Session persistent Security Profile

SaBusMgrCoreWeb/Web/Controllers/SbmController_Web.cs

@@ -95,7 +95,7 @@ namespace Sarand.BusinessMgr.Net.Core.Web.Controllers
 				// Some actions (eg. score password) don't need to.
 				if (StoreSessionData)
 				{
-					String sessionDataJson = JsonConvert.SerializeObject(SessionData);
+					String sessionDataJson = JsonConvert.SerializeObject(SessionData, SbmController_Web.SessionDataJsonSerializerSettings);
 					HttpContext.Session.Set(SessionStorage.SessionKey_SessionData, SessionStorage.sessionDataEncoding.GetBytes(sessionDataJson));
 				}
 			}
@@ -189,15 +189,21 @@ namespace Sarand.BusinessMgr.Net.Core.Web.Controllers
 					return base.CreateProperties(type, MemberSerialization.Fields);
 				}
 			};
+			public static JsonSerializerSettings JsonSerialisationSettings = new JsonSerializerSettings
+			{
+				NullValueHandling = NullValueHandling.Ignore
+			};
 			public static JsonSerializerSettings JsonDeserialisationSettings = new JsonSerializerSettings
 			{
 				ContractResolver = new SbmSessionDataContractResolver(),
 				// Force all deserialised objects to be replaced - to avoid proxy lists not populating.
-				ObjectCreationHandling = ObjectCreationHandling.Replace
+				ObjectCreationHandling = ObjectCreationHandling.Replace,
+				NullValueHandling = NullValueHandling.Ignore
 			};
 		}
 		private readonly SessionStorage sessionStorage = new SessionStorage();
-		public static JsonSerializerSettings SbmSessionDataJsonSerializerSettings { get { return SessionStorage.JsonDeserialisationSettings; } }
+		public static JsonSerializerSettings SessionDataJsonSerializerSettings { get { return SessionStorage.JsonSerialisationSettings; } }
+		public static JsonSerializerSettings SessionDataJsonDeserializerSettings { get { return SessionStorage.JsonDeserialisationSettings; } }
 
 		//-------------------------------------------------------------------
 		public SbmSessionData_Web SessionData

SaBusMgrStandardBase/Base/App/Sbm.cs

@@ -667,24 +667,24 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		/// </summary>
 		public enum SecurityRight
 		{
-			// Other.
+			/* Admin. */
 			Security_Admin,                 // Security administration.
 			Database_Admin,                 // Database administration.
 			ReferenceData_Admin,            // Reference data administration
 			InterfaceConfig,                // Interface configuration
-										   // Contacts.
+			/* Contacts. */
 			Affiliate_Create,               // Create new contacts (companies and individuals).
 			Affiliate_Update,               // Update contacts.
-											// Associations.
+			/* Associations. */
 			Association_Create,             // Create new Associations (customers and suppliers etc).
 			Association_Update,             // Update Associations.
-											// Commodity.
+			/* Commodity. */
 			Commodity_Create,               // Create new products.
 			Commodity_Update,               // Update products.
 			StockTake,                      // Update stock take information.
 			Asset_Create,                   // Create new assets.
 			Asset_Update,                   // Update assets.
-											// Transaction.
+			/* Transaction. */
 			Transaction_Create,             // Create new Transactions (quotes, orders etc).
 			Transaction_View,               // View Transactions.
 			Transaction_Update,             // Update Transactions.
@@ -693,7 +693,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 			Transaction_ByType,             // View Transactions by type.
 			Transaction_UpdateByTypeStatus, // Update Transactions by type and status.
 			InterfaceByCategory,            // Interface configuration
-										   // Financal.
+			/* Financal. */
 			Financial_Update,               // View/update financial information.
 			Financial_View,                 // View financial information.
 			Financial_ViewByType,           // View Financial information by type.

SaBusMgrStandardBase/Base/App/SbmAppConfig.cs

@@ -24,7 +24,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		public static bool IsViewApplicable(SbmInternals internals, Sbm.View view)
 		{
 			SbmSessionConsole sessionConsole = internals.SessionConsole;
-			ISbmSecurityProfile_Core securityProfile = sessionConsole.UserContext.SecurityProfile_Core;
+			ISbmSecurityProfile_Core securityProfile = sessionConsole.UserContext.SecurityProfile;
 			switch (view)
 			{
 				//-----------------------------------------------------------

SaBusMgrStandardBase/Base/App/SbmInternals.cs

@@ -49,7 +49,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 			public SysId UserAffiliateId => new SysId();
 			public override DbUpdateInfo DbUpdateInfo => new DbUpdateInfo(UserSecurityItemId, UserDisplayName, SacsSystem.ComputerName);
 			// User security.
-			public ISbmSecurityProfile_Core SecurityProfile_Core => throw new NotImplementedException();
+			public ISbmSecurityProfile_Core SecurityProfile => throw new NotImplementedException();
 			// Organisation.
 			public SysId OrganisationAffiliateId => new SysId();
 			public Sbm.AffiliateType OrganisationAffiliateType => Sbm.AffiliateType.Unknown;
@@ -153,7 +153,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		public bool ReadOnly { get; }
 		public ISbmUserOrganisationContext UserContext { get; }
 		public SbmSessionContext SessionContext { get { return UserContext.SessionContext; } }
-		public ISbmSecurityProfile_Core SecurityProfile { get { return UserContext.SecurityProfile_Core; } }
+		public ISbmSecurityProfile_Core SecurityProfile { get { return UserContext.SecurityProfile; } }
 		public SbmAccountsDfn AccountsDfn { get { if (accountsDfn == null) accountsDfn = new SbmAccountsDfn(UserContext); { return accountsDfn; } } }
 		// Database.
 		public ISacsDatabase BusMgrDatabase { get { return Application.GetBusMgrDatabase(SessionContext); } }

SaBusMgrStandardBase/Base/App/SbmSecurityProfile.cs

@@ -9,19 +9,24 @@ using Sarand.Net.Standard.Base.Security;
 using Sarand.Net.Standard.Base.Utils;
 using System;
 using System.Collections.Generic;
+using System.Linq;
+using static Sarand.BusinessMgr.Net.Standard.Base.App.Sbm;
 
 namespace Sarand.BusinessMgr.Net.Standard.Base.App
 {
 	//=======================================================================
-	public class SbmSecurityProfile : SaErrorStateItem, ISbmSecurityProfile_Core
+	/// <summary>
+	/// Security Profile associated with Core BusinessMgr Session.
+	/// <para>Once populated from database (Security tables etc) data needs to be self-sustaining via Serialisation.deserialistion
+	/// to ensure that no further database queries are required to reconsuct the data for each web request.</para>
+	/// <para>Hence the local data structures to store the defined Security Rights and User/Host profiles.</para>
+	/// </summary>
+	public class SbmSecurityProfile : ISbmSecurityProfile_Core
 	{
 		//-------------------------------------------------------------------
 		// Data members.
 		private static readonly String userNameUnknown = "Unknown";
 		private bool includeHostSecurityProfile = false;
-		private SaSecurityProfile userSecurityProfile;
-		private SaSecurityProfile hostSecurityProfile;
-		private readonly List<SaSecurityRight> securityRights = new List<SaSecurityRight>();
 
 		//-------------------------------------------------------------------
 		// Construction.
@@ -40,15 +45,18 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		//-------------------------------------------------------------------
 		// Properties.
 
