Propose authorization allow guards before Db2 updates

Proprietary

Propose a complete non-allow rejection when a concrete non-allow authorizer result can pass the modeled checks before an approved Db2 UPDATE. Accept one structure qualifier in SQL host names. Require exact current key declarations and ordinary scalar assignment sources. Require a checked current identity, complete current resource key, permitted mutable columns and explicit table, encoding, input preservation and value-independent permission contracts. Bind the proposal to exact caller, ordinary COPY and complete schema snapshots. Require an existing denial exit approved for every non-allow result. Insert one typed IF before a standalone top-level UPDATE. Preserve all original bytes and verify the complete authorization proof on the changed tree. Existing complete checks remain unchanged. Preserve bounded disjoint writes, literal messages and returning IF alternatives. Require a concrete representable non-allow result that reaches the UPDATE through the modeled checks. Missing witnesses remain unresolved without a finding. Report a conditional CWE-754 finding only after establishing the current invocation, denied continuation and all identity, resource and SQL mapping facts. An unsafe exit or insertion leaves that finding without an edit. Application-team review remains required. This does not establish provider or authorizer implementations, successful SQL results, concurrency protection or an actual denied execution.

io.moderne.mainframe.security.ProposeDb2AuthorizationAllowGuard

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

One-based EXEC SQL line of the protected UPDATE.

Exact unquoted uppercase schema and table name covered by the resource contract.

Exact path of the approved complete enforced CREATE TABLE snapshot.

Lowercase SHA-256 of the complete approved schema snapshot.

Strict version 1 JSON object with identity, resource and result interfaces. Supply authorizerPreservesRecords, ordered keyColumns, updateActionValue, updateResourceTypeValue and allowedSetColumns. Explicitly supply resourceTypeBindsDb2Table, compatibleSqlEncoding and valueIndependentAuthorization. No premise has a default. See the current authorized Db2 UPDATE contract in the repository README.

Provenance of the approved current identity provider, authorizer, input preservation, record layouts, addressability, disjoint storage and Db2 resource binding. The UPDATE permission covers the named mutable columns independently of their new values. Approve compatible SQL character encoding, STDSQL(NO) and the complete enforced schema. Also approve the existing denial exit for every non-allow outcome. Preserve required messages, cleanup and transaction behavior. These semantics are supplied and are not inferred from names.

Existing paragraph approved for every non-allow result. An optional IN or OF section qualifier is supported. Its bounded path must terminate without reaching the UPDATE.

mod run . --recipe=io.moderne.mainframe.security.ProposeDb2AuthorizationAllowGuard \ -P sourcePath=security/cbl/VSUDGOOD.cbl \ -P programName=VSUDGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P updateLine=40 \ -P tableName=VTEST.AUTH_ITEM \ -P schemaSourcePath=security/ddl/VSUDAUTH.ddl \ -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P authorizationContract='<authorizationContract>' \ -P contractSource='mainframe-fixtures fictional current authorized Db2 UPDATE contract' \ -P approvedExit=DENY-PARA

Its required option authorizationContract has no example to run with. Fill it in above.

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.