emasser 3.4.1 → 3.12.0

data/lib/emasser/help/poam_put_mapper.md

@@ -1,107 +1,107 @@
-Endpoint request parameters/fields
-
-Field                   Data Type  Details
--------------------------------------------------------------------------------------------------
-systemId                 Integer   [Required] Unique eMASS identifier. Will need to provide correct number.
-poamId                   Integer   [Required] Unique POA&M identifier. Will need to provide correct number.
-displayPoamId            Integer   [Required] Globally unique identifier for individual POA&M Items, seen on the front-end as "ID".
-status                   String    [Required] Values include the following: (Ongoing,Risk Accepted,Completed,Not Applicable.
-vulnerabilityDescription String    [Required] Provide a description of the POA&M Item. 2000 Characters.
-sourceIdentVuln          String    [Required] Include Source Identifying Vulnerability text. 2000 Characters.
-pocOrganization          String    [Required] Organization/Office represented. 100 Characters.
-resources                String    [Required] List of resources used. 250 Characters.
-
-milestones               JSON      [Conditional] Please see Notes 1 for more details.
-pocFirstName             String    [Conditional] First name of POC. 100 Characters.
-pocLastName              String    [Conditional] Last name of POC. 100 Characters.
-pocEmail                 String    [Conditional] Email address of POC. 100 Characters.
-pocPhoneNumber           String    [Conditional] Phone number of POC (area code) ***-**** format. 100 Characters.
-severity                 String    [Conditional] Values include the following: (Very Low, Low, Moderate, High, Very High)
-scheduledCompletionDate  Date      [Conditional] Required for ongoing and completed POA&M items. Unix time format.
-completionDate           Date      [Conditional] Field is required for completed POA&M items. Unix time format.
-comments                 String    [Conditional] Field is required for completed and risk accepted POA&M items. 2000 Characters.
-isActive                 Boolean   [Conditional] Optionally used in PUT to delete milestones when updating a POA&M
-
-externalUid              String    [Optional] Unique identifier external to the eMASS application for use with associating POA&M Items. 100 Characters.
-controlAcronym           String    [Optional] Control acronym associated with the POA&M Item. NIST SP 800-53 Revision 4 defined.
-cci                      String    [Optional] CCI associated with the test result.
-securityChecks           String    [Optional] Security Checks that are associated with the POA&M.
-rawSeverity              String    [Optional] Values include the following: (I, II, III)
-
-relevanceOfThreat        String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
-likelihood               String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
-impact                   String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
-impactDescription        String    [Optional] Include description of Security Control's impact.
-residualRiskLevel        String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
-recommendations          String    [Optional] Include recommendations. Character Limit 2,000.
-mitigation               String    [Optional] Include mitigation explanation. 2000 Characters.
-
-isInherited              String    [Read-Only] Indicates whether a POA&M Item is inherited.
-reviewStatus             string    [Read-Only] Values include the following options: (Not Approved, Under Review, Approved)
-extensionDate            Date      [Read-Only] Value returned for a POA&M Item with review status "Approved" and has a milestone
-                                               with a scheduled completion date that extends beyond the POA&M Item’s scheduled completion date.
-
-If any poc information is provided all POC fields are required. See additional details for POC fields below.
-To delete a milestone through the POA&M PUT you must include it as inactive by setting isActive=false.
-If a milestone Id is not provided a new milestone is created. 
-
-Business Rules
-
-
-The following fields are required based on the value of the `status` field
-  |Value           |Required Fields
-  |----------------|--------------------------------------------------------
-  |Risk Accepted   |comments, resources
-  |Ongoing         |scheduledCompletionDate, resources, milestones (at least 1)
-  |Completed       |scheduledCompletionDate, comments, resources,
-  |                |completionDate, milestones (at least 1)
-  |Not Applicable  |POAM can not be created
-
-If a POC email is supplied, the application will attempt to locate a user
-already registered within the application and pre-populate any information
-not explicitly supplied in the request. If no such user is found, these
-fields are required within the request.
-  - pocOrganization, pocFirstName, pocLastName, pocEmail, pocPhoneNumber
-
-Business logic, the following rules apply when adding POA&Ms
-
-- POA&M Item cannot be saved if associated Security Control or AP is inherited.
-- POA&M Item cannot be created manually if a Security Control or AP is Not Applicable.
-- Completed POA&M Item cannot be saved if Completion Date is in the future.
-- Completed POA&M Item cannot be saved if Completion Date (completionDate) is in the future.
