Lab 01: Security Requirements & Misuse Cases¶

# validate_requirements.py
import json, jsonschema, sys

SCHEMA = {
    "type": "array",
    "items": {
        "type": "object",
        "required": ["id", "type", "category", "statement", "rationale", "testable", "acceptance_criteria"],
        "properties": {
            "id": {"type": "string", "pattern": "^SR-\\d{3}$"},
            "type": {"enum": ["functional", "non-functional", "constraint"]},
            "category": {"type": "string"},
            "statement": {"type": "string", "minLength": 20},
            "rationale": {"type": "string", "minLength": 10},
            "testable": {"type": "boolean"},
            "acceptance_criteria": {"type": "string", "minLength": 10}
        }
    },
    "minItems": 8
}

with open("requirements.json") as f:
    data = json.load(f)

jsonschema.validate(data, SCHEMA)

# Check category coverage
required_cats = {"authentication","authorization","encryption","audit_logging","input_validation","session_management"}
found_cats = {r["category"] for r in data}
missing = required_cats - found_cats
if missing:
    print(f"FAIL: Missing categories: {missing}")
    sys.exit(1)

# Check all are testable
non_testable = [r["id"] for r in data if not r["testable"]]
if non_testable:
    print(f"WARNING: Non-testable requirements: {non_testable}")

print(f"PASS: {len(data)} requirements validated, all 6 categories covered.")

import json, pytest

@pytest.fixture
def reqs():
    with open("requirements.json") as f:
        return json.load(f)

def test_minimum_count(reqs):
    assert len(reqs) >= 8, "Must have at least 8 requirements"

def test_unique_ids(reqs):
    ids = [r["id"] for r in reqs]
    assert len(ids) == len(set(ids)), "Requirement IDs must be unique"

def test_all_testable(reqs):
    non_testable = [r["id"] for r in reqs if not r["testable"]]
    assert not non_testable, f"All requirements must be testable: {non_testable}"

def test_category_coverage(reqs):
    required = {"authentication","authorization","encryption","audit_logging","input_validation","session_management"}
    found = {r["category"] for r in reqs}
    assert required.issubset(found), f"Missing: {required - found}"

def test_acceptance_criteria_length(reqs):
    short = [r["id"] for r in reqs if len(r.get("acceptance_criteria","")) < 20]
    assert not short, f"Acceptance criteria too short: {short}"

# YOUR ADDITIONAL TEST (required for full credit):
# Add at least one test of your own that checks something meaningful
# about your requirement set. Comment explaining what and why.