index.js

const express = require('express')
const router = express.Router()
const mw = require('../../middleware/middleware')
const errorMsgs = require('../../middleware/errorMessages')
const controller = require('./org.controller')
const registryOrgController = require('../registry-org.controller/registry-org.controller.js')
const registryUserController = require('../registry-user.controller/registry-user.controller.js')
const { body, param, query } = require('express-validator')
const { parseGetParams, parsePostParams, parsePutParams, parseError, isUserRole, isValidUsername, isOrgRole, validateUpdateOrgParameters } = require('./org.middleware')
// Only God and Javascript know swhy its saying it is not used when it is.....
// eslint-disable-next-line no-unused-vars
const { toUpperCaseArray, isFlatStringArray, handleRegistryParameter } = require('../../middleware/middleware')
const getConstants = require('../../../src/constants').getConstants
const CONSTANTS = getConstants()

router.get('/registry/org',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'registryOrgAll'
  #swagger.summary = "Retrieves all registry organizations (accessible to Secretariat)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
        <h2>Expected Behavior</h2>
        <p><b>Secretariat:</b> Retrieves information about all registry organizations</p>"
  #swagger.parameters['$ref'] = [
    '#/components/parameters/pageQuery',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns information about all registry organizations, along with pagination fields if results span multiple pages of data',
    content: {
      "application/json": {
        schema: {
          $ref: '../schemas/registry-org/list-registry-orgs-response.json'
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlySecretariat,
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
  query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
  query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
  parseError,
  parseGetParams,
  registryOrgController.ALL_ORGS
)

router.get('/registry/org/:shortname/users',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'userOrgAll'
  #swagger.summary = "Retrieves all users for the organization with the specified short name (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves information about users in the same organization</p>
        <p><b>Secretariat:</b> Retrieves all user information for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/pageQuery',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns all users for the organization, along with pagination fields if results span multiple pages of data',
    content: {
      "application/json": {
        schema: {
          $ref: '../schemas/registry-user/list-registry-users-response.json'
        },
        example: {
          totalCount: 1,
          itemsPerPage: 100,
          pageCount: 1,
          currentPage: 1,
          prevPage: null,
          nextPage: null,
          users: [
            {
                "UUID": "fe566221-6a2c-4279-8800-4d3795325997",
                "org_UUID": "9e243a41-352b-426a-9dfd-f664b4c71e80",
                "username": "jdoe",
                "name": {
                    "first": "John",
                    "last": "Doe"
                },
                "role": "ADMIN",
                "is_active": true,
                "time": {
                    "created": "2021-02-12T17:15:37.382Z",
                    "modified": "2021-02-12T17:15:37.382Z"
                }
            }
          ]
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
  query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
  query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
  parseError,
  parseGetParams,
  registryOrgController.USER_ALL)

router.get('/registry/org/:shortname/hard_quota',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'orgHardQuota'
  #swagger.summary = "Retrieves an organization's CVE ID quota (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves the CVE ID quota for the user's organization</p>
        <p><b>Secretariat:</b> Retrieves the CVE ID quota for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the CVE ID quota for an organization',
    content: {
      "application/json": {
        schema: {
          $ref: '../schemas/registry-org/get-registry-org-quota-response.json'
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  controller.ORG_ID_QUOTA)

router.get('/registry/org/:identifier',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'registryOrgSingle'
  #swagger.summary = "Retrieves information about the registry organization specified by short name or UUID (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves registry organization record for the specified shortname or UUID if it is the user's organization</p>
        <p><b>Secretariat:</b> Retrieves information about any registry organization</p>"
  #swagger.parameters['identifier'] = { description: 'The shortname or UUID of the registry organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the registry organization information',
    content: {
      "application/json": {
        schema: {
          $ref: '../schemas/registry-org/get-registry-org-response.json'
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  registryOrgController.SINGLE_ORG
)

