filegrc 0.16.8 → 0.16.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.8",
+  "version": "0.16.10",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -117,13 +117,16 @@ export function applicabilityScopeRevision(record, program, resources, model, op
     policies: resources
       .filter(({ type, id }) => type === "policy" && selectedPolicyIds.has(id))
       .sort(compareRecordIds)
-      .map((policy) => options.legacyPolicyStatus
+      .map((policy) => options.legacyPolicyStatus || options.legacyPolicyOverrides
         ? pick({
             ...policy,
-            status: options.legacyPolicyStatus === "approved" && ["in-review", "active"].includes(policy.status)
-              ? "approved" : policy.status,
-            effectiveOn: options.legacyPolicyStatus === "approved" && policy.status === "active"
-              ? undefined : policy.effectiveOn
+            status: (options.legacyPolicyOverrides?.[policy.id]?.status || options.legacyPolicyStatus || "current") === "current"
+              ? policy.status : options.legacyPolicyOverrides?.[policy.id]?.status || options.legacyPolicyStatus,
+            effectiveOn: (options.legacyPolicyOverrides?.[policy.id]?.withoutEffectiveOn
+              ?? options.legacyPolicyWithoutEffectiveOn) ? undefined : policy.effectiveOn,
+            approvedContentRevisions: (options.legacyPolicyOverrides?.[policy.id]?.withoutApprovalBinding
+              ?? options.legacyPolicyWithoutApprovalBinding)
+              ? undefined : policy.approvedContentRevisions
           }, [
             "id", "status", "policyKind", "version", "programRole", "effectiveOn",
             "requirementIds", "audience", "acknowledgementRequired",
@@ -168,11 +171,50 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
   if (!review?.scopeRevision) return false;
   const matches = (revision) => revisionsMatch("applicability-scope", review.scopeRevision, revision);
   if (matches(applicabilityScopeRevision(record, program, resources, model))) return true;
-  // Reviews written before the scope fix included Policy lifecycle fields. Accept
-  // that earlier fingerprint only when its material inputs still match.
-  if (matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "current" }))) return true;
-  return resources.some(({ type, status }) => type === "policy" && ["in-review", "active"].includes(status))
-    && matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "approved" }));
+  // Older reviews hashed Policy approval metadata alongside scope facts.
+  // Reconstruct each Policy independently because other Policies may already
+  // have been approved when one Policy changes. Material fields stay current.
+  for (const legacyPolicyStatus of ["current", "draft", "in-review", "approved", "active"]) {
+    for (const legacyPolicyWithoutApprovalBinding of [false, true]) {
+      for (const legacyPolicyWithoutEffectiveOn of [false, true]) {
+        if (matches(applicabilityScopeRevision(record, program, resources, model, {
+          legacyPolicyStatus,
+          legacyPolicyWithoutApprovalBinding,
+          legacyPolicyWithoutEffectiveOn
+        }))) return true;
+      }
+    }
+  }
+  const selectedControlIds = new Set(program?.controlIds || []);
+  const selectedPolicyIds = new Set(resources
+    .filter(({ type, id }) => type === "control" && selectedControlIds.has(id))
+    .flatMap(({ policyIds }) => policyIds || []));
+  for (const id of record.policyIds || []) selectedPolicyIds.add(id);
+  const policies = resources.filter(({ type, id }) => type === "policy" && selectedPolicyIds.has(id));
+  // One Policy may advance while the others retain different approval states.
+  // Reconstruct that Policy's former lifecycle fields without changing any
+  // material scope fact or searching combinations of unrelated Policies.
+  for (const policy of policies) {
+    for (const value of legacyPolicyAlternatives(policy)) {
+      if (matches(applicabilityScopeRevision(record, program, resources, model, {
+        legacyPolicyOverrides: { [policy.id]: value }
+      }))) return true;
+    }
+  }
+  return false;
+}
+
+function legacyPolicyAlternatives(policy) {
+  const prior = {
+    active: ["approved", "in-review", "draft"],
+    approved: ["in-review", "draft"],
+    "in-review": ["draft"]
+  }[policy.status] || [];
+  return prior.map((status) => ({
+    status,
+    withoutApprovalBinding: status === "draft" || status === "in-review",
+    withoutEffectiveOn: true
+  }));
 }
 
 function pick(record, fields, model, objectType = null) {

package/src/audit-preparation.js

@@ -1831,6 +1831,9 @@ function item(id, status, title, message, resource = {}, options = {}) {
     message,
     ...(resource.type ? { resourceType: resource.type } : {}),
     ...(resource.id ? { resourceId: resource.id } : {}),
+    ...(resource.type ? { destination: resource.id
+      ? { kind: "record", resourceType: resource.type, resourceId: resource.id }
+      : { kind: "collection", resourceType: resource.type } } : {}),
     ...(options.commands?.length ? { commands: options.commands } : {}),
     ...(options.affectedActionItemIds?.length ? { affectedActionItemIds: options.affectedActionItemIds } : {}),
     ...(options.affectedEventIds?.length ? { affectedEventIds: options.affectedEventIds } : {}),

