001package gov.nist.secauto.oscal.lib.model; 002 003import gov.nist.secauto.metaschema.core.datatype.adapter.UriAdapter; 004import gov.nist.secauto.metaschema.core.datatype.adapter.UriReferenceAdapter; 005import gov.nist.secauto.metaschema.core.datatype.adapter.UuidAdapter; 006import gov.nist.secauto.metaschema.core.datatype.markup.MarkupLine; 007import gov.nist.secauto.metaschema.core.datatype.markup.MarkupLineAdapter; 008import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultiline; 009import gov.nist.secauto.metaschema.core.datatype.markup.MarkupMultilineAdapter; 010import gov.nist.secauto.metaschema.core.model.IBoundObject; 011import gov.nist.secauto.metaschema.core.model.IMetaschemaData; 012import gov.nist.secauto.metaschema.core.model.JsonGroupAsBehavior; 013import gov.nist.secauto.metaschema.core.model.constraint.IConstraint; 014import gov.nist.secauto.metaschema.core.util.ObjectUtils; 015import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValue; 016import gov.nist.secauto.metaschema.databind.model.annotations.AllowedValues; 017import gov.nist.secauto.metaschema.databind.model.annotations.BoundAssembly; 018import gov.nist.secauto.metaschema.databind.model.annotations.BoundField; 019import gov.nist.secauto.metaschema.databind.model.annotations.BoundFlag; 020import gov.nist.secauto.metaschema.databind.model.annotations.Expect; 021import gov.nist.secauto.metaschema.databind.model.annotations.GroupAs; 022import gov.nist.secauto.metaschema.databind.model.annotations.IndexHasKey; 023import gov.nist.secauto.metaschema.databind.model.annotations.KeyField; 024import gov.nist.secauto.metaschema.databind.model.annotations.Matches; 025import gov.nist.secauto.metaschema.databind.model.annotations.MetaschemaAssembly; 026import gov.nist.secauto.metaschema.databind.model.annotations.ValueConstraints; 027import java.lang.Override; 028import java.lang.String; 029import java.net.URI; 030import java.util.LinkedList; 031import java.util.List; 032import java.util.UUID; 033import org.apache.commons.lang3.builder.ReflectionToStringBuilder; 034import org.apache.commons.lang3.builder.ToStringStyle; 035 036/** 037 * Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in <a href="https://doi.org/10.6028/NIST.SP.800-60v2r1">NIST SP 800-60</a>. 038 */ 039@MetaschemaAssembly( 040 formalName = "System Information", 041 description = "Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in [NIST SP 800-60](https://doi.org/10.6028/NIST.SP.800-60v2r1).", 042 name = "system-information", 043 moduleClass = OscalSspModule.class, 044 valueConstraints = @ValueConstraints(allowedValues = {@AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name", values = @AllowedValue(value = "privacy-designation", description = "Is this a privacy sensitive system? yes or no")), @AllowedValues(level = IConstraint.Level.ERROR, target = "prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='privacy-designation']/@value", values = {@AllowedValue(value = "yes", description = "The system is privacy sensitive."), @AllowedValue(value = "no", description = "The system is not privacy sensitive.")}), @AllowedValues(level = IConstraint.Level.ERROR, target = "link/@rel", allowOthers = true, values = @AllowedValue(value = "privacy-impact-assessment", description = "A link to the privacy impact assessment.")), @AllowedValues(level = IConstraint.Level.ERROR, target = "information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)", allowOthers = true, values = {@AllowedValue(value = "fips-199-low", description = "A 'low' sensitivity level as defined in [FIPS-199](https://doi.org/10.6028/NIST.FIPS.199)."), @AllowedValue(value = "fips-199-moderate", description = "A 'moderate' sensitivity level as defined in [FIPS-199](https://doi.org/10.6028/NIST.FIPS.199)."), @AllowedValue(value = "fips-199-high", description = "A 'high' sensitivity level as defined in [FIPS-199](https://doi.org/10.6028/NIST.FIPS.199).")}, remarks = "FIPS-199 taxonomy is provided here as a starting point. We will provide other taxonomies based on community requests.")}, indexHasKey = @IndexHasKey(level = IConstraint.Level.ERROR, target = "link[@rel='privacy-impact-assessment' and starts-with(@href,'#')]", indexName = "index-back-matter-resource", keyFields = @KeyField(target = "@href", pattern = "#(.