SAIF.Data.NHibernate security and authorization

This page documents authorization mechanisms implemented or consumed by SAIF.Data.NHibernate. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level. This library references no Active Directory resource names and enforces no role checks directly — its security relevance is entirely data-level: GroupImageRepository applies confidential- and deleted-image visibility filters driven by caller-supplied boolean flags, PolicyOutputDocumentRepository scopes agency document visibility, ClaimBillEntryRepository forwards the caller's conflict-claim access flag to the bill queue API, and several ClassMaps expose claim security attributes and debtor SSNs (PII) with no access check at this layer.

[!WARNING] HIGH severity finding (SC-SDN-01): GroupImageRepository.GetFilteredImageGroups's deleted-image visibility filter is logically inverted. See Security concerns below for full detail — this is the most significant finding in this document.

Authorization architecture

Authorization is not implemented in this library. All visibility/access decisions are expressed as query filters driven by boolean flags computed upstream by SAIF.Services (e.g., GroupImageSecurityProvider.CanUserSeeConfidentialImages()/CanUserSeeDeletedImages(), based on AD resources GroupImagingConfidential/GroupImagingDeleted) and passed in as method parameters or ImageFilterCriteria properties. This library never queries Active Directory, never checks IsInRole/IsAuthorized, and has no [SAIFAuthorize] attributes, controllers, or actions.

flowchart TD
    Caller["SAIF.Services caller<br>(computes AD-resource-backed flags)"] --> Repo["SAIF.Data.NHibernate repository<br>(GroupImageRepository, PolicyOutputDocumentRepository, etc.)"]
    Repo --> Filter["In-memory / query-scoping filter<br>using caller-supplied flag"]
    Filter --> DB["Oracle / SQL Server"]

AD resource catalog

None found. A scan of compiled .cs, .hbm.xml, and .config files under Data/SAIF.Data.NHibernate/ found no AD resource-name constants or literals, no IsInRole/IsAuthorized calls, no Principal/WindowsIdentity usage, no System.DirectoryServices usage, and no LDAP strings.

Resource name	Purpose	Enforcement point	Source
None	—	—	—

Authorization enforcement points

Attribute-based authorization

None found. The library has no controllers, actions, or authorization attributes.

Programmatic authorization checks

None found. No method in this library checks AD membership directly. Visibility filtering is driven entirely by boolean flags supplied by the caller (see Data-level authorization below).

