Add Leveraged Authorization Entry Constraints

features/fedramp_extensions.feature

@@ -102,6 +102,9 @@ Examples:
   | inventory-item-allows-authenticated-scan |
   | inventory-item-public |
   | inventory-item-virtual |
+  | leveraged-authorization-has-authorization-type |
+  | leveraged-authorization-has-impact-level |
+  | leveraged-authorization-has-system-identifier |
   | leveraged-authorization-nature-of-agreement |
   | marking |
   | missing-response-components |
@@ -301,6 +304,12 @@ Examples:
   | inventory-item-public-PASS.yaml |
   | inventory-item-virtual-FAIL.yaml |
   | inventory-item-virtual-PASS.yaml |
+  | leveraged-authorization-has-authorization-type-FAIL.yaml |
+  | leveraged-authorization-has-authorization-type-PASS.yaml |
+  | leveraged-authorization-has-impact-level-FAIL.yaml |
+  | leveraged-authorization-has-impact-level-PASS.yaml |
+  | leveraged-authorization-has-system-identifier-FAIL.yaml |
+  | leveraged-authorization-has-system-identifier-PASS.yaml |
   | leveraged-authorization-nature-of-agreement-FAIL.yaml |
   | leveraged-authorization-nature-of-agreement-PASS.yaml |
   | marking-FAIL.yaml |

src/validations/constraints/content/ssp-leveraged-authorization-has-authorization-type-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/> Missing authorization-type -->
+      <date-authorized>2015-01-01</date-authorized>
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-impact-level-INVALID.xml

@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/> Missing impact-level -->
+      <party-uuid>f0bc13a4-3303-47dd-80d3-380e159c8362</party-uuid>
+      <date-authorized>2015-01-01</date-authorized>
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-system-identifier-INVALID.xml

@@ -0,0 +1,7 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="leveraged-system-identifier" value="F1603047866"/> Missing leveraged-system-identifier -->
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -517,6 +517,21 @@
 				<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
 				<message>A FedRAMP SSP system implementation section MUST have at least two inventory items.</message>
 			</expect>
+            <expect id="leveraged-authorization-has-authorization-type" target="leveraged-authorization" test="count(prop[@name='authorization-type'][@ns='https://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has Authorization Type</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one authorization type for each leveraged authorization entry.</message>
+            </expect>
+            <expect id="leveraged-authorization-has-impact-level" target="leveraged-authorization" test="count(prop[@name='impact-level'][@ns='https://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has Impact Level</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one impact level for each leveraged authorization entry.</message>
+            </expect>
+            <expect id="leveraged-authorization-has-system-identifier" target="leveraged-authorization" test="count(prop[@name='leveraged-system-identifier'][@ns='https://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has System Identifier</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one system identifier for each leveraged authorization entry.</message>
+            </expect>
 		</constraints>
 	</context>    
     <context>

src/validations/constraints/unit-tests/leveraged-authorization-has-authorization-type-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-authorization-type
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-authorization-type
+  content: ../content/ssp-leveraged-authorization-has-authorization-type-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-authorization-type
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-authorization-type-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-authorization-type
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-authorization-type
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-authorization-type
+      result: pass

src/validations/constraints/unit-tests/leveraged-authorization-has-impact-level-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-impact-level
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-impact-level
+  content: ../content/ssp-leveraged-authorization-has-impact-level-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-impact-level
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-impact-level-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-impact-level
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-impact-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-impact-level
+      result: pass

src/validations/constraints/unit-tests/leveraged-authorization-has-system-identifier-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-system-identifier
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-system-identifier
+  content: ../content/ssp-leveraged-authorization-has-system-identifier-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-system-identifier
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-system-identifier-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-system-identifier
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-system-identifier
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-system-identifier
+      result: pass