*)")), matches = {@Matches(level = IConstraint.Level.ERROR, target = "link[@rel='privacy-impact-assessment']/@href[starts-with(.,'#')]", typeAdapter = UriReferenceAdapter.class), @Matches(level = IConstraint.Level.ERROR, target = "link[@rel='privacy-impact-assessment']/@href[not(starts-with(.,'#'))]", typeAdapter = UriAdapter.class)}) 045) 046public class SystemInformation implements IBoundObject { 047 private final IMetaschemaData __metaschemaData; 048 049 @BoundAssembly( 050 formalName = "Property", 051 description = "An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.", 052 useName = "prop", 053 maxOccurs = -1, 054 groupAs = @GroupAs(name = "props", inJson = JsonGroupAsBehavior.LIST) 055 ) 056 private List<Property> _props; 057 058 @BoundAssembly( 059 formalName = "Link", 060 description = "A reference to a local or remote resource, that has a specific relation to the containing object.", 061 useName = "link", 062 maxOccurs = -1, 063 groupAs = @GroupAs(name = "links", inJson = JsonGroupAsBehavior.LIST) 064 ) 065 private List<Link> _links; 066 067 @BoundAssembly( 068 formalName = "Information Type", 069 description = "Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in [NIST SP 800-60](https://doi.org/10.6028/NIST.SP.800-60v2r1).", 070 useName = "information-type", 071 minOccurs = 1, 072 maxOccurs = -1, 073 groupAs = @GroupAs(name = "information-types", inJson = JsonGroupAsBehavior.LIST) 074 ) 075 private List<InformationType> _informationTypes; 076 077 public SystemInformation() { 078 this(null); 079 } 080 081 public SystemInformation(IMetaschemaData data) { 082 this.__metaschemaData = data; 083 } 084 085 @Override 086 public IMetaschemaData getMetaschemaData() { 087 return __metaschemaData; 088 } 089 090 public List<Property> getProps() { 091 return _props; 092 } 093 094 public void setProps(List<Property> value) { 095 _props = value; 096 } 097 098 /** 099 * Add a new {@link Property} item to the underlying collection. 100 * @param item the item to add 101 * @return {@code true} 102 */ 103 public boolean addProp(Property item) { 104 Property value = ObjectUtils.requireNonNull(item,"item cannot be null"); 105 if (_props == null) { 106 _props = new LinkedList<>(); 107 } 108 return _props.add(value); 109 } 110 111 /** 112 * Remove the first matching {@link Property} item from the underlying collection. 113 * @param item the item to remove 114 * @return {@code true} if the item was removed or {@code false} otherwise 115 */ 116 public boolean removeProp(Property item) { 117 Property value = ObjectUtils.requireNonNull(item,"item cannot be null"); 118 return _props != null && _props.remove(value); 119 } 120 121 public List<Link> getLinks() { 122 return _links; 123 } 124 125 public void setLinks(List<Link> value) { 126 _links = value; 127 } 128 129 /** 130 * Add a new {@link Link} item to the underlying collection. 131 * @param item the item to add 132 * @return {@code true} 133 */ 134 public boolean addLink(Link item) { 135 Link value = ObjectUtils.requireNonNull(item,"item cannot be null"); 136 if (_links == null) { 137 _links = new LinkedList<>(); 138 } 139 return _links.add(value); 140 } 141 142 /** 143 * Remove the first matching {@link Link} item from the underlying collection. 144 * @param item the item to remove 145 * @return {@code true} if the item was removed or {@code false} otherwise 146 */ 147 public boolean removeLink(Link item) { 148 Link value = ObjectUtils.requireNonNull(item,"item cannot be null"); 149 return _links != null && _links.remove(value); 150 } 151 152 public List<InformationType> getInformationTypes() { 153 return _informationTypes; 154 } 155 156 public void setInformationTypes(List<InformationType> value) { 157 _informationTypes = value; 158 } 159 160 /** 161 * Add a new {@link InformationType} item to the underlying collection. 162 * @param item the item to add 163 * @return {@code true} 164 */ 165 public boolean addInformationType(InformationType item) { 166 InformationType value = ObjectUtils.requireNonNull(item,"item cannot be null"); 167 if (_informationTypes == null) { 168 _informationTypes = new LinkedList<>(); 169 } 170 return _informationTypes.add(value); 171 } 172 173 /** 174 * Remove the first matching {@link InformationType} item from the underlying collection. 