--- title: SAIF.Web.API dependencies summary: Internal and external dependencies for this library. status: draft owner: andmil last_reviewed: 2026-09-15 library: SAIF.Web.API reference_type: package --- # SAIF.Web.API dependencies `SAIF.Web.API` declares no ``s: `SAIF.Web.API.csproj` references only NuGet packages. It references `ErrorResponse` / `SAIF.API.Exceptions.*` types by fully-qualified name at compile time, but which assembly actually supplies those types — the sibling `SAIF.Web.API.Core` project or the `SAIF.Framework.Core` package — is unresolved (see [Internal dependencies](#internal-dependencies)).** All actual authorization, logging, and environment-configuration behavior is delegated to services assumed to be supplied by the hosting application through `SAIF.Framework.Core`; no such registration exists inside this library.* ## Internal dependencies `SAIF.Web.API` declares no ``s of any kind, so no internal same-repo project qualifies for this table under the canonical Reference Type enum (`Project Reference` | `NuGet Package` | `NuGet Package (same-repo)`). The unresolved compile-time reference to `ErrorResponse` / `SAIF.API.Exceptions.*` types is not a confirmed dependency on any specific project or package and is therefore documented as an open question in [Dependency risks and notes](#dependency-risks-and-notes) rather than as a table row here. | Dependency | Reference Type | Usage | | --- | --- | --- | | `SAIF.Framework.Core` | NuGet Package | Supplies `SAIF.Core.Services.IEnvironmentService`, `ILogService`, `ILogServiceForApi`, `SAIF.Core.Services.UserProfile.ISecurityApiClient`, `SAIF.Common.Extensions` (string/URI extension methods), `MissingDependencyException`, and `Enforce`. Resolved per request via ASP.NET Web API's `IDependencyScope` (service locator), not constructor injection. | ## External dependencies | Dependency | Version | Usage | | --- | --- | --- | | `Grpc.Core` | 2.44.0 | Referenced with `ExcludeAssets: runtime;native;contentfiles;analyzers;buildtransitive` (compile-time reference/compile assembly only, no runtime binaries deployed). No `Grpc.Core.*` types are used anywhere in this library's own source; the reason for the reference could not be determined from source alone.** | | `Microsoft.AspNet.WebApi.WebHost` | 5.2.3 | Provides the `System.Web.Http.*` types (`ActionFilterAttribute`, `AuthorizeAttribute`, `HttpActionContext`, `DelegatingHandler` support, etc.) used throughout `ApiResponseHandler`, `SaifAuthorizeAttribute`, and `RequireSSLAttribute`. | ## Dependency risks and notes - **Undeclared compile-time coupling to an unresolved supplier.** `SAIF.Web.API` references `ErrorResponse` / `SAIF.API.Exceptions.*` by fully-qualified type name at compile time with no ``/`` naming an explicit supplier. The sibling `SAIF.Web.API.Core` project declares matching types, and the `SAIF.Framework.Core` package is an equally plausible source; which one the build actually resolves is unconfirmed and is recorded as an open question requiring inspection of the restored `SAIF.Framework.Core` 2.0.25119.2 assembly.** - **Nuspec dependency drift.** Two `.nuspec` files exist for this package: a templated `src\SAIF.Web.API\SAIF.Web.Api.nuspec` (dependencies resolved from the `.csproj` at pack time) and a separate, hard-coded `nuspec\SAIF.Web.API\SAIF.Web.API.nuspec` that pins `SAIF.Framework.Core` at version `1.0` and lists `Microsoft.AspNet.WebApi.Client`/`Microsoft.AspNet.WebApi.Core` as dependencies — none of which match the `.csproj`'s actual references (`SAIF.Framework.Core` 2.0.25119.2, `Microsoft.AspNet.WebApi.WebHost` only). Which nuspec is authoritative for the actual `nuget pack` step could not be confirmed from local pipeline YAML alone (the `build-steps-nuget.yml` template lives in an external repository).** - **`Grpc.Core` reference rationale is unknown.** No gRPC types are used anywhere in this library's source, yet the package is referenced with most asset types excluded; this could be a vestigial reference or a compile-time requirement of an undetermined transitive consumer.** - **Host must register `IEnvironmentService` and `ISecurityApiClient`.** Both are resolved via `IDependencyScope` per request rather than constructor-injected. No registration call site exists inside this library, so this describes a requirement on the hosting application rather than an observed registration.* If either is unregistered by the hosting application's `IDependencyResolver`, `SaifAuthorizeAttribute.IsAuthorized` throws `MissingDependencyException`, surfacing as an unhandled server error rather than a 401/403 response. - **`ISecurityApiClient` implementation is opaque to this library.** The concrete authorization mechanism behind `ISecurityApiClient.IsAuthorized(user, role)` (WCF `SecurityService`, HTTP API, or another mechanism) is defined in `SAIF.Framework.Core` and could not be determined from this repository.** - **Pipeline path/casing drift.** `pipelines\build-vars-webapi.yml` declares `SolutionPath`/`ProjectPath` values (`SAIF.Web.Api.sln`, `SAIF.Web.Api\SAIF.Web.Api.csproj`) whose casing differs from the actual on-disk repository paths (`SAIF.Web.API.sln`, `SAIF.Web.API\SAIF.Web.API.csproj`); likely harmless on case-insensitive Windows build agents but flagged for completeness. > **Note:** Statements marked with * were inferred from code structure, naming conventions, or > contextual evidence where direct confirmation was not available in source artifacts. Statements > marked with ** could not be confirmed; treat as unknown until verified. ## Related documentation - [Index](index.md) - [Overview](overview.md) - [Architecture](architecture.md) - [Configuration](configuration.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Security and authorization](security-authorization.md) - [API reference](api/index.md) ## Sources - `src/SAIF.Web.API/SAIF.Web.API.csproj` - `src/SAIF.Web.API/ApiResponseHandler.cs` - `src/SAIF.Web.API/ExceptionHandler.cs` - `src/SAIF.Web.API/SaifAuthorizeAttribute.cs` - `src/SAIF.Web.API/RequireSSLAttribute.cs` - `src/SAIF.Web.API/SAIF.Web.Api.nuspec` - `src/SAIF.Web.API.Core/SAIF.Web.API.Core.csproj` - `src/SAIF.Web.API.sln` - `nuspec/SAIF.Web.API/SAIF.Web.API.nuspec` - `pipelines/build-vars-webapi.yml` - `pipelines/build-webapi.yml` - `pipelines/release-webapi.yml`