Initial SQL-only 1C adapter baseline

plugins/1c/connector/policies/read-only-query.yaml

@@ -0,0 +1,40 @@
+id: 1c-readonly-query-policy
+status: active
+default_mode: deny
+allowed:
+  - select
+limits:
+  max_rows: 1000
+  default_rows: 100
+  timeout_seconds: 30
+  max_timeout_seconds: 120
+deny_patterns:
+  - "(?i)\\bВЫБРАТЬ\\s+РАЗРЕШЕННЫЕ\\b.*\\bПОМЕСТИТЬ\\b"
+  - "(?i)\\bПОМЕСТИТЬ\\b"
+  - "(?i)\\bУНИЧТОЖИТЬ\\b"
+  - "(?i)\\bОБНОВИТЬ\\b"
+  - "(?i)\\bВСТАВИТЬ\\b"
+  - "(?i)\\bУДАЛИТЬ\\b"
+  - "(?i)\\bALTER\\b"
+  - "(?i)\\bDROP\\b"
+  - "(?i)\\bUPDATE\\b"
+  - "(?i)\\bINSERT\\b"
+  - "(?i)\\bDELETE\\b"
+  - "(?i)\\bCREATE\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\bALTER\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\bDROP\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\b(GRANT|DENY|REVOKE)\\b"
+masking:
+  enabled: true
+  fields:
+    - "(?i).*пароль.*"
+    - "(?i).*телефон.*"
+    - "(?i).*email.*"
+    - "(?i).*почта.*"
+    - "(?i).*паспорт.*"
+    - "(?i).*инн.*"
+audit:
+  log_queries: true
+  log_params: false
+  log_result_rows: false
+notes: "Read-only query runner policy. Connection identity comes only from the explicit base_id settings. Validate before execution and apply row limits/masking."