175 * @param item the item to remove 176 * @return {@code true} if the item was removed or {@code false} otherwise 177 */ 178 public boolean removeInformationType(InformationType item) { 179 InformationType value = ObjectUtils.requireNonNull(item,"item cannot be null"); 180 return _informationTypes != null && _informationTypes.remove(value); 181 } 182 183 @Override 184 public String toString() { 185 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 186 } 187 188 /** 189 * Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in <a href="https://doi.org/10.6028/NIST.SP.800-60v2r1">NIST SP 800-60</a>. 190 */ 191 @MetaschemaAssembly( 192 formalName = "Information Type", 193 description = "Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in [NIST SP 800-60](https://doi.org/10.6028/NIST.SP.800-60v2r1).", 194 name = "information-type", 195 moduleClass = OscalSspModule.class, 196 valueConstraints = @ValueConstraints(expect = @Expect(level = IConstraint.Level.WARNING, test = "@uuid", message = "It is a best practice to provide a UUID.")) 197 ) 198 public static class InformationType implements IBoundObject { 199 private final IMetaschemaData __metaschemaData; 200 201 /** 202 * "A <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented\">machine-oriented</a>, <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique\">globally unique</a> identifier with <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance\">cross-instance</a> scope that can be used to reference this information type elsewhere in <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#ssp-identifiers\">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>information type</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href=\"https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency\">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document." 203 */ 204 @BoundFlag( 205 formalName = "Information Type Universally Unique Identifier", 206 description = "A [machine-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier with [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope that can be used to reference this information type elsewhere in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#ssp-identifiers). The locally defined *UUID* of the `information type` can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same subject across revisions of the document.", 207 name = "uuid", 208 typeAdapter = UuidAdapter.class 209 ) 210 private UUID _uuid; 211 212 @BoundField( 213 formalName = "title field", 214 description = "A human readable name for the information type. This title should be meaningful within the context of the system.", 215 useName = "title", 216 minOccurs = 1, 217 typeAdapter = MarkupLineAdapter.class 218 ) 219 private MarkupLine _title; 220 221 @BoundField( 222 formalName = "Information Type Description", 223 description = "A summary of how this information type is used within the system.", 224 useName = "description", 225 minOccurs = 1, 226 typeAdapter = MarkupMultilineAdapter.class 227 ) 228 private MarkupMultiline _description; 229 230 @BoundAssembly( 231 formalName = "Information Type Categorization", 232 description = "A set of information type identifiers qualified by the given identification `system` used, such as NIST SP 800-60.", 233 useName = "categorization", 234 maxOccurs = -1, 235 groupAs = @GroupAs(name = "categorizations", inJson = JsonGroupAsBehavior.LIST) 236 ) 237 private List<Categorization> _categorizations; 238 239 @BoundAssembly( 240 formalName = "Property", 241 description = "An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.", 242 useName = "prop", 243 maxOccurs = -1, 244 groupAs = @GroupAs(name = "props", inJson = JsonGroupAsBehavior.LIST) 245 ) 246 private List<Property> _props; 247 248 @BoundAssembly( 249 formalName = "Link", 250 description = "A reference to a local or remote resource, that has a specific relation to the containing object.", 251 useName = "link", 252 maxOccurs = -1, 253 groupAs = @GroupAs(name = "links", inJson = JsonGroupAsBehavior.LIST) 254 ) 255 private List<Link> _links; 256 257 @BoundAssembly( 258 formalName = "Confidentiality Impact Level", 259 description = "The expected level of impact resulting from the unauthorized disclosure of the described information.", 260 useName = "confidentiality-impact" 261 ) 262 private Impact _confidentialityImpact; 263 264 @BoundAssembly( 265 formalName = "Integrity Impact Level", 266 description = "The expected level of impact resulting from the unauthorized modification of the described information.", 267 useName = "integrity-impact" 268 ) 269 private Impact _integrityImpact; 270 271 @BoundAssembly( 272 formalName = "Availability Impact Level", 273 description = "The expected level of impact resulting from the disruption of access to or use of the described information or the information system.", 274 useName = "availability-impact" 275 ) 276 private Impact _availabilityImpact; 277 278 public InformationType() { 279 this(null); 280 } 281 282 public InformationType(IMetaschemaData data) { 283 this.