Source-derived document; reported behaviour, inference and evidence gaps are identified in the text.

Return to: Security boundaries

Security boundaries

Where do trust or privileges change, which flows cross those boundaries, and what controls are evidenced?

This view treats a boundary crossing as a flow between the documented desktop application and an actor, external system, or dependency. The strongest evidenced crossings are user-driven menu and form interaction, database access through the stores7 alias, and command execution delegated to _app.execute E0001 E0002. The application is characterized as Swing-based, but the framework implementation, database schema, authentication, authorization, process identity, and deployment assignments are not supplied E0001 E0002.

No documented authentication or authorization control establishes that a crossing changes user privilege. Where a warning, transaction, validation, or deletion check is present, it is described as an evidenced control; its security effectiveness is not verified from these published documents E0001 E0002 E0003 E0004.

Diagram

flowchart LR
  nde8ba9430b218504adb1["User (inferred)"]
  n6859a6379a40ca589e6d["Desktop application"]
  n18e23a86e0b3d7a17d97["stores7 database"]
  n6dc67800eaa9c9098325["Operating system (inferred)"]
  nbbc498a216b66ff6fa14["Framework dependencies"]
  n2842ff50a63027df479a["Application interaction boundary (inferred)"]
  ned901fcd5de63e01ce88["Database persistence boundary (inferred)"]
  n21dcfa1659d2d7b40a0e["Operating-system command boundary (inferred)"]
  nde8ba9430b218504adb1 -.->|"User operates application (inferred)"| n6859a6379a40ca589e6d
  n6859a6379a40ca589e6d -->|"Application accesses database"| n18e23a86e0b3d7a17d97
  n6859a6379a40ca589e6d -->|"Application invokes operating-system command execution"| n6dc67800eaa9c9098325
  n6859a6379a40ca589e6d -->|"Application uses framework dependency"| nbbc498a216b66ff6fa14

Elements

User

Kind: actor
Basis: inferred
Description: A user is inferred from the documented menus, data-entry forms, customer operations, order entry, reports, and interruption of data entry E0001 E0003.
Evidence: E0001 E0003 E0004
Goal: Operate customer, order, stock, and report functions through the desktop application.

Desktop application

Kind: component
Basis: reported
Description: The application has a Swing entry point, a main menu for Customer, Orders, Stock, Reports, and Exit, and an additional bang command that passes user-provided text to _app.execute E0001 E0002.
Evidence: E0001 E0002

stores7 database

Kind: external_system
Basis: reported
Description: The application selects a database alias named stores7; customer and order source code contains database queries and persistence operations, but the actual schema and database host are not supplied E0001 E0002.
Evidence: E0001 E0002

Operating system

Kind: external_system
Basis: inferred
Description: The bang command is described as shell-like because it prompts for a command and passes it to _app.execute; the target operating-system process, execution identity, and permission model are not documented E0001 E0002.
Evidence: E0001 E0002

Framework dependencies

Kind: component
Basis: reported
Description: The source uses com.ais.fc.ix framework classes for application, GUI, input, database, reporting, error handling, and form behavior, while the framework implementations are absent E0001 E0002 E0003 E0004.
Evidence: E0001 E0002 E0003 E0004

Application interaction boundary

Kind: boundary
Basis: inferred
Description: This boundary represents the documented interaction between the user and the desktop application through menus, forms, reports, and interruption of data entry E0001 E0003.
Evidence: E0001 E0003 E0004

Database persistence boundary

Kind: boundary
Basis: inferred
Description: This boundary represents application operations that query or modify database records through the stores7 alias; schema and connection-security details are missing E0001 E0002.
Evidence: E0001 E0002

Operating-system command boundary

Kind: boundary
Basis: inferred
Description: This boundary represents the documented handoff from the application’s bang command to command execution through _app.execute; the warning identifies possible execution errors or unsafe behavior but does not establish the resulting privilege context E0001 E0002.
Evidence: E0001 E0002

Relationships

User operates application

From: User
To: Desktop application
Relation: crosses
Basis: inferred
Description: The user interaction boundary is inferred from documented main-menu commands, customer and order data entry, reports, help, and interruption of entry E0001 E0003.
Evidence: E0001 E0003 E0004
Trigger: Menu selection or form input.
Guard: Customer deletion requires confirmation and is prevented when the customer has related orders; state validation can present valid states for invalid or missing codes E0001 E0003.
Information: Customer, order, stock, state, report-selection, and command-input data E0001 E0003.
Mechanism: Swing-oriented menus and generated form components, with framework input controls and screens E0001 E0003 E0004.
Trust change: No authenticated identity, authorization decision, or privilege change is evidenced.
Control: Confirmation, related-order deletion check, state validation, and an interruption path are documented; their effectiveness and enforcement at runtime are unverified E0001 E0003 E0004.
Owner: Application operator; the responsible organizational owner is not established.