+		// User.
+		public SysId UserId { get; protected set; } = new SysId();
+		public String UserDisplayName { get; private set; }
+		public String UserLocation { get; private set; }
+		public DateTime UserLastLogin { get; private set; }
+
 		//-------------------------------------------------------------------
 		// Refresh profile.
 		public void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityConsole securityConsole, SysId userId, List<SaSecurityRight> securityRights)
 		{
-			ClearErrorState();
-
 			// Make a note of the security right.
-			this.securityRights.Clear();
+			PopulateSecurityRights(securityRights);
-			this.securityRights.AddRange(securityRights);
 
 			SysId previousUserId = UserId;
 
@@ -58,19 +66,19 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 			// Load new profile.
 			if (securityConsole != null)
 			{
-				userSecurityProfile = securityConsole.GetUserSecurityProfile(UserId);
+				RefreshProfile(sessionConsole, securityConsole.GetUserSecurityProfile(UserId), includeHostSecurityProfile ? securityConsole.GetHostSecurityProfile() : null);
-				if (hostSecurityProfile == null && includeHostSecurityProfile)
-					hostSecurityProfile = securityConsole.GetHostSecurityProfile();
 			}
 			SaLogger.Debug($"{SysUtil.Fn} User: '{UserDisplayName}' [Id: {UserId}]" + (SysId.IsValid(previousUserId) ? ". Previous UserId: " + SysId.ToString(previousUserId) : ""));
 
-			RefreshProfileSettings(sessionConsole);
-
 		}
 		protected void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityProfile userSecurityProfile, SaSecurityProfile hostSecurityProfile)
 		{
-			this.userSecurityProfile = userSecurityProfile;
+			UserDisplayName = (userSecurityProfile?.Description ?? userNameUnknown);
-			this.hostSecurityProfile = hostSecurityProfile;
+			UserLocation = StringUtil.NullOnBlank(userSecurityProfile?.Location ?? "");
+			UserLastLogin = (userSecurityProfile?.LastLogin ?? DateTime.MinValue);
+			UserProfile.Populate(userSecurityProfile);
+			if (hostSecurityProfile != null)
+				HostProfile = new SecurityProfileData(hostSecurityProfile);
 			RefreshProfileSettings(sessionConsole);
 		}
 		private void RefreshProfileSettings(SbmSessionConsole sessionConsole)
@@ -94,30 +102,143 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		}
 
 		//-------------------------------------------------------------------
-		// User.
+		// Security Rights.
-		public SysId UserId { get; protected set; } = new SysId();
+		public class SecurityRightData
-		public String UserDisplayName { get { return (userSecurityProfile != null ? userSecurityProfile.Description : userNameUnknown); } }
+		{
-		public String UserLocation { get { return (userSecurityProfile != null ? userSecurityProfile.Location : ""); } }
+			public int Type { get; set; }
-		public DateTime UserLastLogin { get { return (userSecurityProfile != null ? userSecurityProfile.LastLogin : DateTime.MinValue); } }
+			public String Code { get; set; }
+		}
+		[JsonProperty("SecurityRights")]
+		public List<SecurityRightData> SecurityRights { get; private set; } = new List<SecurityRightData>();
+		private void PopulateSecurityRights(List<SaSecurityRight> rights)
+		{
+			SecurityRights = rights.Select(item => new SecurityRightData() { Type = item.Type, Code = item.Code }).ToList();
+		}
+
+		//-------------------------------------------------------------------
+		// Security Profiles.
+		// Profile properties are stored locally in such a way to allow serialisation/deserialisation
+		// and application of security rules without having to duplicate the complete Security Profile.
+
+		public class SecurityProfileData
+		{
+			public SecurityProfileData() { }
+			public SecurityProfileData(SaSecurityProfile securityProfile)
+			{
+				Populate(securityProfile);
+			}
+			// Security.
+			/// <summary>Is the Security Right code granted access for the Data item (if specified).</summary>
+			public bool IsSecurityRightGranted(String rightCode, SysId dataItemId = null)
+			{
+				if (SystemAdmin ?? false) return true;
+				return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightGranted(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightGranted(rightCode, dataItemId)));
+			}
+			/// <summary>Is the Security Right code denined access for the Data item (if specified).</summary>
+			public bool IsSecurityRightDenied(String rightCode, SysId dataItemId = null)
+			{
+				if (SystemAdmin ?? false) return false;
+				return ((Groups != null && Groups.Any(item => item.Rights.IsSecurityRightDenied(rightCode, dataItemId))) || (Rights != null && Rights.IsSecurityRightDenied(rightCode, dataItemId)));
+			}
+			// Population.
+			public void Populate(SaSecurityProfile securityProfile)
+			{
+				Clear();
+				if (securityProfile.SystemAdmin)
+					SystemAdmin = true;
+				foreach (var group in securityProfile.Groups)
+				{
+					GroupData groupData = new GroupData() { Code = group.Code };
+					groupData.Rights.Populate(group.Rights);
+					Groups.Add(groupData);
+				}
+				Rights.Populate(securityProfile.Rights);
+			}
+			public void Clear()
+			{
+				SystemAdmin = null;
+				Groups.Clear();
+				Rights.Clear();
+			}
+			// Properties.
+			public bool? SystemAdmin { get; private set; }
+			public class GroupData
+			{
+				public String Code { get; set; }
+				public RightsData Rights { get; set; } = new RightsData();
+			}
+			public List<GroupData> Groups { get; private set; } = new List<GroupData>();
+			public class RightData
+			{
+				public String Code { get; set; }
+				public SysId DataItemId { get; set; }
+			}
+			public class RightsData
+			{
+				// Construction.
+				public RightsData() { }
+				public RightsData(IEnumerable<SaSecurityProfile.RightData> rights)
+				{
+					Populate(rights);
+				}
+				// Security.
+				public bool IsSecurityRightGranted(String rightCode, SysId dataItemId)
+				{
+					return Granted != null && Granted.Any(item => item.Code.EqualsCI(rightCode) && SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId));
+				}
+				public bool IsSecurityRightDenied(String rightCode, SysId dataItemId)
+				{
+					return Denied != null && Denied.Any(item => item.Code.EqualsCI(rightCode) && SysId.ToInt(dataItemId) == SysId.ToInt(item.DataItemId));
+				}
+				// Population.
+				public void Populate(IEnumerable<SaSecurityProfile.RightData> rights)
+				{
+					Clear();
+					foreach (var right in rights)
+					{
+						RightData rightData = new RightData() { Code = right.Code, DataItemId = SysId.IsValid(right.DataItemId) ? right.DataItemId : null };
+						if (right.Granted)
+						{
+							if (Granted == null) Granted = new HashSet<RightData>();
+							Granted.Add(rightData);
+						}
+						else
+						{
+							if (Denied == null) Denied = new HashSet<RightData>();
+							Denied.Add(rightData);
+						}
+					}
+				}
+				public void Clear()
+				{
+					Granted = null;
+					Denied = null;
+				}
+				public HashSet<RightData> Granted { get; private set; }
+				public HashSet<RightData> Denied { get; private set; }
+			}
+			public RightsData Rights { get; private set; } = new RightsData();
+		}
+		// User and Host profiles.
+		public SecurityProfileData UserProfile { get; private set; } = new SecurityProfileData();
+		public SecurityProfileData HostProfile { get; private set; }
 
 		//-------------------------------------------------------------------
 		// Utilities.
-		public bool IsUserMemberOfSecurityGroup(SysId secGroupId)
+		public String GetSecurityRightCode(Sbm.SecurityRight securityRight)
 		{
-			if (userSecurityProfile != null)
+			return SecurityRights.FirstOrDefault(item => item.Type == (int)securityRight)?.Code ?? "";
-				return userSecurityProfile.IsMemberOfSecurityGroup(secGroupId);
-			return false;
 		}
 		public bool IsSecurityRightGranted(Sbm.SecurityRight securityRight, SysId id = null)
 		{
-			if (userSecurityProfile != null)
+			if (UserProfile != null)
-				return userSecurityProfile.IsSecurityRightGranted(securityRights.GetCodeForType(securityRight));
+				return UserProfile.IsSecurityRightGranted(GetSecurityRightCode(securityRight), id);
 			return false;
 		}
 		public bool IsSecurityRightDenied(Sbm.SecurityRight securityRight, SysId id = null)
 		{
-			if (userSecurityProfile != null)
+			if (UserProfile != null)
-				return userSecurityProfile.IsSecurityRightDenied(securityRights.GetCodeForType(securityRight), id);
+				return UserProfile.IsSecurityRightDenied(GetSecurityRightCode(securityRight), id);
 			return true;
 		}
 
