Propose current identity for Db2 update authorization

Proprietary

Propose current identity copies when the authorizer for an actual Db2 UPDATE receives identity from explicitly prohibited sources. Accept one structure qualifier in SQL host names. Require exact current key declarations and ordinary scalar assignment sources. Require a checked current provider, complete current resource key, complete allow check, permitted mutable columns and explicit value-independent permission. Bind the proposal to exact caller, ordinary COPY and complete schema snapshots. Require explicit approval for the identity-field overwrites. Correct only missing current mappings with complete equal-width prohibited-origin evidence. Leave already current fields unchanged. Keep findings without a partial correction when another required identity mapping is unresolved. Insert typed MOVE statements before the actual top-level authorizer CALL. Preserve every original byte outside the insertion and add no period. Require the changed tree to establish complete current authorization at the same actual UPDATE and authorizer call. Application-team review remains required. This does not establish provider internals, SQL success, new value validity, concurrency protection or an actual unauthorized execution.

io.moderne.mainframe.security.ProposeCurrentDb2UpdateIdentity

Required

sourcePathString

Exact approved caller path.

programNameString

Exact program ID. Retain quotes for a literal ID.

sourceSha256String

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

copybookSnapshotsString

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

updateLineint

One-based EXEC SQL line of the protected UPDATE.

tableNameString

Exact unquoted uppercase schema and table name covered by the resource contract.

schemaSourcePathString

Exact path of the approved complete enforced CREATE TABLE snapshot.

schemaSha256String

Lowercase SHA-256 of the complete approved schema snapshot.

authorizationContractString

Strict version 1 JSON object with identity, resource and result interfaces. Supply authorizerPreservesRecords, ordered keyColumns, updateActionValue, updateResourceTypeValue and allowedSetColumns. Explicitly supply resourceTypeBindsDb2Table, compatibleSqlEncoding and valueIndependentAuthorization. No premise has a default. See the current authorized Db2 UPDATE contract in the repository README.

contractSourceString

Provenance of the approved current identity provider, authorizer, input preservation, record layouts, addressability, disjoint storage and Db2 resource binding. The UPDATE permission covers the named mutable columns independently of their new values. Approve compatible SQL character encoding, STDSQL(NO) and the complete enforced schema. These semantics are supplied and are not inferred from names.

prohibitedSourcesList

One to 64 exact outermost-first dotted PIC X declarations prohibited as identity origins for this authorization request. Names alone do not establish the restriction. Separate values with commas.

identityCopyContractSourceString

Provenance of approval to copy the checked current provider fields into this request immediately before the actual authorizer CALL. Approve the prohibited origins and these exact overwrites while preserving required audit and later behavior.

mod run . --recipe=io.moderne.mainframe.security.ProposeCurrentDb2UpdateIdentity \
  -P sourcePath=security/cbl/VSUDGOOD.cbl \
  -P programName=VSUDGOOD \
  -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P copybookSnapshots='{}' \
  -P updateLine=40 \
  -P tableName=VTEST.AUTH_ITEM \
  -P schemaSourcePath=security/ddl/VSUDAUTH.ddl \
  -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P authorizationContract='<authorizationContract>' \
  -P contractSource='mainframe-fixtures fictional current authorized Db2 UPDATE contract' \
  -P prohibitedSources='[INPUT-DATA.INPUT-USER]' \
  -P identityCopyContractSource='mainframe-fixtures fictional current identity copy contract'

Its required option authorizationContract has no example to run with. Fill it in above.

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.