Analyze current resource values at authorization calls

Proprietary

Prove the configured action, resource type and current key mapping immediately before an exact approved authorization CALL. Require full-width policy values and complete equal-width copies or terminal key comparisons in one local statement sequence. Support PIC X keys and unsigned DISPLAY integers of at most 18 digits. For comparisons, support at most eight configured key pairs and 256 equality combinations. Require native character comparisons for PIC X keys. Both numeric operands must have valid contents before a comparison. Later validation cannot justify an earlier comparison. Only equalities present in every continuing combination establish a binding. No continuing combination produces no positive proof. Bound each copy analysis to 64 statements and 64 stored fields. A later overwrite invalidates the affected copy. Before numeric copies, require valid contents from a complete NUMERIC rejection check, a representable integer literal or ordinary default zero initialization. Checking a source after an unvalidated copy does not prove that copy. Unknown effects, calls and unsupported branches discard evidence. Require complete ordinary source and unaliased DISPLAY records. Alternate ENTRY, NEXT SENTENCE, allocation, freeing and address rebinding prevent proof. Report numeric validation origins, copy lines and equality check lines without recording key contents. Report evidence without source changes or vulnerability findings. A positive result does not establish current identity, business-valid keys, a checked authorization result, preservation by the authorizer or the resource used by a later protected operation.

io.moderne.mainframe.security.AnalyzeCurrentAuthorizationResource

Required

Exact repository-relative source covered by the resource contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Exact literal CALL target approved for this complete interface. Its implementation is not inferred from its name.

One to 16 distinct exact outermost-first dotted declarations of complete local DISPLAY records. The call must pass these records in this order by reference. Separate values with commas.

One-based authorization argument containing the action, resource type and all request keys.

Exact outermost-first dotted PIC X declaration in the request record.

Exact full-width approved action. Use one to 256 printable ASCII characters. Case and every trailing space are significant.

Exact outermost-first dotted PIC X declaration in the request record. It must differ from the action and key fields.

Exact full-width approved resource type. Use one to 256 printable ASCII characters. Case and every trailing space are significant.

One to 16 distinct exact request key declarations. Use PIC X or unsigned DISPLAY integers. They must differ from the action and resource type fields. Separate values with commas.

Distinct exact declarations containing the requested resource keys in the same order. Each pair must have the same category and width. Support at most 256 characters or 18 unsigned DISPLAY digits. Numeric contents require a current validity proof. Source records must be outside all authorization arguments. The contract must establish valid addressable incoming records that are disjoint from local and other incoming storage. Separate values with commas.

Provenance of the complete interfaces, approved action and type, current key mapping and incoming storage contract. The recipe records this input and does not fetch or infer it.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentAuthorizationResource \ -P sourcePath=security/cbl/VSRMGOOD.cbl \ -P programName=VSRMGOOD \ -P authorizationRoutine=VSRAUTH \ -P authorizationArguments='[VS-RESOURCE-REQUEST, VS-AUTH-RESPONSE]' \ -P requestArgument=1 \ -P actionField=VS-RESOURCE-REQUEST.VS-RESOURCE-ACTION \ -P actionValue='READ ' \ -P resourceTypeField=VS-RESOURCE-REQUEST.VS-RESOURCE-TYPE \ -P resourceTypeValue='VSACCT ' \ -P requestKeyFields='[VS-RESOURCE-REQUEST.VS-RESOURCE-KEY]' \ -P currentKeyFields='[VS-RESOURCE-INPUT.VS-REQUESTED-KEY]' \ -P contractSource='mainframe-fixtures fictional current authorization resource contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.