router.get('/registry/org/:shortname/user/:username',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'registryUserSingle'
  #swagger.summary = "Retrieves information about a user for the specified username and organization short name (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves information about a registry user in the same organization</p>
        <p><b>Secretariat:</b> Retrieves any registry user's information</p>"
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.parameters['shortname'] = {
    description: 'The shortname of the organization'
  }
  #swagger.parameters['username'] = {
    description: 'The username of the registry user',
    schema: {
      type: 'string',
      pattern: '^[a-zA-Z0-9._@-]+$'
    }
  }
  #swagger.responses[200] = {
    description: 'Returns information about the specified registry user',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/registry-user/get-registry-user-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  param(['username']).isString().trim().notEmpty().custom(isValidUsername),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  registryUserController.SINGLE_USER
)

router.post('/registry/org',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'orgCreateSingle'
  #swagger.summary = "Creates an organization (accessible to Secretariat)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
        <h2>Expected Behavior</h2>
        <p><b>Secretariat:</b> Creates a new organization</p>"
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema: {
          anyOf: [
            { $ref: '../schemas/registry-org/SecretariatOrg.json' },
            { $ref: '../schemas/registry-org/CNAOrg.json' },
            { $ref: '../schemas/registry-org/ADPOrg.json' },
            { $ref: '../schemas/registry-org/BulkDownloadOrg.json' }
          ]
        },
        example: {
          short_name: 'fake_company',
          name: 'Fake Company',
          hard_quota: 1000,
          authority: ['CNA']
        }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Returns information about all organizations, along with pagination fields if results span multiple pages of data',
    content: {
      "application/json": {
        schema: {
          $ref: '../schemas/registry-org/list-registry-orgs-response.json'
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlySecretariat,
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parsePostParams,
  parseError,
  registryOrgController.CREATE_ORG
)

router.put('/registry/org/:shortname',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'orgUpdateSingle'
  #swagger.summary = "Updates information about the organization specified by short name (accessible Temporarily to Secretariat only)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role temporarily.</p>
        <p>In the future, only the organization's admin will be able to request changes to its information.</p>
        <p>With Joint Approval required for the following fields:</p>
        <h2>Expected Behavior</h2>
        <b>This endpoint expects a full organization object in the request body.</b>
        <p><b>Secretariat:</b> Updates any organization's information</p>
        <p><b>Organization Admin:</b> Requests changes to its organization's information</p>
        <ul>
          <li>short_name</li>
          <li>long_name</li>
          <li>authority</li>
          <li>aliases</li>
          <li>oversees</li>
          <li>root_or_tlr</li>
          <li>charter_or_scope</li>
          <li>product_list</li>
          <li>disclosure_policy</li>
          <li>contact_info.poc</li>
          <li>contact_info.poc_email</li>
          <li>contact_info.poc_phone</li>
          <li>contact_info.org_email</li>
          <li>cna_role_type</li>
          <li>cna_country</li>
          <li>vulnerability_advisory_locations</li>
          <li>advisory_location_require_credentials</li>
          <li>industry</li>
          <li>tl_root_start_date</li>
          <li>is_cna_discussion_list</li>
        </ul>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema: {
          $ref: '../schemas/registry-org/update-registry-org-request.json'
        },
        example: {
          short_name: 'fake_company',
          name: 'Fake Company',
          hard_quota: 1000,
          authority: ['CNA']
        }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Returns information about the organization updated',
    content: {
      "application/json": {
        schema: {
            $ref: '../schemas/registry-org/update-registry-org-response.json'
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlySecretariat,
  parseError,
  parsePutParams,
  registryOrgController.UPDATE_ORG
)

