Merge pull request #12 from mitre/csv_attestation

inspec-reporter-json-hdf.gemspec

@@ -18,6 +18,8 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '~> 2.5'
 
   spec.add_runtime_dependency 'git-lite-version-bump', '~> 0.17', '>= 0.17.3'
+  spec.add_runtime_dependency 'roo', '~> 2.8.3'
+
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'bundler-audit'
   spec.add_development_dependency 'codeclimate-test-reporter'

lib/inspec-reporter-json-hdf/reporter.rb

@@ -1,13 +1,16 @@
 
 require 'inspec/plugin/v2'
 require 'json'
+require 'roo'
 
 VALID_FREQUENCY = %w[annually semiannually quarterly monthly every2weeks weekly every3days daily].freeze
 
 VALID_STATUSES = %w[passed failed].freeze
 
 DATE_FORMAT = '%Y-%m-%d'.freeze
 
+SUPPORTED_INCLUDE_TYPES = %w[csv xlsx].freeze
+
 module InspecPlugins::HdfReporter
   # Reporter Plugin Class
   class Reporter < Inspec.plugin(2, :reporter)
@@ -41,40 +44,24 @@ def report
     private
 
     def apply_attestation(results, attestation)
-      if results.empty?
-        results = [{
-          "code_desc": 'Manually verified Status provided through attestation',
-          "run_time": 0.0,
-          "start_time": DateTime.now.to_s,
-          "status": attestation['status'],
-          "message": attestation_message(attestation)
-        }]
-      else
-        results.each do |result|
-          result[:message] = 'Automated test returned as passed.' if result[:status].eql?('passed')
-          result[:message] = result[:skip_message] if result[:status].eql?('skipped')
-
-          result[:status] = attestation['status']
-          result[:message] = result[:message] + attestation_message(attestation)
-
-          if result[:backtrace]
-            result[:message] = result[:message] + "\nbacktrace: #{result[:backtrace]}"
-            result[:backtrace] = nil
-          end
-        end
-      end
-      results
+      results << {
+        "code_desc": 'Manually verified Status provided through attestation',
+        "run_time": 0.0,
+        "start_time": DateTime.now.to_s,
+        "status": attestation['status'],
+        "message": attestation_message(attestation)
+      }
     end
 
     def attestation_message(attestation)
-      "
-       Attestation:
-       Status: #{attestation['status']}
-       Explanation: #{attestation['explanation']}
-       Updated: #{attestation['updated']}
-       Updated By: #{attestation['updated_by']}
-       Frequency: #{attestation['frequency']}
-       "
+      [
+       'Attestation:',
+       "Status: #{attestation['status']}",
+       "Explanation: #{attestation['explanation']}",
+       "Updated: #{attestation['updated']}",
+       "Updated By: #{attestation['updated_by']}",
+       "Frequency: #{attestation['frequency']}",
+       ].join("\n")
     end
 
     def attestation_expired?(date, frequency)
@@ -88,9 +75,9 @@ def advanced_date(date, frequency)
       when 'annually'
         parsed_date.next_year(1)
       when 'semiannually'
-        parsed_date.next_year(0.5)
+        parsed_date.next_month(6)
       when 'quarterly'
-        parsed_date.next_year(0.25)
+        parsed_date.next_month(3)
       when 'monthly'
         parsed_date.next_month(1)
       when 'every2weeks'
@@ -121,9 +108,47 @@ def valid_status?(status)
       status.is_a?(String) && VALID_STATUSES.include?(status.downcase)
     end
 
+    def parse_include_file(include_file)
+      if File.exist?(include_file['path'])
+        if SUPPORTED_INCLUDE_TYPES.include?(include_file['type'])
+          sheet = Roo::Spreadsheet.open(include_file['path'], extension: include_file['type'].to_sym ).sheet(0)
+
+          attestations = sheet.parse(control_id: "Control_ID",
+                                     explanation: "Explanation",
+                                     frequency: "Frequency",
+                                     status: "Status",
+                                     updated: "Updated",
+                                     updated_by: "Updated_By",
+                                     clean:true
+                                     )
+          # Following is required to convert Datetime field returned by xlsx parser to string
+          attestations.map do |h|
+            h[:updated] = h[:updated].to_s
+          end
+        else
+          puts "Warning: Invalid `include-attestations-file` type provided. Supported types: #{SUPPORTED_INCLUDE_TYPES.to_s}"
+        end
+      else
+        puts "Warning: Include Attestation File provided  '#{include_file['path']}' not found."
+      end
+      attestations || []
+    end
+
     def collect_attestations
       plugin_config = Inspec::Config.cached.fetch_plugin_config('inspec-reporter-json-hdf')
-      attestations = plugin_config['attestations'] || []
+      attestations = []
+
+      # Parse Attestations from include file.
+      attestations = parse_include_file(plugin_config['include-attestations-file']) if plugin_config['include-attestations-file']
+
+      attestations.map!{ |x| x.transform_keys(&:to_s) }
+
+      # Merge inline Attestations from config file and `include file` with precedence to inline definitions.
+      attestations = (plugin_config['attestations'] || []) + attestations 
+      attestations.uniq! {|e| e['control_id'] }
+
+      # Remove Attestations records without status provided.
+      attestations.reject! { |x| x['status'].eql?("") || x['status'].nil? }
 