-- Risk Accepted POA&M Item cannot be saved with a Scheduled Completion Date (scheduledCompletionDate) or Milestones
-- POA&M Item with a review status of "Not Approved" cannot be saved if Milestone Scheduled Completion Date exceeds POA&M Item  Scheduled Completion Date.
-- POA&M Item with a review status of "Approved" can be saved if Milestone Scheduled Completion Date exceeds POA&M Item Scheduled Completion Date.
-- POA&M Items that have a status of "Completed" and a status of "Ongoing" cannot be saved without Milestones.
-- POA&M Items that have a status of "Risk Accepted" cannot have milestones.
-- POA&M Items with a review status of "Approved" that have a status of "Completed" and "Ongoing" cannot update Scheduled Completion Date.
-- POA&M Items that have a review status of "Approved" are required to have a Severity Value assigned.
-- POA&M Items cannot be updated if they are included in an active package.
-- Archived POA&M Items cannot be updated.
-- POA&M Items with a status of "Not Applicable" will be updated through test result creation.
-- If the Security Control or Assessment Procedure does not exist in the system we may have to just import POA&M Item at the System Level.
-
-
-The following parameters/fields have the following character limitations:
-- POA&M Item cannot be saved if the Point of Contact fields exceed 100 characters:
-  - Office / Organization (pocOrganization)
-  - First Name            (pocFirstName)
-  - Last Name             (pocLastName)
-  - Email                 (email)
-  - Phone Number          (pocPhoneNumber)
-- POA&M Item cannot be saved if Mitigation field (mitigation) exceeds 2,000 characters.
-- POA&M Item cannot be saved if Source Identifying Vulnerability field (sourceIdentVuln) exceeds 2,000 characters.
-- POA&M Item cannot be saved if Comments field (comments) exceeds 2,000 characters 
-- POA&M Item cannot be saved if Resource field (resource) exceeds 250 characters.
-- POA&M Items cannot be saved if Milestone Description (description) exceeds 2,000 characters.
-
-Example:
-
-bundle exec exe/emasser put poams update --systemId [value] --poamId [value] --status [value] --vulnerabilityDescription [value] --sourceIdentVuln [value] --reviewStatus [value]
-
-Notes:
-1 - The format for milestones is:
-    --milestone milestoneId:[value] description:[value] scheduledCompletionDate:[value]
-2 - The example is only showing the required fields. Refer to instructions listed above for conditional and optional fields requirements.
-3 - If a field is misrepresented (wrong value) the following response may be provided by the server:
-Response body: {"meta":{"code":500,"errorMessage":"Sorry! Something went wrong on our end. Please contact emass_support@bah.com for assistance."}}
+Endpoint request parameters/fields
+
+Field                   Data Type  Details
+-------------------------------------------------------------------------------------------------
+systemId                 Integer   [Required] Unique eMASS identifier. Will need to provide correct number.
+poamId                   Integer   [Required] Unique POA&M identifier. Will need to provide correct number.
+displayPoamId            Integer   [Required] Globally unique identifier for individual POA&M Items, seen on the front-end as "ID".
+status                   String    [Required] Values include the following: (Ongoing,Risk Accepted,Completed,Not Applicable.
+vulnerabilityDescription String    [Required] Provide a description of the POA&M Item. 2000 Characters.
+sourceIdentVuln          String    [Required] Include Source Identifying Vulnerability text. 2000 Characters.
+pocOrganization          String    [Required] Organization/Office represented. 100 Characters.
+resources                String    [Required] List of resources used. 250 Characters.
+
+milestones               JSON      [Conditional] Please see Notes 1 for more details.
+pocFirstName             String    [Conditional] First name of POC. 100 Characters.
+pocLastName              String    [Conditional] Last name of POC. 100 Characters.
+pocEmail                 String    [Conditional] Email address of POC. 100 Characters.
+pocPhoneNumber           String    [Conditional] Phone number of POC (area code) ***-**** format. 100 Characters.
+severity                 String    [Conditional] Values include the following: (Very Low, Low, Moderate, High, Very High)
+scheduledCompletionDate  Date      [Conditional] Required for ongoing and completed POA&M items. Unix time format.
+completionDate           Date      [Conditional] Field is required for completed POA&M items. Unix time format.
+comments                 String    [Conditional] Field is required for completed and risk accepted POA&M items. 2000 Characters.
+isActive                 Boolean   [Conditional] Optionally used in PUT to delete milestones when updating a POA&M
+
+externalUid              String    [Optional] Unique identifier external to the eMASS application for use with associating POA&M Items. 100 Characters.
+controlAcronym           String    [Optional] Control acronym associated with the POA&M Item. NIST SP 800-53 Revision 4 defined.
+cci                      String    [Optional] CCI associated with the test result.
+securityChecks           String    [Optional] Security Checks that are associated with the POA&M.
+rawSeverity              String    [Optional] Values include the following: (I, II, III)
+
