From b0726ccf1314fc7c9efe2283be1eddfd97ea49aa Mon Sep 17 00:00:00 2001
From: Rene Tshiteya <rene-claude.tshiteya@noblis.org>
Date: Fri, 5 Jan 2024 15:24:55 -0500
Subject: [PATCH] Add support to associate roles with privileges

---
 src/metaschema/oscal_implementation-common_metaschema.xml | 5 +++++
 src/metaschema/oscal_ssp_metaschema.xml                   | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/src/metaschema/oscal_implementation-common_metaschema.xml b/src/metaschema/oscal_implementation-common_metaschema.xml
index 60138cbf4b..1946853273 100644
--- a/src/metaschema/oscal_implementation-common_metaschema.xml
+++ b/src/metaschema/oscal_implementation-common_metaschema.xml
@@ -386,6 +386,7 @@
                   <field ref="role-id" min-occurs="0" max-occurs="unbounded">
                         <group-as name="role-ids" in-json="ARRAY"/>
                   </field>
+                  <!-- TODO: deprecate use of 'authorized-privilege' in the user assembly.  Instead, add 'role-id' to 'authorized-privilege' assembly and apply to  -->
                   <assembly ref="authorized-privilege" max-occurs="unbounded">
                         <group-as name="authorized-privileges" in-json="ARRAY"/>
                   </assembly>
@@ -429,6 +430,10 @@
                   <field ref="function-performed" min-occurs="1" max-occurs="unbounded">
                         <group-as name="functions-performed" in-json="ARRAY"/>
                   </field>
+                  <field ref="role-id" min-occurs="0" max-occurs="unbounded">
+                        <group-as name="role-ids" in-json="ARRAY"/>
+                  </field>
+                  <!-- Todo: will need to create contstraint such that referenced role-id must exist in the metadata -->
             </model>
       </define-assembly>
       <define-field name="function-performed" as-type="string">
diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml
index f7ac668666..a260193791 100644
--- a/src/metaschema/oscal_ssp_metaschema.xml
+++ b/src/metaschema/oscal_ssp_metaschema.xml
@@ -581,6 +581,12 @@
         <use-name>user</use-name>
         <group-as name="users" in-json="ARRAY"/>
       </assembly>
+
+      <assembly ref="authorized-privilege" min-occurs="1" max-occurs="unbounded">
+        <authorized-privilege>authorized-privilege</authorized-privilege>
+        <group-as name="authorized-privileges" in-json="ARRAY" />
+      </assembly>
+
       <assembly ref="system-component" min-occurs="1" max-occurs="unbounded">
         <use-name>component</use-name>
         <group-as name="components" in-json="ARRAY"/>