filegrc 0.9.1 → 0.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/collection-revision.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
+  authoritativeSourceRevisionValue,
   collectionRevisionInputs,
   collectionScopeRevisionFacts
 } from "./collection-scope.js";
@@ -16,15 +17,19 @@ export function collectionRevision(loaded, resourceType, options = {}) {
     .map((input) => [input.record.id, input]));
   const authoritativeSource = loaded.resources.find(({ id }) => id === options.authoritativeSourceId);
   if (authoritativeSource) {
-    inputs.set(authoritativeSource.id, { record: authoritativeSource, value: authoritativeSource });
+    inputs.set(authoritativeSource.id, {
+      record: authoritativeSource,
+      value: authoritativeSourceRevisionValue(authoritativeSource),
+      includeContent: true
+    });
   }
   const records = [...inputs.values()]
-    .map(({ record, value }) => ({
+    .map(({ record, value, includeContent }) => ({
       id: record.id,
       revision: createHash("sha256")
         .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value)))
         .digest("hex"),
-      contentRevisions: markdownEntries(loaded.model, record).flatMap(({ path }) => {
+      contentRevisions: (includeContent ? markdownEntries(loaded.model, record) : []).flatMap(({ path }) => {
         try {
           const content = readFileSync(resolveDataPath(loaded.root, path), "utf8");
           return [{ path, revision: createHash("sha256").update(content).digest("hex") }];

package/src/collection-scope.js

@@ -39,7 +39,7 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
 export function collectionRevisionInputs(loaded, resourceType, program) {
   const reviewed = scopedCollectionRecords(loaded, resourceType, program);
   if (!modelSupports(loaded.model, "program-scope")) {
-    return reviewed.map((record) => ({ record, value: record }));
+    return reviewed.map((record) => ({ record, value: record, includeContent: true }));
   }
   const byId = new Map(loaded.resources.map((record) => [record.id, record]));
   const records = new Map(reviewed.map((record) => [record.id, record]));
@@ -90,7 +90,9 @@ export function collectionRevisionInputs(loaded, resourceType, program) {
     record,
     value: reviewedIds.has(record.id)
       ? record
-      : dependencyRevisionValue(resourceType, record)
+      : dependencyRevisionValue(resourceType, record),
+    includeContent: reviewedIds.has(record.id)
+      || dependencyContentAffectsRevision(resourceType, record.type)
   }));
 }
 
@@ -138,9 +140,20 @@ export function collectionScopeRevisionFacts(loaded, resourceType, program) {
   return common;
 }
 
+export function authoritativeSourceRevisionValue(record) {
+  return Object.fromEntries(Object.entries(record).filter(([field]) => (
+    !authoritativeSourceBookkeepingFields.has(field)
+  )));
+}
+
+const authoritativeSourceBookkeepingFields = new Set([
+  "tags",
+  "statusTransition"
+]);
+
 const dependencyFields = {
   framework: {
-    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "informationTypeIds", "classificationId", "internetExposed"],
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
     requirement: ["id", "type", "title", "frameworkId", "reference", "description", "parentRequirementId"]
   },
   vendor: {
@@ -154,22 +167,29 @@ const dependencyFields = {
   },
   component: {
     system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
-    control: ["id", "type", "status", "statement", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "componentIds", "evidenceSourceComponentIds"],
-    vendor: ["id", "type", "status", "category", "criticality", "description", "standardAgreement", "agreementDocumentId", "startDate", "endDate", "classificationId", "informationTypeIds"],
+    control: ["id", "type", "status", "systemIds", "componentIds", "evidenceSourceComponentIds"],
+    vendor: ["id", "type", "status", "category", "criticality", "description", "startDate", "endDate"],
     classification: ["id", "type", "status", "rank", "description", "handlingRequirements"],
     "information-type": ["id", "type", "status", "classificationId", "description"]
   },
   "complementary-control": {
-    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "informationTypeIds", "classificationId", "internetExposed"],
-    control: ["id", "type", "status", "statement", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "componentIds", "evidenceSourceComponentIds"],
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+    control: ["id", "type", "status", "statement", "activity", "systemIds", "componentIds", "evidenceSourceComponentIds"],
     vendor: ["id", "type", "status", "category", "criticality", "description", "standardAgreement", "agreementDocumentId", "startDate", "endDate", "classificationId", "informationTypeIds"],
     requirement: ["id", "type", "title", "frameworkId", "reference", "description", "parentRequirementId"],
     commitment: ["id", "type", "status", "commitmentKind", "statement", "systemIds", "requirementIds", "controlIds", "customerFacing", "effectiveOn"],
     document: ["id", "type", "status", "documentKind", "version", "effectiveOn", "approvedOn", "approvedContentRevisions", "systemIds", "controlIds", "componentIds", "classificationId"],
-    component: ["id", "type", "status", "componentKind", "description", "vendorId", "systemUses", "informationUses", "internetExposed"]
+    component: ["id", "type", "status", "componentKind", "description", "criticality", "vendorId", "systemUses", "informationUses", "internetExposed", "classificationId", "continuityObjectives"]
   }
 };
 
+const dependencyContentTypes = {
+  framework: new Set(["system"]),
+  vendor: new Set(["document"]),
+  component: new Set(["system"]),
+  "complementary-control": new Set(["system", "control", "document", "component"])
+};
+
 function dependencyRevisionValue(resourceType, record) {
   const fields = dependencyFields[resourceType]?.[record.type];
   if (!fields) return { id: record.id, type: record.type };
@@ -178,6 +198,10 @@ function dependencyRevisionValue(resourceType, record) {
     .map((field) => [field, record[field]]));
 }
 
+function dependencyContentAffectsRevision(resourceType, dependencyType) {
+  return dependencyContentTypes[resourceType]?.has(dependencyType) || false;
+}
+
 function sorted(values) {
   return [...(values || [])].sort();
 }