Add Element method to merge in control implementations statements from another component

CHANGELOG.md

@@ -9,6 +9,8 @@ v0.9.14-dev (April xx, 2022)
 * Support private components (elements).
 * Assign responsible roles to components (elements) and appointing parties to roles. 
 
+Release adds support for private components and integrations with third party services.
+
 **UI changes**
 
 * Change label 'certified statement' to 'reference statement'.
@@ -20,6 +22,7 @@ v0.9.14-dev (April xx, 2022)
 * Added tabs for coponent requests.
 * Only Component owner can edit user permissions.
 * Display the control framework along side of controls in component control listing page.
+* Remove icons from project listing.
 
 **Developer changes**
 
@@ -30,14 +33,19 @@ v0.9.14-dev (April xx, 2022)
 * Support for hidden components by adding 'hidden' boolean field to controls.models.Element.
 * Support for requiring approval components by adding 'require_approval' boolean field to controls.models.Element.
 * Create new components as private and assign owner permissions to user who created the component.
+* Added extensible Integrations Django appplication to support communication with third-party services via APIs, etc.
+* Added initial support for DoJ's CSAM integration.
+* Added ElementPermissionSerializer for component (element) permissions.
 * Add tests for component creation form user interface.
 * Add ElementPermissionSerializer, UpdateElementPermissionSerializer, RemoveUserPermissionFromElementSerializer for component (element) permissions.
 * Add ElementWithPermissionsViewSet for component (element) permissions.
 * Add more permission functions to element model: assigning a user specific permissions, removing all permissions from a user, and checking if a user is an owner of the element.
 * Updated User model to include search by 'username' and exclusion functionality to queryset.
 * Add model Roles, Party, and Appointments to siteapp to support identifying roles on Components (Element).
 * Assign owners to components imported via OSCAL. If no user is identified during component (element creation) assign first Superuser (administrator) as component owner.
+* Add to controls.models.Element.merge_component_implementation_statements method to Merge a second component statements to statements of first component.
 * Support navigating to specific tab on component library component page using URL hash (#) reference.
+* Protype integrations System Summary page.
 
 **Bug fixes**
 
@@ -46,6 +54,7 @@ v0.9.14-dev (April xx, 2022)
 * Resolve components not displaying the tag widget by properly setting existingTags default for new component.
 * Footer fixes.
 * Assign owners to default components (elements) created during install first_run script.
+* Correctly display POA&M forms with left-side menu.
 
 v0.9.13 (January 23, 2022)
 --------------------------

api/controls/serializers/element.py

@@ -1,12 +1,14 @@
 from rest_framework import serializers
 from rest_framework.relations import PrimaryKeyRelatedField
 
+
 from api.base.serializers.types import ReadOnlySerializer, WriteOnlySerializer
 from api.controls.serializers.import_record import SimpleImportRecordSerializer
 from api.siteapp.serializers.tags import SimpleTagSerializer
 from api.siteapp.serializers.appointment import SimpleAppointmentSerializer
-from controls.models import Element, ElementRole, ElementControl
-from siteapp.models import Appointment, Role, Party, Tag
+from controls.models import Element, ElementRole, ElementControl, Statement
+from controls.enums.statements import StatementTypeEnum
+from siteapp.models import Appointment, Party, Request, Role, Tag
 from guardian.shortcuts import (assign_perm, get_objects_for_user,
                                 get_perms_for_model, get_user_perms,
                                 get_users_with_perms, remove_perm)
@@ -28,9 +30,14 @@ class DetailedElementSerializer(SimpleElementSerializer):
     roles = SimpleElementRoleSerializer(many=True)
     tags = SimpleTagSerializer(many=True)
     appointments = SimpleAppointmentSerializer(many=True)
-    # parties = serializers.SerializerMethodField()
     parties = serializers.SerializerMethodField('get_parties')
+    criteria = serializers.SerializerMethodField('get_criteria')
+    numOfStmts = serializers.SerializerMethodField('get_numOfStmts')
 
