Analyze current authorization at Db2 updates

Proprietary

Tie a current checked identity, exact resource mapping and complete allow check to one actual SQL UPDATE. Accept one structure qualifier in SQL host names. Require exact current key declarations and ordinary scalar assignment sources. Require exact source, ordinary COPY and complete schema snapshots. Match every CHAR primary-key predicate to the current authorized key field and every plain CHAR assignment to an approved mutable column. Require explicit approval of authorizer input preservation, the table resource binding, SQL encoding and value-independent UPDATE permissions. Join identity, resource and result evidence by the actual authorization CALL. Unknown effects, watched writes, intervening calls or SQL prevent reuse of the decision. Reuse bounded local identity and result proofs. Each protected operation consumes its receipt. Nested sequences start with fresh evidence. Report source lines, field mappings and component status without changing source, assigning a CWE or recording identity, key or payload values. A positive result is conditional on reaching this UPDATE and on the supplied interface semantics. It does not establish authorizer internals, concurrency protection, successful SQL results or whole-program coverage.

io.moderne.mainframe.security.AnalyzeCurrentAuthorizedDb2Update

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

One-based EXEC SQL line of the protected UPDATE.

Exact unquoted uppercase schema and table name covered by the resource contract.

Exact path of the approved complete enforced CREATE TABLE snapshot.

Lowercase SHA-256 of the complete approved schema snapshot.

Strict version 1 JSON object with identity, resource and result interfaces. Supply authorizerPreservesRecords, ordered keyColumns, updateActionValue, updateResourceTypeValue and allowedSetColumns. Explicitly supply resourceTypeBindsDb2Table, compatibleSqlEncoding and valueIndependentAuthorization. No premise has a default. See the current authorized Db2 UPDATE contract in the repository README.

Provenance of the approved current identity provider, authorizer, input preservation, record layouts, addressability, disjoint storage and Db2 resource binding. The UPDATE permission covers the named mutable columns independently of their new values. Approve compatible SQL character encoding, STDSQL(NO) and the complete enforced schema. These semantics are supplied and are not inferred from names.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentAuthorizedDb2Update \ -P sourcePath=security/cbl/VSUDGOOD.cbl \ -P programName=VSUDGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P updateLine=40 \ -P tableName=VTEST.AUTH_ITEM \ -P schemaSourcePath=security/ddl/VSUDAUTH.ddl \ -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P authorizationContract='<authorizationContract>' \ -P contractSource='mainframe-fixtures fictional current authorized Db2 UPDATE contract'

Its required option authorizationContract has no example to run with. Fill it in above.

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.