Add Prepared By Constraints

[Gabeblis]

Committer Notes

Purpose

This PR introduces three constraints aimed at ensuring FedRAMP compliance for the digital authorization package by verifying the prepared-by roles/parties. These constraints ensure that all required elements are present and that necessary information is accurately documented.

Changes

Constraint: role-defined-prepared-by

• Validates that there is a defined role with the ID "prepared-by".

Constraint: responsible-party-prepared-by

• Ensures that a responsible party is assigned to the prepared-by role.

Constraint: responsible-party-prepared-by-location-valid

• Validates that the party assigned to the prepared-by role includes a location-uuid with the required address details.

Tests

• Added invalid test data files for all three constraints.
• Added pass/fail YAML files for the three constraints to verify their functionality.
• Updated ssp-all-VALID.xml to contain the required information so that the constraints fire and pass as expected.

All Submissions:

• Have you selected the correct base branch per Contributing guidance?
• Have you set "Allow edits and access to secrets by maintainers"?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Have you added an explanation of what your changes do and why you'd like us to include them?
• If applicable, have all FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.?
• If applicable, does this PR reference the issue it addresses and explain how it addresses the issue?

By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.

[aj-stein-gsa]

Can you address the updated AC requirements in the issue? Sorry again.

[Gabeblis]

Can you address the updated AC requirements in the issue? Sorry again.

Resolved here: 75317f8. I added the check for an embedded address assembly in the party and I added another -VALID.xml test file in order to validate both scenarios.

[Rene2mt]

overall, I'm okay with this PR, but we need to determine if we're going to require a country code for locations / addresses. Perhaps that can be addressed separately from this PR?

[aj-stein-gsa]

overall, I'm okay with this PR, but we need to determine if we're going to require a country code for locations / addresses. Perhaps that can be addressed separately from this PR?

For context, one of the other checks for country code is too aggressive and that should be rolled back anyway, I think. So that is why I have not brought it up in this PR yet.

[Gabeblis]

@aj-stein-gsa @Rene2mt I just opened #885 to address the issue with the country-code checks being too broad in the data-center constraints.

resolved