+    def get_numOfStmts(self, element):
+        stmts = Statement.objects.filter(producer_element_id = element.id, statement_type=StatementTypeEnum.CONTROL_IMPLEMENTATION_PROTOTYPE.name)
+        return len(stmts)
+
     def get_parties(self, element):
         parties = []
         counter = 1;
@@ -77,9 +84,16 @@ def getParty(parties_list, party_id):
                 counter += 1
                 parties.append(party)
         return parties
+    def get_criteria(self, element):
+        criteria_results = element.statements_produced.filter(statement_type=StatementTypeEnum.COMPONENT_APPROVAL_CRITERIA.name)
+        if len(criteria_results) > 0:
+            criteria_text = criteria_results.first().body
+        else:
+            criteria_text = ""
+        return criteria_text
     class Meta:
         model = Element
-        fields = SimpleElementSerializer.Meta.fields + ['roles', 'import_record', 'tags', 'appointments', 'parties']
+        fields = SimpleElementSerializer.Meta.fields + ['roles', 'import_record', 'tags', 'appointments', 'parties', 'criteria', 'numOfStmts']
 
 class ElementPermissionSerializer(SimpleElementSerializer):
     users_with_permissions = serializers.SerializerMethodField('get_list_of_users')
@@ -167,4 +181,73 @@ class CreateMultipleAppointmentsFromRoleIds(WriteOnlySerializer):
     role_ids = serializers.JSONField()
     class Meta:
         model = Element
-        fields = ['role_ids']
+        fields = ['role_ids']
+
+class ElementRequestsSerializer(ReadOnlySerializer):
+    requested = serializers.SerializerMethodField('get_list_of_requested')
+
+    def get_list_of_requested(self, element):
+        list_of_requests = []
+        counter = 1
+        for request in element.requests.all():
+
+            list_of_system_PointOfContacts = []
+            for user in request.system.root_element.appointments.filter(role__title="Point of Contact"):
+                list_of_system_PointOfContacts.append(user.party.name)
+
+            list_of_requestedElements_PointOfContacts = []
+            for user in request.requested_element.appointments.filter(role__title="Point of Contact"):
+                list_of_requestedElements_PointOfContacts.append(user.party.name)
+
+            req = {
+                "id": counter,
+                "requestId": request.id,
+                "userId": request.user.id,
+                "user_name": request.user.name,
+                "user_email": request.user.email,
+                "user_phone_number": request.user.phone_number,
+                "system": {
+                    "id": request.system.id,
+                    "name": request.system.root_element.name,
+                    "full_name": request.system.root_element.full_name,
+                    "name": request.system.root_element.name,
+                    "description": request.system.root_element.description,
+                    "point_of_contact": list_of_system_PointOfContacts,
+                },
+                "requested_element": {
+                    "id": request.requested_element.id,
+                    "name": request.requested_element.name,
+                    "full_name": request.requested_element.full_name,
+                    "name": request.requested_element.name,
+                    "description": request.requested_element.description,
+                    "private": request.requested_element.private,
+                    "require_approval": request.requested_element.require_approval,
+                    "point_of_contact": list_of_requestedElements_PointOfContacts,
+                },
+                "criteria_comment": request.criteria_comment,
+                "criteria_reject_comment": request.criteria_reject_comment,
+                "status": request.status,
+            }
+            counter += 1
+            list_of_requests.append(req)
+        return list_of_requests
+    class Meta:
+        model = Element
+        fields = ['requested']
+
+class ElementSetRequestsSerializer(WriteOnlySerializer):
+    requests_ids = PrimaryKeyRelatedField(source='request', many=True, queryset=Request.objects)
+    class Meta:
+        model = Element
+        fields = ['requests_ids']
+
+class ElementCreateAndSetRequestSerializer(WriteOnlySerializer):
+    proposalId = serializers.IntegerField(max_value=None, min_value=None)
+    userId = serializers.IntegerField(max_value=None, min_value=None)
+    systemId = serializers.IntegerField(max_value=None, min_value=None)
+    criteria_comment = serializers.CharField(min_length=None, max_length=None, allow_blank=True, trim_whitespace=True)
+    criteria_reject_comment = serializers.CharField(min_length=None, max_length=None, allow_blank=True, trim_whitespace=True)
+    status = serializers.CharField(min_length=None, max_length=None, allow_blank=True, trim_whitespace=True)
+    class Meta:
+        model = Element
+        fields = ['proposalId', 'userId', 'systemId', 'criteria_comment', 'criteria_reject_comment', 'status']

