Initial SQL-only 1C adapter baseline

2026-07-22 03:03:47 +03:00
commit e2503b77e7
545 changed files with 184711 additions and 0 deletions
@@ -0,0 +1,65 @@
+id: 1c-sql-base-access-policy
+status: active
+default_mode: deny
+summary: "Every 1C base uses only its explicitly configured SQL connection; data is read-only and metadata writes are saved-state-only."
+
+base_settings:
+  selector: base_id
+  source:
+    - ONEC_SQL_BASES_JSON
+    - ONEC_SQL_BASES_JSON_FILE
+  required_fields:
+    - server
+    - database
+    - user
+  secret_fields_one_of:
+    - password
+    - password_env
+  rules:
+    - "Every live request must contain an explicit base_id."
+    - "Resolve server, database, user, and password only from the settings entry for that base_id."
+    - "Do not substitute another base, infer a SQL database name, or use shared/default SQL credentials."
+    - "Do not persist connection passwords in repository or project files."
+
+read_scope:
+  application_data: read_only
+  metadata_structure: read_only
+  configuration_tables:
+    Config: read_only
+    ConfigCAS: read_only
+    ConfigSave: read_only_except_saved_state_metadata_write
+    ConfigCASSave: read_only_except_saved_state_metadata_write
+
+write_scope:
+  allowed:
+    base_metadata_saved_state: ConfigSave
+    extension_metadata_saved_state: ConfigCASSave
+  forbidden:
+    - application_data_tables
+    - Config
+    - ConfigCAS
+    - SQL_system_tables
+    - SQL_security_objects
+  constraints:
+    - "The payload must be a metadata saved-state change, never application data."
+    - "The target table must be exactly ConfigSave or ConfigCASSave."
+    - "Require explicit saved-state write opt-in, expected SHA-1, backup, transaction, and readback verification."
+    - "A saved-state write must not activate or apply the configuration."
+
+sql_identity_management:
+  mode: forbidden
+  forbidden_actions:
+    - CREATE_LOGIN
+    - ALTER_LOGIN
+    - DROP_LOGIN
+    - CREATE_USER
+    - ALTER_USER
+    - DROP_USER
+    - CREATE_ROLE
+    - ALTER_ROLE
+    - DROP_ROLE
+    - GRANT
+    - DENY
+    - REVOKE
+  rule: "Use the login and password already stored in the selected base settings; never create or modify adapter-owned SQL identities or permissions."
+