Skip to content

Commit 077f6bc

Browse files
jpower432jpower432
committed
feat: adds initial schema for Layer 5
Assisted by: Cursor Agent Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
1 parent d1a5b97 commit 077f6bc

File tree

3 files changed

+358
-0
lines changed

3 files changed

+358
-0
lines changed

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ lintcue:
3030
@cue eval ./schemas/layer-2.cue --all-errors --verbose
3131
@cue eval ./schemas/layer-3.cue --all-errors --verbose
3232
@cue eval ./schemas/layer-4.cue --all-errors --verbose
33+
@cue eval ./schemas/layer-5.cue --all-errors --verbose
3334

3435
cuegen:
3536
@echo " > Generating types from cue schema ..."
@@ -41,11 +42,14 @@ cuegen:
4142
@mv cue_types_gen.go layer3/generated_types.go
4243
@cue exp gengotypes ./schemas/layer-4.cue
4344
@mv cue_types_gen.go layer4/generated_types.go
45+
@cue exp gengotypes ./schemas/layer-5.cue
46+
@mv cue_types_gen.go layer5/generated_types.go
4447
@go build -o utils/types_tagger utils/types_tagger.go
4548
@utils/types_tagger layer1/generated_types.go
4649
@utils/types_tagger layer2/generated_types.go
4750
@utils/types_tagger layer3/generated_types.go
4851
@utils/types_tagger layer4/generated_types.go
52+
@utils/types_tagger layer5/generated_types.go
4953
@rm utils/types_tagger
5054

5155
dirtycheck:

‎layer5/generated_types.go‎

Lines changed: 194 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎schemas/layer-5.cue‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
package schemas
2+
3+
import "time"
4+
5+
// #EnforcementAction defines an auditable record of policy enforcement.
6+
#EnforcementAction: {
7+
metadata: #Metadata
8+
// Executed indicates whether the enforcement action was successfully executed.
9+
executed: bool
10+
// ExecutedAt defines when the enforcement action was executed.
11+
"executed-at": #Datetime @go(ExecutedAt)
12+
// Message defines a brief description of what enforcement action was actually taken.
13+
message?: string
14+
// Target defines the subject of the enforcement action.
15+
target?: #Target
16+
// Action defines the high-level action performed during enforcement.
17+
action: #Action
18+
// Control defines the Layer 2 control being enforced.
19+
control: #Mapping
20+
// Findings defines Layer 4 AssessmentLog outcomes that triggered this enforcement action.
21+
findings?: [...#Finding]
22+
// Exception defines an optional exception that may apply to this finding.
23+
exception?: #Exception
24+
// RemediationPlan uniquely identifies the remediation response when the Layer 3 Enforcement
25+
// Method is AutoRemediation.
26+
"remediation-plan"?: string @go(RemediationPlanId)
27+
// NotificationPlan uniquely identifies the notification response when the Layer 3 Enforcement
28+
// Method is Manual Remediation.
29+
"notification-plan"?: string @go(NotificationPlan)
30+
// EnforcementPlan uniquely identifies the enforcement response when the Layer 3 Enforcement
31+
// Method is Deployment Gate.
32+
"enforcement-plan"?: string @go(EnforcementPlan)
33+
}
34+
35+
// Metadata contains metadata about the Layer 5 Enforcement Action.
36+
#Metadata: {
37+
// Id defines the unique identifier for the metadata record.
38+
id: string
39+
// Version defines the version of the metadata schema.
40+
version?: string
41+
// Author defines the entity that produced the enforcement action.
42+
author: #Author
43+
// MappingReferences defines references to external standards, frameworks, or documents.
44+
"mapping-references"?: [...#MappingReference] @go(MappingReferences) @yaml("mapping-references,omitempty")
45+
}
46+
47+
// Contact represents contact information for a person.
48+
#Contact: {
49+
// Name defines the contact person's name.
50+
name: string
51+
// Primary indicates whether this contact is the first point of contact for inquiries. Only one entry should be marked as primary.
52+
primary: bool
53+
// Affiliation defines the entity with which the contact is affiliated, such as a school or employer.
54+
affiliation?: string @go(Affiliation,type=*string)
55+
// Email defines a preferred email address to reach the contact.
56+
email?: #Email @go(Email,type=*Email)
57+
// Social defines a social media handle or profile for the contact.
58+
social?: string @go(Social,type=*string)
59+
}
60+
61+
// Author contains the information about the entity that produced the evaluation plan or log.
62+
#Author: {
63+
// Name defines the name of the author.
64+
name: string
65+
// Uri defines a URI for the author.
66+
uri?: string
67+
// Version defines the version of the authoring entity.
68+
version?: string
69+
// Contact defines contact information for the author.
70+
contact?: #Contact @go(Contact)
71+
}
72+
73+
// MappingReference provides references to external standards, frameworks, or documents.
74+
#MappingReference: {
75+
// Id defines the unique identifier for the referenced document or standard.
76+
id: string
77+
// Title defines a human-readable title of the referenced document.
78+
title: string
79+
// Version defines the version of the referenced document.
80+
version: string
81+
// Description defines an optional description of the referenced document.
82+
description?: string
83+
// Url defines an optional URL to access the referenced document (must be valid HTTP/HTTPS URL).
84+
url?: =~"^https?://[^\\s]+$"
85+
}
86+
87+
// Mapping represents a mapping between internal controls and external standards.
88+
#Mapping: {
89+
// ReferenceId defines the corresponding MappingReference id.
90+
"reference-id": string @go(ReferenceId)
91+
// EntryId defines the specific element within the referenced document.
92+
"entry-id": string @go(EntryId)
93+
// Strength defines how effectively the referenced item addresses the associated control or procedure on a scale of 1 to 10, with 10 being the most effective.
94+
strength?: int & >=1 & <=10
95+
// Remarks defines additional context about the mapping entry.
96+
remarks?: string
97+
}
98+
99+
// Exception represents an approved exception to policy enforcement.
100+
#Exception: {
101+
// Id defines the unique identifier for this exception.
102+
id: string
103+
// ApprovedBy defines the person or entity who approved this exception.
104+
"approved-by": #Contact @go(ApprovedBy)
105+
// ApprovalDate defines the date and time when the exception was approved.
106+
"approval-date": #Datetime @go(ApprovalDate)
107+
// ExpirationDate defines the optional date when this exception expires.
108+
"expiration-date"?: #Datetime @go(ExpirationDate)
109+
// Justification defines the justification for why this exception is necessary.
110+
"justification": string @go(Justification)
111+
// RiskLevel defines the risk level associated with this exception.
112+
"risk-level": #RiskLevel @go(RiskLevel) @yaml("risk-level")
113+
// CompensatingControls defines an optional list of compensating controls implemented to mitigate risk.
114+
"compensating-controls"?: [...#Mapping] @go(CompensatingControls)
115+
// ReviewDate defines the optional date when this exception should be reviewed.
116+
"review-date"?: #Datetime @go(ReviewDate)
117+
}
118+
119+
// Target defines the subject of the enforcement action.
120+
#Target: {
121+
// TargetId uniquely identifies the specific target instance.
122+
"target-id": string @go(TargetId)
123+
// TargetName defines a human-readable name of the target.
124+
"target-name": string @go(TargetName)
125+
// TargetType defines the type or category of the target.
126+
"target-type": string @go(TargetType)
127+
// Environment defines the environment where the target exists.
128+
environment?: string
129+
}
130+
131+
// Finding is a self-contained record of a detected issue.
132+
#Finding: {
133+
// Requirement defines the specific requirement that was evaluated.
134+
"requirement": #Mapping
135+
// Result defines the result of evaluating this requirement.
136+
result: #Result
137+
// Message defines a human-readable description of what was found.
138+
message: string
139+
}
140+
141+
// Datetime represents a timestamp in ISO 8601 format with timezone.
142+
#Datetime: time.Format("2006-01-02T15:04:05Z07:00") @go(Datetime,format="date-time")
143+
144+
// Email represents a valid email address format.
145+
#Email: =~"^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$"
146+
147+
// Action is the high-level enforcement outcome.
148+
#Action:
149+
"Block" |
150+
"Allow" |
151+
"Remediate" |
152+
"Waive" |
153+
"Notify" |
154+
"Unknown"
155+
156+
// Result is the outcome of the assessment.
157+
#Result: "Not Run" | "Passed" | "Failed" | "Needs Review" | "Not Applicable" | "Unknown"
158+
159+
// RiskLevel from Layer 3 (Policy layer)
160+
#RiskLevel: "Critical" | "High" | "Medium" | "Low" | "Informational"

0 commit comments

Comments
 (0)