id: 1c-sql-base-access-policy
status: active
default_mode: deny
summary: "Every 1C base uses only its explicitly configured SQL connection; data is read-only and metadata writes are saved-state-only."

base_settings:
  selector: base_id
  source:
    - ONEC_SQL_BASES_JSON
    - ONEC_SQL_BASES_JSON_FILE
  required_fields:
    - server
    - database
    - user
  secret_fields_one_of:
    - password
    - password_env
  rules:
    - "Every live request must contain an explicit base_id."
    - "Resolve server, database, user, and password only from the settings entry for that base_id."
    - "Do not substitute another base, infer a SQL database name, or use shared/default SQL credentials."
    - "Do not persist connection passwords in repository or project files."

read_scope:
  application_data: read_only
  metadata_structure: read_only
  configuration_tables:
    Config: read_only
    ConfigCAS: read_only
    ConfigSave: read_only_except_saved_state_metadata_write
    ConfigCASSave: read_only_except_saved_state_metadata_write

write_scope:
  allowed:
    base_metadata_saved_state: ConfigSave
    extension_metadata_saved_state: ConfigCASSave
  forbidden:
    - application_data_tables
    - Config
    - ConfigCAS
    - SQL_system_tables
    - SQL_security_objects
  constraints:
    - "The payload must be a metadata saved-state change, never application data."
    - "The target table must be exactly ConfigSave or ConfigCASSave."
    - "Require explicit saved-state write opt-in, expected SHA-1, backup, transaction, and readback verification."
    - "A saved-state write must not activate or apply the configuration."

sql_identity_management:
  mode: forbidden
  forbidden_actions:
    - CREATE_LOGIN
    - ALTER_LOGIN
    - DROP_LOGIN
    - CREATE_USER
    - ALTER_USER
    - DROP_USER
    - CREATE_ROLE
    - ALTER_ROLE
    - DROP_ROLE
    - GRANT
    - DENY
    - REVOKE
  rule: "Use the login and password already stored in the selected base settings; never create or modify adapter-owned SQL identities or permissions."