@@ -126,59 +247,80 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		public class AdminProfile
 		{
 			internal AdminProfile() { }
-			public bool CanManageSecurity { get; internal set; } = false;
+			public bool? ManageSecurity { get; internal set; }
-			public bool CanManageDatabase { get; internal set; } = false;
+			public bool? ManageDatabase { get; internal set; }
-			public bool CanManageReferenceData { get; internal set; } = false;
+			public bool? ManageReferenceData { get; internal set; }
-			public bool CanManageInterfaces { get; internal set; } = false;
+			public bool? ManageInterfaces { get; internal set; }
 		}
 		public AdminProfile Admin { get; internal set; }
 		private void RefreshAdminProfile(SbmSessionConsole sessionConsole)
 		{
-			Admin.CanManageSecurity = UserHasSecurityRight(Sbm.SecurityRight.Security_Admin);
+			if (UserHasSecurityRight(Sbm.SecurityRight.Security_Admin))
-			Admin.CanManageDatabase = UserHasSecurityRight(Sbm.SecurityRight.Database_Admin);
+				Admin.ManageSecurity = true;
-			Admin.CanManageReferenceData = UserHasSecurityRight(Sbm.SecurityRight.ReferenceData_Admin);
+			if (UserHasSecurityRight(Sbm.SecurityRight.Database_Admin))
-			Admin.CanManageInterfaces = UserHasSecurityRight(Sbm.SecurityRight.InterfaceConfig);
+				Admin.ManageDatabase = true;
+			if (UserHasSecurityRight(Sbm.SecurityRight.ReferenceData_Admin))
+				Admin.ManageReferenceData = true;
+			if (UserHasSecurityRight(Sbm.SecurityRight.InterfaceConfig))
+				Admin.ManageInterfaces = true;
 		}
+		// Admin.
+		public bool UserCanManageSecurity() { return Admin.ManageSecurity ?? false; }
+		public bool UserCanManageDatabase() { return Admin.ManageDatabase ?? false; }
+		public bool UserCanManageReferenceData() { return Admin.ManageReferenceData ?? false; }
+		public bool UserCanManageInterfaces() { return Admin.ManageInterfaces ?? false; }
 
 		//-------------------------------------------------------------------
 		// Security rights - Manage.
 		public class ManageProfile
 		{
 			internal ManageProfile() { }
-			public bool CanManageTasks { get; internal set; } = false;
+			public bool? CanManageTasks { get; internal set; }
-			public bool CanManageTimesheets { get; internal set; } = false;
+			public bool? CanManageTimesheets { get; internal set; }
 		}
 		public ManageProfile Manage { get; internal set; }
 		private void RefreshManageProfile(SbmSessionConsole sessionConsole)
 		{
-			Manage.CanManageTasks = UserHasSecurityRight(Sbm.SecurityRight.TaskManager);
+			if (UserHasSecurityRight(Sbm.SecurityRight.TaskManager))
-			Manage.CanManageTimesheets = UserHasSecurityRight(Sbm.SecurityRight.TimesheetManager);
+				Manage.CanManageTasks = true;
+			if (UserHasSecurityRight(Sbm.SecurityRight.TimesheetManager))
+				Manage.CanManageTimesheets = true;
 		}
+		// Manage.
+		public bool UserCanManageTasks() { return Manage.CanManageTasks ?? false; }
+		public bool UserCanManageTimesheets() { return Manage.CanManageTimesheets ?? false; }
 
 		//-------------------------------------------------------------------
 		// Security rights - Financials.
 		public class FinancialProfile
 		{
 			internal FinancialProfile() { }
-			public bool ViewFinancials { get; internal set; }
+			public bool? ViewFinancials { get; internal set; }
-			public bool UpdateFinancials { get; internal set; }
+			public bool? UpdateFinancials { get; internal set; }
-			public bool ViewCommoditySupplyFinancials { get; internal set; }
+			public bool? ViewCommoditySupplyFinancials { get; internal set; }
-			public bool UpdateCommoditySupplyFinancials { get; internal set; }
+			public bool? UpdateCommoditySupplyFinancials { get; internal set; }
-			public bool ViewCommoditySalesFinancials { get; internal set; }
+			public bool? ViewCommoditySalesFinancials { get; internal set; }
-			public bool UpdateCommoditySalesFinancials { get; internal set; }
+			public bool? UpdateCommoditySalesFinancials { get; internal set; }
-			public bool FinancialsAccessControl { get; internal set; }
+			public bool? FinancialsAccessControl { get; internal set; }
 		}
 		public FinancialProfile Financial { get; internal set; }
 		private void RefreshFinancialProfile(SbmSessionConsole sessionConsole)
 		{
-			Financial.ViewFinancials = UserHasSecurityRight(Sbm.SecurityRight.Financial_View);
+			if (UserHasSecurityRight(Sbm.SecurityRight.Financial_View))
-			Financial.UpdateFinancials = UserHasSecurityRight(Sbm.SecurityRight.Financial_Update);
+				Financial.ViewFinancials = true;
-			Financial.ViewCommoditySupplyFinancials = UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySupply);
+			if (UserHasSecurityRight(Sbm.SecurityRight.Financial_Update))
-			Financial.UpdateCommoditySupplyFinancials = UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySupply);
+				Financial.UpdateFinancials = true;
-			Financial.ViewCommoditySalesFinancials = UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySales);
+			if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySupply))
-			Financial.UpdateCommoditySalesFinancials = UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySales);
+				Financial.ViewCommoditySupplyFinancials = true;
+			if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySupply))
+				Financial.UpdateCommoditySupplyFinancials = true;
+			if (UserCanAccessFinancialViewOfType(Sbm.FinancialType.CommoditySales))
+				Financial.ViewCommoditySalesFinancials = true;
+			if (UserCanAccessFinancialUpdateOfType(Sbm.FinancialType.CommoditySales))
+				Financial.UpdateCommoditySalesFinancials = true;
 			// Config options.
-			Financial.FinancialsAccessControl = (sessionConsole != null && !sessionConsole.AllowOption(Sbm.ConfigOption.FinancialsAccessControl));
+			if ((sessionConsole != null && !sessionConsole.AllowOption(Sbm.ConfigOption.FinancialsAccessControl)))
+				Financial.FinancialsAccessControl = true;
 		}
 
 		private bool UserCanAccessFinancialViewOfType(Sbm.FinancialType financialType)
@@ -202,14 +344,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		/// <summary>Does the user have sufficient rights to view the specified financials.</summary>
 		public bool UserCanViewFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
 		{
-			if (!Financial.FinancialsAccessControl) return true;
+			if (!Financial.FinancialsAccessControl ?? false) return true;
-			if (Financial.UpdateFinancials || Financial.ViewFinancials)
+			if ((Financial.UpdateFinancials ?? false) || (Financial.ViewFinancials ?? false))
 			{
 				// If specific type of financial is requested, check that view access is not denied.
 				if (financialType == Sbm.FinancialType.CommoditySupply)
-					return Financial.ViewCommoditySupplyFinancials;
+					return Financial.ViewCommoditySupplyFinancials ?? false;
 				else if (financialType == Sbm.FinancialType.CommoditySales)
-					return Financial.ViewCommoditySalesFinancials;
+					return Financial.ViewCommoditySalesFinancials ?? false;
 				else return true;
 			}
 			return false;
@@ -218,14 +360,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		/// <summary>Does the user have sufficient rights to update the specified financials.</summary>
 		public bool UserCanUpdateFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any)
 		{
-			if (!Financial.FinancialsAccessControl) return true;
+			if (!Financial.FinancialsAccessControl ?? false) return true;
-			if (Financial.UpdateFinancials)
+			if (Financial.UpdateFinancials ?? false)
 			{
 				// If specific type of financial is requested, check that update access is not denied.
 				if (financialType == Sbm.FinancialType.CommoditySupply)
-					return Financial.UpdateCommoditySupplyFinancials;
+					return Financial.UpdateCommoditySupplyFinancials ?? false;
 				else if (financialType == Sbm.FinancialType.CommoditySales)
-					return Financial.UpdateCommoditySalesFinancials;
+					return Financial.UpdateCommoditySalesFinancials ?? false;
 				else return true;
 			}
 			return false;
@@ -236,58 +378,38 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		public class ContactsProfile
 		{
 			internal ContactsProfile() { }
-			public bool Create { get; internal set; } = false;
+			public bool? Create { get; internal set; }
-			public bool Update { get; internal set; } = false;
+			public bool? Update { get; internal set; }
 		}
 		public ContactsProfile Contacts { get; internal set; }
-		public bool UserCanCreateContacts() { return Contacts.Create; }
-		public bool UserCanUpdateContacts() { return Contacts.Update; }
 		private void RefreshContactsProfile(SbmSessionConsole sessionConsole)
 		{
-			Contacts.Update = (UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Update));
+			if (UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Update))
-			Contacts.Create = (Contacts.Update || UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Create));
+				Contacts.Update = true;
+			if (Contacts.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Affiliate_Create))
+				Contacts.Create = true;
 		}
+		// Contacts.
+		public bool UserCanCreateContacts() { return Contacts.Create ?? false; }
+		public bool UserCanUpdateContacts() { return Contacts.Update ?? false; }
 