+relevanceOfThreat        String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
+likelihood               String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
+impact                   String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
+impactDescription        String    [Optional] Include description of Security Control's impact.
+residualRiskLevel        String    [Optional] Values include the following: (Very Low, Low, Moderate, High, Very High)
+recommendations          String    [Optional] Include recommendations. Character Limit 2,000.
+mitigation               String    [Optional] Include mitigation explanation. 2000 Characters.
+
+isInherited              String    [Read-Only] Indicates whether a POA&M Item is inherited.
+reviewStatus             string    [Read-Only] Values include the following options: (Not Approved, Under Review, Approved)
+extensionDate            Date      [Read-Only] Value returned for a POA&M Item with review status "Approved" and has a milestone
+                                               with a scheduled completion date that extends beyond the POA&M Item’s scheduled completion date.
+
+If any poc information is provided all POC fields are required. See additional details for POC fields below.
+To delete a milestone through the POA&M PUT you must include it as inactive by setting isActive=false.
+If a milestone Id is not provided a new milestone is created. 
+
+Business Rules
+
+
+The following fields are required based on the value of the `status` field
+  |Value           |Required Fields
+  |----------------|--------------------------------------------------------
+  |Risk Accepted   |comments, resources
+  |Ongoing         |scheduledCompletionDate, resources, milestones (at least 1)
+  |Completed       |scheduledCompletionDate, comments, resources,
+  |                |completionDate, milestones (at least 1)
+  |Not Applicable  |POAM can not be created
+
+If a POC email is supplied, the application will attempt to locate a user
+already registered within the application and pre-populate any information
+not explicitly supplied in the request. If no such user is found, these
+fields are required within the request.
+  - pocOrganization, pocFirstName, pocLastName, pocEmail, pocPhoneNumber
+
+Business logic, the following rules apply when adding POA&Ms
+
+- POA&M Item cannot be saved if associated Security Control or AP is inherited.
+- POA&M Item cannot be created manually if a Security Control or AP is Not Applicable.
+- Completed POA&M Item cannot be saved if Completion Date is in the future.
+- Completed POA&M Item cannot be saved if Completion Date (completionDate) is in the future.
+- Risk Accepted POA&M Item cannot be saved with a Scheduled Completion Date (scheduledCompletionDate) or Milestones
+- POA&M Item with a review status of "Not Approved" cannot be saved if Milestone Scheduled Completion Date exceeds POA&M Item  Scheduled Completion Date.
+- POA&M Item with a review status of "Approved" can be saved if Milestone Scheduled Completion Date exceeds POA&M Item Scheduled Completion Date.
+- POA&M Items that have a status of "Completed" and a status of "Ongoing" cannot be saved without Milestones.
+- POA&M Items that have a status of "Risk Accepted" cannot have milestones.
+- POA&M Items with a review status of "Approved" that have a status of "Completed" and "Ongoing" cannot update Scheduled Completion Date.
+- POA&M Items that have a review status of "Approved" are required to have a Severity Value assigned.
+- POA&M Items cannot be updated if they are included in an active package.
+- Archived POA&M Items cannot be updated.
+- POA&M Items with a status of "Not Applicable" will be updated through test result creation.
+- If the Security Control or Assessment Procedure does not exist in the system we may have to just import POA&M Item at the System Level.
+
+
+The following parameters/fields have the following character limitations:
+- POA&M Item cannot be saved if the Point of Contact fields exceed 100 characters:
+  - Office / Organization (pocOrganization)
+  - First Name            (pocFirstName)
+  - Last Name             (pocLastName)
+  - Email                 (email)
+  - Phone Number          (pocPhoneNumber)
+- POA&M Item cannot be saved if Mitigation field (mitigation) exceeds 2,000 characters.
+- POA&M Item cannot be saved if Source Identifying Vulnerability field (sourceIdentVuln) exceeds 2,000 characters.
+- POA&M Item cannot be saved if Comments field (comments) exceeds 2,000 characters 
+- POA&M Item cannot be saved if Resource field (resource) exceeds 250 characters.
+- POA&M Items cannot be saved if Milestone Description (description) exceeds 2,000 characters.
+
+Example:
+
+bundle exec exe/emasser put poams update --systemId [value] --poamId [value] --status [value] --vulnerabilityDescription [value] --sourceIdentVuln [value] --reviewStatus [value]
+
+Notes:
+1 - The format for milestones is:
+    --milestone milestoneId:[value] description:[value] scheduledCompletionDate:[value]
+2 - The example is only showing the required fields. Refer to instructions listed above for conditional and optional fields requirements.
+3 - If a field is misrepresented (wrong value) the following response may be provided by the server:
+Response body: {"meta":{"code":500,"errorMessage":"Sorry! Something went wrong on our end. Please contact emass_support@bah.com for assistance."}}

