introduce user constraints

GSA · Oct 4, 2024 · f163f8a · f163f8a
1 parent 8301e38
commit f163f8a
Show file tree

Hide file tree

Showing 25 changed files with 224 additions and 0 deletions.
diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
@@ -137,6 +137,20 @@ Examples:
   | scan-type-PASS.yaml |
   | security-level-FAIL.yaml |
   | security-level-PASS.yaml |
+  | user-has-authorized-privilege-FAIL.yaml |
+  | user-has-authorized-privilege-PASS.yaml |
+  | user-has-privilege-level-FAIL.yaml |
+  | user-has-privilege-level-PASS.yaml |
+  | user-has-role-id-FAIL.yaml |
+  | user-has-role-id-PASS.yaml |
+  | user-has-sensitivity-level-FAIL.yaml |
+  | user-has-sensitivity-level-PASS.yaml |
+  | user-has-user-type-FAIL.yaml |
+  | user-has-user-type-PASS.yaml |
+  | user-privilege-level-FAIL.yaml |
+  | user-privilege-level-PASS.yaml |
+  | user-sensitivity-level-FAIL.yaml |
+  | user-sensitivity-level-PASS.yaml |
   | user-type-FAIL.yaml |
   | user-type-PASS.yaml |
 #END_DYNAMIC_TEST_CASES
@@ -215,5 +229,12 @@ Examples:
   | role-defined-system-owner |
   | scan-type |
   | security-level |
+  | user-has-authorized-privilege |
+  | user-has-privilege-level |
+  | user-has-role-id |
+  | user-has-sensitivity-level |
+  | user-has-user-type |
+  | user-privilege-level |
+  | user-sensitivity-level |
   | user-type |
 #END_DYNAMIC_CONSTRAINT_IDS
diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -151,7 +151,14 @@
       <title>System Administrator</title>
       <prop name="type" value="internal"/>
       <prop name="privilege-level" value="read-write"/>
+      <prop ns='https://fedramp.gov/ns/oscal' name="sensitivity" value="high-risk"/>
       <role-id>system-admin</role-id>
+      <authorized-privilege>
+        <title>Admin</title>
+        <description><p>admin user</p></description>
+        <function-performed>administration</function-performed>
+      </authorized-privilege>
+
     </user>
 
     <component uuid="55555555-0000-4000-9000-000000000005" type="this-system">

diff --git a/src/validations/constraints/content/ssp-user-has-authorized-privilege-INVALID.xml b/src/validations/constraints/content/ssp-user-has-authorized-privilege-INVALID.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-has-privilege-level-INVALID.xml b/src/validations/constraints/content/ssp-user-has-privilege-level-INVALID.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-has-role-id-INVALID.xml b/src/validations/constraints/content/ssp-user-has-role-id-INVALID.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-has-sensitivity-level-INVALID.xml b/src/validations/constraints/content/ssp-user-has-sensitivity-level-INVALID.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-has-user-type-INVALID.xml b/src/validations/constraints/content/ssp-user-has-user-type-INVALID.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-privilege-level-INVALID.xml b/src/validations/constraints/content/ssp-user-privilege-level-INVALID.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+      <prop name="privilege-level" value="invalid"/>
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/content/ssp-user-sensitivity-level-INVALID.xml b/src/validations/constraints/content/ssp-user-sensitivity-level-INVALID.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <user uuid="44444444-0000-4000-9000-000000000004">
+      <prop ns='https://fedramp.gov/ns/oscal' name="sensitivity" value="infinite-risk"/>
+    </user>
+  </system-implementation>
+</system-security-plan>
diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -196,6 +196,24 @@
                 <enum value="no">No</enum>
             </allowed-values>
 
+
+            <allowed-values id="user-privilege-level" target="//user/prop[@name='privilege-level']/@value" allow-other="no" level="ERROR">
+                        <formal-name>Privilege Level</formal-name>
+                        <description>The privilege level of the user.</description>
+                        <enum value="read">Read</enum>
+                        <enum value="read-write">Read-Write</enum>
+                        <enum value="write">Write</enum>
+                        <enum value="no-access">No Access</enum>
+                    </allowed-values>
+            <allowed-values id="user-sensitivity-level" target="//user/prop[@ns='https://fedramp.gov/ns/oscal' and @name='sensitivity']/@value"  allow-other="no" level="ERROR">
+                        <formal-name>User Sensitvity Level</formal-name>
+                        <description>Sensitivity level of the user.</description>
+                        <enum value="high-risk">High Risk</enum>
+                        <enum value="severe">Severe</enum>
+                        <enum value="moderate">Moderate</enum>
+                        <enum value="limited">Limited</enum>
+                        <enum value="not-applicable">Not Applicable</enum>
+            </allowed-values>
         </constraints>
 