 		//-------------------------------------------------------------------
 		// Security rights - Transactions.
 		public class TransactionsProfile
 		{
 			internal TransactionsProfile() { }
-			public bool Create { get; internal set; } = false;
+			public bool? Create { get; internal set; }
-			public bool Update { get; internal set; } = false;
+			public bool? Update { get; internal set; }
-			public bool CanUpdateTransactionTypeStatusCat(SbmSecurityProfile securityProfile, Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat)
-			{
-				SysId transactionTypeStatusCatId = SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCat);
-
-				// Check if update of this transaction type and status is denied:
-				if (securityProfile.IsSecurityRightDenied(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
-					return false;
-
-				// Check if update of this transaction type and status is explicitly allowed:
-				if (securityProfile.IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
-					return true;
-
-				// Check if any other statuses for this type of transaction are allowed.
-				foreach (TypeCodeDesc statusCat in SbmTransaction.GetTransactionStatusCats(transactionType))
-				{
-					SbmTransaction.StatusCat transactionStatusCatOther = (SbmTransaction.StatusCat)statusCat.Type;
-					// Ignore the transaction status category.
-					if (transactionStatusCatOther == transactionStatusCat) continue;
-					if (securityProfile.IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCatOther)))
-						// Explicit granting of right to another status for this transaction right
-						// implies that other statuses are implicitly denied.
-						return false;
-				}
-				return true;
-			}
 		}
 		public TransactionsProfile Transaction { get; internal set; }
 		private void RefreshTransactionProfile(SbmSessionConsole sessionConsole)
 		{
-			Transaction.Update = (UserHasSecurityRight(Sbm.SecurityRight.Transaction_Update));
+			if ((UserHasSecurityRight(Sbm.SecurityRight.Transaction_Update)))
-			Transaction.Create = (Transaction.Update || UserHasSecurityRight(Sbm.SecurityRight.Transaction_View));
+				Transaction.Update = true;
+			if ((Transaction.Update ?? false || UserHasSecurityRight(Sbm.SecurityRight.Transaction_View)))
+				Transaction.Create = true;
 		}
-
+		// Transactions.
 		public bool UserCanAccessTransactionsOfType(Sbm.TransactionType transactionType)
 		{
 			if ((int)transactionType < 1) return false;
@@ -296,29 +418,54 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 				return false;
 			return true;
 		}
+		public bool CanUpdateTransactionTypeStatusCat(Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat)
+		{
+			SysId transactionTypeStatusCatId = SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCat);
+
+			// Check if update of this transaction type and status is denied:
+			if (IsSecurityRightDenied(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
+				return false;
+
+			// Check if update of this transaction type and status is explicitly allowed:
+			if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, transactionTypeStatusCatId))
+				return true;
+
+			// Check if any other statuses for this type of transaction are allowed.
+			foreach (TypeCodeDesc statusCat in SbmTransaction.GetTransactionStatusCats(transactionType))
+			{
+				SbmTransaction.StatusCat transactionStatusCatOther = (SbmTransaction.StatusCat)statusCat.Type;
+				// Ignore the transaction status category.
+				if (transactionStatusCatOther == transactionStatusCat) continue;
+				if (IsSecurityRightGranted(Sbm.SecurityRight.Transaction_UpdateByTypeStatus, SbmTransaction.GetTransactionTypeStatusId(transactionType, transactionStatusCatOther)))
+					// Explicit granting of right to another status for this transaction right
+					// implies that other statuses are implicitly denied.
+					return false;
+			}
+			return true;
+		}
 
 		//-------------------------------------------------------------------
 		// Security rights - ItemType.
 		public class ItemTypesProfile
 		{
 			internal ItemTypesProfile() { }
-			public bool Create { get; internal set; }
+			public bool? Create { get; internal set; }
-			public bool Update { get; internal set; }
+			public bool? Update { get; internal set; }
-			public bool Remove { get; internal set; }
+			public bool? Remove { get; internal set; }
 			// Config options.
-			public bool Processes { get; internal set; }
+			public bool? Processes { get; internal set; }
-			public bool Contacts { get; internal set; }
+			public bool? Contacts { get; internal set; }
-			public bool Commodities { get; internal set; }
+			public bool? Commodities { get; internal set; }
-			public bool Portfolios { get; internal set; }
+			public bool? Portfolios { get; internal set; }
-			public bool PriceSets { get; internal set; }
+			public bool? PriceSets { get; internal set; }
-			public bool CommodityCustomers { get; internal set; }
+			public bool? CommodityCustomers { get; internal set; }
-			public bool CommoditySuppliers { get; internal set; }
+			public bool? CommoditySuppliers { get; internal set; }
-			public bool Transactions { get; internal set; }
+			public bool? Transactions { get; internal set; }
-			public bool Assets { get; internal set; }
+			public bool? Assets { get; internal set; }
-			public bool Vehicles { get; internal set; }
+			public bool? Vehicles { get; internal set; }
-			public bool StockLocations { get; internal set; }
+			public bool? StockLocations { get; internal set; }
-			public bool StockContainers { get; internal set; }
+			public bool? StockContainers { get; internal set; }
-			public bool StockControl { get; internal set; }
+			public bool? StockControl { get; internal set; }
 		}
 		public ItemTypesProfile ItemType { get; } = new ItemTypesProfile();
 		private void RefreshItemTypeProfile(SbmSessionConsole sessionConsole)
@@ -337,56 +484,14 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 			ItemType.StockContainers = sessionConsole.GetStockControlConfig().AllowStockContainers();
 			ItemType.StockControl = sessionConsole.GetStockControlConfig().AllowStockControl();
 		}
-
+		// Item types.
-		public bool ItemTypeIsAllowed(Sbm.ItemType itemType)
+		public bool UserCanViewItemType(Sbm.ItemType itemType)
 		{
-			switch (itemType)
-			{
-				//case Sbm.ItemType.SecItem:
-				//case Sbm.ItemType.Currency:
-				//case Sbm.ItemType.Region:
-				//case Sbm.ItemType.Language:
-				//case Sbm.ItemType.TaxCode:
-				//case Sbm.ItemType.UnitMeasure:
-				case Sbm.ItemType.Process: return ItemType.Processes;
-				case Sbm.ItemType.Affiliate:
-				case Sbm.ItemType.Address: return ItemType.Contacts;
-				case Sbm.ItemType.Commodity: return ItemType.Commodities;
-				case Sbm.ItemType.PortfolioItem: return ItemType.Portfolios;
-				case Sbm.ItemType.Location: return ItemType.StockLocations;
-				case Sbm.ItemType.Container:
-				case Sbm.ItemType.ContainerItem: return ItemType.StockContainers;
-				case Sbm.ItemType.Movement:
-				case Sbm.ItemType.StockLevel: return ItemType.StockControl;
-				case Sbm.ItemType.PriceSet:
-				case Sbm.ItemType.Price: return ItemType.PriceSets;
-				case Sbm.ItemType.CommodityCustomer: return ItemType.CommodityCustomers;
-				case Sbm.ItemType.CommoditySupplier: return ItemType.CommoditySuppliers;
-				//case Sbm.ItemType.Association:
-				case Sbm.ItemType.Transaction:
-				case Sbm.ItemType.Requirement:
-				case Sbm.ItemType.Constituent: return ItemType.Transactions;
-				//case Sbm.ItemType.SystemAccount:
-				//case Sbm.ItemType.SystemUser:
-				//case Sbm.ItemType.SystemAccountUser:
-				case Sbm.ItemType.AssetCategory:
-				case Sbm.ItemType.AssetCategoryProcess:
-				case Sbm.ItemType.Asset:
-				case Sbm.ItemType.AssetProcess: return ItemType.Assets;
-				case Sbm.ItemType.VehicleClass:
-				case Sbm.ItemType.Vehicle:
-				case Sbm.ItemType.VehicleEvent:
-				case Sbm.ItemType.VehicleFeature: return ItemType.Vehicles;
-				case Sbm.ItemType.CommodityProcess: return ItemType.Processes;
-				case Sbm.ItemType.RequirementProcess: return ItemType.Processes;
-					//case Sbm.ItemType.Interface:
-			}
 			return true;
 		}
 		public bool UserCanCreateItemType(Sbm.ItemType itemType)
 		{
-			if (userSecurityProfile?.SystemAdmin ?? false) return true;
+			if (UserProfile?.SystemAdmin ?? false) return true;
-			if (!ItemTypeIsAllowed(itemType)) return false;
 			switch (itemType)
 			{
 				case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
@@ -432,7 +537,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		}
 		public bool UserCanUpdateItemType(Sbm.ItemType itemType)
 		{
-			if (userSecurityProfile?.SystemAdmin ?? false) return true;
+			if (UserProfile?.SystemAdmin ?? false) return true;
 			switch (itemType)
 			{
 				case Sbm.ItemType.SecItem: return IsSecurityRightGranted(Sbm.SecurityRight.Security_Admin);
@@ -493,17 +598,75 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.App
 		// Security rights.
 		public bool UserHasSecurityRight(Sbm.SecurityRight securityRight, SysId dataItemId = null)
 		{
-			String rightCode = securityRights.GetCodeForType(securityRight);
+			String rightCode = GetSecurityRightCode(securityRight);
 			if (StringUtil.IsEmpty(rightCode)) return false;
 			// Check if right is denied by either user or host profiles.
-			if (userSecurityProfile != null && userSecurityProfile.IsSecurityRightDenied(rightCode)) return false;
+			if (UserProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
-			if (hostSecurityProfile != null && hostSecurityProfile.IsSecurityRightDenied(rightCode)) return false;
+			if (HostProfile?.IsSecurityRightDenied(rightCode) ?? false) return false;
 			// Check if right is granted by either user or host profiles.
-			if (userSecurityProfile != null && userSecurityProfile.IsSecurityRightGranted(rightCode)) return true;
+			if (UserProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
-			if (hostSecurityProfile != null && hostSecurityProfile.IsSecurityRightGranted(rightCode)) return true;
+			if (HostProfile?.IsSecurityRightGranted(rightCode) ?? false) return true;
 			return false;
 		}
 
