Analyze current identity at authorization calls

Proprietary

Prove that the configured authorization identity fields match one successfully checked provider call in the same local statement sequence. Seed identity origins only at an exact approved provider CALL. Require a complete success condition and a branch that exits for every non-success result. Support explicit level 88 conditions with bounded Boolean logic and existing terminal rejection paths. Preserve pending or checked provider evidence across an independent read-only rejection whose rejected path terminates. This does not grant provider success. Propagate complete equal-width PIC X copies through at most 64 intervening statements and 64 stored origins. After provider success, complete terminal equality checks can establish exact current values for at most eight configured pairs under native character comparisons. Evaluate up to 256 equality combinations with bounded Boolean conditions. Never grant evidence when no combination continues. Equality establishes current values without changing their historical origins or proving saved-data freshness. Preserve proof across disjoint plain scalar MOVEs, validated default initialization, no-ops and literal messages. Writes to provider storage, unknown effects, other calls and unsupported branches invalidate it. A later provider call needs its own success check. Require complete ordinary source and unaliased local DISPLAY record layouts. Alternate ENTRY and NEXT SENTENCE prevent the proof. Report missing identity mappings without changing code or treating unknown origins as trusted. A positive result proves only the supplied current identity mapping at that call. It does not prove provider authentication internals, resource authorization, action or key mapping, authorization-response handling, later protected use or validity across tasks.

io.moderne.mainframe.security.AnalyzeCurrentAuthorizationIdentity

Required

Exact repository-relative source covered by the identity contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Exact literal CALL target approved to supply the current identity. The routine takes exactly one required BY REFERENCE record. Its implementation is not inferred from its name.

Exact outermost-first dotted declaration of the provider's complete local output record. The contract must approve this entire declared layout for the selected source version.

Exact outermost-first dotted level 88 declaration on the provider response. The response must be an ordinary unsigned DISPLAY integer of one to four digits inside the provider record.

One to 16 distinct approved success numbers from 0 through 9999. The level 88 declaration must contain exactly this set. All other responses invalidate the provider output. Separate values with commas.

Exact literal CALL target whose request requires current identity. This is a different routine from the provider.

Exact required BY REFERENCE argument count from one to 16.

One-based request argument containing every configured request identity field.

One to 16 distinct exact provider PIC X declarations. Each field contains one approved current context component after provider success. Separate values with commas.

Distinct exact request PIC X declarations in the same order as the provider fields. Each pair must have the same width of at most 256 characters. The request must be disjoint from the provider record. Separate values with commas.

Provenance of the current identity provider, its complete success set and the authorization request mapping. The recipe records this input and does not fetch or infer the contract.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentAuthorizationIdentity \ -P sourcePath=security/cbl/VSICGOOD.cbl \ -P programName=VSICGOOD \ -P identityProviderRoutine=VSIDENT \ -P identityArgument=VS-IDENTITY \ -P identitySuccessCondition=VS-IDENTITY.VS-IDENTITY-RC.VS-IDENTITY-OK \ -P identitySuccessValues='[0]' \ -P authorizationRoutine=VSAUTHZ \ -P authorizationArgumentCount=2 \ -P authorizationRequestArgument=1 \ -P identityFields='[VS-IDENTITY.VS-CURRENT-USER, VS-IDENTITY.VS-CURRENT-TENANT]' \ -P requestIdentityFields='[VS-AUTH-REQUEST.VS-AUTH-USER, VS-AUTH-REQUEST.VS-AUTH-TENANT]' \ -P contractSource='mainframe-fixtures fictional current authorization identity contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.