router.post('/registry/org/:shortname/user',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'registryUserCreateSingle'
  #swagger.summary = "Create a user with the provided short name as the owning organization (accessible to Admins and Secretariats)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the organization</p>
        <h2>Expected Behavior</h2>
        <p><b>Admin User:</b> Creates a user for the Admin's organization</p>
        <p><b>Secretariat:</b> Creates a user for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema:
            { $ref: '../schemas/registry-user/create-registry-user-request.json' }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Returns the new user information (with the secret)',
    content: {
      "application/json": {
        schema:
            { $ref: '../schemas/registry-user/create-registry-user-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlySecretariatOrAdmin,
  mw.onlyOrgWithPartnerRole,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  body(['org_uuid']).optional().isString().trim(),
  body(['uuid']).optional().isString().trim(),
  body(['name.first']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_FIRSTNAME_LENGTH }).withMessage(errorMsgs.FIRSTNAME_LENGTH),
  body(['name.last']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_LASTNAME_LENGTH }).withMessage(errorMsgs.LASTNAME_LENGTH),
  body(['name.middle']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_MIDDLENAME_LENGTH }).withMessage(errorMsgs.MIDDLENAME_LENGTH),
  body(['name.suffix']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_SUFFIX_LENGTH }).withMessage(errorMsgs.SUFFIX_LENGTH),
  body(['authority.active_roles']).optional()
    .custom(mw.isFlatStringArray)
    .bail()
    .customSanitizer(toUpperCaseArray)
    .custom(isUserRole),
  parseError,
  parsePostParams,
  registryOrgController.USER_CREATE_SINGLE
)

router.put('/registry/org/:shortname/user/:username',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'registryUserUpdateSingle'
  #swagger.summary = "Updates information about a user for the specified username and organization shortname (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>
        <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>
        <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/active',
    '#/components/parameters/orgShortname',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the updated user information',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/registry-user/update-registry-user-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlyOrgWithPartnerRole,
  parseError,
  parsePutParams,
  registryUserController.UPDATE_USER)

router.put('/registry/org/:shortname/user/:username/reset_secret',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'userResetSecret'
  #swagger.summary = "Reset the API key for a user (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular User:</b> Resets user's own API secret</p>
        <p><b>Admin User:</b> Resets any user's API secret in the Admin's organization</p>
        <p><b>Secretariat:</b> Resets any user's API secret</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the new API key',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/user/reset-secret-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlyOrgWithPartnerRole,
  parseError,
  parsePostParams,
  controller.USER_RESET_SECRET
)

router.post('/registry/org/:shortname/user/:username/grant-role',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'registryUserGrantRole'
  #swagger.summary = "Grants a role to a user (accessible to Secretariat or Org Admin)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the organization</p>
        <h2>Expected Behavior</h2>
        <p><b>Admin User:</b> Grants a role to a user in the Admin's organization</p>
        <p><b>Secretariat:</b> Grants a role to a user in any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema: {
          type: 'object',
          properties: {
            role: {
              type: 'string',
              enum: ['ADMIN']
            }
          },
          required: ['role']
        }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Role granted successfully',
    content: {
        "application/json": {
            schema: { type: 'object', properties: { message: { type: 'string' } } }
        }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  // mw.onlyOrgWithPartnerRole, // This might be too restrictive if we want Secretariat to do it for any org type
  parseError,
  parsePostParams,
  registryUserController.GRANT_ROLE
)

router.post('/registry/org/:shortname/user/:username/revoke-role',
  /*
  #swagger.tags = ['Registry User']
  #swagger.operationId = 'registryUserRevokeRole'
  #swagger.summary = "Revokes a role from a user (accessible to Secretariat or Org Admin)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the organization</p>
        <h2>Expected Behavior</h2>
        <p><b>Admin User:</b> Revokes a role from a user in the Admin's organization</p>
        <p><b>Secretariat:</b> Revokes a role from a user in any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema: {
          type: 'object',
          properties: {
            role: {
              type: 'string',
              enum: ['ADMIN']
            }
          },
          required: ['role']
        }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Role revoked successfully',
    content: {
        "application/json": {
            schema: { type: 'object', properties: { message: { type: 'string' } } }
        }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  // mw.onlyOrgWithPartnerRole,
  parseError,
  parsePostParams,
  registryUserController.REVOKE_ROLE
)

