filegrc 0.16.12 → 0.16.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.12",
+  "version": "0.16.13",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -27,6 +27,13 @@ const unorderedStringArrayFields = new Set([
   "tags"
 ]);
 
+const applicabilityDecisionFields = {
+  requirement: ["frameworkId", "reference", "description", "parentRequirementId"],
+  control: ["statement", "requirementIds", "code", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"],
+  commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "requirementIds", "controlIds", "customerFacing", "reportingRouteRequirements"],
+  "complementary-control": ["responsibleParty", "statement", "systemIds", "vendorId", "requirementIds", "commitmentIds", "relatedControlIds", "sourceDocumentIds", "componentIds"]
+};
+
 export function applicabilityScopeRevision(record, program, resources, model, options = {}) {
   const scopedResource = ["commitment", "control", "complementary-control"].includes(record?.type)
     && !options.legacyBroadScope && !options.legacyBroadCommitment;
@@ -83,8 +90,7 @@ export function applicabilityScopeRevision(record, program, resources, model, op
           .sort((left, right) => left.requirementId.localeCompare(right.requirementId))
       })
     },
-    resource: canonicalObject(model, record.type, Object.fromEntries(Object.entries(record)
-      .filter(([field]) => !excludedResourceFields.has(field)))),
+    resource: applicabilityResourceFacts(record, model, options),
     systems: resources
       .filter(({ type, id }) => type === "system" && selectedSystemIds.has(id))
       .sort(compareRecordIds)
@@ -196,6 +202,17 @@ function compareRecordIds(left, right) {
   return left.id.localeCompare(right.id);
 }
 
+function applicabilityResourceFacts(record, model, options) {
+  const fields = Number(model.modelVersion) >= 11 && !options.legacyResourceProjection
+    ? applicabilityDecisionFields[record.type] : null;
+  if (!fields) return canonicalObject(model, record.type, Object.fromEntries(Object.entries(record)
+    .filter(([field]) => !excludedResourceFields.has(field))));
+  const value = Object.fromEntries(["id", "type", "title", "externalIds", "extensions", ...fields]
+    .filter((field) => record[field] !== undefined).map((field) => [field, record[field]]));
+  value.unavailable = ["not-applicable", "retired", "superseded"].includes(record.status);
+  return canonicalObject(model, record.type, value);
+}
+
 export function applicabilityReviewIsCurrent(review, record, program, resources, model, root = null) {
   if (
     review?.scopeRevision
@@ -204,12 +221,17 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
     && Number(model?.modelVersion || 0) < 7
   ) return true;
   if (!review?.scopeRevision) return false;
+  if (Number(model.modelVersion) >= 11 && record?.type === "control"
+    && (review.decision === "not-applicable") !== (record.status === "not-applicable")) return false;
+  if (Number(model.modelVersion) >= 11 && ["retired", "superseded"].includes(record?.status)) return false;
   const matches = (revision) => revisionsMatch("applicability-scope", review.scopeRevision, revision);
   if (matches(applicabilityScopeRevision(record, program, resources, model))) return true;
+  if (Number(model.modelVersion) >= 11 && applicabilityDecisionFields[record?.type]
+    && matches(applicabilityScopeRevision(record, program, resources, model, { legacyResourceProjection: true }))) return true;
   if (["commitment", "control", "complementary-control"].includes(record?.type) && matches(applicabilityScopeRevision(
     record, program, resources, model, { legacyBroadScope: true }
   ))) return true;
-  if (["commitment", "control", "complementary-control"].includes(record?.type) && root && historicalScopedReviewMatches(
+  if (Number(model.modelVersion) >= 11 && applicabilityDecisionFields[record?.type] && root && historicalScopedReviewMatches(
     review.scopeRevision, record, program, resources, model, root
   )) return true;
   // Older reviews hashed Policy approval metadata alongside scope facts.
@@ -263,9 +285,14 @@ function historicalScopedReviewMatches(stored, record, program, resources, model
     if (!revisionsMatch("applicability-scope", current, applicabilityScopeRevision(
       historicalRecord, historicalProgram, historicalResources, historicalModel
     ))) continue;
-    if (revisionsMatch("applicability-scope", stored, applicabilityScopeRevision(
-      historicalRecord, historicalProgram, historicalResources, historicalModel, { legacyBroadScope: true }
-    ))) return true;
+    for (const legacyBroadScope of [false, true]) {
+      for (const legacyResourceProjection of [false, true]) {
+        if (revisionsMatch("applicability-scope", stored, applicabilityScopeRevision(
+          historicalRecord, historicalProgram, historicalResources, historicalModel,
+          { legacyBroadScope, legacyResourceProjection }
+        ))) return true;
+      }
+    }
   }
   return false;
 }