Data-level authorization

Entity type	Validation method	Mechanism	Source
ImageGroup / Image (table Image_Group), confidential images (DLA-SDN-01)	GroupImageRepository.GetFilteredImageGroups(string groupId, ImageFilterCriteria filter)	In-memory LINQ filter after ToList(): keeps the image when Image.SecurityLevel == Image.NonConfidentialSecurityLevel or filter.CanUserSeeConfidentialImages. The flag originates from Services/SAIF.Services/Groups/Imaging/ImageService.CreateGroupImageRepositoryFilter → GroupImageSecurityProvider.CanUserSeeConfidentialImages() (AD resource GroupImagingConfidential)**	Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs
ImageGroup / Image, deleted images (DLA-SDN-02)	GroupImageRepository.GetFilteredImageGroups	In-memory filter ig.Image.ImageDeleteCode != null \|\| filter.CanUserSeeDeletedImages. Flag from GroupImageSecurityProvider.CanUserSeeDeletedImages() (AD resource GroupImagingDeleted). This predicate is inverted relative to the deletion convention used elsewhere — see SC-SDN-01	Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs
PolicyOutputDocument (table policy_output_document), agency visibility (DLA-SDN-03)	PolicyOutputDocumentRepository.GetReleasedAgencyViewablePolicyOutputDocuments, GetHeldAndPendingAgencyViewablePolicyOutputDocuments, ReleasedAgencyInboxViewableQuery, GetReleasedAgencyViewableChildOutputDocuments; local extensions AgencyViewable/AgencyInboxViewable	Query-scoping filters restrict to document types with agency_view_flag/agency_inbox_flag = Y (mapped in OutputDocumentTypeCodeBaseMap) and to the supplied agency, producer, or policy. Duplicates the SAIF.Data PolicyOutputDocumentExtensions filters. The agency/producer/policy ids are caller-supplied and not validated against the current user at this layer*	Data/SAIF.Data.NHibernate/Repositories/OutputDocuments/PolicyOutputDocumentRepository.cs, Data/SAIF.Data.NHibernate/Mappings/OutputDocuments/OutputDocumentTypeCodeBaseMap.cs
Claim bill queue (ClaimBillQueueTask) (DLA-SDN-04)	ClaimBillEntryRepository.GetNextClaimBillFromQueue(bool hasConflictAccess)	Delegates to SAIF.Data's CCClaimApiService.GetNextClaimBillFromQueue(hasConflictAccess), which passes the flag to the Guidewire CC Claim Data API; the API applies the conflict-claim restriction**. The legacy named query ClaimBillEntry_GetNextBillFromQueue (see procedures/pk82039-billentry-task-process.md) is still embedded but no longer invoked by the repository	Data/SAIF.Data.NHibernate/Repositories/ClaimBillEntryRepository.cs, Data/SAIF.Data.NHibernate/Mappings/Claims/Bills/ClaimBillEntry.hbm.xml
Claim security attributes and overrides (DLA-SDN-05)	Mapping only — no validation method in this library	SecurityOverrideMap maps CL_SECURITY_OVERRIDE (WORKER_CONFLICT_FLAG, HOSTILE_WORKER_CODE); ClaimPersonMap maps WORKER_CONFLICT_FLAG/HOSTILE_WORKER_CODE; InjuryClaimMap maps EXTERNAL_VIEW_FLAG/TIN_AUTHORIZED_USE_FLAG; ClaimForOnBaseMap maps isconflictclaim; NotepadMap maps confidential_flag; OnBaseDocumentSubTypeMap/NotepadTypeMap map default_confidential_flag. These columns feed claim-security decisions in Services/SAIF.Services/Security/ClaimSecurityService.cs	Data/SAIF.Data.NHibernate/Mappings/Claims/SecurityOverride/SecurityOverrideMap.cs, Data/SAIF.Data.NHibernate/Mappings/Claims/ClaimPersonMap.cs, Data/SAIF.Data.NHibernate/Mappings/Claims/InjuryClaimMap.cs, Data/SAIF.Data.NHibernate/Mappings/Claims/Information/ClaimForOnBaseMap.cs, Data/SAIF.Data.NHibernate/Mappings/Notes/NotepadMap.cs

The direct-lookup methods GroupImageRepository.GetImageGroup(long), GetImageGroupOrDefault(long), and ImageFound(long) apply neither the confidential nor the deleted filter; any caller that exposes an image by id must enforce visibility itself*.

Segregation of duties

None found. There are no SOD classes, no employee_access/menu_structure queries, and no conflicting-privilege rules enforced in this library. ClaimAuthorityPurposeType maps authority purposes (1 = ApproveReserves, 2 = InitiateReserves, 3 = Initiate, 4 = Approve; Data/SAIF.Data.NHibernate/CustomTypes/ClaimAuthorityPurposeType.cs), and EmployeeAuthorityLimitMap/CaseCostMap map AUTHORIZED_BY_EMPLID/AUTHORIZER_EMPLID; these persist initiate/approve data that could support a maker-checker rule, but no such rule is enforced in this library*.

Security interfaces and contracts

Interface / Class	Role	Consumers	Source
ImageFilterCriteria	Carries caller-computed visibility flags (CanUserSeeConfidentialImages, CanUserSeeDeletedImages) into GroupImageRepository	GroupImageRepository.GetFilteredImageGroups	Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs (defined in SAIF.Data)*
ICCClaimApiService	Carries the caller-supplied conflict-claim access flag into the Guidewire bill queue API	ClaimBillEntryRepository	Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs (defined in SAIF.Data)*

Machine/application authorization

None found. The library performs no machine-account AD validation and holds no credentials. Database identity is supplied by the consuming application through SAIF.Framework.Data.NHibernate**.

