SPIKE: CRM457-1920: PII enforcement

config/pii.yml

@@ -0,0 +1,13 @@
+# For each database table, and each column in that table, flag whether
+# there is PII in the column:
+firm_offices:
+  name: true
+  address_line_1: true
+  address_line_2: true
+  town: false
+  postcode: true
+  previous_id: false
+  vat_registered: false
+providers:
+  email: true
+  auth_provider: false

config/schemas/crm4.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://submit-crime-forms.service.justice.gov.uk/crm4.json",
+  "title": "Prior Authority Application",
+  "description": "An application for prior authority to incur disbursements, previously CRM4",
+  "type": "object",
+  "properties": {
+    "application_id": {
+      "description": "The ID of the application",
+      "type": "string",
+      "x-pii": false
+    },
+    "application_state": {
+      "description": "The state of the application. Must initially be 'submitted'",
+      "type": "string",
+      "x-pii": false
+    },
+    "application": {
+      "type": "object",
+      "properties": {
+        "laa_reference": {
+          "type": "string",
+          "x-pii": false
+        },
+        "firm_office": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "type": "string",
+              "x-pii": true
+            },
+            "account_number": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "required": [ "laa_reference", "firm_office" ]
+    }
+  },
+  "required": [ "application_id", "application_state", "application" ]
+}

spec/pii_spec.rb

@@ -0,0 +1,43 @@
+require 'rails_helper'
+
+RSpec.describe 'PII' do
+  describe 'pii.yml' do
+    let(:ignored_tables) { %w[schema_migrations ar_internal_metadata] }
+    let(:ignored_columns) { %w[created_at id updated_at] }
+    let(:pii_definitions) { YAML.load_file(Rails.root.join('config/pii.yml')) }
+
+    it 'explicitly marks every database column as either PII or not' do
+      ActiveRecord::Base.connection.tables.each do |table_name|
+        next if ignored_tables.include?(table_name)
+
+        (ActiveRecord::Base.connection.columns(table_name).map(&:name) - ignored_columns).each do |column_name|
+          expect(pii_definitions.dig(table_name, column_name)).not_to(
+            be_nil,
+            "Table column #{table_name}.#{column_name} has not been listed in config/pii.yml"
+          )
+        end
+      end
+    end
+  end
+
+  describe 'PAA schema' do
+    let(:schema_file) { JSON.load_file(Rails.root.join('config/schemas/crm4.json')) }
+
+    it 'explicitly marks every property as PII or not' do
+      checker = lambda do |properties, parent_attributes|
+        properties.each do |name, attributes|
+          if attributes['type'] == 'object'
+            checker.call(attributes['properties'], parent_attributes + [name])
+          else
+            expect(attributes['x-pii']).not_to(
+              be_nil,
+              "#{parent_attributes.join('->')}->#{name} does not have a PII definition"
+            )
+          end
+        end
+      end
+
+      checker.call(schema_file['properties'], [])
+    end
+  end
+end