__metaschemaData = data; 284 } 285 286 @Override 287 public IMetaschemaData getMetaschemaData() { 288 return __metaschemaData; 289 } 290 291 public UUID getUuid() { 292 return _uuid; 293 } 294 295 public void setUuid(UUID value) { 296 _uuid = value; 297 } 298 299 public MarkupLine getTitle() { 300 return _title; 301 } 302 303 public void setTitle(MarkupLine value) { 304 _title = value; 305 } 306 307 public MarkupMultiline getDescription() { 308 return _description; 309 } 310 311 public void setDescription(MarkupMultiline value) { 312 _description = value; 313 } 314 315 public List<Categorization> getCategorizations() { 316 return _categorizations; 317 } 318 319 public void setCategorizations(List<Categorization> value) { 320 _categorizations = value; 321 } 322 323 /** 324 * Add a new {@link Categorization} item to the underlying collection. 325 * @param item the item to add 326 * @return {@code true} 327 */ 328 public boolean addCategorization(Categorization item) { 329 Categorization value = ObjectUtils.requireNonNull(item,"item cannot be null"); 330 if (_categorizations == null) { 331 _categorizations = new LinkedList<>(); 332 } 333 return _categorizations.add(value); 334 } 335 336 /** 337 * Remove the first matching {@link Categorization} item from the underlying collection. 338 * @param item the item to remove 339 * @return {@code true} if the item was removed or {@code false} otherwise 340 */ 341 public boolean removeCategorization(Categorization item) { 342 Categorization value = ObjectUtils.requireNonNull(item,"item cannot be null"); 343 return _categorizations != null && _categorizations.remove(value); 344 } 345 346 public List<Property> getProps() { 347 return _props; 348 } 349 350 public void setProps(List<Property> value) { 351 _props = value; 352 } 353 354 /** 355 * Add a new {@link Property} item to the underlying collection. 356 * @param item the item to add 357 * @return {@code true} 358 */ 359 public boolean addProp(Property item) { 360 Property value = ObjectUtils.requireNonNull(item,"item cannot be null"); 361 if (_props == null) { 362 _props = new LinkedList<>(); 363 } 364 return _props.add(value); 365 } 366 367 /** 368 * Remove the first matching {@link Property} item from the underlying collection. 369 * @param item the item to remove 370 * @return {@code true} if the item was removed or {@code false} otherwise 371 */ 372 public boolean removeProp(Property item) { 373 Property value = ObjectUtils.requireNonNull(item,"item cannot be null"); 374 return _props != null && _props.remove(value); 375 } 376 377 public List<Link> getLinks() { 378 return _links; 379 } 380 381 public void setLinks(List<Link> value) { 382 _links = value; 383 } 384 385 /** 386 * Add a new {@link Link} item to the underlying collection. 387 * @param item the item to add 388 * @return {@code true} 389 */ 390 public boolean addLink(Link item) { 391 Link value = ObjectUtils.requireNonNull(item,"item cannot be null"); 392 if (_links == null) { 393 _links = new LinkedList<>(); 394 } 395 return _links.add(value); 396 } 397 398 /** 399 * Remove the first matching {@link Link} item from the underlying collection. 400 * @param item the item to remove 401 * @return {@code true} if the item was removed or {@code false} otherwise 402 */ 403 public boolean removeLink(Link item) { 404 Link value = ObjectUtils.requireNonNull(item,"item cannot be null"); 405 return _links != null && _links.remove(value); 406 } 407 408 public Impact getConfidentialityImpact() { 409 return _confidentialityImpact; 410 } 411 412 public void setConfidentialityImpact(Impact value) { 413 _confidentialityImpact = value; 414 } 415 416 public Impact getIntegrityImpact() { 417 return _integrityImpact; 418 } 419 420 public void setIntegrityImpact(Impact value) { 421 _integrityImpact = value; 422 } 423 424 public Impact getAvailabilityImpact() { 425 return _availabilityImpact; 426 } 427 428 public void setAvailabilityImpact(Impact value) { 429 _availabilityImpact = value; 430 } 431 432 @Override 433 public String toString() { 434 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 435 } 436 437 /** 438 * A set of information type identifiers qualified by the given identification <code>system</code> used, such as NIST SP 800-60. 