OpenPlace Solution Guidelines and Standards [Documentation]

[DNing]

These OpenPlace Standards, including recommended best practices, are to ensure that developer is developing OpenPlace Solutions that meet OneStream solution development requirements.

1. SOLUTION DEVELOPMENT & MANAGEMENT STANDARDS

1. All developers are encouraged to utilize an industry-standard PMI-approved software development methodology (e.g., Agile, Waterfall, Scrum, and Kanban) to manage the development of their solution development for any solutions to be submitted into OpenPlace.

2. All developers shall perform commercially reasonable unit testing, performance testing, and quality assurance testing on all solutions that are submitted to OpenPlace.

3. All developers shall perform Security testing and provide testing logs to OneStream upon request.

4. All developers are encouraged to test for any functional issues or bugs.

5. All OpenPlace Solutions that, in OneStream’s sole opinion, cause performance or functional issues with OneStream Offering(s) may, in OneStream’s sole discretion, be immediately suspended and removed from OpenPlace without prior notification. Such OpenPlace Solutions will not be reinstated until the developer has resolved the issue within such OpenPlace Solution and has resubmitted it for approval by OneStream.

2. SOLUTION CODING STANDARDS

1. All OpenPlace Solutions shall follow fundamental programming principles specified in Appendix A (“ Fundamental Programming Best Practices ”).

2. All OpenPlace Solutions shall follow fundamental data architecture and database design standards specified in Appendix B (“ Fundamental Data Architecture & Database Design Best Practices ”).

3. Except as otherwise agreed upon OneStream, all OpenPlace Solutions shall only use the OneStream Business Rule API (BRApi). All published and non-published public functions may change with future OneStream platform releases upon the discretion of OneStream without prior notification. In the event Partner wishes to submit a request to have a non-published function exposed in the BRApi namespace, Partner shall submit the request in accordance with process specified in Appendix I (“Requesting Exceptions for OpenPlace Solutions”).

4. OpenPlace Solutions are permitted to directly query OneStream core tables or core solutions (e.g., TXM, OFC, ACM, SML, etc.); however, Partner Solutions are prohibited from updating, modifying, editing, or writing to such core tables or core solutions.

5. Except as otherwise agreed upon by OneStream, OpenPlace Solutions shall not have literal SQL strings sent into solution assets. All SQL queries must be parameterized to prevent opening vulnerabilities to malicious attacks, including SQL injection attacks.

6. OpenPlace solutions shall have all parameters set to validated pre- and post-run to ensure security and data validity.

7. OpenPlace Solutions with long-running synchronous jobs will be subject to suspension.

8. OpenPlace Solutions with egregious use of error logging will be subject to suspension.

9. OpenPlace Solutions are required to have commented code.

10. OpenPlace Solutions are required to have commercially reasonable error-handling checks and user messages.

11. OpenPlace Solutions are required to have a solution installer or install procedure.

12. OpenPlace Solutions are required to have a solution uninstaller that uninstalls all artifacts and data created by every Partner Solution. Partner can optionally, in addition, provide a partial uninstall routine.

3. SOLUTION DOCUMENT REQUIREMENTS.

1. OpenPlace Solutions must provide a OpenPlace Solution and name and Developer name.

2. OpenPlace Solutions must have the formatting as specified in Appendix C (“Solution Overview Template”).

3. OpenPlace shall provide OneStream the items required for the PartnerPlace listing as specified in the Appendix H (“OpenPlace Listing Artifacts Guide”).

4. SCANS AND REVIEW REQUIREMENTS

1. All OpenPlace solutions will be scanned by OneStream using Marketplace Solution Tools (“MST”) and/ or other third-party code-checking tools. MST is available on the Solution Exchange, within Marketplace, and it is recommended that developers utilize this tool during development and prior to solution submission. MST’s current functionality will scan for the following warnings and critical items:

1. Unsafe SQL Queries

2. Parameters of Command Type with unused SQL queries

3. Unsupported solution file type

4. Unsupported file type

5. Solution initialization failure

6. Missing Using () statement on database connection

7. Uninitialized variables

8. Untyped variables

9. Missing return type on function

10. References to direct assemblies (.dll)

11. External database connections

12. References to external processes

13. External references

14. Security violations regarding certain users and group modifications

2. At the sole discretion of OneStream, OpenPlace Solution submissions may be subject to a manual code review process prior to obtaining approval from OneStream. If the submission has been encrypted, the submission will need to be resent in an unencrypted format.