data/lib/emasser/help/staticcode_clear_mapper.md

@@ -1,16 +1,16 @@
-Add static code scans into a system asset module
-
-Endpoint request parameters/fields
-
-Field            Data Type  Details
-------------------------------------------------------------------------------------------
-systemId         Integer    [Required] Unique system identifier
-applicationName  String     [Required] Name of the software application that was assessed
-version          String     [Required] The version of the application
-clearFindings*   Boolean    [Required] To clear an application's findings set it to true
-
-*The clearFindings field is an optional field, but required with a value of "True" to clear out all application findings for a single application/version pairing.
-  
-Example:
-
-bundle exec exe/emasser post scan_findings clear --systemId [value] --applicationName [value] --version [value] --clearFindings
+Add static code scans into a system asset module
+
+Endpoint request parameters/fields
+
+Field            Data Type  Details
+------------------------------------------------------------------------------------------
+systemId         Integer    [Required] Unique system identifier
+applicationName  String     [Required] Name of the software application that was assessed
+version          String     [Required] The version of the application
+clearFindings*   Boolean    [Required] To clear an application's findings set it to true
+
+*The clearFindings field is an optional field, but required with a value of "True" to clear out all application findings for a single application/version pairing.
+  
+Example:
+
+bundle exec exe/emasser post scan_findings clear --systemId [value] --applicationName [value] --version [value] --clearFindings