Security concerns

ID	Severity	Concern	Source
SC-SDN-01	High	Inverted deleted-image filter. GetFilteredImageGroups keeps an image when ImageDeleteCode != null \|\| CanUserSeeDeletedImages. GroupImageRepository.Delete and ImagingDataModelExtensions.IsDeleted treat null, empty, or " " as not deleted and "Y" as deleted. For a user without GroupImagingDeleted, soft-deleted images ("Y") therefore pass the filter and are returned, while never-deleted images with a null code are hidden. This is an authorization bypass for deleted group images. SAIF.Services Groups/Imaging/ImageService.GetImages relies on this filter and applies none of its own; by contrast, Services/SAIF.Services/Agencies/Imaging/ImageService.cs uses !Image.IsDeleted() \|\| CanUserSeeDeletedImages correctly	Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs, Services/SAIF.Services/Interfaces/Imaging/ImagingDataModelExtensions.cs, Services/SAIF.Services/Groups/Imaging/ImageService.cs
SC-SDN-02	Medium	Both image visibility filters run in memory after ToList(), so every image in the group (including confidential and deleted ones) is loaded into the process before filtering. This is a performance and exposure-surface concern rather than a direct leak	Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs
SC-SDN-03	Medium	PII: CollectionsRepository.GetDebtorSsn runs named query Collections_GetDebtorSSN (SQL-008) and SearchCollections (SQL-012) accepts an SSN search parameter. No access check is present at this layer; callers must restrict it*	Data/SAIF.Data.NHibernate/Repositories/CollectionsRepository.cs, Data/SAIF.Data.NHibernate/Mappings/Collections/Collections.hbm.xml, Data/SAIF.Data.NHibernate/Mappings/Collections/DebtorSsnMap.cs
SC-SDN-04	Low	EDI maps are bound to a personal Oracle schema OPS$JIMMIL, implying the application account needs grants on an individual's schema — a least-privilege and portability concern	Data/SAIF.Data.NHibernate/Mappings/Edi/EdiElementMap.cs, Data/SAIF.Data.NHibernate/Mappings/Edi/EdiFileMap.cs, Data/SAIF.Data.NHibernate/Mappings/Edi/EdiSegmentMap.cs
SC-SDN-05	Informational	All inline SQL (CreateSqlQuery, named queries) uses bound parameters; no string concatenation of user input was observed	Data/SAIF.Data.NHibernate/Repositories/**, Data/SAIF.Data.NHibernate/Mappings/**/*.hbm.xml
SC-SDN-06	Informational	GroupImageRepository.Delete performs a soft delete and stamps UpdateUser/UpdateDate from the caller-supplied ImageDelete, but does not check CanUserEditImages; enforcement is expected in the caller*	Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs

Notes

• Mark inferred statements with * and unknown statements with **. Statements above follow this convention.
• This library defines no AD resource names of its own; the resource names referenced above (GroupImagingConfidential, GroupImagingDeleted) are defined and consumed by SAIF.Services, not by this library — they are cited here for traceability only.

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Database tables
• SQL catalog
• Procedures
• API reference

Sources

• Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs
• Data/SAIF.Data.NHibernate/Repositories/OutputDocuments/PolicyOutputDocumentRepository.cs
• Data/SAIF.Data.NHibernate/Repositories/ClaimBillEntryRepository.cs
• Data/SAIF.Data.NHibernate/Repositories/CollectionsRepository.cs
• Data/SAIF.Data.NHibernate/Mappings/Claims/Bills/ClaimBillEntry.hbm.xml
• Data/SAIF.Data.NHibernate/Mappings/Collections/Collections.hbm.xml