/sap-pfcg

name: sap-pfcg
description: |
  PFCG role automation — turns the manual post-diagnosis grind (add a tcode, regenerate,
  user-compare, assign) into one-line commands where every write is confirm-gated with an explicit
  delta preview and PROVEN by an authoritative AGR_* RFC re-read (never "thinks" it changed a role).
  show is a read-only role dossier (AGR_DEFINE/AGR_TEXTS header, AGR_TCODES menu, AGR_USERS
  assignments, AGR_PROF generated profile + AGR_1251 auth-row count, T000 client modifiability).
  assign/unassign add/remove users via the released BAPI_USER_ACTGROUPS_ASSIGN read-modify-write path
  (pure RFC, full-set-replace from a fresh GET_DETAIL + the requested delta ONLY — never over-grants;
  reuses /sap-su01's verified assignment writer, the binding ownership split: pfcg = role->users,
  su01 = user->roles). create / add-tcodes / remove-tcodes / generate drive PFCG (SAPLPRGN_TREE) +
  SUPC (SAPPROFC_NEW) via recorded GUI flows that NEVER enter the authorization tree (Phase 1's
  make-or-break), behind a confirm gate + a Customizing TR (/sap-transport-request --type
  customizing), each verified by an exact AGR_TCODES / AGR_PROF re-read. user-compare delegates
  RHAUTUPD_NEW to /sap-run-report. The auth tree (auth-values/org-levels) is Phase 2; delete is out
  of scope. v1 RFC legs are identical ECC6 + S/4; GUI legs are per-release with PFCG_NEEDS_RECORDING
  degradation. Depends on /sap-suim (before/after grant diff) + the /sap-transport-request
  Customizing-TR extension (both shipped). Prerequisites: pinned /sap-login RFC profile; a live GUI
  session for create/menu/generate; NCo 3.1 (32-bit).
argument-hint: "show <ROLE> | add-tcodes <ROLE> <T1,T2> [--generate] | generate <ROLE> | assign <ROLE> <USER[,..]> | unassign <ROLE> <USER>"

SAP PFCG Role Skill

You make the five safe Phase-1 role changes as one-liners: show (read-only dossier), add/remove menu tcodes, generate the profile (via SUPC, never the auth tree), user-compare, and assign/unassign users — every write confirm-gated on an explicit delta and verified by an authoritative RFC re-read.

Task: $ARGUMENTS

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SKILL_DIR>/references/sap_pfcg_verify.ps1` | `-Mode snapshot\|list` | Role dossier (show) + write-gate re-read | | `<SKILL_DIR>/references/sap_pfcg_create.vbs` | GUI (`%%ROLE_NAME%%`·`%%ROLE_DESC%%`·`%%TRANSPORT%%`·`%%SESSION_PATH%%`·`%%ATTACH_LIB_VBS%%`·`%%SESSION_LOCK_VBS%%`) | PFCG create-single-role — **recorded on EC2 2026-07-11** (Role>Create>Role → desc → Save; step-verified, assembled-driver smoke-test pending) | | `<SKILL_DIR>/references/sap_pfcg_generate.vbs` | GUI (`%%ROLE_NAME%%`·`%%SESSION_PATH%%`·`%%ATTACH_LIB_VBS%%`·`%%SESSION_LOCK_VBS%%`) | Profile generate — **recorded on EC2 2026-07-11**. Uses PFCG's **in-editor Generate** (auth-data screen 120 → Generate → confirm name; makes NO auth-tree edits) — supersedes the original SUPC plan per the "record GUI pfcg" instruction; `PFCG_NEEDS_RECORDING` (exit 3) if `btnPROFIL1` isn't locatable on a release | | `<SKILL_DIR>/references/sap_pfcg_menu.vbs` | GUI | add/remove-tcodes menu flow — **`NEEDS_RECORDING`**: the menu-tab add-transaction goes through a GuiShell-toolbar `pressButton` whose fcode isn't drive-discoverable → needs SAP's built-in recorder (`/sap-gui-probe --record`, Mode R) | | `/sap-su01` (assign/unassign) · `/sap-suim` (fetch-role diff) · `/sap-transport-request` (`--type customizing`) · `/sap-run-report` (RHAUTUPD_NEW) | sub-skills | Reused assignment writer / before-after diff / Customizing TR / user comparison | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_lib.ps1` · `sap_attach_lib.vbs` (`%%ATTACH_LIB_VBS%%`) · `sap_session_lock.vbs` (`%%SESSION_LOCK_VBS%%`) | libs | RFC + Tier-3 attach + write lock | | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` + `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_safety_gate.ps1` | Rule 0 | Environment guard — Step 2 runs `-Action assert` first for every write mode |

---

Step 0 — Directories + Logging

Resolve `work_dir` + `{RUN_TEMP}` (canonical one-liner — `sap_connection_lib.ps1` is dot-sourced there — with `Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))` appended). `{RUN_TEMP}` = the per-run scratch dir holding the log state file; mint it once here and reuse (re-minting breaks the `-Action end` state-file lookup). Start logging (`sap_log_helper.ps1`, state `{RUN_TEMP}\sap_pfcg_run.json`). Pinned RFC profile; GUI session for create/menu/generate.

Step 1 — Parse & Dispatch

`show` | `create` | `add-tcodes` | `remove-tcodes` | `generate` | `user-compare` | `assign` | `unassign`. Uppercase ROLE/TCODES/USERS. Chained flags (`--generate --compare`) run under ONE combined confirm gate.

Step 2 — Preflight (write modes)

**Rule 0 first** (`safety_policy.md`; `show` skips it): `powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-pfcg` — `SAFETY: ALLOW` (0) proceed; `TYPED_CONFIRM_REQUIRED` (3) -> the operator types the shown `PROD <SID>/<CLIENT>` token, re-run with `-ConfirmationText '<their verbatim answer>'`, proceed only on `ALLOW_CONFIRMED`; `REFUSED class=<C>` (1) / `ERROR` (2) -> **STOP**, end `FAILED` with `-ErrorClass <C>`, relay the remediation lines — never bypass or drive PFCG manually instead. The Step 4 confirm still applies after an ALLOW/ALLOW_CONFIRMED.

`sap_pfcg_verify.ps1 -Mode snapshot` gives client modifiability (T000) + role existence: refuse `AUTH_CLIENT_NOT_MODIFIABLE`; create on an existing role -> `PFCG_ROLE_EXISTS`; the others on a missing role -> `AUTH_ROLE_NOT_FOUND`. TSTC-validate each add-tcode; BAPI_USER_EXISTENCE_CHECK each user.

Step 3 — show / BEFORE snapshot

... sap_pfcg_verify.ps1 -Mode snapshot -Role <R> -OutDir "{RUN_TEMP}\pfcg"

`PFCG:` dossier lines (desc / menu_tcodes / assigned_users / generated_profile / auth_rows / client modifiability) + `role_snapshot_<R>.tsv`. `show`