Namespace SEBT.Portal.Core.AppSettings

Classes

ActionRuleSettings: Rules for a single self-service action (e.g., address update or card replacement).

AddressValidationDataSettings: Per-state address validation data loaded from appsettings.{state}.json. Contains blocked address lists, street abbreviation mappings, and length constraints that vary by state. Empty defaults allow states without these constraints to run without additional configuration.

AddressValidationPolicySettings: Per-state policy for address updates. Override in appsettings.{state}.json as needed.

CheckerFeaturesRateLimitSettings: Configuration settings for rate limiting the public enrollment checker features endpoint. Deliberately a separate policy from EnrollmentCheckRateLimitSettings: every open checker tab polls the features endpoint once a minute, so sharing the enrollment-check partition would let a few tabs behind one NAT (school computer lab, library) drain the per-IP budget that real enrollment checks need.

CoLoadedCohortFilterSettings: Controls whether co-loaded Summer EBT cases are removed from the household payload for the MixedOrApplicantExcluded cohort. Classification (CoLoadedCohort) always runs for analytics.

EmailOtpSenderServiceSettings

EnrollmentCheckRateLimitSettings: Configuration settings for enrollment check rate limiting.

EnrollmentCheckerSettings

Configuration served to the standalone enrollment checker app at runtime via the public enrollment features endpoint. The checker is a statically-hosted frontend with no server of its own, so any setting that must change without a redeploy has to flow through this section.

Values can be overridden at runtime through the AWS AppConfig app-settings profile; consumers must read them via IOptionsMonitor<T> so hot-reloaded values take effect without an app restart.

FeatureFlags: Constants for feature flag names used across the portal. Names must contain only alphanumeric characters and underscores to satisfy both the FeatureFlagQueryService validator and AWS AppConfig naming requirements.

IalRequirement: An IAL requirement that is either uniform (same level for all case types) or per-case-type (different levels depending on how cases were loaded).

IdProofingEligibilitySettings: Optional gate before the Socure DocV path. When enabled (DC), users without a portal household record or with no cases and no applications are blocked from Socure — same rule as the dashboard empty state.

IdProofingRequirementsSettings: Unified settings for all identity proofing requirements, keyed by resource+action (e.g. "address+view", "card+write"). See docs/config/ial/README.md for the configuration guide.

IdProofingValiditySettings: Configures how long an ID proofing verification remains valid before the user must re-verify. Expiration is computed dynamically from IdProofingCompletedAt plus this duration — no baked-in expiration dates are stored.

IdentifierHasherSettings: Configuration for the identifier hasher. The secret key should be stored in configuration and/or secrets manager.

IncomeEligibilitySettings: Income screening thresholds for the checker's not-enrolled result. Toggled by the EnableCheckerIncomeEligibility flag; this section carries the figures. They track federal poverty guidelines, which are reissued annually.

IssuanceTypeRuleSettings: Rules for a specific issuance type within an action.

JwtSettings: Configuration settings for JWT token generation.

MaintenanceBannerSettings: Maintenance banner configuration for the enrollment checker. The on/off toggle is the EnableCheckerMaintenanceBanner feature flag; this section carries the banner copy itself.

OidcSettings

OidcStepUpSettings: OIDC client used for elevated verification (IAL1+ step-up). Public values only; secrets belong on the Next.js server. Binds to Oidc:StepUp in configuration.

OidcVerificationClaimSettings: Configures the OIDC claim names used by the external identity provider to convey ID verification level and date, under Oidc:VerificationClaims. The primary names are required whenever OIDC is enabled; the fallbacks are optional.

OpenTelemetrySettings: Represents the "Otel" section of appsettings.json, which configures OpenTelemetry exporters and options.

OtpBypassSettings: Settings related to bypassing OTP validation for a specific email address in non-production environments. This is intended to facilitate SEBT's DAST scanning, but should be used with caution and should never be enabled in production or for any real user accounts.

OtpRateLimitSettings: Configuration settings for OTP rate limiting.

OutageScheduleSettings

Configurable schedule of outage windows. When the current time (interpreted in TimeZoneId) falls within any window, the portal force-enables the outage_page_enabled feature flag so the outage page appears automatically — no manual toggling required. Bind from appsettings.{State}.json or the AWS AppConfig AppSettings profile (the latter allows updating windows at runtime without a redeploy).

Validated at startup: an unknown timezone, an unparseable window, a window that ends before it starts, or an unrecognized target all prevent the app from starting. A malformed schedule is a deploy failure, never a silently skipped window.

OutageWindow: A single scheduled outage window. Start and End are local wall-clock date-times in the schedule's TimeZoneId (ISO-8601 with no offset, e.g. "2026-06-21T22:00:00"). The window is start-inclusive and end-exclusive.

OutageWindowParsing: Parses the string-typed fields of an OutageWindow. Shared by the startup validator that rejects malformed schedules and by the evaluator that reads them at request time, so the two cannot disagree about which windows are well-formed.

PiiEncryptionKeySetting

PiiEncryptionSettings: AES-256-GCM key material configuration for reversible PII column encryption (see ADR).

RedisSettings

SeedingSettings: Configuration for database seeding behavior.

SelfServiceRulesSettings

Configuration for per-state self-service action rules. Controls which portal actions (address update, card replacement) are available based on the user's program type (issuance type) and card status.

Per-state overrides go in appsettings.{State}.json under the SelfServiceRules section.

DC configuration (allows SummerEbt users only):

"SelfServiceRules": {
  "AddressUpdate": {
    "Enabled": true,
    "ByIssuanceType": {
      "SummerEbt": { "Enabled": true, "AllowedCardStatuses": ["Active", "Mailed"] }
    }
  }
}

SmartySettings: Configuration for Smarty US Street Address API.

SmtpClientSettings

SocureDocvEgregiousReasonRejectionSettings: Configurable immediate rejection for known egregious Socure DocV reason codes (device tampering, liveness failure, etc.)

SocureSettings: Configuration for the Socure identity verification integration. In non-Development environments, WebhookSecret is required at startup.

StateHouseholdIdSettings: Configuration for preferred household ID types used to authorize guardians and link to household data. The first type that can be resolved from the user is used for lookup.

WebhookRateLimitSettings: Configuration settings for Socure webhook endpoint rate limiting. Uses IP-based partitioning with a fixed window. TODO: Confirm appropriate thresholds with Socure and the team.

Interfaces

IHaveConfigSectionName

IOidcCoreSettings

Enums

ExporterKind

HistogramAggregationKind

OutageTarget: Surfaces an outage window can apply to. Window Target strings parse to these values. When querying outage state, pass the asking surface (Portal or EnrollmentChecker); Both is a window-level value meaning the window applies to every surface.

Table of Contents

Namespace SEBT.Portal.Core.AppSettings

Classes

Interfaces

Enums