Benjamin Admin
2301fb2122
The Obligation Registry filled proposed_obligation_id (7/7) + cut the logging family (obligations 47->66). Adopted obligation_id onto our 7 accepted CRA->OWASP mappings; the join now prefers the EXACT obligation_id over the coarse citation_unit (which stays as fallback for not-yet-adopted rows). Effect: semantic coverage 2->4 (user_authentication_required, credential_confidentiality_protection, auth_key_management, event_logging_security_events). Befund 1 resolved: V11.2.1 crypto now sits under credential_confidentiality_protection, not user_authentication_required. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
60 lines
2.1 KiB
Go
60 lines
2.1 KiB
Go
package ucca
|
|
|
|
import "testing"
|
|
|
|
func loadGraph(t *testing.T) (*ObligationJoinKeys, *ControlMappingSet, *EvidenceRequirementSet) {
|
|
t.Helper()
|
|
joins, err := LoadObligationJoinKeys("../../../obligations/obligation_join_keys.json")
|
|
if err != nil {
|
|
t.Fatalf("join keys: %v", err)
|
|
}
|
|
maps, err := LoadControlMappings("../../data/control_mappings")
|
|
if err != nil {
|
|
t.Fatalf("mappings: %v", err)
|
|
}
|
|
ev, err := LoadEvidenceRequirements("../../data/evidence_requirements")
|
|
if err != nil {
|
|
t.Fatalf("evidence: %v", err)
|
|
}
|
|
return joins, maps, ev
|
|
}
|
|
|
|
func TestAssessObligationStatus(t *testing.T) {
|
|
joins, maps, ev := loadGraph(t)
|
|
|
|
// covered obligation, no evidence collected yet (MVP) -> offen
|
|
st := AssessObligationStatus(joins, maps, ev, "user_authentication_required", nil)
|
|
if st.Status != "offen" {
|
|
t.Errorf("want offen, got %q", st.Status)
|
|
}
|
|
if len(st.Controls) == 0 {
|
|
t.Fatal("expected controls for a covered obligation")
|
|
}
|
|
for _, c := range st.Controls {
|
|
if len(c.MissingEvidence) != len(c.RequiredEvidence) {
|
|
t.Error("MVP: all required evidence should be missing")
|
|
}
|
|
}
|
|
t.Logf("DURCHSTICH user_authentication_required: status=%s legal_basis=%v citation_spans=%s",
|
|
st.Status, st.LegalBasis, st.CitationSpans)
|
|
for _, c := range st.Controls {
|
|
t.Logf(" %s %s (%s): %d required evidence, %d missing", c.Framework, c.Control, c.MappingType, len(c.RequiredEvidence), len(c.MissingEvidence))
|
|
}
|
|
|
|
// all evidence present -> erfuellt
|
|
st2 := AssessObligationStatus(joins, maps, ev, "user_authentication_required", func(f, c, et string) bool { return true })
|
|
if st2.Status != "erfuellt" {
|
|
t.Errorf("want erfuellt with all evidence present, got %q", st2.Status)
|
|
}
|
|
|
|
// uncovered obligation (no accepted control reaches it) -> unklar
|
|
if st3 := AssessObligationStatus(joins, maps, ev, "sbom_creation", nil); st3.Status != "unklar" {
|
|
t.Errorf("uncovered sbom_creation: want unklar, got %q", st3.Status)
|
|
}
|
|
|
|
// unknown obligation_id -> unklar
|
|
if st4 := AssessObligationStatus(joins, maps, ev, "does_not_exist", nil); st4.Status != "unklar" {
|
|
t.Errorf("unknown obligation: want unklar, got %q", st4.Status)
|
|
}
|
|
}
|