data/lib/emasser/help/staticcode_post_mapper.md

@@ -1,21 +1,21 @@
-Add static code scans into a system asset module
-
-Endpoint request parameters/fields
-
-Field                   Data Type  Details
--------------------------------------------------------------------------------------------------
-systemId                Integer    [Required] Unique system identifier
-applicationName         String     [Required] Name of the software application that was assessed
-version                 String     [Required] The version of the application
-codeCheckName           String     [Required] Name of the software vulnerability or weakness
-scanDate                Integer    [Required] The findings scan date - Unix time format
-cweId                   String     [Required] The Common Weakness Enumerator (CWE) identifier
-
-rawSeverity*            String     [Optional] Values include the following: (Low, Medium, Moderate, High, Critical)
-count                   Integer    [Optional] Number of instances observed for a specified finding
-
-*rawSeverity: In eMASS, values of "Critical" will appear as "Very High", and values of “Medium” will appear as "Moderate". Any values not listed as options in the list above will map to “Unknown” and appear as blank values.
-
-Example:
-
-bundle exec exe/emasser post scan_findings add --systemId [value] --applicationName [value] --version [value] --codeCheckName [value] --scanDate [value] --cweId [value]
+Add static code scans into a system asset module
+
+Endpoint request parameters/fields
+
+Field                   Data Type  Details
+-------------------------------------------------------------------------------------------------
+systemId                Integer    [Required] Unique system identifier
+applicationName         String     [Required] Name of the software application that was assessed
+version                 String     [Required] The version of the application
+codeCheckName           String     [Required] Name of the software vulnerability or weakness
+scanDate                Integer    [Required] The findings scan date - Unix time format
+cweId                   String     [Required] The Common Weakness Enumerator (CWE) identifier
+
+rawSeverity*            String     [Optional] Values include the following: (Low, Medium, Moderate, High, Critical)
+count                   Integer    [Optional] Number of instances observed for a specified finding
+
+*rawSeverity: In eMASS, values of "Critical" will appear as "Very High", and values of “Medium” will appear as "Moderate". Any values not listed as options in the list above will map to “Unknown” and appear as blank values.
+
+Example:
+
+bundle exec exe/emasser post scan_findings add --systemId [value] --applicationName [value] --version [value] --codeCheckName [value] --scanDate [value] --cweId [value]

data/lib/emasser/help/testresults_post_mapper.md

@@ -1,21 +1,21 @@
-Endpoint request body parameters/fields
-
-Field            Data Type   Details
--------------------------------------------------------------------------------------------------
-systemId         Integer     [Required] Unique eMASS identifier. Will need to provide correct number
-cci              String      [Required] CCI associated with the test result.
-isInherited      Boolean     [Read-Only] Indicates whether a test result is inherited.
-testedBy         String      [Required] Last Name, First Name. 100 Characters. 
-testDate         Date        [Required] Unix time format.
-description      String      [Required] Include description of test result. 4000 Characters.
-type             String      [Read-Only] Indicates the location in the Control Approval Chain when the test result is submitted.
-complianceStatus String      [Required] Values include the following: (Compliant, Non-Compliant, Not Applicable)
-
-control          String      [Read-Only] Control acronym associated with the test result. NIST SP 800-53 Revision 4 defined.
-
-Example:
-
-bundle exec exe/emasser post test_results add --systemId [value] --cci [value] --testedBy [value] --testDate [value] --description [value] --complianceStatus [value]
-
-Note: If no POA&Ms or AP exist for the control (system), you will get this response:
-"You have entered a Non-Compliant Test Result. You must create a POA&M Item for this Control and/or AP if one does not already exist."
+Endpoint request body parameters/fields
+
+Field            Data Type   Details
+-------------------------------------------------------------------------------------------------
+systemId         Integer     [Required] Unique eMASS identifier. Will need to provide correct number
+cci              String      [Required] CCI associated with the test result.
+isInherited      Boolean     [Read-Only] Indicates whether a test result is inherited.
+testedBy         String      [Required] Last Name, First Name. 100 Characters. 
+testDate         Date        [Required] Unix time format.
+description      String      [Required] Include description of test result. 4000 Characters.
+type             String      [Read-Only] Indicates the location in the Control Approval Chain when the test result is submitted.
+complianceStatus String      [Required] Values include the following: (Compliant, Non-Compliant, Not Applicable)
+
+control          String      [Read-Only] Control acronym associated with the test result. NIST SP 800-53 Revision 4 defined.
+
+Example:
+
+bundle exec exe/emasser post test_results add --systemId [value] --cci [value] --testedBy [value] --testDate [value] --description [value] --complianceStatus [value]
+
+Note: If no POA&Ms or AP exist for the control (system), you will get this response:
+"You have entered a Non-Compliant Test Result. You must create a POA&M Item for this Control and/or AP if one does not already exist."

