From d518ad12d5a82eef4d459835e54cbc00fa922d26 Mon Sep 17 00:00:00 2001
From: Mike Stern <mike-stern@users.noreply.github.com>
Date: Thu, 14 Jan 2021 15:12:43 -0600
Subject: [PATCH] Tasks/issue 32b (#49)

* adding a spec that is broken

in the spirit of:
 - make it break
 - make it work
 - make it pretty

Formatting Report...
passed: 21 / pending: 0 / failed: 4 / total: 25

* surpress some of the xpspec output

* fix the test

* make scenario for party be invalid party-uuid instead of role-id
* fix id's to be more specific
* make scenario for rol be invalid role-id instead of party-uuid

* add rule for parties, roles and responsible-party association

* restructure test location under master SSP scenario per feedback
---
 .gitignore                           |   1 +
 resources/validations/src/ssp.sch    |  15 ++-
 resources/validations/test/ssp.xspec | 131 +++++++++++++++++++++++++++
 3 files changed, 145 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index fe26465f4..ac4eb681b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,5 +5,6 @@ utils
 resources/validations/src/ssp.xsl
 resources/validations/report
 resources/validations/target
+resources/validations/test/xspec/*
 *.DS_Store
 resources/validations/lib/**.jar
diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch
index 81843b6d0..afb0cb1fc 100644
--- a/resources/validations/src/ssp.sch
+++ b/resources/validations/src/ssp.sch
@@ -340,5 +340,16 @@
             >Response statement component remarks for <sch:value-of select="../../@statement-id"/> is too short with <sch:value-of select="$remarks-length"/> characters. It must be <sch:value-of select="$required-length"/> characters long.</sch:assert>
     </sch:rule>
 