package/src/program-readiness.js

@@ -774,9 +774,23 @@ export function collectionReviewReadinessItem(assessment) {
       ? { id: firstIncomplete.resourceId, type: assessment.resourceType }
       : needsFirstRecord ? { type: assessment.resourceType }
         : approvalAction ? { type: approvalAction.resourceType, ...(approvalAction.resourceId ? { id: approvalAction.resourceId } : {}) }
-          : assessment.review || { type: assessment.resourceType },
+          : { type: assessment.resourceType },
     {
       resourceType: approvalAction?.resourceType || assessment.resourceType,
+      ...(!proposalAction && !needsFirstRecord && !approvalAction && assessment.review?.id
+        ? { subject: { type: "collection-review", id: assessment.review.id } }
+        : {}),
+      destination: proposalAction
+        ? { kind: "record", resourceType: assessment.resourceType, resourceId: firstIncomplete.resourceId }
+        : needsFirstRecord
+          ? { kind: "collection", resourceType: assessment.resourceType, create: true }
+          : approvalAction
+            ? approvalAction.reviewCollection
+              ? { kind: "collection-review", resourceType: approvalAction.resourceType }
+              : approvalAction.resourceId
+              ? { kind: "record", resourceType: approvalAction.resourceType, resourceId: approvalAction.resourceId }
+              : { kind: "collection", resourceType: approvalAction.resourceType, ...(approvalAction.createResource ? { create: true, scheduleDocument: true } : {}) }
+            : { kind: "collection-review", resourceType: assessment.resourceType },
       reviewPoints: assessment.configuration.reviewPoints,
       ...(approvalAction?.createResource ? { createResource: true } : {}),
       ...(pendingRetentionRow && !proposalAction ? { unresolvedAssignments: [{
@@ -842,6 +856,7 @@ function collectionApprovalIssueAction(assessment) {
   if (issue.code === "unreviewed-similar-information-types") return {
     title: "Review similar Information Types",
     resourceType: "information-type",
+    reviewCollection: true,
     commands: ["npx filegrc list information-type --workflow --json", "npx filegrc review-collection information-type --scaffold > REVIEW.json", "npx filegrc review-collection information-type REVIEW.json --preview --json", "npx filegrc review-collection information-type REVIEW.json --yes --json"]
   };
   return {

package/src/web.js

@@ -53,6 +53,38 @@ export function pageActionIdentity(href = "", fallback = "") {
   return route.startsWith("#/resource/") ? route : fallback || href;
 }
 