router.put('/registry/org/:shortname/conversation/:index',
  /*
  #swagger.tags = ['Registry Organization']
  #swagger.operationId = 'registryUserUpdateConversation'
  #swagger.summary = "Update the conversation at the given index for the given organization (accessible to Secretariat or Org Admin)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the organization</p>
        <h2>Expected Behavior</h2>
        <p><b>Admin User:</b> Allowed to update only the message body of any conversation posted by them</p>
        <p><b>Secretariat:</b> Allowed to update the message body and/or visibility of any conversation</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['index'] = { description: 'The index of the conversation to update' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the updated conversation',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/conversation/update-conversation-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.useRegistry(),
  mw.validateUser,
  mw.onlyOrgWithPartnerRole,
  parseError,
  parsePostParams,
  registryOrgController.EDIT_CONVERSATION
)

router.get('/org',
  /*
  #swagger.tags = ['Organization']
  #swagger.operationId = 'orgAll'
  #swagger.summary = "Retrieves all organizations (accessible to Secretariat)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
        <h2>Expected Behavior</h2>
        <p><b>Secretariat:</b> Retrieves information about all organizations</p>"
  #swagger.parameters['$ref'] = [
    '#/components/parameters/pageQuery',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns information about all organizations, along with pagination fields if results span multiple pages of data',
    content: {
      "application/json": {
        schema: {
          oneOf: [
            { $ref: '../schemas/org/list-orgs-response.json' },
            { $ref: '../schemas/registry-org/list-registry-orgs-response.json' }
          ]
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.handleRegistryParameter,
  mw.validateUser,
  mw.onlySecretariat,
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
  query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
  query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
  parseError,
  parseGetParams,
  controller.ORG_ALL)

router.post(
  '/org',
  /*
  #swagger.tags = ['Organization']
  #swagger.operationId = 'orgCreateSingle'
  #swagger.summary = "Creates an organization as specified in the request body (accessible to Secretariat)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
        <h2>Expected Behavior</h2>
        <p><b>Secretariat:</b> Creates an organization</p>
  "
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema: { $ref: '../schemas/org/create-org-request.json' }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Returns information about the organization created',
    content: {
      "application/json": {
        schema: {
          oneOf: [
            { $ref: '../schemas/org/create-org-response.json' },
            { $ref: '../schemas/registry-org/create-registry-org-response.json' }
          ]
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  mw.onlySecretariat,
  body(['short_name'])
    .isString().withMessage(errorMsgs.MUST_BE_STRING).trim()
    .notEmpty().withMessage(errorMsgs.NOT_EMPTY)
    .isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }).withMessage(errorMsgs.SHORTNAME_LENGTH),
  body(['name'])
    .isString().withMessage(errorMsgs.MUST_BE_STRING).trim()
    .notEmpty().withMessage(errorMsgs.NOT_EMPTY),
  body(['authority.active_roles']).optional()
    .custom(isFlatStringArray)
    .customSanitizer(toUpperCaseArray)
    .custom(isOrgRole),
  body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parsePostParams,
  controller.ORG_CREATE_SINGLE
)
router.get(
  '/org/:identifier',
  /*
  #swagger.tags = ['Organization']
  #swagger.operationId = 'orgSingle'
  #swagger.summary = "Retrieves information about the organization specified by short name or UUID (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves organization record for the specified shortname or UUID if it is the user's organization</p>
        <p><b>Secretariat:</b> Retrieves information about any organization</p>"
  #swagger.parameters['identifier'] = { description: 'The shortname or UUID of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the organization information',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/org/get-org-response.json' }
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  param(['identifier']).isString().trim(),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  controller.ORG_SINGLE
)
router.put('/org/:shortname',
  /*
  #swagger.tags = ['Organization']
  #swagger.operationId = 'orgUpdateSingle'
  #swagger.summary = "Updates information about the organization specified by short name (accessible to Secretariat)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
        <h2>Expected Behavior</h2>
        <p><b>Secretariat:</b> Updates any organization's information</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/id_quota',
    '#/components/parameters/name',
    '#/components/parameters/newShortname',
    '#/components/parameters/active_roles_add',
    '#/components/parameters/active_roles_remove',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns information about the organization updated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/org/update-org-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  mw.onlySecretariat,
  validateUpdateOrgParameters(),
  parseError,
  parsePutParams,
  controller.ORG_UPDATE_SINGLE)

