UserAccess

UserAccess is the abstract, per-instance authorization-decision cache extended by domain access classes such as SAIF.Application.Claim/ClaimUserAccess. It binds to a clsSecurityPrincipal via SetPrincipal and memoizes each resource name's IsAuthorized result in a case-insensitive SortedList(Of String, Boolean), so repeated AD resource checks during a single request do not re-query the security service (BR-APP-004). It carries no knowledge of any specific AD resource name — resource names are supplied entirely by callers and forwarded verbatim to the framework principal.

Purpose

• Provides the single authorization-decision call site in this library: HasAccess is the only member that actually asks clsSecurityPrincipal.IsAuthorized for a decision.
• Caches each decision per instance, keyed on the lower-cased resource name, so a mid-session AD group change is not observed until a new instance is created (BR-APP-004).
• Supplies a cache-warming entry point (CheckAccess) for callers that want to pre-evaluate several resource names in one call.

Context

• Namespace: SAIF.Application
• Assembly/package: SAIF.Application (embedded, ProjectReference)

Public members

Member	Signature	Purpose
CheckAccess	Public Sub (ParamArray inResourceName As String())	Pre-evaluates and caches authorization for a set of AD resource names in one call; the per-resource result is discarded, so the method's only effect is populating the cache.
HasAccess	Public Function (inResourceName As String) As Boolean	Returns the cached authorization decision, or on first request calls clsSecurityPrincipal.IsAuthorized(inResourceName) and caches the result under the lower-cased resource name (BR-APP-004).

Protected members (available to derived access classes)

Member	Signature	Purpose
SetPrincipal	Protected Sub (inPrincipal As clsSecurityPrincipal)	Injects the identity whose authorizations are evaluated; derived classes must call this before HasAccess.

Behavioral notes

• m_Principal has no default; calling HasAccess before SetPrincipal throws a NullReferenceException rather than failing via an explicit deny.**
• CheckAccess loops the supplied names calling HasAccess on each, but the loop variable is overwritten each iteration and then discarded, so the method returns no information to the caller — it is a cache warm-up only.
• The framework appends the environment suffix (Resource / TestResource) to the resource name inside clsSecurityPrincipal.IsAuthorized, not in this class.*

Constraints and usage notes

• The class is MustInherit; it must be extended by a domain access class (e.g. ClaimUserAccess) that calls SetPrincipal and supplies concrete resource names.
• Resource-name matching is case-insensitive because both the cache key and the HasAccess argument are lower-cased before comparison.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Application/UserAccess.vb
• SAIF.Application.Claim/ClaimUserAccess.vb