+export function resolveWorkflowDestination(destination, options = {}) {
+  if (!destination?.resourceType) return "";
+  if (options.resourceTypes && !options.resourceTypes[destination.resourceType]) return "";
+  const type = encodeURIComponent(destination.resourceType);
+  if (destination.kind === "record") {
+    const exists = !options.resources || options.resources.some((entry) => {
+      const record = entry.record || entry;
+      return record.type === destination.resourceType && record.id === destination.resourceId;
+    });
+    return destination.resourceId && exists
+      ? `#/resource/${type}/${encodeURIComponent(destination.resourceId)}${destination.edit ? "?edit=1" : ""}`
+      : resolveWorkflowDestination({ kind: "collection", resourceType: destination.resourceType }, options);
+  }
+  if (destination.kind === "collection-review") {
+    if (destination.resourceType === "retention-schedule-item" && options.retentionScheduleApproval) {
+      return "#/retention-schedule";
+    }
+    return `#/resources/${type}?review-collection=1`;
+  }
+  if (destination.kind === "collection") {
+    const create = destination.create && !options.readOnly;
+    if (destination.resourceType === "retention-schedule-item" && options.retentionScheduleApproval) {
+      return create ? "#/retention-schedule?new=1" : "#/retention-schedule";
+    }
+    if (destination.resourceType === "document" && create && destination.scheduleDocument) {
+      return "#/resources/document?new=1&documentScope=program&documentKind=schedule&programRole=required&title=Data%20Retention%20Schedule";
+    }
+    return `#/resources/${type}${create ? "?new=1" : ""}`;
+  }
+  return "";
+}
+
 export function renderIndex(state = null) {
   const snapshot = state
     ? `<script id="filegrc-data" type="application/json">${safeJson(state)}</script>`
@@ -100,6 +132,7 @@ const RESOURCE_GUIDE_OUTPUTS = ${JSON.stringify(RESOURCE_OUTPUTS)};
 const dashboardProgramReadiness = ${dashboardProgramReadiness.toString()};
 const workflowHrefBelongsToPage = ${workflowHrefBelongsToPage.toString()};
 const pageActionIdentity = ${pageActionIdentity.toString()};
+const resolveWorkflowDestination = ${resolveWorkflowDestination.toString()};
 const selectDefaultAudit = ${selectDefaultAudit.toString()};
 const STAGE_PAGE_SUMMARIES = ${JSON.stringify({
   ...RESOURCE_PAGE_SUMMARIES,
@@ -786,11 +819,7 @@ function renderRetentionScheduleIssues() {
   ));
   if (!actions.length) return "";
   return '<section class="retention-issues"><div class="section-head"><div><p class="kicker">Before approval</p><h2>Items to resolve</h2></div></div><div class="retention-issue-list">' + actions.map((item) => {
-    const href = item.href || (item.id?.startsWith("retention-use-")
-      ? retentionScheduleItemHref(item)
-      : item.resourceId && item.resourceType
-        ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-        : '#/resources/' + encodeURIComponent(item.resourceType || "retention-schedule-item"));
+    const href = item.href || workflowItemHref(item) || "#/retention-schedule";
     return '<a href="' + href + '"><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message) + '</small></span><b>Review</b></a>';
   }).join("") + '</div></section>';
 }
@@ -1286,9 +1315,7 @@ function renderFinishStepThree() {
   ));
   const next = implementationItems.find(({ status }) => status !== "complete");
   if (!oversightItem) {
-    const href = next?.id?.startsWith("collection-review-") && next.resourceType
-      ? "#/resources/" + encodeURIComponent(next.resourceType) + "?review-collection=1"
-      : next?.id?.startsWith("source-family-")
+    const href = next?.id?.startsWith("source-family-")
         ? "#/evidence-sources"
         : next ? workflowItemHref({ ...next, state: next.status }) || "#/resources/control" : "#/resources/control";
     return '<section class="finish-step panel blocked"><div><p class="kicker">Finish Step 3</p><h2>Complete implementation first</h2><p>' + esc(next?.message || "Finish the Step 3 work areas before the final review becomes available.") + '</p></div><a class="button primary" href="' + esc(href) + '">Continue implementation</a></section>';
@@ -1490,6 +1517,16 @@ function openCollectionReviewDialog(type) {
 }
 
 function workflowItemHref(item) {
+  const destinationOptions = {
+    retentionScheduleApproval: modelSupports("retention-schedule-approval"),
+    readOnly: state.readOnly,
+    resourceTypes: state.model.resources,
+    resources: state.resources
+  };
+  const destinationHref = (destination) => resolveWorkflowDestination(destination, destinationOptions);
+  if (item.destination) {
+    return destinationHref(item.destination);
+  }
   const source = item.source?.id && item.source?.type && item.source.type !== "unknown"
     ? item.source
     : null;
@@ -1518,19 +1555,18 @@ function workflowItemHref(item) {
     && item.subject?.id
     && state.resources.some(({ record }) => record.type === applicabilityType && record.id === item.subject.id)
   ) {
-    return "#/resource/" + encodeURIComponent(applicabilityType) + "/" + encodeURIComponent(item.subject.id);
+    return destinationHref({ kind: "record", resourceType: applicabilityType, resourceId: item.subject.id });
   }
   if (commands.some((command) => command.includes(" scaffold retention-schedule-item"))) {
     return retentionScheduleItemHref(item);
   }
   if (applicabilityType && state.model.resources[applicabilityType]) {
-    return "#/resources/" + encodeURIComponent(applicabilityType) + "?review=1";
+    return destinationHref({ kind: "collection", resourceType: applicabilityType }) + "?review=1";
   }
   const collectionReviewCommand = commands.find((command) => command.includes(" review-collection "));
   const collectionReviewType = collectionReviewCommand?.match(/review-collection\s+([a-z0-9-]+)/)?.[1];
   if (collectionReviewType && state.model.collectionReviews?.[collectionReviewType]) {
-    if (collectionReviewType === "retention-schedule-item" && modelSupports("retention-schedule-approval")) return "#/retention-schedule";
-    return "#/resources/" + encodeURIComponent(collectionReviewType) + "?review-collection=1";
+    return destinationHref({ kind: "collection-review", resourceType: collectionReviewType });
   }
   if (
     commands.some((command) => command.includes(" get ") && command.includes(" --mutation"))
@@ -1538,25 +1574,25 @@ function workflowItemHref(item) {
     && item.subject?.type
     && state.model.resources[item.subject.type]
   ) {
-    return "#/resource/" + encodeURIComponent(item.subject.type) + "/" + encodeURIComponent(item.subject.id) + "?edit=1";
+    return destinationHref({ kind: "record", resourceType: item.subject.type, resourceId: item.subject.id, edit: true });
   }
   if (commands.some((command) => command.includes(" external-reviewer-setup"))) {
     const reviewer = resourcesOfType("appointment")
       .find(({ record }) => record.appointmentKind === "independent-policy-reviewer");
-    if (reviewer) return "#/resource/appointment/" + encodeURIComponent(reviewer.record.id);
+    if (reviewer) return destinationHref({ kind: "record", resourceType: "appointment", resourceId: reviewer.record.id });
   }
   if (commands.some((command) => command.includes(" evidence-map"))) return "#/stage/controls";
   const reference = item.subject?.id && item.subject?.type
     ? item.subject
     : source;
   if (reference && reference.type !== "unknown") {
-    return "#/resource/" + encodeURIComponent(reference.type) + "/" + encodeURIComponent(reference.id);
+    return destinationHref({ kind: "record", resourceType: reference.type, resourceId: reference.id });
   }
   const missingType = item.subject?.type && state.model.resources[item.subject.type]
     ? item.subject.type
     : null;
   if (missingType) {
-    return "#/resources/" + encodeURIComponent(missingType) + (state.readOnly ? "" : "?new=1");
+    return destinationHref({ kind: "collection", resourceType: missingType, create: !state.readOnly });
   }
   if (item.auditId) return "#/audit-packet?auditId=" + encodeURIComponent(item.auditId);
   const stage = {
@@ -1714,13 +1750,9 @@ function retentionSchedulePageItems() {
         ...item,
         key: item.id,
         state: "ready",
-        href: item.id === "collection-review-retention-schedule-item"
-          ? retentionCollectionActionHref(item)
-          : item.id?.startsWith("retention-use-")
+        href: item.id?.startsWith("retention-use-")
             ? retentionScheduleItemHref(item)
-            : item.resourceId && item.resourceType
-              ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-              : workflowItemHref(item) || "#/retention-schedule",
+            : workflowItemHref(item) || "#/retention-schedule",
         subject: item.resourceId && item.resourceType
           ? { type: item.resourceType, id: item.resourceId }
           : item.subject
@@ -1728,19 +1760,6 @@ function retentionSchedulePageItems() {
   ]);
 }
 