router.get('/org/:shortname/id_quota',
  /*
  #swagger.tags = ['Organization']
  #swagger.operationId = 'orgIdQuota'
  #swagger.summary = "Retrieves an organization's CVE ID quota (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves the CVE ID quota for the user's organization</p>
        <p><b>Secretariat:</b> Retrieves the CVE ID quota for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the CVE ID quota for an organization',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/org/get-org-quota-response.json' }
        }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  controller.ORG_ID_QUOTA)
router.get('/org/:shortname/users',
  /*
  #swagger.tags = ['Users']
  #swagger.operationId = 'userOrgAll'
  #swagger.summary = "Retrieves all users for the organization with the specified short name (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves information about users in the same organization</p>
        <p><b>Secretariat:</b> Retrieves all user information for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/pageQuery',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns all users for the organization, along with pagination fields if results span multiple pages of data',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/user/list-users-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.handleRegistryParameter,
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
  query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
  query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
  parseError,
  parseGetParams,
  controller.USER_ALL)

router.post('/org/:shortname/user',
  /*
  #swagger.tags = ['Users']
  #swagger.operationId = 'userCreateSingle'
  #swagger.summary = "Create a user with the provided short name as the owning organization (accessible to Admins and Secretariats)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the organization</p>
        <h2>Expected Behavior</h2>
        <p><b>Admin User:</b> Creates a user for the Admin's organization</p>
        <p><b>Secretariat:</b> Creates a user for any organization</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.requestBody = {
    required: true,
    content: {
      'application/json': {
        schema:
            { $ref: '../schemas/user/create-user-request.json' }
      }
    }
  }
  #swagger.responses[200] = {
    description: 'Returns the new user information (with the secret)',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/user/create-user-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  mw.onlySecretariatOrAdmin,
  mw.onlyOrgWithPartnerRole,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  body(['org_uuid']).optional().isString().trim(),
  body(['uuid']).optional().isString().trim(),
  body(['name.first']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_FIRSTNAME_LENGTH }).withMessage(errorMsgs.FIRSTNAME_LENGTH),
  body(['name.last']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_LASTNAME_LENGTH }).withMessage(errorMsgs.LASTNAME_LENGTH),
  body(['name.middle']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_MIDDLENAME_LENGTH }).withMessage(errorMsgs.MIDDLENAME_LENGTH),
  body(['name.suffix']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_SUFFIX_LENGTH }).withMessage(errorMsgs.SUFFIX_LENGTH),
  body(['authority.active_roles']).optional()
    .custom(mw.isFlatStringArray)
    .bail()
    .customSanitizer(toUpperCaseArray)
    .custom(isUserRole),
  parseError,
  parsePostParams,
  controller.USER_CREATE_SINGLE)

router.get('/org/:shortname/user/:username',
  /*
  #swagger.tags = ['Users']
  #swagger.operationId = 'userSingle'
  #swagger.summary = "Retrieves information about a user for the specified username and organization short name (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular, CNA & Admin Users:</b> Retrieves information about a user in the same organization</p>
        <p><b>Secretariat:</b> Retrieves any user's information</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns information about the specified user',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/user/get-user-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  param(['username']).isString().trim().notEmpty().custom(isValidUsername),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parseGetParams,
  controller.USER_SINGLE)

