Propose current identity for Db2 read authorization

Proprietary

Propose current identity copies when the authorizer for an actual Db2 SELECT receives identity from explicitly prohibited sources. Accept one structure qualifier in SQL host names. Require exact declaration identity for keys and disjoint ordinary output storage. Require a checked current provider, complete current resource key, complete allow check, permitted read columns and disjoint outputs. Bind the proposal to exact caller, ordinary COPY and complete schema snapshots. Require explicit approval for the identity-field overwrites. Correct only missing current mappings with complete equal-width prohibited-origin evidence. Leave already current fields unchanged. Keep findings without a partial correction when another required identity mapping is unresolved. Insert typed MOVE statements before the actual top-level authorizer CALL. Preserve every original byte outside the insertion and add no period. Require the changed tree to establish complete current authorization at the same actual SELECT and authorizer call. Application-team review remains required. This does not establish provider internals, SQL success, returned data validity or an actual unauthorized execution.

io.moderne.mainframe.security.ProposeCurrentDb2SelectIdentity

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

One-based EXEC SQL line of the protected SELECT.

Exact unquoted uppercase schema and table name covered by the resource contract.

Exact path of the approved complete enforced CREATE TABLE snapshot.

Lowercase SHA-256 of the complete approved schema snapshot.

Strict version 1 JSON object with identity, resource and result interfaces. Supply authorizerPreservesRecords, ordered keyColumns, selectActionValue, selectResourceTypeValue and allowedReadColumns. Explicitly supply resourceTypeBindsDb2Table and compatibleSqlEncoding. No premise has a default. See the current authorized Db2 SELECT contract in the repository README.

Provenance of the approved current identity provider, authorizer, input preservation, record layouts, addressability, disjoint storage and Db2 resource binding. The SELECT permission covers the named read columns. Approve compatible SQL character encoding, STDSQL(NO) and the complete enforced schema. These semantics are supplied and are not inferred from names.

One to 64 exact outermost-first dotted PIC X declarations prohibited as identity origins for this authorization request. Names alone do not establish the restriction. Separate values with commas.

Provenance of approval to copy the checked current provider fields into this request immediately before the actual authorizer CALL. Approve the prohibited origins and these exact overwrites while preserving required audit and later behavior.

mod run . --recipe=io.moderne.mainframe.security.ProposeCurrentDb2SelectIdentity \ -P sourcePath=security/cbl/VSUQGOOD.cbl \ -P programName=VSUQGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P selectLine=40 \ -P tableName=VTEST.AUTH_ITEM \ -P schemaSourcePath=security/ddl/VSUDAUTH.ddl \ -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P authorizationContract='<authorizationContract>' \ -P contractSource='mainframe-fixtures fictional current authorized Db2 SELECT contract' \ -P prohibitedSources='[INPUT-DATA.INPUT-USER]' \ -P identityCopyContractSource='mainframe-fixtures fictional current identity copy contract'

Its required option authorizationContract has no example to run with. Fill it in above.

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.