Skip to content

SAIF.Data security and authorization

This page documents authorization mechanisms implemented or consumed by this library. SAIF.Data references and enforces no Active Directory resource names; its security relevance is entirely data-level (saif-data-security-analysis.md).

Authorization architecture

SAIF.Data has no attribute-based or programmatic AD-role authorization of its own. It supplies data-level building blocks that a higher layer (chiefly SAIF.Services) combines into an authorization decision: a boolean claim-security-override check, entity/DTO fields carrying claim, image, note, and document confidentiality attributes, agency/producer/policy scoping filters for output documents, and the service-credential plumbing for its two outbound REST clients (saif-data-security-analysis.md).

flowchart TD
    Caller[SAIF.Services caller] --> Override["ClaimSecurityOverrideProvider.HasClaimSecurityOverride"]
    Override --> DB["(CL_SECURITY_OVERRIDE)"]
    Caller --> Flags["Confidentiality/conflict flags on<br>SecurityOverride, ClaimPerson,<br>InjuryClaim, ClaimHeaderData"]
    Caller --> Scoping["PolicyOutputDocumentExtensions<br>agency/producer/policy filters"]
    Flags --> Decision["SAIF.Services.Security.ClaimSecurityService<br>(combines flags with AD resources)"]
    Override --> Decision

AD resource catalog

None found. A repository-wide scan of Data/SAIF.Data/**/*.cs for IsInRole, PrincipalPermission, Authorize, WindowsIdentity, IPrincipal, Thread.CurrentPrincipal, SecurityService, and DirectoryServices returned no matches in compiled code (saif-data-security-analysis.md AD group / resource catalog).

Authorization enforcement points

None found. SAIF.Data is a class library with no controllers, actions, or authorization attributes, and no method grants or denies an operation based on AD membership (saif-data-security-analysis.md Authorization enforcement points).

Data-level authorization

Entity type Validation method Mechanism Source
SecurityOverride (table CL_SECURITY_OVERRIDE) ClaimSecurityOverrideProvider.HasClaimSecurityOverride(long claimId, string employeeId) NHibernate LINQ Any() over rows where ClaimId == claimId, EmplId == employeeId, EffDate <= DateTime.Today and ExpDate >= DateTime.Today; returns true when an active, date-bounded override grants the employee access to the claim (SD-BR-020) Data/SAIF.Data/Queries/Claims/ClaimSecurityOverrideProvider.cs, Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs
Claim security attribute carriers: SecurityOverride.IsWorkerConflict/HostileWorker, ClaimPerson.IsWorkerConflict/HostileWorker, InjuryClaim.IsSecured/IsRestricted/IsExternallyViewable, ClaimHeaderData.IsWorkerConflict, ClaimSecurity.HostileWorkerCode/WorkerConflictFlag Attribute carriers only; no validation method in this library Flags are read from the database and surfaced to SAIF.Services.Security.ClaimSecurityService.GetClaimSecurity, which combines them with the ConflictClaim and SecureClaim AD resources* Data/SAIF.Data/Model/Claims/SecurityOverride/SecurityOverride.cs, Data/SAIF.Data/Model/Claims/ClaimPerson.cs, Data/SAIF.Data/Model/Claims/InjuryClaim.cs, Data/SAIF.Data/Model/Claims/Information/ClaimHeaderData.cs, Data/SAIF.Data/Model/Claims/Information/ClaimSecurity.cs
ImageFilterCriteria (group images) Criteria DTO: CanUserSeeConfidentialImages, CanUserSeeDeletedImages The caller sets the flags from AD checks in SAIF.Services; the filter itself is applied in SAIF.Data.NHibernate's GroupImageRepository.GetFilteredImageGroups. SAIF.Data only carries the flags Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs
PolicyOutputDocument (agency/producer document visibility) PolicyOutputDocumentExtensions.AgencyViewable, AgencyInboxViewable, Released, ForAgency(agencyId), ForProducer(producerId), ForPolicyOrAccount(policyNumber, accountNumber), composed in OutputDocumentQueryProvider.GetReleasedAgencyViewablePolicyOutputDocuments, GetHeldAndPendingAgencyViewablePolicyOutputDocuments, ReleasedAgencyInboxViewableQuery Query-scoping filters restricted to a caller-supplied agency id, producer id, or policy number; only document types flagged IsAgencyViewable/IsAgencyInboxViewable are returned. SAIF.Data does not verify that the current user belongs to that agency or policy* (SD-BR-072) Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs, Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs
Claim bill queue (ClaimBillQueueTask) CCClaimApiService.GetNextClaimBillFromQueue(bool hasConflictAccess) The caller's conflict-claim access is passed to the Guidewire CC Claim Data API as a path segment (PUT v1/BillEntryTaskProcess/NextBillFromQueue/{hasConflictAccess}); the API decides server-side whether conflict-claim bills may be dequeued to this user** Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs

Confidentiality flags that exist on entities but are not filtered anywhere in SAIF.Data: Notepad.IsConfidential, NotepadType.IsConfidentialByDefault, DocumentImageTypeCode.IsConfidentialByDefault, OnBaseDocumentSubType.IsConfidentialByDefault, DocumentDetail.IS_CONFIDENTIAL_FLAG, ProviderTypeCode.IsServiceProviderRestricted. EbillQueryProvider.GetConfidentialBillAssignment() returns the CONF assignment rule used to route confidential e-bills; it is a routing rule, not an access check (saif-data-security-analysis.md).