       if attestations.empty?
         puts 'Warning: Attestations not provided; HDF will be generated without attestations.'

templates/attestations.config.template.json

@@ -0,0 +1,29 @@
+{
+    "plugins": {
+        "inspec-reporter-json-hdf": {
+            "include-attestations-file": {
+                "path": "./attestations.xlsx",
+                "type": "xlsx"
+            },
+            "attestations": [
+                {
+                    "control_id": "test-control-1",
+                    "explanation": "The routine review through interview/examination attests to this control passing",
+                    "frequency": "annually",
+                    "status": "passed",
+                    "updated": "2021-04-06",
+                    "updated_by": "John Doe, ISSO"
+                },
+                {
+                    "control_id": "test-control-2",
+                    "explanation": "The routine review through interview/examination attests to this control passing",
+                    "frequency": "semiannually",
+                    "status": "passed",
+                    "updated": "2021-04-06",
+                    "updated_by": "John Doe, ISSO"
+                }
+            ]
+        }
+    },
+    "version": "1.2"
+}

test/functional/inspec_plugin_functional_test.rb

@@ -4,104 +4,111 @@ class InspecPluginFunctionalTest < Minitest::Test
   def test_with_a_single_pass_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('passed', hdf_json['profiles'][0]['controls'][0]['results'][0]['status'])
-    assert_match(%r(Automated test returned as passed.\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][0]['results'][0]['message'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][0]['results'][1]['status'])
+
+    message = hdf_json['profiles'][0]['controls'][0]['results'][1]['message']
+    assert_match(%r(Attestation:), message)
+    assert_match(%r(Status: passed), message)
+    assert_match(%r(Explanation: Non-expired Status passed), message)
+    assert_match(%r(Updated By: John Doe, ISSO), message)
+    assert_match(%r(Frequency: annually), message)
     refute_nil(hdf_json['profiles'][0]['controls'][0]['attestation'])
   end
 
-
   def test_with_a_multiple_pass_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('passed', hdf_json['profiles'][0]['controls'][1]['results'][0]['status'])
     assert_equal('passed', hdf_json['profiles'][0]['controls'][1]['results'][1]['status'])
-    assert_match(%r(Automated test returned as passed.\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][1]['results'][0]['message'])
-    assert_match(%r(Automated test returned as passed.\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][1]['results'][1]['message'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][1]['results'][2]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][1]['attestation'])
   end
 
   def test_with_a_single_fail_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][2]['results'][0]['status'])
-    assert_match(%r(\nexpected false\n     got true\n\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][2]['results'][0]['message'])
+    assert_equal('failed', hdf_json['profiles'][0]['controls'][2]['results'][0]['status'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][2]['results'][1]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][2]['attestation'])
   end
 
   def test_with_a_multiple_fail_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][3]['results'][0]['status'])
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][3]['results'][1]['status'])
-    assert_match(%r(\nexpected false\n     got true\n\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][3]['results'][0]['message'])
-    assert_match(%r(\nexpected true\n     got false\n\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][3]['results'][1]['message'])
+    assert_equal('failed', hdf_json['profiles'][0]['controls'][3]['results'][0]['status'])
+    assert_equal('failed', hdf_json['profiles'][0]['controls'][3]['results'][1]['status'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][3]['results'][2]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][3]['attestation'])
   end
 
