Find prohibited characters in COBOL authorization identities

Proprietary

Trace individual character origins into identity fields in an explicitly configured authorization request. The approved contract must prohibit every copied character or substring from the named sources. Report exact retained positions after partial STRING writes, equal-width MOVEs and supported local assignments. Across IF and EVALUATE branches, retain only the same source declaration and character position on every branch. Require the configured literal CALL target and exact count of plain BY REFERENCE arguments. Every identity field must belong to the selected request argument. Support ordinary PIC X fields of at most 256 characters. Limit STRING operands to 16, condition nesting to 16 and EVALUATE labels to 64. Summarize unique qualified paragraphs with at most 64 expanded statements and 16 active paragraphs. Bound each origin to 64 transfer steps and evidence sites. Reject recursion, aliases, incomplete source, unsupported storage and unknown effects. Missing origins do not establish trusted identity. Findings describe a provenance violation at the request boundary. They do not authenticate a user, prove reachability, establish that authorization succeeds or change application behavior. Preserve character origins across supported DISPLAY statements with up to 16 ordinary PIC X fields, literal slices and bounded ASCII text operands. Validate every operand before preserving facts. Device options, expressions, dynamic slices and unsupported storage remain barriers.

io.moderne.mainframe.security.FindAuthorizationCharacterOrigins

Required

sourcePathString

Exact repository-relative source covered by the authorization contract.

programNameString

Program ID covered by the contract. Retain quotes for literal IDs. Their contents match case exactly.

authorizationRoutineString

Exact literal CALL target defined by the contract.

argumentCountint

Exact number of BY REFERENCE arguments required by the interface. Must be between one and 16.

requestArgumentint

One-based position of the authorization request argument.

identityFieldsList

One to 64 exact outermost-first dotted declarations that supply identity in the request. Each must be an elementary ordinary PIC X field within the passed request. Separate values with commas.

prohibitedSourcesList

One to 64 exact elementary ordinary PIC X declarations whose data the contract forbids in any character position of these identity fields. This includes copied substrings. This is a provenance restriction. Checks elsewhere do not waive it. Names do not establish trust. Separate values with commas.

contractSourceString

Provenance of the approved interface and source restrictions. The contract must define the argument interface and forbid every copied character from the named sources. It is recorded and is not fetched or inferred.

mod run . --recipe=io.moderne.mainframe.security.FindAuthorizationCharacterOrigins \
  -P sourcePath=security/cbl/VSAYTAIL.cbl \
  -P programName=VSAYTAIL \
  -P authorizationRoutine=VSAUTHZ \
  -P argumentCount=2 \
  -P requestArgument=1 \
  -P identityFields='[VS-AUTH-REQUEST.VS-AUTH-USER, VS-AUTH-REQUEST.VS-AUTH-TENANT]' \
  -P prohibitedSources='[VS-INPUT-USER, VS-INPUT-TENANT]' \
  -P contractSource=mainframe-fixtures/README.md

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.