Add metric DocumentCSAFRedRestricted

[anatheka]

@immqu I think we should extend the compare function by adding an operator named "isNot" or "notUsed" to verify if a property is not utilized. This enhancement would allow us to write this metric in a more intuitive manner.

[immqu]

There is a reference to p1 missing

[anatheka]

I added the reference p1 to the noAuthentication property, but it doesn’t make any difference since the Rego rule does not check against the target value.

[immqu]

Okay, I would just find it more intuitive to reference [noAuthentication] with p1 and then set the p1 targetValue to false ("noAuthentication should not be set")

[immqu]

We have "isIn" as a compare function, so we would need the opposite "not isIn". But we need a new compare function for that, right?

[anatheka]

We have "isIn" as a compare function, so we would need the opposite "not isIn". But we need a new compare function for that, right?

Couldn´t we use just the operator not? https://www.openpolicyagent.org/docs/policy-language#negation

[immqu]

Yes, but we have to keep in mind that there is not dedicated compare function for that, so:

• Either we have to write a new compare function or adapt the existing "isIn" function
• Or we have to write the respective policies like so: compliant if {not compare(data.operator, data.target_value, val)}
  Or am I overlooking another possibility?

[anatheka]

No, you are right. But I would prefer to use the not operator instead of writing new compare functions.

[immqu]

Okay let's use this solution for now. I think it's not very well readable, but it is a rare case anyway

[immqu]

Should be a string

[anatheka]

No, we do not need a string, the rego file already checks if one of the two labels are available. Furthermore it is checked if noAuthentication is available and that is the part which is not checked by the configuration values.