3. At the sole discretion of OneStream, OpenPlace Solution submissions are subject to a manual security review and scan by OneStream in an unencrypted format. If the submission has been encrypted by any means, it must be re-submitted in an unencrypted format. All OpenPlace Solutions will undergo security tests, including, but not limited to the following:

1. Access control: Rights granted to each user do not expose other pieces of information that may be sensitive or private

2. Access control: Ways to escalate privilege within the solution or to use the solution to elevate OneStream privileges

3. Injection flaws: Manipulation of the communication to inject through SQL, OS commands, malicious code, and any other method.

4. OpenPlace Solutions must pass all installation tests, including but not limited to: (I) loading and uncompressing all OpenPlace Solution files; (ii) verification of all created tables, dashboards, and business rules present based on the OpenPlace Solution’s install guide; (iii) data structure and scheme match the OpenPlace Solution’s install guide; (iv) all OpenPlace Solution business rules compile successfully; and (v) the OpenPlace Solution loads successfully.

5. OpenPlace Solutions must pass all uninstall tests: (I) within the solution “settings” options for “uninstall;” and (ii) within the uninstall dashboard have a selection to: (1) uninstall fully (required), and (2) uninstall UI (optional as needed for the solution).

6. OpenPlace Solutions are required to pass all uninstall full tests, including but not limited to: (I) execute uninstall full option; (ii) verify all solution dashboards, so that all UI elements, and business rules are no longer present; and (iii) verify all solution tables and data are no longer present.

5. NAMING CONVENTION STANDARDS

1. OpenPlace Solutions are required follow the OneStream Solution naming convention standards as specified in Appendix G (“Naming Convention Standards).

6. OPERATIONAL SOLUTION SUPPORT REQUIREMENTS

1. OpenPlace Solutions are developer Community supported. Developers are encouraged but not required to support any OpenPlace solutions they release on OpenPlace.

7. PUBLISHING CUSTOM DLL REQUEST

1. OpenPlace Solutions must only use native core OneStream platform DLLs.

8. APPENDIX

1. Fundamental Programming Best Practices

2. Fundamental Data Architecture & Database Design Best Practices

3. Solution Overview Template

4. Release Notes Template

5. Solution Guide Template

6. Quick Reference Template

7. Naming Convention Standards

8. OpenPlace Listing Artifacts Guide

9. Requesting Exceptions for OpenPlace Solutions

[MarcusH]

The Appendices are not available to people who are not in the onestreamsoftware.sharepoint.com directory.

[DNing]

we are uploading those documents into OneCommunity and relinking the URL.

[DanielHopson]

Are you able to advise when this will be actioned?

Many thanks, Daniel

[DNing]

We are working with our support team to setup a permanent externally accessible area to so store all the additional appendix documents.  The Service Now ticket is being processed.  I'll update this thread when is complete.

We thank you for you patience.   

[CASubhasish]

Hello,

Can you Please confirm if the Documents are Posted in OneCommunity & wher we can access it.

Thanks,

Subhasish

[DNing]

We currently have it accessible here Appendix Folder .  If you have issues accessing this location please email OpenPlaceProgram@onestreamsoftware.com and we can send you the files.  Note we are in the process of expanding the this thread to attach the appendix documents directly to the post.

[DanielWillis]

Are there any significant differences between the PartnerPlace standards vs the OpenPlace standards?

[DNing]

Daniel,

There are a few requirements that are excluded from the OpenPlace standards vs the PartnerPlace standards.  But the core solution development coding standards remain the same.