     </context>

diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
@@ -29,6 +29,27 @@
             </expect>
         </constraints>
     </context>
+    <context>
+        <metapath target="//user"/>
+        <constraints>
+
+        <expect id="user-has-user-type" target="." test="count(prop[@name='type']) = 1">
+            <message>User must have a single type prop.</message>
+        </expect>
+        <expect id="user-has-privilege-level" target="." test="count(prop[@name='privilege-level']) = 1">
+            <message>User must have a single privilege prop.</message>
+        </expect>
+        <expect id="user-has-sensitivity-level" target="." test="count(prop[@name='sensitivity']) = 1">
+            <message>User must have a single sensitivity prop.</message>
+        </expect>
+        <expect id="user-has-role-id" target="." test="count(role-id) gt 0">
+            <message>User must have at least one role id.</message>
+        </expect>
+        <expect id="user-has-authorized-privilege" target="." test="count(authorized-privilege) gt 0">
+            <message>User must have at least one authorized privilege id.</message>
+        </expect>
+        </constraints>
+    </context>
     <context>
         <metapath target="/system-security-plan"/>
         <constraints>

diff --git a/src/validations/constraints/unit-tests/user-has-authorized-privilege-FAIL.yaml b/src/validations/constraints/unit-tests/user-has-authorized-privilege-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for user-has-authorized-privilege
+  description: >-
+    This test case validates the behavior of constraint
+    user-has-authorized-privilege
+  content: ../content/ssp-user-has-authorized-privilege-INVALID.xml
+  expectations:
+    - constraint-id: user-has-authorized-privilege
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-has-authorized-privilege-PASS.yaml b/src/validations/constraints/unit-tests/user-has-authorized-privilege-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for user-has-authorized-privilege
+  description: >-
+    This test case validates the behavior of constraint
+    user-has-authorized-privilege
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-has-authorized-privilege
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-has-privilege-level-FAIL.yaml b/src/validations/constraints/unit-tests/user-has-privilege-level-FAIL.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for user-has-privilege-level
+  description: This test case validates the behavior of constraint user-has-privilege-level
+  content: ../content/ssp-user-has-privilege-level-INVALID.xml
+  expectations:
+    - constraint-id: user-has-privilege-level
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-has-privilege-level-PASS.yaml b/src/validations/constraints/unit-tests/user-has-privilege-level-PASS.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for user-has-privilege-level
+  description: This test case validates the behavior of constraint user-has-privilege-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-has-privilege-level
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-has-role-id-FAIL.yaml b/src/validations/constraints/unit-tests/user-has-role-id-FAIL.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for user-has-role-id
+  description: This test case validates the behavior of constraint user-has-role-id
+  content: ../content/ssp-user-has-role-id-INVALID.xml
+  expectations:
+    - constraint-id: user-has-role-id
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-has-role-id-PASS.yaml b/src/validations/constraints/unit-tests/user-has-role-id-PASS.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for user-has-role-id
+  description: This test case validates the behavior of constraint user-has-role-id
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-has-role-id
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-has-sensitivity-level-FAIL.yaml b/src/validations/constraints/unit-tests/user-has-sensitivity-level-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for user-has-sensitivity-level
+  description: >-
+    This test case validates the behavior of constraint
+    user-has-sensitivity-level
+  content: ../content/ssp-user-has-sensitivity-level-INVALID.xml
+  expectations:
+    - constraint-id: user-has-sensitivity-level
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-has-sensitivity-level-PASS.yaml b/src/validations/constraints/unit-tests/user-has-sensitivity-level-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for user-has-sensitivity-level
+  description: >-
+    This test case validates the behavior of constraint
+    user-has-sensitivity-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-has-sensitivity-level
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-has-user-type-FAIL.yaml b/src/validations/constraints/unit-tests/user-has-user-type-FAIL.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for user-has-user-type
+  description: This test case validates the behavior of constraint user-has-user-type
+  content: ../content/ssp-user-has-user-type-INVALID.xml
+  expectations:
+    - constraint-id: user-has-user-type
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-has-user-type-PASS.yaml b/src/validations/constraints/unit-tests/user-has-user-type-PASS.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for user-has-user-type
+  description: This test case validates the behavior of constraint user-has-user-type
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-has-user-type
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-privilege-level-FAIL.yaml b/src/validations/constraints/unit-tests/user-privilege-level-FAIL.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for user-privilege-level
+  description: This test case validates the behavior of constraint user-privilege-level
+  content: ../content/ssp-user-privilege-level-INVALID.xml
+  expectations:
+    - constraint-id: user-privilege-level
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-privilege-level-PASS.yaml b/src/validations/constraints/unit-tests/user-privilege-level-PASS.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for user-privilege-level
+  description: This test case validates the behavior of constraint user-privilege-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-privilege-level
+      result: pass
diff --git a/src/validations/constraints/unit-tests/user-sensitivity-level-FAIL.yaml b/src/validations/constraints/unit-tests/user-sensitivity-level-FAIL.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Negative Test for user-sensitivity-level
+  description: This test case validates the behavior of constraint user-sensitivity-level
+  content: ../content/ssp-user-sensitivity-level-INVALID.xml
+  expectations:
+    - constraint-id: user-sensitivity-level
+      result: fail
diff --git a/src/validations/constraints/unit-tests/user-sensitivity-level-PASS.yaml b/src/validations/constraints/unit-tests/user-sensitivity-level-PASS.yaml
@@ -0,0 +1,7 @@
+test-case:
+  name: Positive Test for user-sensitivity-level
+  description: This test case validates the behavior of constraint user-sensitivity-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: user-sensitivity-level
+      result: pass