api/controls/serializers/poam.py

@@ -1,14 +1,41 @@
+from rest_framework import serializers
 from api.base.serializers.types import ReadOnlySerializer
 from api.controls.serializers.statements import DetailedStatementSerializer
 from controls.models import Poam
 
 
 class SimplePoamSerializer(ReadOnlySerializer):
+    statement = serializers.SerializerMethodField('get_statement')
+
+    def get_statement(self, poam):
+        smt = {
+            'sid': poam.statement.sid,
+            'sid_class': poam.statement.sid_class,
+            'source': poam.statement.source,
+            'pid': poam.statement.pid,
+            'body': poam.statement.body,
+            'statement_type': poam.statement.statement_type,
+            'remarks': poam.statement.remarks,
+            'status': poam.statement.status,
+            'version': poam.statement.version,
+            'created': poam.statement.created,
+            'updated': poam.statement.updated,
+            # 'parent': poam.statement.parent,
+            # 'prototype': poam.statement.prototype,
+            # 'producer_element': poam.statement.producer_element,
+            # 'consumer_element': poam.statement.consumer_element,
+            # 'mentioned_elements': poam.statement.mentioned_elements,
+            'uuid': poam.statement.uuid,
+            'import_record': poam.statement.import_record,
+            # 'change_log': poam.statement.change_log,
+            # 'history': poam.statement.history,
+        }
+        return smt
     class Meta:
         model = Poam
         fields = ['poam_id', 'controls', 'weakness_name', 'weakness_detection_source', 'weakness_source_identifier',
                   'remediation_plan', 'scheduled_completion_date', 'milestones','milestone_changes',
-                  'risk_rating_original', 'risk_rating_adjusted', 'poam_group']
+                  'risk_rating_original', 'risk_rating_adjusted', 'poam_group', 'statement']
 
 
 class DetailedPoamSerializer(SimplePoamSerializer):

api/controls/serializers/system.py

@@ -1,3 +1,4 @@
+from rest_framework import serializers
 from rest_framework.relations import PrimaryKeyRelatedField
 
 from api.base.serializers.types import ReadOnlySerializer, WriteOnlySerializer
@@ -29,3 +30,35 @@ class WriteElementTagsSerializer(WriteOnlySerializer):
     class Meta:
         model = System
         fields = ['tag_ids']
+
+class SystemCreateAndSetProposalSerializer(WriteOnlySerializer):
+    userId = serializers.IntegerField(max_value=None, min_value=None)
+    elementId = serializers.IntegerField(max_value=None, min_value=None)
+    criteria_comment = serializers.CharField(min_length=None, max_length=None, allow_blank=True, trim_whitespace=True)
+    status = serializers.CharField(min_length=None, max_length=None, allow_blank=True, trim_whitespace=True)
+    class Meta:
+        model = System
+        fields = ['userId', 'elementId', 'criteria_comment','status']
+
+
+class SystemRetrieveProposalsSerializer(ReadOnlySerializer):
+    proposals = serializers.SerializerMethodField('get_proposals')
+
+    def get_proposals(self, system):
+        list_of_proposals = []
+        counter = 1
+        for proposal in system.proposals.all():
+            list_of_proposals.append({
+                'id': counter,
+                'proposal_id': proposal.id,
+                'user': proposal.user.username,
+                'elementId': proposal.requested_element.id,
+                'element_name': proposal.requested_element.name,
+                'criteria_comment': proposal.criteria_comment,
+                'status': proposal.status,
+            })
+            counter += 1
+        return list_of_proposals
+    class Meta:
+        model = System
+        fields = ['proposals']

api/controls/views/element.py

@@ -1,13 +1,13 @@
+import collections
 from rest_framework.decorators import action
 from rest_framework.response import Response
 