+		//-------------------------------------------------------------------
+		public class SecurityProfileException : Exception
+		{
+			public SecurityProfileException(string message) : base(message) { }
+		}
+		/// <summary>Verify that the specified profiles matches this one, eg. after deserialisation.</summary>
+		public bool CompareProfiles(ISbmSecurityProfile_Core securityProfile_Core)
+		{
+			// Profile.
+			if (securityProfile_Core == null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is null.");
+			SbmSecurityProfile securityProfile = securityProfile_Core as SbmSecurityProfile;
+			if (securityProfile == null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile does not match type.");
+
+			// Security rights.
+			if (SecurityRights.Count != securityProfile.SecurityRights.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Security Rights. Expected: {SecurityRights.Count}. Found: {securityProfile.SecurityRights}.");
+
+			// User profile.
+			if (UserProfile != null && securityProfile.UserProfile == null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a User Profile.");
+			if (UserProfile == null && securityProfile.UserProfile != null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a User Profile.");
+
+			// User profile - Groups.
+			if (UserProfile.Groups?.Count != securityProfile.UserProfile.Groups?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of User Groups. Expected: {UserProfile.Groups?.Count}. Found: {securityProfile.UserProfile.Groups?.Count}.");
+
+			// User profile - Granted Rights.
+			if (UserProfile.Rights?.Granted?.Count != securityProfile.UserProfile.Rights?.Granted?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted User Rights. Expected: {UserProfile.Rights?.Granted?.Count}. Found: {securityProfile.UserProfile.Rights?.Granted?.Count}.");
+
+			// User profile - Denied Rights.
+			if (UserProfile.Rights?.Denied?.Count != securityProfile.UserProfile.Rights?.Denied?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied User Rights. Expected: {UserProfile.Rights?.Denied?.Count}. Found: {securityProfile.UserProfile.Rights?.Denied?.Count}.");
+
+			// Host profile.
+			if (HostProfile != null && securityProfile.HostProfile == null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile is missing a Host Profile.");
+			if (HostProfile == null && securityProfile.HostProfile != null)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile includes a Host Profile.");
+
+			// Host profile - Groups.
+			if (HostProfile?.Groups?.Count != securityProfile.HostProfile?.Groups?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Host Groups. Expected: {HostProfile?.Groups?.Count}. Found: {securityProfile.HostProfile?.Groups?.Count}.");
+
+			// Host profile - Granted Rights.
+			if (HostProfile?.Rights?.Granted?.Count != securityProfile.HostProfile?.Rights?.Granted?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Granted Host Rights. Expected: {HostProfile?.Rights?.Granted?.Count}. Found: {securityProfile.HostProfile?.Rights?.Granted?.Count}.");
+
+			// Host profile - Denied Rights.
+			if (HostProfile?.Rights?.Denied?.Count != securityProfile.HostProfile?.Rights?.Denied?.Count)
+				throw new SecurityProfileException($"{SysUtil.Fn} Supplied profile has different number of Denied Host Rights. Expected: {HostProfile?.Rights?.Denied?.Count}. Found: {securityProfile.HostProfile?.Rights?.Denied?.Count}.");
+
+			return true;
+		}
+
 		//-------------------------------------------------------------------
 	}
 	//=======================================================================

SaBusMgrStandardBase/Base/Core/ISbmSecurityProfile_Core.cs

@@ -1,4 +1,5 @@
 using Sarand.BusinessMgr.Net.Standard.Base.App;
+using Sarand.BusinessMgr.Net.Standard.Base.Bus;
 using Sarand.BusinessMgr.Net.Standard.Base.Consoles;
 using Sarand.Net.Standard.Base.Bus;
 using Sarand.Net.Standard.Base.Core;
@@ -20,19 +21,30 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.Core
 		DateTime UserLastLogin { get; }
 
 		//-------------------------------------------------------------------
-		// Security - Contacts.
+		// Admin.
-		bool UserCanCreateContacts();
+		bool UserCanManageSecurity();
-		bool UserCanUpdateContacts();
+		bool UserCanManageDatabase();
+		bool UserCanManageReferenceData();
+		bool UserCanManageInterfaces();
 
-		// Security - Financials.
+		// Manage.
+		bool UserCanManageTasks();
+		bool UserCanManageTimesheets();
+
+		// Financials.
 		bool UserCanViewFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any);
 		bool UserCanUpdateFinancials(Sbm.FinancialType financialType = Sbm.FinancialType.Any);
 
-		// Security - Transactions.
+		// Contacts.
-		bool UserCanAccessTransactionsOfType(Sbm.TransactionType transactionType);
+		bool UserCanCreateContacts();
+		bool UserCanUpdateContacts();
 
-		// Security Item types.
+		// Transactions.
-		bool ItemTypeIsAllowed(Sbm.ItemType itemType);
+		bool UserCanAccessTransactionsOfType(Sbm.TransactionType transactionType);
+		bool CanUpdateTransactionTypeStatusCat(Sbm.TransactionType transactionType, SbmTransaction.StatusCat transactionStatusCat);
+
+		// Item types.
+		bool UserCanViewItemType(Sbm.ItemType itemType);
 		bool UserCanCreateItemType(Sbm.ItemType itemType);
 		bool UserCanUpdateItemType(Sbm.ItemType itemType);
 		bool UserCanRemoveItemType(Sbm.ItemType itemType);
@@ -44,6 +56,13 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.Core
 		/// <summary>Refresh profile.</summary>
 		void RefreshProfile(SbmSessionConsole sessionConsole, SaSecurityConsole securityConsole, SysId userId, List<SaSecurityRight> securityRights);
 
+		/// <summary>
+		/// Verify that the specified profiles matches this one, eg. after deserialisation.
+		/// <para>- Only to be used for unit tests etc.</para>
+		/// <para>- Expected to throw Exception for any discrepancies found.</para>
+		/// </summary>
+		bool CompareProfiles(ISbmSecurityProfile_Core securityProfile);
+
 		//-------------------------------------------------------------------
 	}
 	//=======================================================================

SaBusMgrStandardBase/Base/Core/ISbmUserOrganisationContext.cs

@@ -26,7 +26,7 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.Core
 
 		//-------------------------------------------------------------------
 		/// <summary>Security profile - what the user is allowed to do based on security roles and groups.</summary>
-		ISbmSecurityProfile_Core SecurityProfile_Core { get; }
+		ISbmSecurityProfile_Core SecurityProfile { get; }
 
 		//-------------------------------------------------------------------
 	}

SaBusMgrStandardBase/Base/Mgr/SbmCoreMgr.cs

@@ -190,8 +190,8 @@ namespace Sarand.BusinessMgr.Net.Standard.Base.Mgr
 		protected SbmAccountsDfn AccountsDfn { get { return Internals.AccountsDfn; } }
 		protected DbUpdateInfo DbUpdateInfo { get { return Internals.DbUpdateInfo; } }
 		// User security profile.
-		public bool UserCanViewCommoditySalesFinancials() { return UserContext.SecurityProfile_Core.UserCanViewFinancials(Sbm.FinancialType.CommoditySales); }
+		public bool UserCanViewCommoditySalesFinancials() { return UserContext.SecurityProfile.UserCanViewFinancials(Sbm.FinancialType.CommoditySales); }
-		public bool UserCanViewCommoditySupplyFinancials() { return UserContext.SecurityProfile_Core.UserCanViewFinancials(Sbm.FinancialType.CommoditySupply); }
+		public bool UserCanViewCommoditySupplyFinancials() { return UserContext.SecurityProfile.UserCanViewFinancials(Sbm.FinancialType.CommoditySupply); }
 		// Managers.
 		protected SbmAccountMgr AccountMgr { get { return Internals.AccountMgr; } }
 		protected SbmCommodityMgr CommodityMgr { get { return Internals.CommodityMgr; } }