Application accesses database

From: Desktop application
To: stores7 database
Relation: crosses
Basis: reported
Description: The application obtains the stores7 database alias and performs customer and order queries or persistence operations, including customer insertion, update, deletion checks, order insertion, item insertion, commit, and rollback attempts E0001 E0002.
Evidence: E0001 E0002
Trigger: Customer or order operation requiring database access.
Guard: Customer deletion is blocked when the related-order count is nonzero; order insertion attempts transaction handling and rollback on reported failure E0001 E0002.
Information: Customer, order, item, and related-order data E0001 E0002.
Mechanism: Java SQL classes, prepared statements and result wrappers in the customer code, database alias lookup, and transaction calls in order insertion E0001 E0002.
Trust change: The application-to-database privilege context is not established; no database authentication, authorization, encryption, or least-privilege evidence is supplied.
Control: Related-order deletion check and transaction/rollback logic are evidenced, but the framework implementations and schema are absent, so enforcement, failure coverage, and security adequacy are unverified E0001 E0002 E0003.
Owner: Database or application owner is not established.

Application invokes operating-system command execution

From: Desktop application
To: Operating system
Relation: crosses
Basis: reported
Description: The bang command prompts for command text and passes it to _app.execute(true, Str.valueOf(cmd)); the source includes warning W0107 concerning the run instruction E0001 E0002.
Evidence: E0001 E0002
Trigger: Selection of the hidden bang command and entry of command text E0001 E0002.
Guard: A warning about possible unsafe or erroneous command execution is documented; no allowlist, authorization check, escaping rule, confirmation step, or sandbox is evidenced E0001 E0002.
Information: User-supplied command text E0001 E0002.
Mechanism: _app.execute invoked by the bang-command path E0001 E0002.
Trust change: A possible transition from application-controlled input to operating-system command execution is evidenced, but the process identity and resulting privilege are unknown.
Control: The warning is evidenced; preventive command restrictions and runtime enforcement are unverified.
Owner: Application owner is not established.

Application uses framework dependency

From: Desktop application
To: Framework dependencies
Relation: crosses
Basis: reported
Description: The application relies on framework classes for GUI startup, input grids, database access, reporting, error handling, and form behavior, while those implementations are not included E0001 E0002 E0003 E0004.
Evidence: E0001 E0002 E0003 E0004
Trigger: Application startup, form interaction, database operation, report generation, or error handling.
Guard: No framework-level trust or privilege guard is documented.
Information: Form values, database operations, report output, status codes, and command values may pass through framework APIs E0001 E0002 E0003.
Mechanism: GUIApplication, GridInputArray, GridDisplayArray, SQL wrappers, report factories, and custom form classes are referenced by the supplied artifacts E0001 E0002 E0003.
Trust change: No trust or privilege change is established; the framework’s execution context and security controls are unknown.
Control: Application-level validation, status handling, and transaction calls are visible in parts of the source, but framework enforcement and error semantics are unverified E0001 E0002 E0003.
Owner: Framework owner is not established.

Gaps

The evidence does not establish authenticated actors, roles, authorization rules, database credentials, operating-system identities, service accounts, process isolation, network boundaries, encryption, audit logging, or deployment locations E0001 E0002 E0003 E0004.

The stores7 name is an alias, not proof of a database host or deployment relationship, and the framework references do not prove where framework code executes E0001 E0002. The implementation of _app.execute, Construct, DBHelper, ErrorHandler, and related framework classes is missing, leaving command restrictions, SQL construction safety, transaction coverage, and status handling unresolved E0001 E0002.

The documentation conflicts on capabilities: help and second-opinion evidence describe order update/delete and backlog or stock-list reporting as unimplemented, while interfaces and overview material expose those operations as menu or API surfaces E0002 E0003 E0004. This does not by itself identify a boundary weakness, but it limits confidence about which flows can actually cross the application boundary.

Follow-up should obtain the framework and command-execution implementations, database connection and privilege configuration, schema and deployment documentation, authentication and authorization design, and runtime observations of each crossing.

Recovery limitations

• Ownership, mechanism or boundary controls remain explicitly unverified.
• Some identified concepts have no supported connection.
• The view includes explicitly marked inference.

Sources

• E0001 — SHA256 26c6795c3bc4cc1018c05a3a14a9e8bfd1a7ac99525d062262c695930de1f2d0
• E0002 — SHA256 94dd964106462ec595f965ac2acdca80c48d31234c90d9f93ef18c5d0f26cf01
• E0003 — SHA256 d6724e53cd2df11bbcdc4c2e6b8487fa7ffa2317a121b3ebae2594a6130343e0
• E0004 — SHA256 a7fa93a436c487d708267db6e5038c7415b98377a56232869519d6206a15e7e9