router.put('/org/:shortname/user/:username',
  /*
  #swagger.tags = ['Users']
   #swagger.operationId = 'userUpdateSingle'
  #swagger.summary = "Updates information about a user for the specified username and organization shortname (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>
        <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>
        <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/active',
    '#/components/parameters/activeUserRolesAdd',
    '#/components/parameters/activeUserRolesRemove',
    '#/components/parameters/nameFirst',
    '#/components/parameters/nameLast',
    '#/components/parameters/nameMiddle',
    '#/components/parameters/nameSuffix',
    '#/components/parameters/newUsername',
    '#/components/parameters/orgShortname',
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the updated user information',
    content: {
      "application/json": {
        schema: {$ref: '../schemas/user/update-user-response.json'}
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */

  mw.validateUser,
  mw.onlyOrgWithPartnerRole,
  query().custom((query) => {
    return mw.validateQueryParameterNames(query, ['active', 'new_username', 'org_short_name', 'name.first', 'name.last', 'name.middle',
      'name.suffix', 'active_roles.add', 'active_roles.remove'])
  }),
  query(['active', 'new_username', 'org_short_name', 'name.first', 'name.last', 'name.middle',
    'name.suffix', 'active_roles.add', 'active_roles.remove']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  param(['username']).isString().trim().notEmpty().custom(isValidUsername),
  query(['active']).optional().isBoolean({ loose: true }),
  query(['new_username']).optional().isString().trim().notEmpty().custom(isValidUsername),
  query(['org_short_name']).optional().isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  query(['name.first']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_FIRSTNAME_LENGTH }).withMessage(errorMsgs.FIRSTNAME_LENGTH),
  query(['name.last']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_LASTNAME_LENGTH }).withMessage(errorMsgs.LASTNAME_LENGTH),
  query(['name.middle']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_MIDDLENAME_LENGTH }).withMessage(errorMsgs.MIDDLENAME_LENGTH),
  query(['name.suffix']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_SUFFIX_LENGTH }).withMessage(errorMsgs.SUFFIX_LENGTH),
  query(['active_roles.add']).optional().toArray()
    .custom(isFlatStringArray)
    .bail()
    .customSanitizer(toUpperCaseArray)
    .custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
  query(['active_roles.remove']).optional().toArray()
    .custom(isFlatStringArray)
    .customSanitizer(toUpperCaseArray)
    .custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
  parseError,
  parsePutParams,
  controller.USER_UPDATE_SINGLE)

router.put('/org/:shortname/user/:username/reset_secret',
  /*
  #swagger.tags = ['Users']
  #swagger.operationId = 'userResetSecret'
  #swagger.summary = "Reset the API key for a user (accessible to all registered users)"
  #swagger.description = "
        <h2>Access Control</h2>
        <p>All registered users can access this endpoint</p>
        <h2>Expected Behavior</h2>
        <p><b>Regular User:</b> Resets user's own API secret</p>
        <p><b>Admin User:</b> Resets any user's API secret in the Admin's organization</p>
        <p><b>Secretariat:</b> Resets any user's API secret</p>"
  #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
  #swagger.parameters['username'] = { description: 'The username of the user' }
  #swagger.parameters['$ref'] = [
    '#/components/parameters/apiEntityHeader',
    '#/components/parameters/apiUserHeader',
    '#/components/parameters/apiSecretHeader'
  ]
  #swagger.responses[200] = {
    description: 'Returns the new API key',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/user/reset-secret-response.json' }
      }
    }
  }
  #swagger.responses[400] = {
    description: 'Bad Request',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/bad-request.json' }
      }
    }
  }
  #swagger.responses[401] = {
    description: 'Not Authenticated',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[403] = {
    description: 'Forbidden',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[404] = {
    description: 'Not Found',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  #swagger.responses[500] = {
    description: 'Internal Server Error',
    content: {
      "application/json": {
        schema: { $ref: '../schemas/errors/generic.json' }
      }
    }
  }
  */
  mw.validateUser,
  mw.onlyOrgWithPartnerRole,
  param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
  param(['username']).isString().trim().notEmpty().custom(isValidUsername),
  query().custom((query) => { return mw.validateQueryParameterNames(query, ['']) }),
  parseError,
  parsePostParams,
  controller.USER_RESET_SECRET)

module.exports = router