compliance-trestle icon indicating copy to clipboard operation
compliance-trestle copied to clipboard

Jinja templating enhancements

Open AleJo2995 opened this issue 1 year ago • 1 comments

Describe the bug

Jinja templating supports generating a table of parameters as follows:

{{ control_writer.write_control_with_sections(
      control, profile, group_title,
      ['statement', 'assessment-objective', 'guidance', 'table_of_parameters'],
      {
         'statement':'Statements',
         'assessment-objective':'Assessment objectives',
         'guidance':'NIST guidance',
         'table_of_parameters':'Parameters'
      },
      label_column=True,
      add_group_to_title=False
      ) | safe
   }}

The table generated looks like this:

| Parameter ID | Values | Label or Choices |
|---|---|---|
| ac-1_prm_1 |  | organization-defined personnel or roles |
| ac-01_odp.01 |  | personnel or roles |
| ac-01_odp.02 |  | personnel or roles |
| ac-01_odp.03 |  | Selection (one or more): organization-level; mission/business process-level; system-level |
| ac-01_odp.04 |  | official |
| ac-01_odp.05 |  | frequency |
| ac-01_odp.06 |  | events |
| ac-01_odp.07 |  | frequency |
| ac-01_odp.08 |  | events |
{: #"Parameters for AC-1" caption-side="top"}

But, it could use some enhancements to handle additional properties that go with parameters. This includes:

  • Information about aggregation

For params like ac-1_prm_1 that aggregate other parameters, it would be useful to indicate that in the parameters table.

            "params": [
              {
                "id": "ac-1_prm_1",
                "props": [
                  {
                    "name": "aggregates",
                    "ns": "http://csrc.nist.gov/ns/rmf",
                    "value": "ac-01_odp.01"
                  },
                  {
                    "name": "aggregates",
                    "ns": "http://csrc.nist.gov/ns/rmf",
                    "value": "ac-01_odp.02"
                  }
                ],
                "label": "organization-defined personnel or roles"
              },
  • A column for guideline prose

It would also be useful to add a column for the prose because it gives a deeper description than the label. For example, see the prose in params like ac-01_odp.01:

              {
                "id": "ac-01_odp.01",
                "props": [
                  {
                    "name": "label",
                    "value": "AC-01_ODP[01]",
                    "class": "sp800-53a"
                  }
                ],
                "label": "personnel or roles",
                "guidelines": [
                  {
                    "prose": "personnel or roles to whom the access control policy is to be disseminated is/are defined;"
                  }
                ]
              },
  • Proper handling of values and profile-values

From recent discussion, I believe values indicates a value that came from the catalog while profile-values indicates a value provided in the profile. It's not clear from the generated table what is shown in the Values column. We either need two columns or some how indicate where the value came from the the Values column.

Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots / Logs.

If applicable, add screenshots to help explain your problem.

Environment

  • OS: [e.g. iOS]
  • Python version:
  • Installed packages:

AleJo2995 avatar Jan 17 '24 21:01 AleJo2995