --> D1{Policy number in context?}
    S1b --> D1
    D1 -->|No| EndSkip([Handler runs without header])
    D1 -->|Yes| S3[Resolve policy header]
    S3 --> S4[Derive ParentAccount if zero]
    S4 --> S5[Set ShowPolicyDropdown]
    S5 --> S6[Validate access then OnRequestStart]
    S6 --> EndOk(["Handler runs, then OnRequestEnd"])

Failure and edge-case behavior

  • Access validation reads Task.Result on an async call, which blocks a request thread and can deadlock in a synchronization context.
  • The handler still runs when access is denied; derived pages must check AccessAllowed themselves.
  • Exception messages are stored in ErrorMessage and displayed to the user.

Sources

  • src/BolMiddleware/Models/BolPolicyModel.cs
  • src/BolMiddleware/Services/Security/SecurityService.cs