usnistgov / OSCAL

Open Security Controls Assessment Language (OSCAL)
https://pages.nist.gov/OSCAL/
Other
667 stars 181 forks source link

Add Metaschema support for valid value validation #437

Closed david-waltermire closed 5 years ago

david-waltermire commented 5 years ago

User Story:

As an OSCAL model developer, I need to be able to define a set of valid values that are then checked for in the JSON and XML schema generated from my Metaschema-based model.

Goals:

The Metaschema allows for a set of valid values to be defined for a flag or field. For example:

<define-flag datatype="NCName" name="order">
  <formal-name>Order</formal-name>
  <description>A designation of how a selection of controls in a profile is to be ordered.</description>
  <valid-values>
    <value name="keep">Keep existing order</value>
    <value name="ascending">Sort values ascending</value>
    <value name="descending">Sort values descending</value>
  </valid-values>
</define-flag>

For a given list of valid values, the specified values can be inclusive, allowing other values to be provided that are not in the list, or exclusive (the default), restricting allowed values to only those on the list. The inclusive behavior is used if the <valid-values @allow-other="yes"/> is provided.

These values are displayed in the schema documentation, but when the exclusive case is selected, the values are not constrained by the generated XML or JSON schema. This support needs to be implemented.

A valid values list can be included in the JSON schema using the enum keyword as follows:

"properties": {
  "order": {
    "description": "An enumerated property",
    "type": "string",
    "enum": [
      "keep",
      "ascending",
      "descending"
    ]

  }
},

Dependencies:

This issue will also partially address issue #390, by providing for validation of valid values.

Acceptance Criteria

wendellpiez commented 5 years ago

Addressed in https://github.com/wendellpiez/OSCAL/tree/sprint22-metaschema

iMichaela commented 5 years ago

7/11/2019

This issue and the related ones (noted in #435 ) for the metaschema need to be reviewed together and unitested. However, more unit tests need to be created for the other features.

david-waltermire commented 5 years ago

@wendellpiez I don't think this has been fully implemented in JSON schema validation. We also don't have a unit test for this.

wendellpiez commented 5 years ago

Also to do on this Issue: wire datatype support into Metaschema Schematron so it can validate a set of valid values against a nominal (declared) datatype to ensure they are all acceptable as tokens of that type.

Also, @anweiss suggests Metaschema require flag/@as-type and perhaps field/@as-type, and not assuming strings. Since there are also boolean and numeric types I guess this is fair. @david-waltermire-nist what do you think?

Short list:

david-waltermire commented 5 years ago

Development on this is complete in PR #492. This is ready for review.