# Delivery A additionally checked actual calls in Git HEAD objects (2026-10-14):
# p4-plugin: CredentialsHelper.lookupCredentialsInItem, P4PasswordImpl and P4TicketImpl
# call ConnectionFactory.testConnection, ConnectionFactory calls connect, ReviewNotifier
# calls openConnection; zephyr-enterprise-test-management-plugin: ZephyrInstance calls
# getCredentialsFromId and UserService.verifyCredentials; azure-keyvault-plugin:
# AzureKeyVaultGlobalConfiguration.doTestConnection calls listPropertiesOfSecrets;
# rocketchatnotifier-plugin: RocketChatNotifier.doTestConnection calls publish.
# Each listed clone is under /home/mc/ousast-results/valid/train/hist/jenkinsci__*.
# No network documentation lookup was performed for this delivery. The existing
# documented checkAnyPermission row below is retained; it was not found in these HEADs.
# Closed authorization facts for Jenkins/Stapler, Spring Security and Servlet code.
# Checked Git HEAD source objects in /home/mc/ousast-results/valid/train/hist/:
# jenkinsci__analysis-core-plugin: DefaultGraphConfigurationView.checkPermission,
# AbstractAnnotation.hasPermission and GlobalSettings.save; android-signing-plugin:
# SignApksBuilder.lookupCredentials; ansible-plugin: AnsibleAdHocCommandBuilder.findCredentialById;
# blueocean-plugin: GitScm.getItemByFullName; cloud-stats-plugin: CloudStatistics.getConfigFile;
# job-import-plugin: JobImportAction.updateByXml. These are real calls, not prose matches.
# checkAnyPermission is documented by Jenkins AccessControlled, although absent from these HEADs:
# https://javadoc.jenkins.io/hudson/security/AccessControlled.html
# checkReadPermission was not found in the clones or API references and is not guessed here.
# Spring and Servlet are already named in ruleset/semantic/java.toml. Their identity/check APIs:
# https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/acls/model/Acl.html
# https://docs.spring.io/spring-security/site/docs/5.4.x/reference/html5/ (Servlet integration)
# Calls use trailing method names. Boolean predicates are ownership_check witnesses, requiring
# an exit before the operation under OrderDominance; only throwing checks are path_guard facts.
version = "1"
language = "java"

[[operation]]
id = "jenkins-credentials-read"
kind = "protected_read"
calls = ["lookupCredentials", "lookupCredentialsInItem", "findCredentialById", "getCredentialsFromId"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"

[[operation]]
# A Stapler doXxx handler is not itself a protected operation; its item lookup is.
id = "jenkins-item-read"
kind = "protected_read"
calls = ["getItemByFullName", "getConfigFile"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"

[[operation]]
id = "jenkins-item-write"
kind = "protected_write"
calls = ["updateByXml", "save"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"

[[operation]]
# JDBC access already named in semantic/java.toml; authorization is separate from SQL escaping.
id = "sql-access"
kind = "protected_read"
calls = ["executeQuery", "execute", "prepareCall"]
requires = ["path_guard", "ownership_check", "identity_constraint"]
sensitivity = "high"

[[operation]]
id = "jenkins-outbound-connection"
kind = "privileged_action"
calls = ["testConnection", "verifyCredentials", "listPropertiesOfSecrets", "openConnection", "connect", "publish"]
requires = ["path_guard", "ownership_check"]
sensitivity = "high"

[[discharger]]
id = "jenkins-permission-guard"
kind = "path_guard"
calls = ["checkPermission", "checkAnyPermission"]

[[discharger]]
id = "permission-predicate"
kind = "ownership_check"
calls = ["hasPermission", "isGranted", "isUserInRole"]

[[discharger]]
# Reading the security context alone is not an authorization guard.
id = "identity-from-context"
kind = "identity_constraint"
identity_sources = ["SecurityContextHolder.getContext().getAuthentication()", "Jenkins.getAuthentication()", "Jenkins.getAuthentication2()", "getUserPrincipal()"]
request_sources = ["getParameter(", "getHeader(", "getCookies(", "getQueryString("]