SaBusMgrTest_Control/Web/Control/App/SbmApplication_SessionData_Tester.cs

@@ -67,11 +67,11 @@ namespace Sarand.BusinessMgr.Test.Web.Control.App
 
 
 				// Serialise data.
-				string sessionDataJson = JsonConvert.SerializeObject(sessionData);
+				string sessionDataJson = JsonConvert.SerializeObject(sessionData, SbmController_Web.SessionDataJsonSerializerSettings);
 				Assert.IsNotNull(sessionDataJson);
 
 				// Deserialise data.
-				SbmSessionData_Control? sessionDataDeserialized = JsonConvert.DeserializeObject<SbmSessionData_Control>(sessionDataJson, SbmController_Web.SbmSessionDataJsonSerializerSettings);
+				SbmSessionData_Control? sessionDataDeserialized = JsonConvert.DeserializeObject<SbmSessionData_Control>(sessionDataJson, SbmController_Web.SessionDataJsonDeserializerSettings);
 				Assert.IsNotNull(sessionDataDeserialized);
 
 				// Validate deserialised data.

SaBusMgrTest_Portal/Web/Portal/App/SbmApplication_SessionData_Tester.cs

@@ -41,11 +41,11 @@ namespace Sarand.BusinessMgr.Test.Web.Portal.App
 				string repositoryContext = "Mimo";
 				SbmSessionContext sessionContext = CreateCoreInstanceConsole(repositoryContext);
 				Assert.IsNotNull(sessionContext);
-				SbmInternals internals = new SbmInternals(GetSessionData(sessionContext, repositoryContext));
-				disposables.Add(internals);
 				ISacsDatabase busMgrDatabase = AppPortal.GetBusMgrDatabase(sessionContext);
 
 				// Internals.
+				SbmInternals internals = new SbmInternals(GetSessionData(sessionContext, repositoryContext));
+				disposables.Add(internals);
 				SaSecurityConsole securityConsole = internals.SecurityConsole;
 				Assert.IsNotNull(securityConsole);
 				securityConsole.RegisterSecurityRights();
@@ -88,9 +88,9 @@ namespace Sarand.BusinessMgr.Test.Web.Portal.App
 				Assert.AreEqual(securityItemUser.EmailAddress, sessionData.User.EmailAddress);
 
 				// Security profile.
-				sessionData.SecurityProfile_Core.RefreshProfile(sessionConsole, securityConsole, securityItemUser.Id, securityConsole.GetRegisteredRights());
+				sessionData.SecurityProfile.RefreshProfile(sessionConsole, securityConsole, securityItemUser.Id, securityConsole.GetRegisteredRights());
-				Assert.IsTrue(sessionData.SecurityProfile_Core.UserCanCreateContacts());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanCreateContacts());
-				Assert.IsTrue(sessionData.SecurityProfile_Core.UserCanViewFinancials());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanViewFinancials());
 
 				// User details.
 				Assert.AreEqual(affiliateUser.Id, sessionData.User.AffiliateId);
@@ -107,11 +107,11 @@ namespace Sarand.BusinessMgr.Test.Web.Portal.App
 
 
 				// Serialise data.
-				string sessionDataJson = JsonConvert.SerializeObject(sessionData);
+				string sessionDataJson = JsonConvert.SerializeObject(sessionData, SbmController_Web.SessionDataJsonSerializerSettings);
 				Assert.IsNotNull(sessionDataJson);
 
 				// Deserialise data.
-				SbmSessionData_Portal sessionDataDeserialized = JsonConvert.DeserializeObject<SbmSessionData_Portal>(sessionDataJson, SbmController_Web.SbmSessionDataJsonSerializerSettings);
+				SbmSessionData_Portal sessionDataDeserialized = JsonConvert.DeserializeObject<SbmSessionData_Portal>(sessionDataJson, SbmController_Web.SessionDataJsonDeserializerSettings);
 				Assert.IsNotNull(sessionDataDeserialized);
 				string sessionDataJsonDeserialized = JsonConvert.SerializeObject(sessionDataDeserialized);
 
@@ -131,12 +131,11 @@ namespace Sarand.BusinessMgr.Test.Web.Portal.App
 				Assert.AreEqual(securityItemUser.EmailAddress, sessionDataDeserialized.User.EmailAddress);
 
 				// Security profile.
-				sessionData.SecurityProfile_Core.RefreshProfile(sessionConsole, securityConsole, securityItemUser.Id, securityConsole.GetRegisteredRights());
+				Assert.IsNotNull(sessionDataDeserialized.SecurityProfile);
-				Assert.IsNotNull(sessionDataDeserialized.SecurityProfile_Core);
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanCreateContacts(), sessionDataDeserialized.SecurityProfile.UserCanCreateContacts());
-				Assert.AreEqual(sessionData.SecurityProfile_Core.UserCanCreateContacts(), sessionDataDeserialized.SecurityProfile_Core.UserCanCreateContacts());
+				Assert.IsTrue(sessionDataDeserialized.SecurityProfile.UserCanCreateContacts());
-				Assert.IsTrue(sessionDataDeserialized.SecurityProfile_Core.UserCanCreateContacts());
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanViewFinancials(), sessionDataDeserialized.SecurityProfile.UserCanViewFinancials());
-				Assert.AreEqual(sessionData.SecurityProfile_Core.UserCanViewFinancials(), sessionDataDeserialized.SecurityProfile_Core.UserCanViewFinancials());
+				Assert.IsTrue(sessionDataDeserialized.SecurityProfile.UserCanViewFinancials());
-				Assert.IsTrue(sessionDataDeserialized.SecurityProfile_Core.UserCanViewFinancials());
 
 				// User details.
 				Assert.AreEqual(affiliateUser.Id, sessionDataDeserialized.User.AffiliateId);
@@ -155,6 +154,141 @@ namespace Sarand.BusinessMgr.Test.Web.Portal.App
 