Consumers of the data-level checks

Consumer Use Source
ClaimInformationService Instantiates ClaimSecurityOverrideProvider and calls HasClaimSecurityOverride(claimId, employee.Id) Services/SAIF.Services/Claims/Information/ClaimInformationService.cs
TaskService, LegalTaskService Combine IsWorkerConflict/IsSecureClaim with the user's secure/conflict access Services/SAIF.Services/Claims/Tasks/TaskService.cs, Services/SAIF.Services/Legal/Tasks/LegalTaskService.cs

Segregation of duties

None found. SAIF.Data has no *SegregationOfDuties*/*SOD* classes and no queries against employee_access or menu_structure. EmployeeAuthorityLimit.AuthorizedByEmplid and EmployeeAuthorityPaymentLimitHistory.AuthorizedByEmplid record who approved a payment-authority limit, but no rule in this library prevents a user from approving their own limit (saif-data-security-analysis.md Segregation of duties findings).

Security interfaces and contracts

Interface / Class Role Consumers Source
IClaimSecurityOverrideProvider Contract for the claim-security-override data-level check SAIF.Services.Claims.Information.ClaimInformationService Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs
ImageFilterCriteria Carries caller-supplied confidential/deleted image visibility flags into SAIF.Data.NHibernate SAIF.Services.Groups.Imaging.ImageService (via GroupImageSecurityProvider), SAIF.Data.NHibernate.GroupImageRepository Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs

Machine/application authorization

No machine-account AD group validation was found. SAIF.Data authenticates itself to downstream APIs as an application using service credentials, recorded here for completeness (saif-data-security-analysis.md Machine/application authorization findings).

Client Credential source Mechanism Source
MedicalBillingApiService (via SAIF.Data.Clients.HttpClientBase) Secure config setting medicalbillingapi.creds, decrypted with IEnvironmentService.GetSecureConfigSetting(AuthKey, systemHash); hash from SystemHashUtil.ComputeHash(SystemType, SystemName) or SystemHashUtil.Get(SystemType) NetworkCredential(user, password) on an HttpClientHandler after splitting the value on \| Data/SAIF.Data/Clients/HttpClientBase.cs, Data/SAIF.Data/Clients/MedicalBillingApiService.cs
CCClaimApiService (via SAIF.Data.Guidewire.Clients.HttpClientBase) None: AuthKey => string.Empty No credentials are attached by this library; any authentication is handled by the Guidewire base class or the network** Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs, Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs

No credential literal is present in source.

Notes

  • Concern (Medium): HttpClientBase.GetAsyncCached builds the cache key from type, URL, ensureSuccess, and body hash only. Responses are cached process-wide (default 30 s, from SAIF.Data.Guidewire's DataClientConfiguration) with no per-user component in the key, so any per-user data-level filtering applied downstream of the API is not reflected in the cache*. Because the calls use a service credential rather than the end user's identity, the API cannot filter by user anyway; authorization must happen in the caller before the call (Data/SAIF.Data/Clients/HttpClientBase.cs).
  • Concern (Low): HttpClientBase.InitializeClient splits the decrypted secure setting on \| and indexes creds[1] without a length check; a malformed secret throws IndexOutOfRangeException rather than a descriptive error (Data/SAIF.Data/Clients/HttpClientBase.cs).
  • Concern (Low): PolicyOutputDocumentExtensions.ForPolicyOrAccount computes account-level documents but returns only policy-level documents (the concatenation is commented out). This narrows rather than widens visibility, so it is a functional defect, not an exposure (SD-BR-074, Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs).
  • Concern (Informational): Agency, producer, and policy scoping filters trust the ids passed in; ownership of those ids must be validated by the caller (for example IPolicySecurityService in SAIF.Services)* (Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs).
  • Concern (Informational): TestRepository/** in-memory seed builders ship in the production assembly; they contain no credentials (Data/SAIF.Data/TestRepository/).
  • Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.

Sources

  • Data/SAIF.Data/Queries/Claims/ClaimSecurityOverrideProvider.cs
  • Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs
  • Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs
  • Data/SAIF.Data/Queries/Claims/Ebilling/EbillQueryProvider.cs
  • Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs
  • Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs
  • Data/SAIF.Data/Clients/HttpClientBase.cs
  • Data/SAIF.Data/Clients/MedicalBillingApiService.cs
  • Data/SAIF.Data/Model/Claims/SecurityOverride/SecurityOverride.cs
  • Data/SAIF.Data/Model/Claims/ClaimPerson.cs
  • Data/SAIF.Data/Model/Claims/InjuryClaim.cs
  • Data/SAIF.Data/Model/Claims/Information/ClaimHeaderData.cs
  • Data/SAIF.Data/Model/Claims/Information/ClaimSecurity.cs
  • Data/SAIF.Data/Model/Claims/Authority/EmployeeAuthorityLimit.cs
  • Data/SAIF.Data/Model/Claims/Authority/EmployeeAuthorityPaymentLimitHistory.cs
  • Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs
  • Data/SAIF.Data/Model/Notes/Notepad.cs
  • Data/SAIF.Data/Model/Notes/NotepadType.cs
  • Data/SAIF.Data/Model/Documents/DocumentImageTypeCode.cs
  • Data/SAIF.Data/Model/Documents/DocumentDetail.cs
  • Data/SAIF.Data/Model/Imaging/OnBaseDocumentSubType.cs
  • Data/SAIF.Data/Model/Providers/ProviderTypeCode.cs
  • Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs
  • Services/SAIF.Services/Claims/Information/ClaimInformationService.cs
  • Services/SAIF.Services/Security/ClaimSecurityService.cs
  • Services/SAIF.Services/Groups/Imaging/ImageService.cs
  • Services/SAIF.Services/Claims/Tasks/TaskService.cs
  • Services/SAIF.Services/Legal/Tasks/LegalTaskService.cs