filegrc 0.9.2 → 0.11.0

package/src/validate.js

@@ -3,10 +3,14 @@ import { readFile, stat } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 import { getResourceDefinition, modelSupports } from "../model/index.js";
 import { scopedCollectionRecords } from "./collection-scope.js";
-import { collectionRevision } from "./collection-revision.js";
+import {
+  collectionRevision,
+  collectionRevisionMatches
+} from "./collection-revision.js";
 import { isSafeGitName } from "./git-name.js";
 import { isCanonicalDataPath, resolveDataPath } from "./paths.js";
 import { parseCalendarDate, validCalendarRecurrence } from "./recurrence.js";
+import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { obligationIsEnabled } from "./program-lifecycle.js";
 import { partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
@@ -42,6 +46,15 @@ async function validateWorkspaceUnmeasured(input) {
   ]));
   const asOf = currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const obligationsByControl = new Map();
+  const reviewRecords = loaded.resources.filter((record) => (
+    record.status === "active" && ["retention-schedule-item", "requirement-mapping"].includes(record.type)
+  ));
+  const reviewDependencyIds = reviewRecords.flatMap((record) => (
+    record.type === "retention-schedule-item"
+      ? retentionReviewResourceIds(record, loaded)
+      : [...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])]
+  ));
+  const currentReviewRevisions = await resourceReviewRevisions(loaded, reviewDependencyIds);
   for (const obligation of loaded.resources.filter((record) => record.type === "obligation" && record.status !== "retired")) {
     for (const controlId of obligation.controlIds || []) {
       if (!obligationsByControl.has(controlId)) obligationsByControl.set(controlId, []);
@@ -85,6 +98,8 @@ async function validateWorkspaceUnmeasured(input) {
       validateCollectionReview(record, loaded, byId, displayPath, diagnostics);
     }
     if (record.type === "obligation") validateObligation(record, loaded.model, byId, displayPath, diagnostics);
+    if (record.type === "retention-schedule-item") validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisions, displayPath, diagnostics);
+    if (record.type === "requirement-mapping") validateRequirementMapping(record, currentReviewRevisions, displayPath, diagnostics);
     if (record.type === "action-item") {
       validateCompletedObligationAction(record, byId, loaded.model, displayPath, diagnostics);
     }
@@ -153,16 +168,20 @@ async function validateWorkspaceUnmeasured(input) {
   }
 
   diagnostics.sort((a, b) => `${a.severity}:${a.path}:${a.code}`.localeCompare(`${b.severity}:${b.path}:${b.code}`));
-  return {
+  const result = {
     ok: !diagnostics.some(({ severity }) => severity === "error"),
     diagnostics,
     counts: {
       resources: loaded.resources.length,
       errors: diagnostics.filter(({ severity }) => severity === "error").length,
       warnings: diagnostics.filter(({ severity }) => severity === "warning").length
-    },
-    loaded
+    }
   };
+  Object.defineProperty(result, "loaded", {
+    value: loaded,
+    enumerable: false
+  });
+  return result;
 }
 
