add is-unique for inventory assets

GSA · Nov 12, 2024 · 581568e · 581568e
1 parent 6b10783
commit 581568e
Show file tree

Hide file tree

Showing 6 changed files with 122 additions and 5 deletions.
diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
@@ -185,6 +185,8 @@ Examples:
   | security-level-PASS.yaml |
   | security-sensitivity-level-matches-security-impact-level-FAIL.yaml |
   | security-sensitivity-level-matches-security-impact-level-PASS.yaml |
+  | unique-inventory-item-asset-id-FAIL.yaml |
+  | unique-inventory-item-asset-id-PASS.yaml |
   | user-has-authorized-privilege-FAIL.yaml |
   | user-has-authorized-privilege-PASS.yaml |
   | user-has-privilege-level-FAIL.yaml |
@@ -299,6 +301,7 @@ Examples:
   | scan-type |
   | security-level |
   | security-sensitivity-level-matches-security-impact-level |
+  | unique-inventory-item-asset-id |
   | user-has-authorized-privilege |
   | user-has-privilege-level |
   | user-has-role-id |

diff --git a/package-lock.json b/package-lock.json
diff --git a/src/validations/constraints/content/ssp-unique-inventory-item-asset-id-INVALID.xml b/src/validations/constraints/content/ssp-unique-inventory-item-asset-id-INVALID.xml
@@ -0,0 +1,81 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+      <title>System Administrator</title>
+      <prop name="type" value="internal"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+      <role-id>system-admin</role-id>
+      <authorized-privilege>
+        <title>Admin</title>
+        <description>
+          <p>admin user</p>
+        </description>
+        <function-performed>administration</function-performed>
+      </authorized-privilege>
+    </user>
+    <component uuid="55555555-0000-4000-9000-000000000005" type="this-system">
+      <title>Primary Application Server</title>
+      <description>
+        <p>Main application server hosting the core system functionality.</p>
+      </description>
+      <purpose>main line</purpose>
+      <status state="operational"/>
+      <responsible-role role-id="system-admin">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-role>
+      <remarks>
+        <p>This is the primary application server for the system.</p>
+      </remarks>
+    </component>
+    <component uuid="66666666-0000-4000-9000-000000000006" type="interconnection">
+      <title>External API Connection</title>
+      <description>
+        <p>Secure connection to an external API for data enrichment.</p>
+      </description>
+      <prop name="interconnection-security" value="vpn" ns="https://fedramp.gov/ns/oscal"/>
+      <prop name="interconnection-direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
+      <status state="operational"/>
+      <responsible-role role-id="system-admin">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-role>
+      <remarks>
+        <p>This connection is used for secure data exchange with external systems.</p>
+      </remarks>
+    </component>
+    <inventory-item uuid="77777777-0000-4000-9000-000000000007">
+      <description>
+        <p>Primary database server</p>
+      </description>
+      <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      <prop name="asset-type" value="database"/>
+      <prop name="allows-authenticated-scan" value="yes"/>
+      <prop name="public" value="no"/>
+      <prop name="virtual" value="yes"/>
+      <prop name="scan-type" value="database" ns="https://fedramp.gov/ns/oscal"/>
+      <responsible-party role-id="asset-owner">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-party>
+      <implemented-component component-uuid="55555555-0000-4000-9000-000000000005">
+        <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      </implemented-component>
+    </inventory-item>
+    <inventory-item uuid="77777777-0000-4000-9000-000000000007">
+      <description>
+        <p>Primary database server</p>
+      </description>
+      <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      <prop name="asset-type" value="database"/>
+      <prop name="allows-authenticated-scan" value="yes"/>
+      <prop name="public" value="no"/>
+      <prop name="virtual" value="yes"/>
+      <prop name="scan-type" value="database" ns="https://fedramp.gov/ns/oscal"/>
+      <responsible-party role-id="asset-owner">
+        <party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
+      </responsible-party>
+      <implemented-component component-uuid="55555555-0000-4000-9000-000000000005">
+        <prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
+      </implemented-component>
+    </inventory-item>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
@@ -454,5 +454,18 @@
             </expect>
         </constraints>
     </context>
-
+    <context>
+        <metapath target="/system-security-plan/system-implementation"/>
+        <constraints>
+            <is-unique id="unique-inventory-item-asset-id" target="inventory-item/prop[@name='asset-id']">
+                <formal-name>Unique Asset Identifier</formal-name>
+                <description>Ensure each inventory item has a unique asset-id property.</description>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#asset-id"/>
+                <key-field target="@value"/>
+                <remarks>
+                    <p>Asset IDs must be unique across all inventory items to ensure proper identification and tracking of system components.</p>
+                </remarks>
+            </is-unique>
+        </constraints>
+    </context>
 </metaschema-meta-constraints>
diff --git a/src/validations/constraints/unit-tests/unique-inventory-item-asset-id-FAIL.yaml b/src/validations/constraints/unit-tests/unique-inventory-item-asset-id-FAIL.yaml
@@ -0,0 +1,11 @@
+test-case:
+  name: Negative Test for unique-inventory-item-asset-id
+  description: >-
+    This test case validates the behavior of constraint
+    unique-inventory-item-asset-id
+  content: ../content/ssp-unique-inventory-item-asset-id-INVALID.xml
+  expectations:
+    - constraint-id: unique-inventory-item-asset-id
+      fail_count:
+        type: "exact"
+        value: 1
diff --git a/src/validations/constraints/unit-tests/unique-inventory-item-asset-id-PASS.yaml b/src/validations/constraints/unit-tests/unique-inventory-item-asset-id-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for unique-inventory-item-asset-id
+  description: >-
+    This test case validates the behavior of constraint
+    unique-inventory-item-asset-id
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: unique-inventory-item-asset-id
+      result: pass