Analyze current authorization at protected calls

Proprietary

Tie a current checked identity and resource mapping to one authorization invocation and its later protected CALL. Join evidence by the actual CALL tree. Require a complete allow check and unchanged provider, request and current-key records through protected use. Require explicit approval that the authorizer preserves all watched records and that the protected interface consumes those exact keys for the approved action and resource type. Reuse the bounded identity, resource and result analyses. Each retains its source, layout, branch, numeric validity and statement limits. A new authorizer or provider invocation cannot borrow an earlier proof. A protected call consumes the local receipt. Unknown effects and watched writes invalidate it. Report component status and source lines without changing code, assigning a CWE or recording identity and key contents. A positive row is conditional on reaching that call in the supported local sequence and on the supplied interface semantics. It does not prove provider or authorizer internals, business-valid keys, concurrency control, whole-program coverage or validity across tasks.

io.moderne.mainframe.security.AnalyzeCurrentAuthorizedOperation

Required

sourcePathString

Exact repository-relative caller covered by the complete operation contract.

programNameString

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

operationContractString

Strict JSON object of at most 16384 characters. Use version 1 and identity, resource and result objects with the corresponding analysis options. Omit sourcePath, programName and contractSource inside them. Supply authorizerPreservesRecords, protectedKeyFields, protectedActionValue and protectedResourceTypeValue. Use arrays of strings for field names and response values. Unknown, duplicate or missing properties prevent analysis. An empty preservation list records missing approval. See the current authorized operation contract in the repository README.

contractSourceString

Provenance of the complete approved semantics. The provider authenticates the current identity. The authorizer decides access for that identity, action, type and key and preserves every named watched record. The protected routine uses the exact configured action, type and keys. Approve complete layouts, addressability and disjoint storage with no hidden alias effects. These semantics are supplied, not inferred from routine names or BY REFERENCE syntax.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentAuthorizedOperation \
  -P sourcePath=security/cbl/VSRNGOOD.cbl \
  -P programName=VSRNGOOD \
  -P operationContract='<operationContract>' \
  -P contractSource='mainframe-fixtures/README.md fictional current authorized operation contract'

Its required option operationContract has no example to run with. Fill it in above.

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.