Namespace SEBT.Portal.Core.Services

Namespaces

SEBT.Portal.Core.Services.Socure

Classes

AddressValidationResult: Result of an address validation call.

EmailLinkedResource: Represents an embedded image for email with Content-ID reference.

IdProofingAssessmentResult: Result of an ID proofing risk assessment from Socure.

OidcCallbackFailureLogEntry: Fields attached to an off-boarding OIDC failure log line.

OidcCallbackTokenResult: Result of validating a callback token.

OidcDiscoveryInfo: The discovery-document endpoints exposed to callers. Kept deliberately narrow so consumers don't take a dependency on the OIDC protocol library's configuration type.

OidcExchangeResult: Result of the OIDC code exchange.

OidcResultHttpStatus: Single source for the HTTP status the API layer returns for each OIDC failure. The controller derives response status codes from this table, and the handlers derive the pass-through HttpStatus values from the same table — so the off-boarding dashboards can never drift from what the API actually returned.

Structs

OutagePageState: Whether a surface's outage page should currently be shown, and why.

Interfaces

IAddressValidationService: Legacy façade over IAddressVerificationService for simple valid/invalid checks. Prefer IAddressVerificationService for structured errors, identifiers, and metadata.

IAddressVerificationService: Validates and normalizes mailing addresses using Smarty (when enabled) and state policy from configuration. Intended for use by portal use cases and state connectors so validation rules stay consistent.

IBlockedAddressDataSource

Supplies blocked-address entries with ZIP context, sourced from per-state data files (CSV, embedded resource, etc.) that ship alongside the application. Distinct from AddressValidationDataSettings.BlockedAddresses, which is a legacy inline list matched on street alone.

Entries returned here participate in (street + 5-digit ZIP) matching so that large state-wide lists do not over-block residential addresses that happen to share a street name with a county office in another city.

IDataSeeder: Abstraction for seeding data into the database.

IDatabaseSeeder: Service for seeding the database with initial or test data.

IEmailLookupHasher: Computes a deterministic 64-character hex MAC for normalized email lookups (equality in SQL via persisted email-hash column). Separate from identifier hashing normalization rules used for SNAP/TANF/SSN.

IEnrollmentCheckSubmissionLogger: Logs de-identified enrollment check submissions for analytics purposes. No PII (names, full dates of birth) is stored -- only birth year, enrollment status, eligibility type, and school name.

IHouseholdIdentifierResolver: Resolves the household identifier to use for authorization and lookup based on the authenticated user and state configuration. State configuration determines which ID type(s) are preferred (e.g. Email, SNAP ID); the resolver returns the first type it can satisfy from the user's claims.

IIdProofingService: Authorization gate: evaluates whether a user meets the IAL requirement for a resource+action, resolved against their household case types.

IIdentifierHasher: Hashes sensitive identifiers (including low-entropy values like SSNs) for secure storage and search. Uses HMAC-SHA256 so the same plaintext produces the same hash for lookup.

ILocalLoginTokenService: Generates a portal JWT for OTP-authenticated (local login) users. All claims are sourced from the User entity.

IOidcCallbackFailureLogger: Structured logging for OIDC callback failures that send users to id-proofing off-boarding.

IOidcExchangeService

Performs the OIDC token exchange and id_token verification entirely server-side. The implementation owns the IdP HTTP calls, JWKS validation, and callback-token signing/validation; UseCases handlers orchestrate it without seeing any of that.

Implementations are stateless between requests (all flow state lives in the pre-auth session store). Inject as scoped or transient.

IOidcTokenService: Generates a portal JWT for OIDC-authenticated users. Accepts the validated IdP callback token as a System.Security.Claims.ClaimsPrincipal, handles verification claim translation, IAL derivation, and ID proofing timestamp computation. Returns Result<T> because step-up flows fail when the IdP returns no verification claims.

IOtpGeneratorService

IOtpSenderService

IOutagePageStateResolver

The single authority on outage page state. Combines the outage schedule with the surface's manual feature flag. The rule, per surface: when any schedule windows target the surface, the schedule alone decides (a manual "true" cannot bypass the maintenance calendar, and a manual "false" cannot suppress a scheduled outage); with no windows targeting the surface, the manual flag decides (the emergency path for unscheduled outages).

Windows targeting one surface never affect the other surface's manual toggle.

IPhoneOverrideProvider: Provides an optional development-only phone override for household lookup. When set, the resolver uses this phone instead of the one from the JWT/user record. Only used in Development; implementations return null in Production.

IPiiSymmetricEncryption: Encrypts/decrypts short UTF-8 strings at rest using an authenticated envelope bound to an explicit key id.

IPiiVisibilityService: Determines which PII fields a user can see based on their IAL level and the configured view requirements. Used by the repository layer for query filtering.

IPreAuthSessionStore: manages the lifecycle of server-side pre-auth OIDC sessions. Implementations store sessions in a cache (L1 memory + optional L2 Redis) with an automatic TTL so abandoned flows expire without explicit cleanup.

ISelfServiceEvaluator: Evaluates self-service action permissions based on configuration rules and the user's household data.

ISessionRefreshTokenService: Generates a refreshed portal JWT by copying claims from the current session's System.Security.Claims.ClaimsPrincipal. The user entity is used only for the internal user ID (JWT sub claim).

ISmtpClientService

ISocureClient: Abstraction over the Socure identity verification API. Workflow-oriented methods that avoid leaking Socure-specific payload shapes into use cases. Backed by StubSocureClient in development, real HTTP client when credentials are available.

Enums

IdProofingOutcome: The outcome of an ID proofing risk assessment.