SAIF.Framework.Core business rules¶

This page captures the 12 business rules enforced by this library, spanning AD/machine authorization naming conventions, configuration precedence, REST security-client input validation, fax validation, and an authorization-validation side effect.

BR-CORE-01 AD resource naming suffix¶

Field	Value
Statement	An AD resource name is suffixed with `Resource` in production or `TestResource` outside production, after stripping any existing suffix.
Trigger	Every call to `SecurityGroupService.GetMembersByResource`.
Enforcement	`SecurityGroupService.GetMembersByResource` (`Services\SecurityGroupService.cs`).
Outcome	The correct environment-scoped AD group is queried instead of the raw resource name.
Source	`Services\SecurityGroupService.cs`

BR-CORE-02 Machine authorization group naming¶

Field	Value
Statement	A machine-authorization group name is suffixed with (`Test`+)`Resource` only when `isResource=true`, honoring `isProductionResource`.
Trigger	`MachineSecurityService.IsAuthorized` call with `isResource=true`.
Enforcement	`MachineSecurityService.IsAuthorized` (`Core\Services\MachineSecurityService.cs`).
Outcome	Correct environment-scoped group name used for the machine membership check.
Source	`Core\Services\MachineSecurityService.cs`

BR-CORE-03 Developer machine hostname gate¶

Field	Value
Statement	A machine is never classified as a developer machine unless its hostname matches the tag-number pattern `^[TV]\d+$`.
Trigger	Every `EnvironmentServiceBase.IsDeveloperMachine` read.
Enforcement	`EnvironmentServiceBase.IsDeveloperMachine` (`Services.Common\EnvironmentServiceBase.cs`).
Outcome	Short-circuits to `false` with no AD call for non-tag hostnames; only tag-numbered hosts proceed to the AD group check.
Source	`Services.Common\EnvironmentServiceBase.cs`

BR-CORE-04 Developer settings override precedence¶

Field	Value
Statement	Developer machine local JSON config overrides (`DeveloperSettingsFile`) take precedence over environment-API-sourced and in-memory cached settings.
Trigger	Every `GetConfigSetting`/`GetConfigSetting<T>` call, when `IsDeveloperMachine` is true and an override file resolves.
Enforcement	`EnvironmentServiceBase.GetConfigSettingInfo` (`Services.Common\EnvironmentServiceBase.cs`).
Outcome	The first matching override entry is returned instead of the platform-sourced value.
Source	`Services.Common\EnvironmentServiceBase.cs`

BR-CORE-05 Security API username format requirement¶

Field	Value
Statement	A username supplied to the Security API client must be formatted `domain\username` (exactly one `\`, both segments non-empty).
Trigger	`SecurityApiClient.GetUser(string)` / `IsAuthorized(username, role)`.
Enforcement	`SecurityApiClient.TryParseDomainUsername` (`Services\Utilities\SecurityApiClient.cs`).
Outcome	`ArgumentException` thrown when the format is invalid; request never reaches the REST API.
Source	`Services\Utilities\SecurityApiClient.cs`

BR-CORE-06 REST role name suffix normalization¶

Field	Value
Statement	An authorization role name passed to `SecurityApiClient.IsAuthorized` has any trailing "resource" text replaced with the environment-configured suffix (`SecurityClient.resourcesuffix`) before the call.
Trigger	`SecurityApiClient.IsAuthorized`.
Enforcement	`SecurityApiClient.HandleResourceNaming` (`Services\Utilities\SecurityApiClient.cs`).
Outcome	The REST API receives an environment-correct role/resource name.
Source	`Services\Utilities\SecurityApiClient.cs`

BR-CORE-07 Fax file required¶

Field	Value
Statement	A `FaxConfig.File` must not be empty.
Trigger	`FaxService` fax-send validation.
Enforcement	`FaxService.FaxConfigValidator` (`Services\Utilities\Documents\FaxService.cs`).
Outcome	Validation failure surfaced through `IValidationService.Validate` if violated.
Source	`Services\Utilities\Documents\FaxService.cs`

BR-CORE-08 Fax recipients required¶

Field	Value
Statement	A `FaxConfig.Recipients` collection must not be empty.
Trigger	`FaxService` fax-send validation.
Enforcement	`FaxService.FaxConfigValidator` (`Services\Utilities\Documents\FaxService.cs`).
Outcome	Validation failure if violated.
Source	`Services\Utilities\Documents\FaxService.cs`

BR-CORE-09 Fax recipient fax number required¶

Field	Value
Statement	Each fax recipient must have a non-empty `FaxNumber`.
Trigger	`FaxService` fax-send validation, per recipient.
Enforcement	`FaxService.FaxRecipientValidator` (`Services\Utilities\Documents\FaxService.cs`).
Outcome	Validation failure if violated.
Source	`Services\Utilities\Documents\FaxService.cs`

BR-CORE-10 Fax recipient name required¶

Field	Value
Statement	Each fax recipient must have a non-empty `RecipientName`.
Trigger	`FaxService` fax-send validation, per recipient.
Enforcement	`FaxService.FaxRecipientValidator` (`Services\Utilities\Documents\FaxService.cs`).
Outcome	Validation failure if violated.
Source	`Services\Utilities\Documents\FaxService.cs`

BR-CORE-11 AuthorizationRules side-effect execution¶

Field	Value
Statement	Every `IValidationService.Validate<T>(T)` call additionally executes the `"AuthorizationRules"` FluentValidation rule set on the same entity, in addition to the default rule set.*
Trigger	Any call to the single-argument `Validate<T>(T)` overload.
Enforcement	`FluentValidationService.Validate<T>(T)` (`Services\Utilities\FluentValidationService.cs`).
Outcome	The `"AuthorizationRules"` rule set always executes as a side effect, though its result is currently discarded — origin of authorization-rule enforcement for consuming validators, not fully wired. Flagged as an open question: unclear whether this is intentional warm-up/caching behavior or a latent defect where authorization-rule failures are silently ignored.*
Source	`Services\Utilities\FluentValidationService.cs`

BR-CORE-12 Security API request pre-validation¶

Field	Value
Statement	A `SecurityApiClient` request whose domain/username cannot be parsed throws before any network call is made.
Trigger	`GetUser`/`IsAuthorized`.
Enforcement	`SecurityApiClient.GetUser(string, string)` (`ArgumentNullException` guard).
Outcome	Prevents malformed REST calls.
Source	`Services\Utilities\SecurityApiClient.cs`

Notes¶

Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
BR-CORE-11 is flagged in the analysis as an open question rather than a confirmed defect — see Architecture.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

Services\SecurityGroupService.cs
Core\Services\MachineSecurityService.cs
Services.Common\EnvironmentServiceBase.cs
Services\Utilities\SecurityApiClient.cs
Services\Utilities\Documents\FaxService.cs
Services\Utilities\FluentValidationService.cs