66 lines
2.0 KiB
YAML
66 lines
2.0 KiB
YAML
id: 1c-sql-base-access-policy
|
|
status: active
|
|
default_mode: deny
|
|
summary: "Every 1C base uses only its explicitly configured SQL connection; data is read-only and metadata writes are saved-state-only."
|
|
|
|
base_settings:
|
|
selector: base_id
|
|
source:
|
|
- ONEC_SQL_BASES_JSON
|
|
- ONEC_SQL_BASES_JSON_FILE
|
|
required_fields:
|
|
- server
|
|
- database
|
|
- user
|
|
secret_fields_one_of:
|
|
- password
|
|
- password_env
|
|
rules:
|
|
- "Every live request must contain an explicit base_id."
|
|
- "Resolve server, database, user, and password only from the settings entry for that base_id."
|
|
- "Do not substitute another base, infer a SQL database name, or use shared/default SQL credentials."
|
|
- "Do not persist connection passwords in repository or project files."
|
|
|
|
read_scope:
|
|
application_data: read_only
|
|
metadata_structure: read_only
|
|
configuration_tables:
|
|
Config: read_only
|
|
ConfigCAS: read_only
|
|
ConfigSave: read_only_except_saved_state_metadata_write
|
|
ConfigCASSave: read_only_except_saved_state_metadata_write
|
|
|
|
write_scope:
|
|
allowed:
|
|
base_metadata_saved_state: ConfigSave
|
|
extension_metadata_saved_state: ConfigCASSave
|
|
forbidden:
|
|
- application_data_tables
|
|
- Config
|
|
- ConfigCAS
|
|
- SQL_system_tables
|
|
- SQL_security_objects
|
|
constraints:
|
|
- "The payload must be a metadata saved-state change, never application data."
|
|
- "The target table must be exactly ConfigSave or ConfigCASSave."
|
|
- "Require explicit saved-state write opt-in, expected SHA-1, backup, transaction, and readback verification."
|
|
- "A saved-state write must not activate or apply the configuration."
|
|
|
|
sql_identity_management:
|
|
mode: forbidden
|
|
forbidden_actions:
|
|
- CREATE_LOGIN
|
|
- ALTER_LOGIN
|
|
- DROP_LOGIN
|
|
- CREATE_USER
|
|
- ALTER_USER
|
|
- DROP_USER
|
|
- CREATE_ROLE
|
|
- ALTER_ROLE
|
|
- DROP_ROLE
|
|
- GRANT
|
|
- DENY
|
|
- REVOKE
|
|
rule: "Use the login and password already stored in the selected base settings; never create or modify adapter-owned SQL identities or permissions."
|
|
|