 from api.base.views.base import SerializerClasses
 from api.base.views.viewsets import ReadOnlyViewSet, ReadWriteViewSet
 from api.controls.serializers.element import DetailedElementSerializer, SimpleElementSerializer, \
-    WriteElementTagsSerializer, ElementPermissionSerializer, UpdateElementPermissionSerializer, RemoveUserPermissionFromElementSerializer, WriteElementAppointPartySerializer, ElementPartySerializer, DeletePartyAppointmentsFromElementSerializer, CreateMultipleAppointmentsFromRoleIds
-from controls.models import Element
-from siteapp.models import Appointment, Party, Role
-from siteapp.models import User
+    WriteElementTagsSerializer, ElementPermissionSerializer, UpdateElementPermissionSerializer, RemoveUserPermissionFromElementSerializer, WriteElementAppointPartySerializer, ElementPartySerializer, DeletePartyAppointmentsFromElementSerializer, CreateMultipleAppointmentsFromRoleIds, ElementRequestsSerializer, ElementSetRequestsSerializer, ElementCreateAndSetRequestSerializer
+from controls.models import Element, System
+from siteapp.models import Appointment, Party, Proposal, Role, Request, User
 
 class ElementViewSet(ReadOnlyViewSet):
     queryset = Element.objects.all()
@@ -18,7 +18,10 @@ class ElementViewSet(ReadOnlyViewSet):
                                            appointments=WriteElementAppointPartySerializer,
                                            removeAppointments=WriteElementAppointPartySerializer,
                                            removeAppointmentsByParty=DeletePartyAppointmentsFromElementSerializer,
-                                           CreateAndSet=CreateMultipleAppointmentsFromRoleIds
+                                           CreateAndSet=CreateMultipleAppointmentsFromRoleIds,
+                                           retrieveRequests=ElementRequestsSerializer,
+                                           setRequest=ElementSetRequestsSerializer,
+                                           CreateAndSetRequest=ElementCreateAndSetRequestSerializer,
                                            )
 
     @action(detail=True, url_path="tags", methods=["PUT"])
@@ -37,7 +40,6 @@ def retrieveParties(self, request, **kwargs):
         element, validated_data = self.validate_serializer_and_get_object(request)
         element.save()
 
-        # import ipdb; ipdb.set_trace()
         serializer_class = self.get_serializer_class('retrieve')
         serializer = self.get_serializer(serializer_class, element)
         return Response(serializer.data)
@@ -108,6 +110,50 @@ def CreateAndSet(self, request, **kwargs):
         serializer_class = self.get_serializer_class('retrieve')
         serializer = self.get_serializer(serializer_class, element)
         return Response(serializer.data)
+
+    @action(detail=True, url_path="retrieveRequests", methods=["GET"])
+    def retrieveRequests(self, request, **kwargs):
+        element, validated_data = self.validate_serializer_and_get_object(request)
+        element.save()
+
+        serializer_class = self.get_serializer_class('retrieveRequests')
+        serializer = self.get_serializer(serializer_class, element)
+        return Response(serializer.data)
+
+    @action(detail=True, url_path="setRequest", methods=["PUT"])
+    def setRequest(self, request, **kwargs):
+        element, validated_data = self.validate_serializer_and_get_object(request)
+        for key, value in validated_data.items():
+            element.add_requests(value)
+        element.save()
+
+        serializer_class = self.get_serializer_class('retrieve')
+        serializer = self.get_serializer(serializer_class, element)
+        return Response(serializer.data)
+
+    @action(detail=True, url_path="CreateAndSetRequest", methods=["POST"])
+    def CreateAndSetRequest(self, request, **kwargs):
+        element, validated_data = self.validate_serializer_and_get_object(request)
+        prop = Proposal.objects.get(id=validated_data['proposalId'])
+        newRequest = Request.objects.create(
+            user=User.objects.get(id=validated_data['userId']),
+            system=System.objects.get(id=validated_data['systemId']),
+            requested_element=element,
+            criteria_comment=validated_data['criteria_comment'],
+            criteria_reject_comment=validated_data['criteria_reject_comment'],
+            status=validated_data['status'],
+        )
+        newRequest.save()
+        prop.req = newRequest
+        prop.save()
+        element.add_requests([newRequest.id])
+        element.save()
+
+        serializer_class = self.get_serializer_class('retrieve')
+        serializer = self.get_serializer(serializer_class, element)
+        return Response(serializer.data)
+
+
 class ElementWithPermissionsViewSet(ReadWriteViewSet):
     # NESTED_ROUTER_PKS = [{'pk': 'modules_pk', 'model_field': 'module', 'model': Module}]
     queryset = Element.objects.all()