 function validateDocumentWorkflowScopes(resources, model, byId, pathById, diagnostics) {
@@ -246,7 +265,7 @@ function validateDocumentWorkflowScopes(resources, model, byId, pathById, diagno
         `Program-scoped Document "${document.title}" cannot fill an Audit engagement or management-Document field.`
       ));
     }
-    if (document.activationBasis !== "legacy-v4") continue;
+    if (!["legacy-v4", "historical"].includes(document.activationBasis)) continue;
     const historicalAuditIds = new Set(auditRefs
       .filter(({ audit }) => ["issued", "delivered", "complete"].includes(audit.status))
       .map(({ audit }) => audit.id));
@@ -254,7 +273,7 @@ function validateDocumentWorkflowScopes(resources, model, byId, pathById, diagno
       diagnostics.push(error(
         "invalid-legacy-document-activation",
         path,
-        `activationBasis legacy-v4 is reserved for an engagement Document tied to exactly one issued, delivered, or completed Audit.`
+        `The historical activation basis is reserved for an engagement Document tied to exactly one issued, delivered, or completed Audit.`
       ));
     }
   }
@@ -313,7 +332,18 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       ? record.authoritativeComponentId || record.authoritativeSystemId
       : null
   });
-  const current = record.collectionRevision === currentRevision;
+  const current = collectionRevisionMatches(
+    loaded,
+    record.resourceType,
+    record.collectionRevision,
+    {
+      program,
+      authoritativeSourceId: record.decision === "externally-managed"
+        ? record.authoritativeComponentId || record.authoritativeSystemId
+        : null,
+      currentRevision
+    }
+  );
   if (current && !recordCount && record.decision === "complete") {
     diagnostics.push(error(
       "invalid-collection-review-decision",
@@ -561,7 +591,7 @@ function validateCompletedObligationEvent(record, byId, model, path, diagnostics
     }
     const obligation = byId.get(action.obligationId);
     const expectedTypes = obligation?.type === "obligation"
-      ? model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || []
+      ? obligationCompletionTypes(model, obligation)
       : [];
     if (!expectedTypes.length) continue;
     const completionIds = modelSupports(model, "guided-workflow")
@@ -588,7 +618,7 @@ function validateCompletedObligationAction(record, byId, model, path, diagnostic
   ) return;
   const obligation = byId.get(record.obligationId);
   if (obligation?.type !== "obligation") return;
-  const expectedTypes = model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || [];
+  const expectedTypes = obligationCompletionTypes(model, obligation);
   if (!expectedTypes.length) return;
   const linked = [...new Set(record.completionResourceIds || [])]
     .map((id) => byId.get(id))
@@ -635,7 +665,19 @@ function validateIndependentApproval(record, byId, path, diagnostics) {
 function validateObligation(record, model, byId, path, diagnostics) {
   const recurrence = record.recurrence;
   if (!recurrence || Array.isArray(recurrence) || typeof recurrence !== "object") return;
-  const activity = model.obligationActivities?.[record.activityType];
+  const activity = record.activityType === "custom"
+    ? { ...model.obligationActivities?.custom, ...record.customActivity }
+    : model.obligationActivities?.[record.activityType];
+  if (record.activityType === "custom") {
+    const invalidTypes = (record.customActivity?.completionResourceTypes || []).filter((type) => !model.resources[type]);
+    if (invalidTypes.length) {
+      diagnostics.push(error(
+        "invalid-obligation-activity",
+        path,
+        `customActivity.completionResourceTypes contains unknown resource types: ${invalidTypes.join(", ")}.`
+      ));
+    }
+  }
   if (
     activity
     && Array.isArray(activity.recurrenceModes)
@@ -674,7 +716,7 @@ function validateObligation(record, model, byId, path, diagnostics) {
       ));
     }
   } else if (recurrence.mode === "event") {
-    if (!model.policyEvents?.[recurrence.eventType]) {
+    if (!model.policyEvents?.[recurrence.eventType] && !modelSupports(model, "custom-obligations")) {
       diagnostics.push(error(
         "invalid-obligation-recurrence",
         path,
@@ -737,6 +779,59 @@ function validateObligation(record, model, byId, path, diagnostics) {
   }
 }
 
+function validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisions, path, diagnostics) {
+  if (record.status !== "active") return;
+  const schedule = byId.get(record.scheduleDocumentId);
+  if (schedule?.type !== "document" || schedule.documentKind !== "schedule" || schedule.workflowScope !== "program" || ["superseded", "retired"].includes(schedule.status)) {
+    diagnostics.push(error(
+      "invalid-retention-schedule-document",
+      path,
+      "scheduleDocumentId must reference a current program Document whose documentKind is schedule."
+    ));
+  }
+  const sources = retentionReviewResourceIds(record, loaded);
+  const revisions = record.reviewedSourceRevisions || {};
+  const missing = sources.filter((id) => (
+    !currentReviewRevisions.get(id) || revisions[id] !== currentReviewRevisions.get(id)
+  )).concat(Object.keys(revisions).filter((id) => !sources.includes(id)));
+  if (missing.length) {
+    diagnostics.push(error(
+      "stale-retention-review",
+      path,
+      `reviewedSourceRevisions must bind the schedule Document, Information Types, operational scope, and authority or source records before activation: ${missing.join(", ")}.`
+    ));
+  }
+}
+
+function validateRequirementMapping(record, currentReviewRevisions, path, diagnostics) {
+  const overlap = (record.sourceResourceIds || []).filter((id) => (record.targetResourceIds || []).includes(id));
+  if (overlap.length) {
+    diagnostics.push(error(
+      "invalid-requirement-mapping",
+      path,
+      `A Requirement Mapping cannot place the same record on both sides: ${[...new Set(overlap)].join(", ")}.`
+    ));
+  }
+  if (record.status !== "active") return;
+  const mappedIds = [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])];
+  const revisions = record.reviewedSourceRevisions || {};
+  const missing = mappedIds.filter((id) => (
+    !currentReviewRevisions.get(id) || revisions[id] !== currentReviewRevisions.get(id)
+  )).concat(Object.keys(revisions).filter((id) => !mappedIds.includes(id)));
+  if (missing.length) {
+    diagnostics.push(error(
+      "stale-requirement-mapping",
+      path,
+      `reviewedSourceRevisions must bind every mapped resource before activation: ${missing.join(", ")}.`
+    ));
+  }
+}
+
+function obligationCompletionTypes(model, obligation) {
+  if (obligation.activityType === "custom") return obligation.customActivity?.completionResourceTypes || [];
+  return model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || [];
+}
+
 function validatePolicyEvent(record, model, byId, path, diagnostics) {
   const event = model.policyEvents?.[record.eventType];
   if (!event) return;