ClaimSecurityService

Implements IClaimSecurityService, computing whether a user is authorized to view a claim flagged as conflict-sensitive and/or secure, and attaching the resulting ClaimSecurityAccess back onto the claim. It depends on IUserProfileService to resolve the current (or a specified) user, checking each flag against the fixed "ConflictClaim"/"SecureClaim" authorization roles.

Purpose

• Determines whether the current (or a named) user has conflict-claim and/or secure-claim access for a given claim's security attributes.
• Populates a claim's Security property (IClaimSecurityAttributes.Security) with the computed access result.

Context

• Namespace: SAIF.Services.Security
• Assembly/package: SAIF.Services (packaged inside the SAIF.SAIFCode.Core NuGet package)

Public members

Member	Signature	Purpose
ClaimSecurityService(...)	public ClaimSecurityService(IUserProfileService userProfileService)	Enforces that the user-profile service is non-null and wires it in for resolving the current or a named user.
GetClaimSecurity(claim)	public ClaimSecurityAccess GetClaimSecurity(IClaimSecurityAttributes claim)	Resolves the current user and returns a ClaimSecurityAccess granting conflict/secure access unless the claim is flagged conflict/secure and the current user lacks the corresponding "ConflictClaim"/"SecureClaim" role.
GetClaimSecurity(userId, claim)	public ClaimSecurityAccess GetClaimSecurity(string userId, IClaimSecurityAttributes claim)	Resolves the named system user (via IUserProfileService.GetSystemUser) and computes the same conflict/secure access result for that user instead of the current one.
GetClaimSecurity(claimSecurity, userAccess) (static)	public static ClaimSecurityAccess GetClaimSecurity(IClaimSecurityAttributes claimSecurity, ClaimUserSecurityAccess userAccess)	Computes conflict/secure access directly from a pre-resolved ClaimUserSecurityAccess, without any user-profile lookup; enforces that both arguments are non-null.
LoadClaimSecurity(claim)	public void LoadClaimSecurity(IClaimSecurityAttributes claim)	Computes access for the current user via GetClaimSecurity(claim) and assigns it to claim.Security.
LoadClaimSecurity(userId, claim)	public void LoadClaimSecurity(string userId, IClaimSecurityAttributes claim)	Computes access for the named user via GetClaimSecurity(userId, claim) and assigns it to claim.Security.

Behavioral notes

• Access is granted for a flag whenever the claim is not marked with that sensitivity (IsConflictClaim/IsSecureClaim false), regardless of the user's roles; the role check only applies when the corresponding flag is set on the claim.
• The static GetClaimSecurity(claimSecurity, userAccess) overload bypasses IUserProfileService entirely, allowing callers that have already resolved a ClaimUserSecurityAccess (e.g. via its own constructor) to reuse the same access-computation logic without an extra profile lookup.

Sources

• Services/SAIF.Services/Security/ClaimSecurityService.cs