439 */ 440 @MetaschemaAssembly( 441 formalName = "Information Type Categorization", 442 description = "A set of information type identifiers qualified by the given identification `system` used, such as NIST SP 800-60.", 443 name = "categorization", 444 moduleClass = OscalSspModule.class 445 ) 446 public static class Categorization implements IBoundObject { 447 private final IMetaschemaData __metaschemaData; 448 449 /** 450 * "Specifies the information type identification system used." 451 */ 452 @BoundFlag( 453 formalName = "Information Type Identification System", 454 description = "Specifies the information type identification system used.", 455 name = "system", 456 required = true, 457 typeAdapter = UriAdapter.class, 458 remarks = "This value must be an [absolute URI](https://pages.nist.gov/OSCAL/concepts/uri-use/#absolute-uri) that serves as a [naming system identifier](https://pages.nist.gov/OSCAL/concepts/uri-use/#use-as-a-naming-system-identifier).", 459 valueConstraints = @ValueConstraints(allowedValues = @AllowedValues(level = IConstraint.Level.ERROR, allowOthers = true, values = @AllowedValue(value = "http://doi.org/10.6028/NIST.SP.800-60v2r1", description = "Based on the section identifiers in NIST [Special Publication 800-60 Volume II Revision 1](https://doi.org/10.6028/NIST.SP.800-60v2r1)."))) 460 ) 461 private URI _system; 462 463 @BoundField( 464 formalName = "Information Type Systematized Identifier", 465 description = "A [human-oriented](https://pages.nist.gov/OSCAL/concepts/identifier-use/#human-oriented), [globally unique](https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique) identifier qualified by the given identification `system` used, such as NIST SP 800-60. This identifier has [cross-instance](https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance) scope and can be used to reference this system elsewhere in [this or other OSCAL instances](https://pages.nist.gov/OSCAL/concepts/identifier-use/#ssp-identifiers). This id should be assigned [per-subject](https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency), which means it should be consistently used to identify the same subject across revisions of the document.", 466 useName = "information-type-id", 467 maxOccurs = -1, 468 groupAs = @GroupAs(name = "information-type-ids", inJson = JsonGroupAsBehavior.LIST) 469 ) 470 private List<String> _informationTypeIds; 471 472 public Categorization() { 473 this(null); 474 } 475 476 public Categorization(IMetaschemaData data) { 477 this.__metaschemaData = data; 478 } 479 480 @Override 481 public IMetaschemaData getMetaschemaData() { 482 return __metaschemaData; 483 } 484 485 public URI getSystem() { 486 return _system; 487 } 488 489 public void setSystem(URI value) { 490 _system = value; 491 } 492 493 public List<String> getInformationTypeIds() { 494 return _informationTypeIds; 495 } 496 497 public void setInformationTypeIds(List<String> value) { 498 _informationTypeIds = value; 499 } 500 501 /** 502 * Add a new {@link String} item to the underlying collection. 503 * @param item the item to add 504 * @return {@code true} 505 */ 506 public boolean addInformationTypeId(String item) { 507 String value = ObjectUtils.requireNonNull(item,"item cannot be null"); 508 if (_informationTypeIds == null) { 509 _informationTypeIds = new LinkedList<>(); 510 } 511 return _informationTypeIds.add(value); 512 } 513 514 /** 515 * Remove the first matching {@link String} item from the underlying collection. 516 * @param item the item to remove 517 * @return {@code true} if the item was removed or {@code false} otherwise 518 */ 519 public boolean removeInformationTypeId(String item) { 520 String value = ObjectUtils.requireNonNull(item,"item cannot be null"); 521 return _informationTypeIds != null && _informationTypeIds.remove(value); 522 } 523 524 @Override 525 public String toString() { 526 return new ReflectionToStringBuilder(this, ToStringStyle.MULTI_LINE_STYLE).toString(); 527 } 528 } 529 } 530}