From 1af36292f789e893c418597082735df12ea910f0 Mon Sep 17 00:00:00 2001
From: Mikhail <misha_mst@mail.ru>
Date: Wed, 22 Jul 2026 03:19:34 +0300
Subject: [PATCH] Authorize upo test mutations and resolve SQL layers

---
 AGENTS.md                                  |  5 ++++
 plugins/1c/connector/adapter_1c_server.py  | 27 +++++++++++++---------
 plugins/1c/connector/repository_control.py |  1 +
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 782cbe1..4262fc4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,6 +16,11 @@
 - For training/download containers on `docker-gpu`, sync the current repo into `Z:\LLM\model-chat-app` first. These containers should read code from the synced app directory, not directly from `Z:\codex\LLM`.
 - Do not store credentials, tokens, model secrets, or host passwords in repositories or project files.
 
+## `upo_test` mutation scope
+
+- `upo_test` is an isolated test infobase. The user has authorized full read/write adapter checks there, including controlled SQL saved-state changes and rollback.
+- This authorization does not turn an adapter-side marker into a native repository lock. When repository coordination is enabled, keep the configured request/confirmation scope and never claim automatic lock verification in the SQL-only adapter version.
+
 ## Test-system security profile
 
 - This project currently runs as an isolated test system; use the minimum security profile unless the user explicitly requests production hardening.
diff --git a/plugins/1c/connector/adapter_1c_server.py b/plugins/1c/connector/adapter_1c_server.py
index 466a389..1af502f 100644
--- a/plugins/1c/connector/adapter_1c_server.py
+++ b/plugins/1c/connector/adapter_1c_server.py
@@ -46852,20 +46852,23 @@ def validate_repository_request_objects_sql(payload: dict[str, Any]) -> tuple[di
         return payload, {"schema": "onec_repository_lock_request.v1", "method": repository_control.METHOD_LOCK_REQUEST, **object_error}
     base_id = str(payload.get("base_id") or "").strip()
     canonical_objects: list[str] = []
+    resolutions: list[dict[str, Any]] = []
     for public_ref in objects or []:
         kind_text, separator, name = public_ref.partition(".")
         if not separator or not kind_text.strip() or not name.strip():
             return payload, invalid_argument(repository_control.METHOD_LOCK_REQUEST, "objects", f"Repository object '{public_ref}' must use a public Kind.Name reference.")
-        result = get_object(
-            canonical_kind(kind_text),
-            name,
-            base_id=base_id,
-            view="effective",
-            limit=20,
-            timeout_seconds=int(payload.get("timeout_seconds") or 60),
-            table="Config",
-            include_semantic=False,
-        )
+        result: dict[str, Any] = {}
+        resolved_table = ""
+        attempts: list[dict[str, Any]] = []
+        for table in ("Config", "ConfigSave", "ConfigCASSave"):
+            result = get_object(
+                canonical_kind(kind_text), name, base_id=base_id, view="effective", limit=20,
+                timeout_seconds=int(payload.get("timeout_seconds") or 60), table=table, include_semantic=False,
+            )
+            attempts.append({"table": table, "status": result.get("status")})
+            if result.get("status") == "ok" and isinstance(result.get("object"), dict):
+                resolved_table = table
+                break
         if result.get("status") != "ok" or not isinstance(result.get("object"), dict):
             return payload, {
                 "schema": "onec_repository_lock_request.v1",
@@ -46874,14 +46877,16 @@ def validate_repository_request_objects_sql(payload: dict[str, Any]) -> tuple[di
                 "status": "not_found",
                 "error": "repository_object_not_found_in_sql",
                 "object": public_ref,
-                "diagnostics": result,
+                "diagnostics": {"attempts": attempts, "last_result": result},
             }
         card = result["object"]
         resolved_kind = str(card.get("kind_ru") or card.get("public_kind") or card.get("kind") or kind_text).strip()
         resolved_name = str(card.get("name") or name).strip()
         canonical_objects.append(f"{resolved_kind}.{resolved_name}")
+        resolutions.append({"requested_object": public_ref, "resolved_object": canonical_objects[-1], "table": resolved_table, "source": "live_sql"})
     normalized = dict(payload)
     normalized["objects"] = canonical_objects
+    normalized["sql_resolution"] = resolutions
     return normalized, None
 
 
diff --git a/plugins/1c/connector/repository_control.py b/plugins/1c/connector/repository_control.py
index aa2cd4d..f8b4087 100644
--- a/plugins/1c/connector/repository_control.py
+++ b/plugins/1c/connector/repository_control.py
@@ -358,6 +358,7 @@ def create_lock_request(payload: dict[str, Any]) -> dict[str, Any]:
             "created_at": time.time(),
             "status": "pending_user_lock",
             "execution": "manual",
+            "sql_resolution": payload.get("sql_resolution") if isinstance(payload.get("sql_resolution"), list) else [],
         }
         _audit(state, "lock_request_created", request_id=request_id, base_id=base_id, objects=plan["lock_objects"])
         _write_state(state)