-</sch:pattern>
-</sch:schema>
\ No newline at end of file
+ 
+    <sch:rule context="/o:system-security-plan/o:metadata">
+        <sch:let name="parties" value="o:party"/> 
+        <sch:let name="roles" value="o:role"/>
+        <sch:let name="responsible-parties" value="./o:responsible-party"/>
+        <sch:let name="extraneous-roles" value="$responsible-parties[not(@role-id = $roles/@id)]"/>
+        <sch:let name="extraneous-parties" value="$responsible-parties[not(o:party-uuid = $parties/@uuid)]"/>
+
+        <sch:assert id="incorrect-role-association" test="not(exists($extraneous-roles))">This SSP has defined a responsible party with <sch:value-of select="count($extraneous-roles)"/> <sch:value-of select="if (count($extraneous-roles)=1) then ' role' else ' roles'"/> not defined in the role: <sch:value-of select="$extraneous-roles/@role-id"/></sch:assert>
+        <sch:assert id="incorrect-party-association" test="not(exists($extraneous-parties))">This SSP has defined a responsible party with <sch:value-of select="count($extraneous-parties)"/> <sch:value-of select="if (count($extraneous-parties)=1) then ' party' else ' parties'"/> is not a defined party: <sch:value-of select="$extraneous-parties/o:party-uuid"/></sch:assert>
+    </sch:rule>
+  </sch:pattern>
+</sch:schema>
diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec
index 021588f44..7e865cc02 100644
--- a/resources/validations/test/ssp.xspec
+++ b/resources/validations/test/ssp.xspec
@@ -677,6 +677,136 @@
             </x:context>
             <x:expect-not-assert id="extraneous-implemented-requirements" label="it is valid."/>
         </x:scenario>
+        <x:scenario label="when responsible party ">
+            <x:scenario label="references a valid role and valid party">
+                <x:context>
+                    <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0">
+                        <metadata>>
+                            <role id="prepared-by">
+                                <title>Prepared By</title>
+                                <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
+                             </role>
+                             <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+                                <party-name>[SAMPLE]Person Name 1</party-name>
+                                <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual's Title</prop>
+                                <address>
+                                    <addr-line>Mailstop A-1</addr-line>
+                                </address>
+                                <email>name@org.domain</email>
+                                <phone>202-000-0001</phone>
+                                <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
+                                <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
+                            </party>
+                            <responsible-party role-id="prepared-by">
+                                <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+                                <remarks>
+                                <p>Exactly one</p>
+                                </remarks>
+                            </responsible-party>
+                        </metadata>
+                    </system-security-plan>
+                </x:context>
+                <x:expect-not-assert id="incorrect-role-association" label="role positive case."/>
+                <x:expect-not-assert id="incorrect-party-association" label="party positive case."/>
+            </x:scenario>
+            <x:scenario label="references a valid role but invalid party">
+                <x:context>
+                    <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0">
+                        <metadata>>
+                            <role id="prepared-by">
+                                <title>Prepared By</title>
+                                <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
+                             </role>
+
+                             <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+                                <party-name>[SAMPLE]Person Name 1</party-name>
+                                <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual's Title</prop>
+                                <address>
+                                    <addr-line>Mailstop A-1</addr-line>
+                                </address>
+                                <email>name@org.domain</email>
+                                <phone>202-000-0001</phone>
+                                <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
+                                <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
+                            </party>
+
+                            <responsible-party role-id="prepared-by">
+                                <party-uuid>3360e343-9860-4bda-9dfc-xxxxxxxxxxxxx</party-uuid>
+                                <remarks>
+                                <p>Exactly one</p>
+                                </remarks>
+                            </responsible-party>
+                        </metadata>
+                    </system-security-plan>
+                </x:context>
+                <x:expect-assert id="incorrect-party-association" label="party-uuid referenced is not defined, case."/>
+            </x:scenario>
+            
+            <x:scenario label="references an invalid role but valid party">
+                <x:context>
+                    <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0">
+                        <metadata>>
+                            <role id="prepared-by">
+                                <title>Prepared By</title>
+                                <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
+                             </role>
+                             <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+                                <party-name>[SAMPLE]Person Name 1</party-name>
+                                <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual's Title</prop>
+                                <address>
+                                    <addr-line>Mailstop A-1</addr-line>
+                                </address>
+                                <email>name@org.domain</email>
+                                <phone>202-000-0001</phone>
+                                <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
+                                <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
+                            </party>
+                            <responsible-party role-id="prepared-for">
+                                <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+                                <remarks>
+                                <p>Exactly one</p>
+                                </remarks>
+                            </responsible-party>
+                        </metadata>
+                    </system-security-plan>
+                </x:context>
+                <x:expect-assert id="incorrect-role-association" label="role-id referenced is not defined case."/>
+            </x:scenario>
+            
+            <x:scenario  label="references an invalid role and invalid party">
+                <x:context>
+                    <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0">
+                        <metadata>>
+                            <role id="prepared-by">
+                                <title>Prepared By</title>
+                                <desc>The organization that prepared this SSP. If developed in-house, this is the CSP itself.</desc>
+                             </role>
+
+                             <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+                                <party-name>[SAMPLE]Person Name 1</party-name>
+                                <prop name="title" ns="https://fedramp.gov/ns/oscal">Individual's Title</prop>
+                                <address>
+                                    <addr-line>Mailstop A-1</addr-line>
+                                </address>
+                                <email>name@org.domain</email>
+                                <phone>202-000-0001</phone>
+                                <member-of-organization>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</member-of-organization>
+                                <location-uuid>27b78960-59ef-4619-82b0-ae20b9c709ac</location-uuid>
+                            </party>
+
+                            <responsible-party role-id="prepared-for">
+                                <party-uuid>3360e343-9860-4bda-9dfc-xxxxxxxxxxxxx</party-uuid>
+                                <remarks>
+                                <p>Exactly one</p>
+                                </remarks>
+                            </responsible-party>
+                        </metadata>
+                    </system-security-plan>
+                </x:context>
+                <x:expect-assert id="incorrect-party-association" label="party-uuid referenced is not defined, case."/>
+                <x:expect-assert id="incorrect-role-association" label="role-id referenced is not defined case."/>
+            </x:scenario>
+        </x:scenario>
     </x:scenario>
     <x:scenario label="For FedRAMP Automation helper functions">
         <x:scenario label="with if-empty-default">
@@ -842,4 +972,5 @@
             </x:scenario>
         </x:scenario>
     </x:scenario>
+
 </x:description>