package/src/batch-review.js

@@ -142,16 +142,23 @@ function planApplicabilityReviewWithContext(context, options) {
       }
     : program;
   const update = reviewedDecisions.flatMap(({ record, result, rationale, reviewedByIds, reviewedOn }) => {
-    const scopeRevision = applicabilityScopeRevision(record, reviewedProgram, loaded.resources, loaded.model);
-    const next = {
-      ...record,
-      applicabilityReview: {
-        decision: result,
-        rationale,
-        reviewedByIds,
-        reviewedOn,
-        scopeRevision
+    const next = { ...record };
+    if (record.type === "control" && result === "not-applicable" && record.status !== "not-applicable") {
+      next.status = "not-applicable";
+      if (loaded.model.resources.control.fields.statusTransition) {
+        next.statusTransition = { changedByIds: reviewedByIds, changedOn: reviewedOn, reason: rationale };
       }
+    }
+    if (record.type === "control" && result !== "not-applicable" && record.status === "not-applicable") {
+      next.status = "planned";
+      delete next.statusTransition;
+    }
+    next.applicabilityReview = {
+      decision: result,
+      rationale,
+      reviewedByIds,
+      reviewedOn,
+      scopeRevision: applicabilityScopeRevision(next, reviewedProgram, loaded.resources, loaded.model)
     };
     if (record.type === "requirement") {
       if (modelSupports(loaded.model, "program-scope")) {
@@ -160,8 +167,6 @@ function planApplicabilityReviewWithContext(context, options) {
       next.applicability = result;
       next.applicabilityRationale = rationale;
     }
-    if (record.type === "control" && result === "not-applicable") next.status = "not-applicable";
-    if (record.type === "control" && result === "applicable" && record.status === "not-applicable") next.status = "planned";
     return [next];
   });
   if (v4RequirementDecisions.length) {

package/src/collection-scope.js

@@ -200,6 +200,7 @@ function scopedProgramPeople(loaded, program = {}) {
 
 export function collectionRevisionInputs(loaded, resourceType, program, options = {}) {
   const legacy = options.legacy === true;
+  const currentModel = modelSupports(loaded.model, "retention-schedule-approval");
   const reviewed = scopedCollectionRecords(loaded, resourceType, program);
   if (!modelSupports(loaded.model, "program-scope")) {
     return reviewed.map((record) => ({ record, value: record, includeContent: true }));
@@ -367,11 +368,11 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
         && record.type === "document"
           ? retentionScheduleDocumentProposalValue(record)
           : options.historicalReviewMetadata
-            ? dependencyRevisionValue(resourceType, record, legacy)
-            : substantiveRevisionValue(dependencyRevisionValue(resourceType, record, legacy)),
+            ? dependencyRevisionValue(resourceType, record, legacy, true, currentModel)
+            : substantiveRevisionValue(dependencyRevisionValue(resourceType, record, legacy, false, currentModel)),
     includeContent: legacy
       || reviewedIds.has(record.id)
-      || dependencyContentAffectsRevision(resourceType, record.type)
+      || dependencyContentAffectsRevision(resourceType, record.type, options.historicalReviewMetadata, currentModel)
   }));
 }
 
@@ -379,7 +380,7 @@ function retentionScheduleRowProposalValue(record, historicalReviewMetadata = fa
   return Object.fromEntries(Object.entries(record).filter(([field]) => ![
     "approvedByIds",
     "approvedOn",
-    ...(historicalReviewMetadata ? [] : ["reviewedSourceRevisions"])
+    ...(historicalReviewMetadata ? [] : ["reviewedSourceRevisions", "tags", "statusTransition"])
   ].includes(field)));
 }
 
@@ -591,22 +592,31 @@ const dependencyContentTypes = {
   component: new Set(["system"]),
   control: new Set(["system", "component", "obligation", "source-coverage", "evidence", "retention-schedule-item", "document", "policy", "training"]),
   "retention-schedule-item": new Set(["document", "policy"]),
-  "complementary-control": new Set(["system", "control", "document", "component"])
+  "complementary-control": new Set(["system", "document", "component"])
 };
 
-function dependencyRevisionValue(resourceType, record, legacy) {
-  const fields = legacy
+function dependencyRevisionValue(resourceType, record, legacy, historicalReviewMetadata = false, currentModel = false) {
+  const controlDecision = currentModel && !historicalReviewMetadata && record.type === "control"
+    && ["retention-schedule-item", "complementary-control"].includes(resourceType);
+  const fields = controlDecision
+    ? resourceType === "retention-schedule-item"
+      ? ["id", "type", "statement", "activity", "controlType", "operationMode", "operationPattern", "requirementIds", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"]
+      : ["id", "type", "statement", "activity", "controlType", "operationMode", "operationPattern", "requirementIds", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"]
+    : legacy
     ? legacyDependencyFieldOverrides[resourceType]?.[record.type]
       || dependencyFields[resourceType]?.[record.type]
     : dependencyFields[resourceType]?.[record.type];
   if (!fields) return { id: record.id, type: record.type };
-  return Object.fromEntries(fields
+  const value = Object.fromEntries(fields
     .filter((field) => record[field] !== undefined)
     .map((field) => [field, record[field]]));
+  if (controlDecision) value.unavailable = ["not-applicable", "retired", "superseded"].includes(record.status);
+  return value;
 }
 