data/lib/emasser/help.rb

@@ -1,11 +1,11 @@
-# frozen_string_literal: true
-
-module Emasser::Help
-  class << self
-    def text(namespaced_command)
-      path = namespaced_command.to_s.tr(':', '/')
-      path = File.expand_path("../help/#{path}.md", __FILE__)
-      File.read(path) if File.exist?(path)
-    end
-  end
-end
+# frozen_string_literal: true
+
+module Emasser::Help
+  class << self
+    def text(namespaced_command)
+      path = namespaced_command.to_s.tr(':', '/')
+      path = File.expand_path("../help/#{path}.md", __FILE__)
+      File.read(path) if File.exist?(path)
+    end
+  end
+end

data/lib/emasser/input_converters.rb

@@ -1,21 +1,21 @@
-# frozen_string_literal: true
-
-require 'active_support/inflector'
-require 'active_support/core_ext/hash'
-
-module InputConverters
-  # Method uses utility class "underscore" from ActiveSupport
-  include ActiveSupport::Inflector
-
-  # Given the full hash of options, select the truly optional ones and then
-  # convert the camelCase optional CLI parameters to underscore as the Swagger auto
-  # generated code converts all camelCase variable within the yaml to an underscore format
-  # This will result in a properly formatted hash of parameters for the API request.
-  # example: controlAcronyms TO control_acronyms
-  #
-  # As an alternative, declare the options in underscore case and only select for the optional_options.
-  def to_input_hash(optional_options_keys, full_options)
-    optional_options_hash = full_options.select { |option| optional_options_keys.include?(option.to_sym) }
-    optional_options_hash.transform_keys { |k| k.to_s.underscore.to_sym }
-  end
-end
+# frozen_string_literal: true
+
+require 'active_support/inflector'
+require 'active_support/core_ext/hash'
+
+module InputConverters
+  # Method uses utility class "underscore" from ActiveSupport
+  include ActiveSupport::Inflector
+
+  # Given the full hash of options, select the truly optional ones and then
+  # convert the camelCase optional CLI parameters to underscore as the Swagger auto
+  # generated code converts all camelCase variable within the yaml to an underscore format
+  # This will result in a properly formatted hash of parameters for the API request.
+  # example: controlAcronyms TO control_acronyms
+  #
+  # As an alternative, declare the options in underscore case and only select for the optional_options.
+  def to_input_hash(optional_options_keys, full_options)
+    optional_options_hash = full_options.select { |option| optional_options_keys.include?(option.to_sym) }
+    optional_options_hash.transform_keys { |k| k.to_s.underscore.to_sym }
+  end
+end

data/lib/emasser/options_parser.rb

@@ -1,20 +1,20 @@
-# frozen_string_literal: true
-
-module OptionsParser
-  def required_options(initializer)
-    options_that_are(initializer, :required)
-  end
-
-  def optional_options(initializer)
-    options_that_are(initializer, :optional)
-  end
-
-  private
-
-  def options_that_are(initializer, constraint)
-    raise(ArgumentError, 'constraint must be required or optional') unless %i[required optional].include?(constraint)
-
-    method = constraint.eql?(:required) ? :select : :reject
-    initializer[2][:current_command].options.send(method) { |_k, v| v.required }
-  end
-end
+# frozen_string_literal: true
+
+module OptionsParser
+  def required_options(initializer)
+    options_that_are(initializer, :required)
+  end
+
+  def optional_options(initializer)
+    options_that_are(initializer, :optional)
+  end
+
+  private
+
+  def options_that_are(initializer, constraint)
+    raise(ArgumentError, 'constraint must be, required or optional') unless %i[required optional].include?(constraint)
+
+    method = constraint.eql?(:required) ? :select : :reject
+    initializer[2][:current_command].options.send(method) { |_k, v| v.required }
+  end
+end