Toggle Network-Based Checks On and Off

[ohsh6o]

Extended Description

As a tool developer and a reviewer, in order to run the validations in secure and/or offline environments, I want the ability to configure the validations to not perform remote network-based checks over the internet when analyzing external data is required.

Preconditions

• Preconditions...

Acceptance Critera

• Demonstrate the ability to run the validation rules (with or without the interface) with remote outbound network checks when deployed locally on a workstation.

Story Tasks

• [x] An ADR explaining the feature and how to implement it in our architecture.
• [x] Add ability to toggle FedRAMP ATO status check on and off with this capability.
• [x] Add ability to toggle FIPS-140-2 CMVP check on and off with this capability.
• [x] Add ability to toggle attachment (back-matter/resource/@rlink) existence checks on and off with this capability.
• [x] Update developer documentation for Java and Python that this is possible.

Definition of Done

• [x] Acceptance criteria met - Each user story should meet the acceptance criteria in the description
• [x] Unit test coverage of our code > 90% (from QASP) this may be fuzzy and hard to prove
• [x] Code quality checks passed (from QASP) - [ ] Accessibility: (from QASP) as we create guidance or documentation and reports (semantic tagging including aria tags): demonstrate with 0 errors reported for WCAG 2.1 AA standards using an automated scanner and 0 errors reported in manual testing
• [x] Code reviewed - Code reviewed by at least one other team members (or developed by a pair)
• [x] Source code merged - Code that’s demoed must be in source control and merged
• [x] Code must successfully build and deploy into staging environment (from QASP): this may evolve from xslt sh pipline into something more - [ ] Security reviewed and reported - Conduct vulnerability and compliance scanning. threat modeling? - [ ] Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities (from QASP) - [ ] Usability tests passed - Each user story should be easy to use by target users (development community? FedRAMP FART team) - [ ] Usability testing and other user research methods must be conducted at regular intervals throughout the development process (not just at the beginning or end). (from QASP)
• [x] Code refactored for clarity - Code must be clean, self-documenting
• [x] No local design debt
• [x] Load/performance tests passed - test data needed - saxon instrumentation
• [x] Documentation generated - update readme or contributing markdown as necessary.
• [x] Architectural Decision Record completed as necessary for significant design choices

[GaryGapinski]

A Schematron document can reference an xs:boolean XSL param defined within the same document that is optional and has a default value. This can be used to conditionally use XPath functions which refer to XML and text documents (there are no other variants without using extension functions not supported by Saxon-HE) for purposes of existence checks and more. Such an XSL reference will not adversely affect Schematron validation in the context of a schema-driven editor (since the param will always be defined with its default value).

• A suitable name should be chosen for the parameter.
• The default value’s meaning should be the one desired for validations which do not or can not provide a setting for the parameter. Namely, the default value specifies that remote resources are accessed (or not) by default.