From d9e9f6f9aa28b276f22aba7f60f86d54d4b09463 Mon Sep 17 00:00:00 2001
From: "A.J. Stein" <aj@gsa.gov>
Date: Fri, 8 Nov 2024 18:57:00 -0500
Subject: [PATCH] For #833 add multiple negative tests, not just one

Add three different scenarios for failing tests to improve coverage for
the different error states.
---
 ...al-version-matches-fedramp-version-INVALID-1.xml |  9 +++++++++
 ...l-version-matches-fedramp-version-INVALID-2.xml} |  0
 ...al-version-matches-fedramp-version-INVALID-3.xml |  9 +++++++++
 .../oscal-version-matches-fedramp-version-FAIL.yaml | 13 +++++++++----
 4 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-1.xml
 rename src/validations/constraints/content/{ssp-oscal-version-matches-fedramp-version-INVALID.xml => ssp-oscal-version-matches-fedramp-version-INVALID-2.xml} (100%)
 create mode 100644 src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-3.xml

diff --git a/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-1.xml b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-1.xml
new file mode 100644
index 0000000000..2097393024
--- /dev/null
+++ b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-1.xml
@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <metadata>
+    <oscal-version>1.0.4</oscal-version>
+    <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="3.0.0-rc1"/>
+  </metadata>
+</system-security-plan>
\ No newline at end of file
diff --git a/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID.xml b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-2.xml
similarity index 100%
rename from src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID.xml
rename to src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-2.xml
diff --git a/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-3.xml b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-3.xml
new file mode 100644
index 0000000000..43ca534c73
--- /dev/null
+++ b/src/validations/constraints/content/ssp-oscal-version-matches-fedramp-version-INVALID-3.xml
@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <metadata>
+    <oscal-version>1.0.4</oscal-version>
+    <!-- prop[@name="fedramp-version"] is missing, so we have to test falling through to default version-->
+  </metadata>
+</system-security-plan>
\ No newline at end of file
diff --git a/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml b/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml
index b04b36f0cb..f9037ac2a1 100644
--- a/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml
+++ b/src/validations/constraints/unit-tests/oscal-version-matches-fedramp-version-FAIL.yaml
@@ -1,9 +1,14 @@
 test-case:
-  name: Negative Test for oscal-version-matches-fedramp-version
+  name: Positive Test for import-profile-has-available-document
   description: >-
-    This test case validates the behavior of constraint
-    oscal-version-matches-fedramp-version
-  content: ../content/ssp-oscal-version-matches-fedramp-version-INVALID.xml
+    This test case validates the behavior of constraint import-profile-has-available-document.
+    Scenario 1 tests: an invalid match below the minimum required version threshold.
+    Scenario 2 tests: an invalid match above the implied maximum required version threshold, a major version greater than required.
+    Scenario 3 tests: an invalid match because the fedramp-version prop is missing, so a fallthrough default is required.
+  content: 
+    - ../content/ssp-oscal-version-matches-fedramp-version-INVALID-1.xml
+    - ../content/ssp-oscal-version-matches-fedramp-version-INVALID-2.xml
+    - ../content/ssp-oscal-version-matches-fedramp-version-INVALID-3.xml
   expectations:
     - constraint-id: oscal-version-matches-fedramp-version
       result: fail