Review Auto-Result Flag and Behavior

[cd-rite]

The API defines an "autoResult" flag associated with individual reviews.

The intent of this flag in "STIG Manager Classic" was to distinguish reviews that were evaluated "manually" by a person using the client from those that were imported from an (presumed) automated source, such as an XCCDF file or HBSS. If a review was flagged as "autoResult," it would be barred from further manual editing, except by a Collection Owner. It does not prevent further "autoResult" updates.

This "Classic" behavior is currently being emulated in STIG Manager OSS in the client, but is not enforced by the API. The STIG Manager Team would like to revisit whether this flag and any associated behavior is useful or needed before enforcing this behavior in the API. Please provide any feedback or thoughts here!

Some sample considerations that would need to be resolved to enforce this feature:

1. Should an autoResult flag on a review change the behavior of that review, or simply be an informational field with no other effects?
2. Should an autoResult review be locked from further manual editing?
3. Should only certain users/clients be allowed to set the "autoResult" flag?
4. Should the STIG Manager app make the decision to set the autoResult flag itself, based on the user setting the Review or some other criteria? (ie. should certain users or clients, such as that a notional XCCDF import utility might use, be marked as an "autoResult" user and have all it's reviews set with that flag?)