-function dependencyContentAffectsRevision(resourceType, dependencyType) {
-  return dependencyContentTypes[resourceType]?.has(dependencyType) || false;
+function dependencyContentAffectsRevision(resourceType, dependencyType, historicalReviewMetadata = false, currentModel = false) {
+  return ((!currentModel || historicalReviewMetadata) && resourceType === "complementary-control" && dependencyType === "control")
+    || dependencyContentTypes[resourceType]?.has(dependencyType) || false;
 }
 
 function sorted(values) {

package/src/retention.js

@@ -167,7 +167,7 @@ export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "leg
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
     const parts = [reviewSource(loaded, entry, scopeHashInput)];
-    for (const markdown of markdownEntries(loaded.model, entry.record)) {
+    for (const markdown of reviewMarkdownEntries(loaded, entry, false)) {
       try {
         parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
       } catch (error) {
@@ -200,7 +200,7 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
     const parts = [reviewSource(loaded, entry, scopeHashInput, legacySource)];
-    for (const markdown of markdownEntries(loaded.model, entry.record)) {
+    for (const markdown of reviewMarkdownEntries(loaded, entry, legacySource)) {
       try {
         const source = historicalCommit
           ? loaded.historicalFiles
@@ -317,10 +317,52 @@ function reviewSource(loaded, entry, scopeHashInput = "legacy", legacySource = f
   }
   return legacySource
     ? canonicalCalculatedRevisionJson(entry.source, scopeHashInput)
-    : canonicalCalculatedRevisionJson(JSON.stringify(substantiveReviewSource(JSON.parse(entry.source))), scopeHashInput);
+    : canonicalCalculatedRevisionJson(JSON.stringify(substantiveReviewSource(
+      JSON.parse(entry.source), modelSupports(loaded.model, "retention-schedule-approval")
+    )), scopeHashInput);
 }
 
-function substantiveReviewSource(record) {
+function reviewMarkdownEntries(loaded, entry, legacySource) {
+  // Control Markdown records the implementation procedure. Retention and
+  // mapping decisions depend on the structured Control design instead.
+  if (!legacySource && modelSupports(loaded.model, "retention-schedule-approval")
+    && entry.record.type === "control") return [];
+  return markdownEntries(loaded.model, entry.record);
+}
+
+const reviewDecisionFields = {
+  control: ["statement", "requirementIds", "code", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"],
+  commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "requirementIds", "controlIds", "customerFacing", "effectiveOn", "reportingRouteRequirements"],
+  "complementary-control": ["responsibleParty", "statement", "systemIds", "vendorId", "requirementIds", "commitmentIds", "relatedControlIds", "sourceDocumentIds", "componentIds"],
+  "source-coverage": ["sourceFamilyId", "coverageKind", "scopeResourceIds", "excludedPopulation", "collectionCadence", "reconciliationMethod", "validFrom", "validThrough", "componentId", "retentionScheduleItemIds"],
+  system: ["purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+  component: ["componentKind", "description", "criticality", "environment", "vendorId", "systemUses", "informationUses", "evidenceSourceKinds", "internetExposed", "classificationId", "continuityObjectives"],
+  vendor: ["category", "criticality", "description", "standardAgreement", "agreementDocumentId", "startDate", "endDate", "informationTypeIds", "classificationId"],
+  "information-type": ["classificationId", "description"],
+  framework: ["version", "publisher", "description", "sourceReference", "effectiveOn"],
+  requirement: ["frameworkId", "reference", "description", "parentRequirementId"],
+  policy: ["policyNumber", "policyKind", "version", "effectiveOn", "supersedesId", "parentPolicyId", "relatedPolicyIds", "relatedDocumentIds", "requirementIds", "audience", "acknowledgementRequired", "programRole", "reportingRouteRequirements"],
+  document: ["documentKind", "workflowScope", "template", "version", "effectiveOn", "supersedesId", "systemIds", "controlIds", "relatedDocumentIds", "audience", "acknowledgementRequired", "trainingIds", "classificationId", "programRole", "componentIds", "reportingRouteRequirements"]
+};
+
+function substantiveReviewSource(record, currentModel) {
+  if (currentModel && reviewDecisionFields[record.type]) {
+    const fields = ["id", "type", "title", "extensions", "externalIds", ...reviewDecisionFields[record.type]];
+    const decision = Object.fromEntries(fields.filter((field) => record[field] !== undefined)
+      .map((field) => [field, record[field]]));
+    if (record.type === "control") {
+      decision.unavailable = ["not-applicable", "retired", "superseded"].includes(record.status);
+    } else if (["policy", "document"].includes(record.type)) {
+      decision.governingStatus = ["approved", "active"].includes(record.status) ? "approved" : record.status || null;
+    } else {
+      decision.status = record.status || null;
+    }
+    if (["control", "commitment", "complementary-control"].includes(record.type)) {
+      decision.nonApplicableDecision = ["not-applicable", "externally-managed", "zero-population"]
+        .includes(record.applicabilityReview?.decision) ? record.applicabilityReview.decision : null;
+    }
+    return decision;
+  }
   const source = record.type === "program" ? {
     id: record.id,
     type: record.type,