-function retentionCollectionActionHref(item) {
-  if (item.resourceType === "document") return item.resourceId
-    ? '#/resource/document/' + encodeURIComponent(item.resourceId) + '?stage=policies'
-    : item.createResource
-      ? '#/resources/document?new=1&documentScope=program&documentKind=schedule&programRole=required&title=Data%20Retention%20Schedule'
-      : '#/resources/document';
-  if (item.resourceType === "information-type") return '#/resources/information-type?review-collection=1';
-  if (item.resourceType === "retention-schedule-item" && item.resourceId && item.resourceId !== item.id) {
-    return '#/resource/retention-schedule-item/' + encodeURIComponent(item.resourceId) + '?stage=policies';
-  }
-  return "#/retention-schedule";
-}
-
 function distinctPageActionItems(items) {
   const distinct = new Map();
   for (const item of items) {
@@ -3017,11 +3036,7 @@ function renderAuditPreparation(preparation) {
   const status = preparation.status === "management-ready" ? "Management work complete" : preparation.counts.action + " actions remaining";
   const stages = preparation.stages.map((stage) => {
     const items = stage.items.map((item) => {
-      const href = item.resourceId
-        ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-        : item.resourceType
-          ? '#/resources/' + encodeURIComponent(item.resourceType)
-          : "";
+      const href = workflowItemHref(item);
       const content = '<span class="preparation-status ' + esc(item.status) + '" aria-hidden="true">' + preparationStatusMark(item.status) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message) + '</small></span>';
       return href ? '<a href="' + href + '">' + content + '</a>' : '<div>' + content + '</div>';
     }).join("");

package/src/workflow.js

@@ -1115,9 +1115,9 @@ export function packetDeliveryIssue(delivery) {
 
 function normalizeFinding(code, item, context) {
   const state = findingState(item.status);
-  const subject = item.resourceType
+  const subject = item.subject || (item.resourceType
     ? { type: item.resourceType, ...(item.resourceId ? { id: item.resourceId } : {}) }
-    : null;
+    : null);
   const dependencies = (item.unresolvedAssignments || []).map((assignment) => ({
     type: assignment.resourceType,
     id: assignment.resourceId,
@@ -1138,6 +1138,7 @@ function normalizeFinding(code, item, context) {
       .filter(([, passed]) => passed === false)
       .map(([name]) => name) } : {}),
     ...(item.resourceId ? { resourceId: item.resourceId } : {}),
+    ...(item.destination ? { destination: item.destination } : {}),
     ...(item.createResourceType ? { createResourceType: item.createResourceType } : {}),
     ...(item.sourceResourceIds ? { sourceResourceIds: item.sourceResourceIds } : {}),
     ...(item.informationTypeId ? { informationTypeId: item.informationTypeId } : {}),