 			}
 		}
+
+		//-------------------------------------------------------------------
+		[TestMethod]
+		public void Test_Application_SessionData_SecurityProfile()
+		{
+			// Record disposable items as they are created so all can be disposed when needed.
+			using (DisposableCollection<SacsDisposable> disposables = new DisposableCollection<SacsDisposable>())
+			{
+				//-----------------------------------------------------------
+				// Initialisation.
+
+				// Session configuration.
+				string repositoryContext = "Mimo";
+				SbmSessionContext sessionContext = CreateCoreInstanceConsole(repositoryContext);
+				Assert.IsNotNull(sessionContext);
+				ISacsDatabase busMgrDatabase = AppPortal.GetBusMgrDatabase(sessionContext);
+
+				// User Session.
+				SbmSessionData_Portal sessionData = new SbmSessionData_Portal(sessionContext, repositoryContext, null, null, null, null);
+				Assert.IsNotNull(sessionData);
+
+				// Internals.
+				SbmInternals internals = new SbmInternals(GetSessionData(sessionContext, repositoryContext));
+				disposables.Add(internals);
+				SaSecurityConsole securityConsole = internals.SecurityConsole;
+				Assert.IsNotNull(securityConsole);
+				securityConsole.RegisterSecurityRights();
+				SbmAccountMgr accountMgr = internals.AccountMgr;
+				Assert.IsNotNull(accountMgr);
+
+				// Session Console.
+				SbmSessionConsole sessionConsole = SbmSessionConsole.CreateConsole(internals.UserContext);
+
+				//-----------------------------------------------------------
+				// Quering.
+
+				// Security item.
+				SaSecurityItem securityItemUser = securityConsole.GetUserByEmail("andy@sarand.com");
+				Assert.IsNotNull(securityItemUser);
+
+				// User account.
+				SbmAffiliate affiliateUser = accountMgr.GetAffiliateByUserId(securityItemUser.Id);
+				Assert.IsNotNull(affiliateUser);
+
+				// Organisations.
+				List<SysIdString> supervisedOrganisations = accountMgr.GetAffiliatesSupervisedBy(affiliateUser.Id);
+				Assert.IsNotNull(supervisedOrganisations);
+				Assert.IsTrue(supervisedOrganisations.Count > 0);
+				SysId affiliateIdOrganisation = supervisedOrganisations[0].Id;
+				SbmAssociation associationOrganisation = accountMgr.GetAssociationByOwnerTypeTarget(affiliateIdOrganisation, Sbm.AssociationType.Internal, affiliateIdOrganisation);
+				Assert.IsNotNull(associationOrganisation);
+				SbmAffiliate affiliateOrganisation = accountMgr.GetAffiliateById(affiliateIdOrganisation);
+				Assert.IsNotNull(affiliateOrganisation);
+
+				//-----------------------------------------------------------
+				// Population.
+
+				// Populate User Session.
+				sessionData.Refresh(securityItemUser, affiliateUser, associationOrganisation, affiliateOrganisation);
+				Assert.AreEqual(securityItemUser.Id, sessionData.UserSecurityItemId);
+				Assert.AreEqual(affiliateUser.Id, sessionData.UserAffiliateId);
+
+				// Validate user session.
+				Assert.IsNotNull(sessionData.User);
+
+				// Security item.
+				Assert.AreEqual(securityItemUser.Id, sessionData.User.SecurityItemId);
+				Assert.AreEqual(securityItemUser.EmailAddress, sessionData.User.EmailAddress);
+
+				// Security profile.
+				sessionData.SecurityProfile.RefreshProfile(sessionConsole, securityConsole, securityItemUser.Id, securityConsole.GetRegisteredRights());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanManageDatabase());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanManageInterfaces());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanCreateContacts());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanViewFinancials());
+				Assert.IsTrue(sessionData.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.Asset));
+
+				//-----------------------------------------------------------
+				// Storing and Retrieving.
+
+				// Serialise data.
+				string sessionDataJson = JsonConvert.SerializeObject(sessionData, SbmController_Web.SessionDataJsonSerializerSettings);
+				Assert.IsNotNull(sessionDataJson);
+
+				// Deserialise data.
+				SbmSessionData_Portal sessionDataDeserialized = JsonConvert.DeserializeObject<SbmSessionData_Portal>(sessionDataJson, SbmController_Web.SessionDataJsonDeserializerSettings);
+				Assert.IsNotNull(sessionDataDeserialized);
+				string sessionDataJsonDeserialized = JsonConvert.SerializeObject(sessionDataDeserialized);
+
+				//-----------------------------------------------------------
+				// Verifing.
+
+				// User.
+				Assert.AreEqual(securityItemUser.Id, sessionDataDeserialized.UserSecurityItemId);
+				Assert.AreEqual(affiliateUser.Id, sessionDataDeserialized.UserAffiliateId);
+
+				// Security profile.
+				Assert.IsNotNull(sessionDataDeserialized.SecurityProfile);
+				Assert.IsTrue(sessionData.SecurityProfile.CompareProfiles(sessionDataDeserialized.SecurityProfile));
+
+				// User.
+				Assert.AreEqual(sessionData.SecurityProfile.UserId, sessionDataDeserialized.SecurityProfile.UserId);
+				Assert.AreEqual(sessionData.SecurityProfile.UserDisplayName, sessionDataDeserialized.SecurityProfile.UserDisplayName);
+				Assert.AreEqual(sessionData.SecurityProfile.UserLocation, sessionDataDeserialized.SecurityProfile.UserLocation);
+				Assert.AreEqual(sessionData.SecurityProfile.UserLastLogin, sessionDataDeserialized.SecurityProfile.UserLastLogin);
+
+				// Security groups.
+
+				// Admin.
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageSecurity(), sessionDataDeserialized.SecurityProfile.UserCanManageSecurity());
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageDatabase(), sessionDataDeserialized.SecurityProfile.UserCanManageDatabase());
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageReferenceData(), sessionDataDeserialized.SecurityProfile.UserCanManageReferenceData());
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageInterfaces(), sessionDataDeserialized.SecurityProfile.UserCanManageInterfaces());
+
+				// Manage.
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageTasks(), sessionDataDeserialized.SecurityProfile.UserCanManageTasks());
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanManageTimesheets(), sessionDataDeserialized.SecurityProfile.UserCanManageTimesheets());
+
+				// Hard-coded rules.
+
+				// Create Contacts.
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanCreateContacts(), sessionDataDeserialized.SecurityProfile.UserCanCreateContacts());
+
+				// View Financials.
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanViewFinancials(), sessionDataDeserialized.SecurityProfile.UserCanViewFinancials());
+
+				// Rules determined by security groups and rights.
+
+				// Item types.
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.Asset), sessionDataDeserialized.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.Asset));
+				Assert.AreEqual(sessionData.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.Asset), sessionDataDeserialized.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.Asset));
+
+				//-----------------------------------------------------------
+			}
+		}
 	}
 	//=======================================================================
 }

SaBusinessMgrCoreWebControl/Control/Controllers/SbmController_Control.cs

@@ -59,7 +59,7 @@ namespace Sarand.BusinessMgr.Web.Control.Controllers
 		public override ISbmUserOrganisationContext UserContext_Core => throw new NotImplementedException();
 		protected override SbmSessionData_Web DeserializeSessionData(String sessionDataJson)
 		{
-			return JsonConvert.DeserializeObject<SbmSessionData_Control>(sessionDataJson, SbmSessionDataJsonSerializerSettings);
+			return JsonConvert.DeserializeObject<SbmSessionData_Control>(sessionDataJson, SessionDataJsonDeserializerSettings);
 		}
 
 		//-------------------------------------------------------------------

SaBusinessMgrCoreWebPortal/Portal/App/SbmSessionData_Portal.cs

@@ -31,7 +31,7 @@ namespace Sarand.BusinessMgr.Web.Portal.App
 		private SbmSessionData_Portal(long sessionIdx, SbmSessionContext sessionContext) :
 			base(sessionIdx, sessionContext)
 		{
-			securityProfile = new SbmSecurityProfile(false);
+			securityProfile_Internal = new SbmSecurityProfile(false);
 			Organisation = new OrganisationData_Portal(null, null);
 			User = new UserData_Portal(sessionContext, null, null);
 		}
@@ -42,7 +42,7 @@ namespace Sarand.BusinessMgr.Web.Portal.App
 		public SbmSessionData_Portal(SbmSessionContext sessionContext) :
 			base(0, sessionContext)
 		{
-			securityProfile = new SbmSecurityProfile(false);
+			securityProfile_Internal = new SbmSecurityProfile(false);
 			Organisation = new OrganisationData_Portal(null, null);
 			User = new UserData_Portal(sessionContext, null, null);
 		}
@@ -55,7 +55,7 @@ namespace Sarand.BusinessMgr.Web.Portal.App
 			base(sessionContext)
 		{
 			RepositoryContext = repositoryContext;
-			securityProfile = new SbmSecurityProfile(false);
+			securityProfile_Internal = new SbmSecurityProfile(false);
 			Organisation = new OrganisationData_Portal(associationOrganisation, affiliateOrganisation);
 			User = new UserData_Portal(sessionContext, securityItemUser, affiliateUser);
 		}
@@ -117,10 +117,11 @@ namespace Sarand.BusinessMgr.Web.Portal.App
 
 		//-------------------------------------------------------------------
 		// Security Profile.
+
 		[JsonProperty("SecurityProfile")]
-		private readonly SbmSecurityProfile securityProfile;
+		private readonly SbmSecurityProfile securityProfile_Internal;
 		[JsonIgnore]
-		public ISbmSecurityProfile_Core SecurityProfile_Core { get { return securityProfile; } }
+		public ISbmSecurityProfile_Core SecurityProfile { get { return securityProfile_Internal; } }
 