   def test_with_a_single_skip_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][4]['results'][0]['status'])
-    assert_match(%r(Manual Test\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][4]['results'][0]['message'])
+    assert_equal('skipped', hdf_json['profiles'][0]['controls'][4]['results'][0]['status'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][4]['results'][1]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][4]['attestation'])
   end
   def test_with_a_multiple_skip_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][5]['results'][0]['status'])
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][5]['results'][1]['status'])
-    assert_match(%r(Manual Test2\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][5]['results'][0]['message'])
-    assert_match(%r(Manual Test2\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][5]['results'][1]['message'])
+    assert_equal('skipped', hdf_json['profiles'][0]['controls'][5]['results'][0]['status'])
+    assert_equal('skipped', hdf_json['profiles'][0]['controls'][5]['results'][1]['status'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][5]['results'][2]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][5]['attestation'])
   end
   def test_with_a_mixed_statuses_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][6]['results'][0]['status'])
+    assert_equal('skipped', hdf_json['profiles'][0]['controls'][6]['results'][0]['status'])
     assert_equal('passed', hdf_json['profiles'][0]['controls'][6]['results'][1]['status'])
-    assert_equal('passed', hdf_json['profiles'][0]['controls'][6]['results'][2]['status'])
-    assert_match(%r(Manual Test\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][6]['results'][0]['message'])
-    assert_match(%r(Automated test returned as passed.\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][6]['results'][1]['message'])
-    assert_match(%r(\nexpected false\n     got true\n\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][6]['results'][2]['message'])
+    assert_equal('failed', hdf_json['profiles'][0]['controls'][6]['results'][2]['status'])
+    assert_equal('passed', hdf_json['profiles'][0]['controls'][6]['results'][3]['status'])
     refute_nil(hdf_json['profiles'][0]['controls'][6]['attestation'])
   end
   def test_with_a_no_statuses_non_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('passed', hdf_json['profiles'][0]['controls'][7]['results'][0]['status'])
-    assert_match(%r(\n       Attestation:\n       Status: passed\n       Explanation: Non-expired Status passed\n), hdf_json['profiles'][0]['controls'][7]['results'][0]['message'])
     refute_nil(hdf_json['profiles'][0]['controls'][7]['attestation'])
   end
   def test_with_a_single_pass_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('passed', hdf_json['profiles'][0]['controls'][8]['results'][0]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][8]['results'][1])
     refute_nil(hdf_json['profiles'][0]['controls'][8]['attestation'])
   end
   def test_with_a_multiple_pass_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('passed', hdf_json['profiles'][0]['controls'][9]['results'][0]['status'])
     assert_equal('passed', hdf_json['profiles'][0]['controls'][9]['results'][1]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][9]['results'][2])
     refute_nil(hdf_json['profiles'][0]['controls'][9]['attestation'])
   end
   def test_with_a_single_fail_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('failed', hdf_json['profiles'][0]['controls'][10]['results'][0]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][10]['results'][1])
     refute_nil(hdf_json['profiles'][0]['controls'][10]['attestation'])
   end
   def test_with_a_multiple_fail_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('failed', hdf_json['profiles'][0]['controls'][11]['results'][0]['status'])
     assert_equal('failed', hdf_json['profiles'][0]['controls'][11]['results'][1]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][11]['results'][2])
     refute_nil(hdf_json['profiles'][0]['controls'][11]['attestation'])
   end
   def test_with_a_single_skip_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('skipped', hdf_json['profiles'][0]['controls'][12]['results'][0]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][12]['results'][1])
     refute_nil(hdf_json['profiles'][0]['controls'][12]['attestation'])
   end
   def test_with_a_multiple_skip_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('skipped', hdf_json['profiles'][0]['controls'][13]['results'][0]['status'])
     assert_equal('skipped', hdf_json['profiles'][0]['controls'][13]['results'][1]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][13]['results'][2])
     refute_nil(hdf_json['profiles'][0]['controls'][12]['attestation'])
   end
   def test_with_a_mixed_statuses_expired_attestation
     hdf_json = JSON.parse(File.read('test_hdf.json'))
     assert_equal('skipped', hdf_json['profiles'][0]['controls'][14]['results'][0]['status'])
     assert_equal('passed', hdf_json['profiles'][0]['controls'][14]['results'][1]['status'])
     assert_equal('failed', hdf_json['profiles'][0]['controls'][14]['results'][2]['status'])
+    assert_nil(hdf_json['profiles'][0]['controls'][14]['results'][3])
     refute_nil(hdf_json['profiles'][0]['controls'][14]['attestation'])
   end
   def test_with_a_no_statuses_expired_attestation

test/generate_attestation_file.rb

@@ -1,5 +1,6 @@
 require 'json'
 require 'date'
+require 'csv'
 
 
 DATE_FORMAT = '%Y-%m-%d'.freeze
@@ -144,10 +145,21 @@
 config_json = {
   'plugins' => {
     'inspec-reporter-json-hdf' => {
-      'attestations' => attestations
+       'include-attestations-file' => {
+           'type' => 'csv',
+           'path' => './attestations.csv'
+       },
+      'attestations' => attestations[0..4]
     }
   },
   'version' => '1.2'
 }
 
 File.write('attestations.json', config_json.to_json)
+
+CSV.open("attestations.csv", "wb") do |csv|
+  csv << ["Control_ID","Explanation","Frequency","Status","Updated","Updated_By"]
+  attestations[5..15].each do |hash|
+    csv << hash.values
+  end
+end