Propose current identity at authorization calls

Proprietary

Propose exact current identity copies immediately before an authorization CALL that receives values from approved prohibited sources. Require a successfully checked current provider result whose context remains unchanged at the call. Correct only request fields with complete equal-width copy origins from prohibited declarations. Leave already current fields unchanged, including values established by supported terminal equality checks. If another required mapping has an unknown or unprohibited origin, retain the proven findings without proposing a partial correction. Bind approval to the exact caller source, all resolved data COPY contents and the selected CALL line. Use the same bounded interface, success and local value proof as AnalyzeCurrentAuthorizationIdentity. An independent read-only terminal rejection can preserve that provider evidence. It cannot supply the required success check. Include the new copies within its limits of 64 intervening statements and 64 stored origins. Require a standalone top-level CALL beginning on its own fixed-format line. Insert typed MOVE statements without periods and preserve all original code and trivia. Require UTF-8 without a byte order mark and consistent LF or CRLF caller endings. The supplied contract must approve these exact request-field overwrites. Application-team review remains required. Do not add providers, authorization routines, rejection paths or transaction behavior. Do not claim resource authorization, action or key correctness, authorization-response handling or protection of later operations.

io.moderne.mainframe.security.ProposeCurrentAuthorizationIdentity

Required

sourcePathString

Exact repository-relative source covered by the identity contract.

programNameString

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

identityProviderRoutineString

Exact literal CALL target approved to supply the current identity. The routine takes exactly one required BY REFERENCE record. Its implementation is not inferred from its name.

identityArgumentString

Exact outermost-first dotted declaration of the provider's complete local output record. The contract must approve this entire declared layout for the selected source version.

identitySuccessConditionString

Exact outermost-first dotted level 88 declaration on the provider response. The response must be an ordinary unsigned DISPLAY integer of one to four digits inside the provider record.

identitySuccessValuesList

One to 16 distinct approved success numbers from 0 through 9999. The level 88 declaration must contain exactly this set. All other responses invalidate the provider output. Separate values with commas.

authorizationRoutineString

Exact literal CALL target whose request requires current identity. This is a different routine from the provider.

authorizationArgumentCountint

Exact required BY REFERENCE argument count from one to 16.

authorizationRequestArgumentint

One-based request argument containing every configured request identity field.

identityFieldsList

One to 16 distinct exact provider PIC X declarations. Each field contains one approved current context component after provider success. Separate values with commas.

requestIdentityFieldsList

Distinct exact request PIC X declarations in the same order as the provider fields. Each pair must have the same width of at most 256 characters. The request must be disjoint from the provider record. Separate values with commas.

contractSourceString

Provenance of the current provider, complete success set, request mapping and prohibited identity origins. The contract must approve copying the current fields into this request immediately before the selected CALL while preserving required audit and later behavior.

sourceSha256String

Lowercase SHA-256 of the complete original UTF-8 caller without a byte order mark. Any caller change prevents application.

copybookSnapshotsString

JSON object containing the independently approved SHA-256 of every resolved data COPY. Use uppercase names without surrounding quotes and lowercase hashes. An empty object applies only to a program with no COPY. Changed, missing or extra dependencies prevent application.

authorizationLineint

One-based CALL line in the approved caller snapshot. The line must select exactly one call to the configured authorization routine.

prohibitedSourcesList

One to 64 exact outermost-first dotted PIC X declarations prohibited as identity origins for this authorization routine. Names alone do not establish this restriction. Separate values with commas.

mod run . --recipe=io.moderne.mainframe.security.ProposeCurrentAuthorizationIdentity \
  -P sourcePath=security/cbl/VSIJGOOD.cbl \
  -P programName=VSIJGOOD \
  -P identityProviderRoutine=VSIDENT \
  -P identityArgument=VS-IDENTITY \
  -P identitySuccessCondition=VS-IDENTITY.VS-IDENTITY-RC.VS-IDENTITY-OK \
  -P identitySuccessValues='[0]' \
  -P authorizationRoutine=VSAUTHZ \
  -P authorizationArgumentCount=2 \
  -P authorizationRequestArgument=1 \
  -P identityFields='[VS-IDENTITY.VS-CURRENT-USER, VS-IDENTITY.VS-CURRENT-TENANT]' \
  -P requestIdentityFields='[VS-AUTH-REQUEST.VS-AUTH-USER, VS-AUTH-REQUEST.VS-AUTH-TENANT]' \
  -P contractSource='mainframe-fixtures fictional current authorization identity contract' \
  -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P copybookSnapshots='{"VSIDCTX":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}' \
  -P authorizationLine=26 \
  -P prohibitedSources='[VS-INBOUND.VS-INPUT-USER, VS-INBOUND.VS-INPUT-TENANT]'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.