 		//-------------------------------------------------------------------
 		// Organisation.
@@ -173,12 +174,13 @@ namespace Sarand.BusinessMgr.Web.Portal.App
 			{
 				base.Refresh();
 				// Check that user matches the session.
-				if (!SysId.IsValid(securityItemUser?.Id) || (SysId.IsValid(SecurityItemId) && !SecurityItemId.Equals(securityItemUser.Id)))
+				// Can only refresh existing User or populate a new one (with no details previously recorded).
+				if (SysId.IsValid(securityItemUser?.Id) && SysId.IsValid(SecurityItemId) && SysId.ToLong(SecurityItemId) != SysId.ToLong(securityItemUser.Id))
 				{
 					SaLogger.Warn($"{SysUtil.Fn} Invalid - User Security Item doesn't match session. Expected Id: {SecurityItemId}. Found: {securityItemUser?.Id}.");
 					return false;
 				}
-				if (!SysId.IsValid(affiliateUser?.Id) || (SysId.IsValid(AffiliateId) && !AffiliateId.Equals(affiliateUser.Id)))
+				if (SysId.IsValid(affiliateUser?.Id) && SysId.IsValid(AffiliateId) && SysId.ToLong(AffiliateId) != SysId.ToLong(affiliateUser.Id))
 				{
 					SaLogger.Warn($"{SysUtil.Fn} Invalid - User Affiliate doesn't match session. Expected Id: {AffiliateId}. Found: {affiliateUser?.Id}.");
 					return false;

SaBusinessMgrCoreWebPortal/Portal/Controllers/SbmController_Portal.cs

@@ -109,7 +109,7 @@ namespace Sarand.BusinessMgr.Web.Portal.Controllers
 		/// </summary>
 		protected override SbmSessionData_Web DeserializeSessionData(String sessionDataJson)
 		{
-			return JsonConvert.DeserializeObject<SbmSessionData_Portal>(sessionDataJson, SbmSessionDataJsonSerializerSettings);
+			return JsonConvert.DeserializeObject<SbmSessionData_Portal>(sessionDataJson, SessionDataJsonDeserializerSettings);
 		}
 
 		//-------------------------------------------------------------------
@@ -180,7 +180,7 @@ namespace Sarand.BusinessMgr.Web.Portal.Controllers
 			}
 
 			// Configure security profile.
-			sessionDataForUser.SecurityProfile_Core.RefreshProfile(internalsForUser.SessionConsole, internalsForUser.SecurityConsole, securityItemUser.Id, internalsForUser.SecurityConsole.GetRegisteredRights());
+			sessionDataForUser.SecurityProfile.RefreshProfile(internalsForUser.SessionConsole, internalsForUser.SecurityConsole, securityItemUser.Id, internalsForUser.SecurityConsole.GetRegisteredRights());
 
 			// 'Keep logged in' can be switched off by the application configuration.
 			keepLoggedIn = App.AppConfig.Security.SignIn.KeepLoggedIn.Allowed && keepLoggedIn;

SaBusinessMgrCoreWebPortal/Portal/Models/Assets/Model_AssetCategory-Config.cs

@@ -95,8 +95,8 @@ namespace Sarand.BusinessMgr.Web.Portal.Models.Assets
 			ViewMode pageMode = GetFilterMode();
 			bool modeIsSearch = pageMode == ViewMode.Search;
 			bool modeIsMaintain = pageMode == ViewMode.Maintain;
-			bool userCanCreateAssetCategories = SessionData_Portal.SecurityProfile_Core.UserCanCreateItemType(Sbm.ItemType.AssetCategory);
+			bool userCanCreateAssetCategories = SessionData_Portal.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.AssetCategory);
-			bool userCanUpdateAssetCategories = SessionData_Portal.SecurityProfile_Core.UserCanUpdateItemType(Sbm.ItemType.AssetCategory);
+			bool userCanUpdateAssetCategories = SessionData_Portal.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.AssetCategory);
 
 			// Actions.
 
@@ -187,8 +187,8 @@ namespace Sarand.BusinessMgr.Web.Portal.Models.Assets
 		public void PopulateItemConfig(ItemConfigData config, ItemId assetCategoryId, Sbm.AssetType assetType)
 		{
 			// Session configuration.
-			bool userCanCreateAssetCategories = SessionData_Portal.SecurityProfile_Core.UserCanCreateItemType(Sbm.ItemType.AssetCategory);
+			bool userCanCreateAssetCategories = SessionData_Portal.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.AssetCategory);
-			bool userCanUpdateAssetCategories = SessionData_Portal.SecurityProfile_Core.UserCanUpdateItemType(Sbm.ItemType.AssetCategory);
+			bool userCanUpdateAssetCategories = SessionData_Portal.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.AssetCategory);
 
 			// Update dialog title.
 			config.Title = Localiser["caption.vehicle.update"];

SaBusinessMgrCoreWebPortal/Portal/Models/SbmModel_Portal.cs

@@ -33,13 +33,13 @@ namespace Sarand.BusinessMgr.Web.Portal.Models
 
 		//-------------------------------------------------------------------
 		// Security profile.
-		public bool UserCanViewFinancials() { return SessionData_Portal.SecurityProfile_Core.UserCanViewFinancials(); }
+		public bool UserCanViewFinancials() { return SessionData_Portal.SecurityProfile.UserCanViewFinancials(); }
-		public bool UserCanViewCommodityFinancials_Supply() { return SessionData_Portal.SecurityProfile_Core.UserCanViewFinancials(FinancialType.CommoditySupply); }
+		public bool UserCanViewCommodityFinancials_Supply() { return SessionData_Portal.SecurityProfile.UserCanViewFinancials(FinancialType.CommoditySupply); }
-		public bool UserCanViewCommodityFinancials_Sales() { return SessionData_Portal.SecurityProfile_Core.UserCanViewFinancials(FinancialType.CommoditySales); }
+		public bool UserCanViewCommodityFinancials_Sales() { return SessionData_Portal.SecurityProfile.UserCanViewFinancials(FinancialType.CommoditySales); }
-		public bool UserCanUpdateFinancials() { return SessionData_Portal.SecurityProfile_Core.UserCanUpdateFinancials(); }
+		public bool UserCanUpdateFinancials() { return SessionData_Portal.SecurityProfile.UserCanUpdateFinancials(); }
-		public bool UserCanStockTake() { return SessionData_Portal.SecurityProfile_Core.UserHasSecurityRight(SecurityRight.StockTake); }
+		public bool UserCanStockTake() { return SessionData_Portal.SecurityProfile.UserHasSecurityRight(SecurityRight.StockTake); }
-		public bool UserCanCreateItem(Sbm.ItemType itemType) { return SessionData_Portal.SecurityProfile_Core.UserCanCreateItemType(itemType); }
+		public bool UserCanCreateItem(Sbm.ItemType itemType) { return SessionData_Portal.SecurityProfile.UserCanCreateItemType(itemType); }
-		public bool UserCanUpdateItem(Sbm.ItemType itemType) { return SessionData_Portal.SecurityProfile_Core.UserCanUpdateItemType(itemType); }
+		public bool UserCanUpdateItem(Sbm.ItemType itemType) { return SessionData_Portal.SecurityProfile.UserCanUpdateItemType(itemType); }
 
 		//-------------------------------------------------------------------
 		// Page menu options.

SaBusinessMgrCoreWebPortal/Portal/Models/Vehicles/Model_Vehicle-Config.cs

@@ -103,8 +103,8 @@ namespace Sarand.BusinessMgr.Web.Portal.Models.Vehicles
 			ViewMode pageMode = GetFilterMode();
 			bool modeIsSearch = pageMode == ViewMode.Search;
 			bool modeIsMaintain = pageMode == ViewMode.Maintain;
-			bool userCanCreateVehicles = SessionData_Portal.SecurityProfile_Core.UserCanCreateItemType(Sbm.ItemType.Vehicle);
+			bool userCanCreateVehicles = SessionData_Portal.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.Vehicle);
-			bool userCanUpdateVehicles = SessionData_Portal.SecurityProfile_Core.UserCanUpdateItemType(Sbm.ItemType.Vehicle);
+			bool userCanUpdateVehicles = SessionData_Portal.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.Vehicle);
 
 			// Actions.
 
@@ -196,8 +196,8 @@ namespace Sarand.BusinessMgr.Web.Portal.Models.Vehicles
 		public void PopulateItemConfig(ItemConfigData config, ItemId vehicleItemId)
 		{
 			// Session configuration.
-			bool userCanCreateVehicles = SessionData_Portal.SecurityProfile_Core.UserCanCreateItemType(Sbm.ItemType.Vehicle);
+			bool userCanCreateVehicles = SessionData_Portal.SecurityProfile.UserCanCreateItemType(Sbm.ItemType.Vehicle);
-			bool userCanUpdateVehicles = SessionData_Portal.SecurityProfile_Core.UserCanUpdateItemType(Sbm.ItemType.Vehicle);
+			bool userCanUpdateVehicles = SessionData_Portal.SecurityProfile.UserCanUpdateItemType(Sbm.ItemType.Vehicle);
 
 			// Update dialog title.
 			config.Title = Localiser["caption.vehicle.update"];