BolMiddleware overview

Documentation context: Pipeline-packed library, NuGet package

BolMiddleware is a net8.0 ASP.NET Core Razor class library that supplies the Business Online (BOL) page chrome and context handling to SAIF Razor Pages applications. It sits between the consuming application and the remote BOL Context, BOL Menu, Policy Header, and Policy Core APIs, and it has no database access of its own.

Purpose

• Give consumer applications a shared BOL look and behavior: layouts, menu, policy header, and page header.
• Carry the user's BOL web context (application, policy, claim) across applications through a short-lived cookie, the session, and the BOL Context API.
• Consumed by BOL Razor Pages applications that inherit BolRazorLayoutStartup and derive their pages from BolContextModel, BolMenuModel, or BolPolicyModel.

Responsibilities

• Register BOL services and API clients (Service registration).
• Resolve and persist the web context for each request (BR-BOLMIDDLEWARE-001, BR-BOLMIDDLEWARE-002).
• Load the BOL menu and apply context changes (BR-BOLMIDDLEWARE-007, BR-BOLMIDDLEWARE-008).
• Load the policy header, check policy access, and offer the policy dropdown (BR-BOLMIDDLEWARE-009, BR-BOLMIDDLEWARE-012).
• Provide four layouts, partial views, three view components, and a navigation script.

Key components

• BolRazorLayoutStartup: startup base class that enables legacy BOL authentication and binds BasicAppMap.
• BolContextModel, BolMenuModel, BolPolicyModel: chained abstract page models for context, menu, and policy header behavior.
• WebContextService, MenuService, PolicyHeaderService, SecurityService: facades over the remote API clients.
• BolPolicyHeaderViewComponent, BolSideMenuViewComponent, BolTopMenuViewComponent: page chrome view components.
• _PolicyLayout, _PolicyOnlyLayout, _ContextOnlyLayout, _MenuOnlyLayout: shared Razor layouts.
• MenuNavigation.js: browser script for menu navigation.

Behavior and notable findings

The library enforces 21 business rules (Business rules) across 17 catalogued operations (Operations and processes). Notable findings are the disabled anti-forgery validation on derived pages, cookies without Secure and SameSite attributes, a fully commented-out BolLayoutStartup, and a duplicate IBolContextApiClient registration; see Security and authorization.

Related documentation

• Index
• Architecture
• Dependencies
• Configuration
• Operations and processes
• Business rules
• Security and authorization
• Service registration
• API reference

Sources

• src/BolMiddleware/BolMiddleware.csproj
• src/BolMiddleware/BolRazorLayoutStartup.cs
• src/BolMiddleware/BolLayoutStartup.cs
• src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs
• src/BolMiddleware/Models/BolContextModel.cs
• src/BolMiddleware/Models/BolMenuModel.cs
• src/BolMiddleware/Models/BolPolicyModel.cs
• src/BolMiddleware/wwwroot/js/MenuNavigation.js