Skip to content

Authorize a request against SAIF roles

SaifAuthorizeAttribute.IsAuthorized(HttpActionContext) decides whether the current caller holds at least one of the roles/resources declared on the attribute, delegating the actual decision to ISecurityApiClient.

Field Value
Operation ID OP-08
Trigger Web API authorization-filter pipeline on any decorated controller/action.
Inputs HttpActionContext, constructed Roles string, request-scoped ISecurityApiClient/IEnvironmentService
Outputs bool
Primary components SaifAuthorizeAttribute.IsAuthorized(HttpActionContext)
Entry point src/SAIF.Web.API/SaifAuthorizeAttribute.cs

Steps

  1. (construction) Roles passed to the constructor are Trim()-ed and joined with , into the inherited AuthorizeAttribute.Roles property (BR-WEBAPI-020). forceProductionRole is stored in _ForceProductionRole and never read.
  2. Enforce.ArgumentNotNull(actionContext, "actionContext") (BR-WEBAPI-014).
  3. Throws when null.
  4. SAIF.Exceptions.Enforce is implemented in SAIF.Framework.Core; its internal steps could not be embedded — the package is not indexed for this run.**
  5. Resolve ISecurityApiClient and IEnvironmentService from actionContext.Request.GetDependencyScope() (BR-WEBAPI-014).
  6. If ISecurityApiClient is null → throw new MissingDependencyException("ISecurityApiClient") (BR-WEBAPI-014).
  7. Fail-closed; surfaces as a 500 via the pipeline.*
  8. If IEnvironmentService is null → throw new MissingDependencyException("IEnvironmentService") (BR-WEBAPI-014).
  9. Fail-closed.
  10. If !Roles.Any() (the joined role string is empty) → return true (BR-WEBAPI-015).
  11. Decorating with no roles authorizes every caller reaching the filter.
  12. Read user = environmentService.User.Identity.Name (BR-WEBAPI-016).
  13. environmentService.User is dereferenced without a null check.
  14. If user.IsNullOrWhiteSpace() → return false (BR-WEBAPI-016).
  15. Returns false → Handle an unauthorized request.
  16. Strip all spaces from Roles, split on ,, and return true if any role satisfies securityApiClient.IsAuthorized(user, role) (BR-WEBAPI-017).
  17. The Any LINQ evaluation short-circuits on the first success; up to N remote calls otherwise.*
  18. ISecurityApiClient.IsAuthorized(user, role) is implemented in SAIF.Framework.Core; its internal steps could not be embedded — the package is not indexed for this run.**
  19. A false result also flows to Handle an unauthorized request.

Process flow

flowchart TD
    subgraph MainFlow["Authorization decision<br>path"]
        Start(["Authorization filter<br>pipeline"]) --> NullCheck["Enforce.ArgumentNotNull(<br>actionContext)"]
        NullCheck --> Resolve["Resolve<br>ISecurityApiClient /<br>IEnvironmentService"]
        Resolve --> SecNull{ISecurityApiClient null?}
        SecNull -->|No| EnvNull{"IEnvironmentService<br>null?"}
        EnvNull -->|No| RolesEmpty{"Roles empty?"}
        RolesEmpty -->|No| ReadUser["user =<br>environmentService.User.<br>Identity.Name"]
        ReadUser --> UserEmpty{"user null/whitespace?"}
        UserEmpty -->|No| AnyRole["Any role:<br>securityApiClient.<br>IsAuthorized(user,<br>role)?"]
    end
    SecNull -->|Yes| ThrowSec["throw<br>MissingDependency<br>Exception"]
    EnvNull -->|Yes| ThrowEnv["throw<br>MissingDependency<br>Exception"]
    RolesEmpty -->|Yes| AllowAll["return true"]
    UserEmpty -->|Yes| Deny["return false"]
    AnyRole -->|True| Allow[return true]
    AnyRole -->|False| Deny2["return false"]

Failure and edge-case behavior

  • A missing ISecurityApiClient or IEnvironmentService throws MissingDependencyException, which surfaces as an unhandled server error (not a 401/403).*
  • environmentService.User is dereferenced without a null guard; an environment service that returns a null User would raise NullReferenceException.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.Web.API/SaifAuthorizeAttribute.cs