---
title: ClaimSecurityService
summary: API reference for ClaimSecurityService.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-24
library: SAIF.Services
reference_type: package
---

# ClaimSecurityService

Implements `IClaimSecurityService`, computing whether a user is authorized to view a claim flagged as conflict-sensitive and/or secure, and attaching the resulting `ClaimSecurityAccess` back onto the claim. It depends on `IUserProfileService` to resolve the current (or a specified) user, checking each flag against the fixed `"ConflictClaim"`/`"SecureClaim"` authorization roles.

## Purpose
- Determines whether the current (or a named) user has conflict-claim and/or secure-claim access for a given claim's security attributes.
- Populates a claim's `Security` property (`IClaimSecurityAttributes.Security`) with the computed access result.

## Context
- Namespace: `SAIF.Services.Security`
- Assembly/package: `SAIF.Services` (packaged inside the `SAIF.SAIFCode.Core` NuGet package)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| ClaimSecurityService(...) | `public ClaimSecurityService(IUserProfileService userProfileService)` | Enforces that the user-profile service is non-null and wires it in for resolving the current or a named user. |
| GetClaimSecurity(claim) | `public ClaimSecurityAccess GetClaimSecurity(IClaimSecurityAttributes claim)` | Resolves the current user and returns a `ClaimSecurityAccess` granting conflict/secure access unless the claim is flagged conflict/secure and the current user lacks the corresponding `"ConflictClaim"`/`"SecureClaim"` role. |
| GetClaimSecurity(userId, claim) | `public ClaimSecurityAccess GetClaimSecurity(string userId, IClaimSecurityAttributes claim)` | Resolves the named system user (via `IUserProfileService.GetSystemUser`) and computes the same conflict/secure access result for that user instead of the current one. |
| GetClaimSecurity(claimSecurity, userAccess) *(static)* | `public static ClaimSecurityAccess GetClaimSecurity(IClaimSecurityAttributes claimSecurity, ClaimUserSecurityAccess userAccess)` | Computes conflict/secure access directly from a pre-resolved `ClaimUserSecurityAccess`, without any user-profile lookup; enforces that both arguments are non-null. |
| LoadClaimSecurity(claim) | `public void LoadClaimSecurity(IClaimSecurityAttributes claim)` | Computes access for the current user via `GetClaimSecurity(claim)` and assigns it to `claim.Security`. |
| LoadClaimSecurity(userId, claim) | `public void LoadClaimSecurity(string userId, IClaimSecurityAttributes claim)` | Computes access for the named user via `GetClaimSecurity(userId, claim)` and assigns it to `claim.Security`. |

## Behavioral notes
- Access is granted for a flag whenever the claim is *not* marked with that sensitivity (`IsConflictClaim`/`IsSecureClaim` false), regardless of the user's roles; the role check only applies when the corresponding flag is set on the claim.
- The static `GetClaimSecurity(claimSecurity, userAccess)` overload bypasses `IUserProfileService` entirely, allowing callers that have already resolved a `ClaimUserSecurityAccess` (e.g. via its own constructor) to reuse the same access-computation logic without an extra profile lookup.

## Sources
- Services/SAIF.Services/Security/ClaimSecurityService.cs